Payment Services Regulation: PSD3 and the PSR

/in , /by

The European Union’s second Payment Services Directive (PSD2) has had a significant impact on the financial sector, promoting competition and encouraging innovation. Over time, however, a comprehensive review and modernisation of the framework became necessary. This process resulted in the third Payment Services Directive (PSD3) and, as a new legislative instrument, the Payment Services Regulation (PSR).The new framework aims, on the one hand, to further strengthen consumer protection rules, tighten security requirements and continue to support innovation in the field of financial services. Another key objective is to bring payment services and electronic money services under a single legal framework, thereby providing clearer regulation for market participants and consumers alike.

Compared to PSD2, the draft of the new framework introduces a number of innovations.

While PSD2 regulated payment services in a single directive, PSD3 and the PSR split the framework: PSD3, as a directive, must be transposed into the national law of the Member States, whereas the PSR, as a regulation, is directly applicable, increasing legal harmonisation and reducing divergences in interpretation at national level.

It is important to note that under the previous regime, payment services (such as payment initiation and account information services) and electronic money services were regulated in separate directives (PSD2 and EMD2). PSD3 and the PSR, however, integrate these provisions into a single legislative framework.

Another reason for this change was that the separate regulation of electronic money services and payment services caused practical problems, as the boundaries between the two types of services had become blurred. The introduction of a unified framework significantly reduces legal uncertainty.

In line with the previous rules, PSD3 includes within the scope of payment services the maintenance of payment accounts, the execution of various payment transactions – such as credit transfers, direct debits and card transactions – the issuing of non-cash payment instruments, as well as the acquiring of payment transactions. Money remittance, payment initiation services and account information services also continue to fall within this category.

In the area of electronic money services, PSD3 introduces a significant innovation compared to the previous regime by expressly defining these services (namely: the issuance of electronic money, the maintenance of payment accounts containing electronic money units, and the transfer of electronic money units).

PSD3 further broadens the scope of Strong Customer Authentication (SCA), so that the new requirements better reflect the most advanced digital security solutions, such as biometric identification or device-based authentication systems.

In addition, the new framework provides for enhanced cooperation between payment service providers in the exchange of fraud-prevention information. For example, market participants will be required to exchange data in cases where a provider detects a transaction suspected of fraud, thereby reducing the risk of financial crime across the EU market. PSD3 also contains extended refund rights for victims of fraud, enabling misled customers to obtain quicker and more effective redress in disputed cases.

Finally, PSD3 lays down an important transitional provision regarding authorisations already granted for payment services and electronic money services, as the so-called “re-application process” remains part of the framework. Under the original proposal, existing payment institutions and electronic money institutions must comply with the updated regulatory requirements within 24 months from the entry into force of the new framework, and demonstrate this to their supervisory authority by submitting the required documentation. The European Parliament takes a pragmatic stance on this issue, emphasising that supervisory authorities should request only those data and documents which are newly required under the updated rules. The Parliament’s position also allows for the extension of the transitional period, which has been welcomed by the industry. However, despite these adjustments, the general obligation to submit compliance documentation to the supervisory authority, set out in the transitional provisions (Articles 44–45), essentially remains unchanged.

The expected timeline for PSD3 and the PSR is currently as follows:
• The final adoption of the framework is expected to take place in the course of 2026. PSD3 will enter into force after the expiry of the subsequent 18-month transposition period, likely in the course of 2027. In contrast, the Payment Services Regulation (PSR), as a regulation, will become directly applicable in the EU Member States upon its adoption.

dr. Balázs Ferenczy

Introduction of the Condominium Building Right into the Legal System

/in , /by

The Parliament has adopted the bill on the amendment of certain acts related to the introduction of the condominium building right, thereby officially creating a new concept of property law — the condominium building right — within the current legal system, alongside several other amendments affecting various areas. In addition to the above, the adopted bill clarifies the applicability of the provisions of the Civil Code concerning the building right (explicitly excluding certain rules in the case of the condominium building right), and amends Act C of 2021 on the Land Registry so that the purchasers’ right relating to a future building — similarly to the purchasers’ right linked to retained ownership — may have a suspensory effect for up to six months on subsequently submitted land registry applications.

The essence of the condominium building right is that, in a condominium under construction, an independent, registrable and encumberable property right may be created in favour of the purchaser in respect of a specific apartment that is later to be established as a separate unit under the founding deed. This right automatically converts into ownership upon the actual establishment of the condominium, retaining the same ranking. An important precondition for establishing the condominium building right is that the fact of the preliminary establishment of the condominium must already be recorded on the title deed. The condominium building right may only be created in connection with the sale and purchase agreement (or a closely related separate agreement) relating to the apartment to be built, for the benefit of the purchaser, in exchange for consideration, whereby the amount paid as consideration for acquiring the right is set off against the purchase price of the property to be created. In the event of enforcement proceedings initiated against the property or the insolvency of the owner, the purchaser obtains a position similar to that of a mortgagee, up to the amount of the purchase price already paid.

The building right may be transferred, but only if the obligor of the right, the original beneficiary, and the new beneficiary enter into an agreement in accordance with the rules of contract assignment, under which all rights and obligations arising from the sale and purchase agreement relating to the property are transferred from the original to the new beneficiary. If the sole beneficiary of the condominium building right dies, the right, as a general rule, reverts to the obligor, who must repay to the heir the amount of the purchase price (or the relevant portion thereof) already paid under the sale and purchase agreement, together with interest calculated from the date of payment.

From a business perspective, the purpose of the condominium building right is to make the risks associated with ongoing condominium developments more manageable and to make the well-known pre-sales phase of new-build projects — purchasing “off-plan” — safer. The purchaser does not merely hold a contractual claim but acquires a property-law position over the specific apartment already during construction, linked to the instalments of the purchase price paid, which ultimately converts into ownership. This may reduce risk on the purchaser’s side, thereby increasing the attractiveness of early entry into such projects. For developers, pre-sales and project financing may become more predictable, as purchasers will enter into agreements with stronger legal protection. For banks, the new structure offers opportunities because the condominium building right may be encumbered with a mortgage already during the construction phase, allowing collateral to appear much earlier and in a more structured way.

Overall, the introduction of the condominium building right is a reform affecting several pieces of legislation, aiming to strengthen the position of purchasers, financing banks, and developers simultaneously through a new legal instrument of property law. If it proves effective in practice, this structure may reduce uncertainties surrounding new-build condominium projects, improve purchaser confidence, and — particularly in combination with the Home Start Programme — contribute to making the market for new apartments more predictable, more financeable, and therefore more attractive for purchasers in the coming years.

dr. Martin Gortva / dr. Aliz Orbán

When GDPR No Longer Helps – An Online Casino and the Limits of The Rights of Access

/in /by

The European Union’s General Data Protection Regulation (GDPR) represented a major step forward in the protection of personal data, however data subjects often abuse the rights granted to them under the GDPR, which significantly complicates the daily operations of controllers.

A recent judgment has highlighted, that the right of access also has limits. In a case involving an online casino, the Landgericht Dortmund (Dortmund Regional Court) ruled that the rights of data subjects cannot be exercised abusively.

What was the case about?

On 8 of April 2025, the Dortmund court ruled in a dispute concerning online gambling, in which it found that the right of access under the GDPR had been exercised abusively.

The data subject – who had previously played at an online casino – intended to bring a damages claim on the grounds that the casino had operated for a period without a licence in Germany. The player claimed, that during this period he had made significant deposits into the casino but had not lost the full amount in gambling, and therefore the casino was obliged to reimburse the non-lost portion, he thus sought to enforce this loss before the court. However, he was unable to show when and how much money he had lost in total, had no records regarding the games and losses, he could not substantiate either that not all deposits had been lost or to specify what exact amount might still be owed by the casino.

The unfortunate player sought to resolve the issue by relying on the right of access guaranteed under the GDPR. Resourcefully, he reasoned that the GDPR’s definition of personal data also encompassed the games played and their outcomes, and, given that such data would be necessary for the resolution of any potential dispute, he assumed with good reason that the casino retained these records for its own protection. Accordingly, the individual exercised the possibility guaranteed under the GDPR and submitted an access request to the casino, seeking disclosure of all data relating to him, including the records of games and losses, in order to calculate the exact amount he might claim back.

However, his plan failed at the first step: the casino rejected his request, considering it abusive, and refused to disclose the data, arguing that the applicant intended to use them not for purposes consistent with the objectives of the GDPR, but rather for the preparation of litigation to be initiated on a basis independent of the GDPR.

The data subject considered the casino’s refusal unlawful and therefore brought the matter before the court, requesting the disclosure of the data and, if the data showed that the casino indeed owed him money, a judgment ordering repayment of the non-lost amounts. Contrary to the plaintiff’s expectations, the court ruled in favour of the casino, holding that the request constituted an abuse of rights, and consequently dismissed the claim for payment in the absence of the data.

Why was it considered abuse?

According to the article 12 (5) (b) of the GDPR, controllers may refuse to act on request for access where the request is “manifestly unfounded” or “excessive.” The court interpreted this provision of the GDPR as not being exhaustive or exclusive, holding that a controller may also lawfully refuse to comply with a request for access in other circumstances where the request amounts to an abuse of rights.

The judgment emphasised that the purpose of the right of access is not to enable a person to use the GDPR as a means of evidence gathering prior to or during litigation, but rather to ensure the transparency of processing operations and to allow the data subject to verify whether processing is carried out lawfully and in accordance with the information provided by the controller. This is also reflected in the preamble 63 GDPR, which states that “A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing.” However, in this case the plaintiff did not seek to verify what data the casino held about him or whether it was lawfully processed – but merely wished to determine how much money he had lost and to use this information as the basis for a damages claim.

The court further compared the situation at issue with other, similar contexts in which the data subject does not have access to his or her own data. typical example is access to health data: a patient often cannot access, and does not hold, all information, test results or medical records concerning him or her. In such cases, the patient genuinely has no other realistic possibility than to rely on the data stored by the physician, and it cannot reasonably be expected that the patient would maintain records, even retrospectively for several years. By contrast, in the court’s view, a player – who could have kept records of his gambling losses himself – is not in the same situation of necessity.

Therefore, the court found that the plaintiff’s request went beyond the purpose of the right guaranteed by the GDPR, and that such an exercise of the right amounted to an abuse of rights. This judgment represents a rare example of a court refusing to grant the right of access on the ground of abuse of rights.

The judgment is of particular significance because, in general, courts tend to side with data subjects and interpret the concept of “abuse of rights” narrowly. In this instance, however, the Dortmund court underlined that:

• The GDPR cannot be used for every purpose, in particular not for the preparation of civil lawsuits.
• The legal instruments established for the protection of personal data do not replace the information-gathering mechanisms available under civil procedural law.

This serves as a warning to both to data subjects and lawyers: the GDPR is a powerful tool, but not a Swiss Army knife to be deployed for any purpose.

The Court of Justice of the European Union (CJEU) has held in several cases (e.g., in C-307/22, C-416/23, C-38/21) that EU law prohibits the abusive exercise of rights. This general principle has now also been applied in the context of the GDPR in an individual case.
 
What does this mean for us in Hungary?

Given that the decision was rendered in Germany, it has no direct effect on Hungarian users for the time being. In the case the practice will be adopted, the GDPR will continue to protect the rights of data subjects, if we wish to know what personal data a controller holds about us, on what legal basis, and for what purposes it is used, we are entitled to request access. However, such an access request should be used for the genuine purposes of the GDPR. This, for example, if we want to verify whether an online store has deleted our old address, or if we suspect unlawful processing, it is entirely appropriate to submit a request. What will likely not be permissible is to use the GDPR as a “weapon” or a loophole. If we intend to bring an action against someone but do not know exactly what we want to claim, the necessary information and evidence should be obtained under the rules of civil procedure, not by abusing the instruments of data protection law.

dr. Kitti Humbert / Zoltán Fischer

Pay Transparency Directive: On its background and the possibilities for exemption from some of its provisions

/in , /by

The European Union’s Pay Transparency Directive 2023/970 brings significant changes for employers (and employees). The aim of the regulation is to promote the principle of “equal pay for equal work” and to highlight gender pay gaps. Although the largest administrative burdens will fall primarily on larger employers with at least 100 employees, smaller companies will not be unaffected either. EU member states must implement the Pay Transparency Directive into their national legislation by 7 June 2026, which means that these rules will likely be applicable to domestic employers starting from next summer.

Companies with fewer than 100 employees are not subject to the regular pay gap reporting obligation and are not required to conduct joint pay assessments with employee representatives if there is an unjustified difference of at least 5% between the average pay levels of female and male employees. Furthermore, these employers will not be required to submit data to the authorities or disclose pay differences. The opposite is true for larger employers, who, in addition to pay assessments, must also develop corrective and preventive measures to ensure equal pay in accordance with the directive. We note that Hungarian regulations may also lay down rules that are stricter than those in the directive, and may even impose the same rules on all employers, but the likelihood of such stricter regulations is very low. Regardless of this, the long-term impact of the directive is likely to affect these employers as well, since, as explained below, employees may request information about their pay.

 Rules from which there are no exceptions

It is important to note that the general transparency rules of the directive apply to all employers, regardless of size. Job applicants must always be informed in advance of the starting salary or salary range, and gender-neutral language must be used in both job advertisements and job titles. Applicants may not be asked about their previous or current pay. The criteria used to determine the remuneration, pay levels and pay increases of employees must be defined by each employer in an objective and gender-neutral manner and made easily accessible to employees. At the request of the employee, employers will be required to disclose data on the employee’s individual pay level and the average pay level of colleagues performing the same or equivalent work, broken down by gender. Furthermore, contrary to current general market practice, employees will not be prohibited from discussing their pay with each other or even disclosing it. It is important to note that in the event of a legal dispute, the employer will have to prove that there was no discrimination.

 

How should the number of employees be calculated?

Presumably, from the date of entry into force of the legislation, the number of employees will have to be determined based on the definition in Act XXXIV of 2004 on small and medium-sized enterprises and the promotion of their development (SME Act), so even smaller employers may be subject to the stricter provisions of the legislation due to the group level calculation.

What does it mean in practice?

While larger companies will have to regularly collect data, prepare reports, and take action based on them, for smaller businesses, the regulation means ensuring transparency in their day-to-day operations. Although they have no administrative reporting obligations, they will have to operate their labor market presence and internal remuneration systems in a much more transparent manner in the future.

For this reason, it is advisable for all employers to start preparing for the legislative changes, especially in case of certain HR processes.

dr. Zsófia Somlóvári / dr. Bence Tóth

Bértranszparencia irányelv: Annak hátteréről és az egyes rendelkezések alóli mentesülés lehetőségeiről

/in /by

Az Európai Unió 2023/970 számú bértranszparencia irányelve jelentős változásokat hoz a munkáltatók (illetve munkavállalók) számára. A szabályozás célja, hogy elősegítse az „egyenlő munkáért egyenlő bér” elvének érvényesülését, és célja, hogy láthatóvá tegye a nemek közötti bérkülönbségeket. Bár a legnagyobb adminisztratív terhek elsősorban a nagyobb, legalább 100 munkavállalót foglalkoztató munkáltatókra nehezednek, de a kisebb cégek sem maradnak érintetlenek. A bértranszparencia irányelvet a tagállamoknak 2026. június 7-ig kell átültetniük a nemzeti jogba, ami azt jelenti, hogy a ezeket a szabályokat valószínűleg jövő nyártól kezdve kell majd kötelezően alkalmazni a hazai munkáltatóknak.

A 100 munkavállaló alatti cégekre nem terjed ki a rendszeres bérkülönbség-jelentési kötelezettség és nem is szükséges közös bérértékelést lefolytatniuk a munkavállalói képviselőkkel, ha indokolatlanul, legalább 5%-os eltérés mutatkozna a női és a férfi munkavállalók átlagos bérszintje között. Továbbá ezen munkáltatók nem is lesznek kötelesek adatokat beküldeni a hatóság részére vagy nyilvánosságra hozni a bérkülönbségeket. Az előzőknek tehát a fordítottja igaz a nagyobb méretű munkáltatók esetében, akiknek a bérértékelésen túl korrekciós és megelőző intézkedéseket is ki kell dolgozniuk az irányelv szerinti egyenlő bér érvényesülése végett.  Megjegyezzük, hogy a magyar szabályozás meghatározhat az irányelvnél szigorúbb szabályokat is, így akár valamennyi munkáltatóra azonos szabályokat is előírhat, azonban egy ilyen szigorúbb szabályozás valószínűsége nagyon alacsony. Az irányelv hosszútávú hatása ettől függetlenül vélhetően ezen munkáltatókat is eléri, hiszen – ahogy lentebb kifejtésre kerül – a munkavállalók információt kérhetnek a bérezésekről.

Szabályok, amelyek alól nincs kivétel

Fontos látni, hogy az irányelv általános átláthatósági szabályai minden munkáltatóra vonatkoznak, mérettől függetlenül. Az állásra pályázókat minden esetben előzetesen tájékoztatni kell a kezdő fizetésről vagy fizetési sávról, valamint nemileg semleges nyelvezetet kell használni mind az álláshirdetésekben, mind az álláshelyek megnevezése során. A pályázókat nem lehet majd megkérdezni a korábbi vagy a jelenlegi fizetéséről sem. A munkavállalók díjazásának, bérszintjének és bérnövekedésének meghatározásához használt kritériumokat minden munkáltatónak objektíven és nemsemlegesen kell meghatároznia, és azokat könnyen hozzáférhetővé kell tenni a munkavállalók számára. A munkavállaló kérésére minden munkáltató köteles lesz kiadni a munkavállaló egyéni bérszintjére és a vele azonos vagy egyenlő értékű munkát végző kollégák nemek szerinti átlagos bérszintjére vonatkozó adatokat. Továbbá – a jelenlegi általános piaci gyakorlattól eltérően – azt sem lehet majd megtiltani a munkavállalóknak, hogy a bérükről egyeztessenek egymással vagy azt akár közzé tegyék. Fontos kiemelni, hogy egy esetleges jogvitában a munkáltatónak kell majd bizonyítania, hogy nem történt hátrányos megkülönböztetés.

Hogyan kell számítani a munkavállalói létszámot?

Feltételezhetően a jogszabály hatályba lépésétől a kis- és középvállalkozásokról, fejlődésük támogatásáról szóló 2004. évi XXXIV. törvény (Kkv. tv.) szerinti definíció szerint szükséges meghatározni a munkavállalói létszámot, így a csoportszinten történő számítás miatt akár kisebb munkáltatók is a jogszabály szigorúbb rendelkezései alá kerülhetnek.

Mit jelent ez a gyakorlatban?

Míg a nagyobb cégeknek rendszeresen kell majd adatokat gyűjteniük, jelentéseket készíteniük és azok alapján intézkedniük, addig a kisebb vállalkozások számára a szabályozás inkább a mindennapi működés átláthatóságának biztosítását jelenti. Bár adminisztratív jelentési kötelezettségük nincs, a munkaerőpiacon való megjelenésüket és a belső bérezési rendszereiket is sokkal átláthatóbban kell működtetniük a jövőben.

Ennek okán valamennyi munkáltató részére javasolható, hogy kezdje meg a felkészülést a jogszabályváltozásokra, főként az egyes HR folyamatok esetében.

Interview with dr. József Kapolyi Featured in BBJ’s Top Legal Executives 2025

/in /by

The Top Legal Executives 2025 edition of the Budapest Business Journal includes an interview with dr. József Kapolyi, founding partner of our firm. Dr. Kapolyi, who has played a defining role in the field of business law for decades, shared his professional views at the request of the BBJ on the legal aspects of artificial intelligence, the potential implications of the AI Act, and the current trends and opportunities shaping the legal profession.

The conversation also explores how our firm combines openness to innovation with sector-specific expertise, and how we support the professional development of the next generation of legal professionals.

 

Another Success Story: Kapolyi Law Firm in Legal500 EMEA 2025

/in /by

We are pleased to announce that Kapolyi Law Firm has once again been ranked in the Legal500 EMEA 2025 guide across multiple practice areas. This recognition also reflects the fact that our team’s legal expertise and client-focused approach continue to bring real value to the business law market.

This year’s edition once again highlighted our firm’s work in the areas of banking, finance and capital markets, real estate and construction, corporate law, as well as dispute resolution.

We are especially proud that several of our colleagues received individual recognition based on their outstanding professional work: Viktor KREZINGER was named a Next Generation Partner, Sándor HABÓCZKY was listed as a Leading Partner, and Martin GORTVA was recognized as a Leading Associate.

We would like to take this opportunity to sincerely thank our clients, whose trust and feedback made these results possible. We are also grateful to every member of our team for their daily work, dedication, and professionalism, which continue to drive the growth of our firm.

We remain committed to providing our clients with high-quality, reliable legal support as they navigate the many challenges of the business world.

Kapolyi Law Firm Earns Recognition Again in the Chambers Europe 2025 Rankings

/in /by

Kapolyi Law Firm is proud to announce that it has once again been recognized in the prestigious Chambers Europe 2025 rankings, which highlight the top law firms and legal professionals across Europe. The firm has been ranked in Banking & Finance and Real Estate, underscoring its consistent excellence and deep expertise in these fields.

Chambers Europe has also individually ranked some of our key professionals:

“This achievement is a testament to our team’s dedication and expertise, but most importantly, to the trust and support of our clients. Their confidence in us drives our commitment to delivering outstanding legal services year after year,” said József Kapolyi, Founding Partner of Kapolyi Law Firm.

For the full Chambers Europe 2025 rankings and more details, visit the Chambers official website.

 

Kapolyi Law Firm Ranked in Chambers Global 2025 – A Recognition of International Excellence

/in /by

We are proud to announce that Kapolyi Law Firm has been recognized in the Chambers Global 2025 guide for its expertise in the Banking & Finance Practice Area. This ranking highlights our firm’s growing recognition in the international legal market, showcasing our ability to handle cross-border transactions and multinational clients with exceptional expertise.

The Chambers Global Guide ranks the top global lawyers, law firms, and in-house counsel in over 200 jurisdictions worldwide, identifying firms that excel in handling international and multi-jurisdictional matters. Unlike Chambers Europe, which focuses on individual European jurisdictions, Chambers Global acknowledges firms with significant cross-border capabilities. Our inclusion in this prestigious ranking confirms our strong ability to navigate complex international legal challenges and reinforces our position as a trusted partner for global clients.

We are particularly pleased that our Banking and Finance team has received this distinguished ranking. We extend our gratitude to the practice leaders, dr. Balázs Ferenczy and dr. Viktor Krezinger, as well as the team’s key members, dr. Ádám Menyhárt, dr. Zsófia Somlóvári and dr. Erzsébet Dénes, for their outstanding contribution to our continued success.

We thank our clients and colleagues for their trust and support, and we remain committed to delivering top-tier legal services on a global scale.

 

Kapolyi Law Firm Attends the 31st ETOUCE Investment and Immigration Summit in Shenzhen

/in /by

Our colleagues, József Kapolyi and Martin Gortva, LL.M., proudly represented our firm at the 31st ETOUCE Investment and Immigration Summit, held in Shenzhen, China, between November 19 and 21, 2024. The event was a great success, offering an excellent platform to connect with leading professionals and companies in the industry while exchanging valuable insights.

Read more