Law / Hungary

2007. évi CXXXVIII. törvény (Bszt.), ICT Resilience of Algorithmic Trading Systems

26/B. §, 2007. évi CXXXVIII. törvény (Bszt.)

In force since 17 Jan 2025.

A sector security regimes rule binding private bodies.

Private right of action

No

Obligation class

Security, Governance

As of 12 October 2026.

What it requires

• If you are an investment firm engaged in algorithmic trading, keep effective systems and risk controls that ensure, in line with DORA Chapter II, that your trading systems are resilient with sufficient capacity, are subject to appropriate trading thresholds and limits, cannot send erroneous orders and cannot be used for market abuse (Bszt., Section 26/B(1)).NIST CSF 2.0PR.IR-03
• Keep effective business-continuity arrangements for any failure of your trading systems, including the ICT business continuity policy and plans and the ICT response and recovery plans set up under DORA Article 11, and fully test and monitor your systems so that they always meet Section 26/B and DORA Chapters II and IV (Section 26/B(2)).NIST CSF 2.0ID.IM-04
• Notify the Supervisory Authority, and the supervisory authority of the seat of each trading venue where you are a member or participant, that you engage in algorithmic trading (Section 26/B(3)).NIST CSF 2.0GV.OC-03

These lines are LexLint's reading of the law's text, as of 12 October 2026.

In the frameworks

NIST Privacy Framework

• PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
• PR.PT-P4Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations.

NIST CSF 2.0

• GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
• ID.IM-04Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
• PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations

CIS Controls

• 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
• 3.10Encryption of sensitive data as it crosses networks.
• 3.11Encryption of sensitive data where it is stored on servers and applications.
• 6.8Access rights defined by job role, and kept up to date.
• 7.1A documented, reviewed approach to finding and handling weaknesses.
• 8.2Turning on and gathering logs from the enterprise's systems.

FINOS AIGF

• AIR-PREV-005System Acceptance Testing
• AIR-PREV-006Data Quality & Classification/Sensitivity
• AIR-PREV-007Legal and Contractual Frameworks for AI Systems
• AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
• AIR-PREV-012Role-Based Access Control for AI Data
• AIR-PREV-014Encryption of AI Data at Rest

7 more

• AIR-PREV-017AI Firewall Implementation and Management
• AIR-PREV-020MCP Server Security Governance
• AIR-PREV-024Human-in-the-Loop Action Approval Gate
• AIR-DET-001AI Data Leakage Prevention and Detection
• AIR-DET-004AI System Observability
• AIR-DET-011Human Feedback Loop for AI Systems
• AIR-DET-021Agent Decision Audit and Explainability

ENISA NIS2 guidance

• 1.1Policy on the security of network and information systems
• 1.2Roles, responsibilities and authorities
• 2.1Risk management framework
• 2.2Compliance monitoring
• 3.1Incident handling policy
• 3.2Monitoring and logging

7 more

• 4.1Business continuity and disaster recovery plan
• 6.2Secure development life cycle
• 6.5Security testing
• 6.10Vulnerability handling and disclosure
• 9.1Cryptography
• 11.2Management of access rights
• 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

Who enforces it

When LexLint raises it

When your app profile says your app is a securities firm.

Back to the example  ·  Lint your app