Digital asset regulation and tokenization in Slovakia

Launching digital asset services in Slovakia requires demonstrating to the National Bank of Slovakia, NBS, that the business model, resources and controls support the requested activities. European MiCA and Act 248/2024 connect authorisation with continuing obligations.

Cybersecurity documentation and separation of client assets deserve particular attention. This guide explains their relationship with permission and why tokenized securities issuance requires different assessment from custody or exchange of other crypto-assets.

How MiCA and Slovak law fit together

MiCA provides the EU framework for crypto-assets and services within its scope, supplemented by Slovakia's Act 248/2024. Assessment must distinguish CASP services, asset-referenced token issuance and electronic money issuance. Classification as a financial instrument brings securities rules into consideration even where the underlying technology is identical.

The NBS's July 2026 announcement confirms authorised providers and the former transition's closure in December 2025. Historical exchange or wallet trade licensing does not establish current entitlement. Customers should verify the provider's identity, covered services and, for firms operating from another Member State, the relevant cross-border route.

What NBS authorises and what the issuer must do

The NBS administers domestic MiCA procedures, but provider authorisation does not replace issuer requirements. Existing banks or financial entities can use Article 60 only for services permitted by their status and after the required notification. EMT issuance and certain payment operations also require consideration of banking and payments legislation.

Supervision does not establish a product's profitability. The NBS announcement on authorised providers expressly maintains its investment risk warning. This assessment therefore distinguishes an available regulatory route, permission scope and an individual project's financial condition or operation. A single favourable label cannot determine all three.

Which application documents and audit are required

Pre-application guidance requires substantive preparation covering the business model, control structure, staff and operational presence. A preliminary meeting is discretionary, outside formal proceedings and neither legal advice nor an indication of approval. Responsible officers should be able to explain management, anti-money laundering controls and technology systems alongside any advisers attending.

The reform explained by the NBS, effective on 1 March 2026, strengthens external cybersecurity audit documentation for applicants intending to use networks and information systems. Section 13 of the Act preserves the former rules for proceedings already initiated and not finally concluded before that date. Applications must identify the applicable version.

How client rights and assets are protected

The DLT Pilot Regime provides specific financial instrument infrastructure permissions and limited exemptions. It does not turn CASP authorisation into permission to operate every securities market. Issuance requires documented rights, the responsible obligor, governing law and legal effects of registration and transfer, including any formalities remaining outside blockchain.

For custody, section 3 of domestic legislation protects crypto-assets outside the provider's estate against enforcement and preserves client rights on insolvency. Separation must be legally and operationally demonstrable. This protection does not replace position records, reconciliation or the ability to identify and return assets attributable to each client.

Which controls must continue operating

DORA requires ICT risk management, incident handling, continuity and technology provider oversight within its scope. An audit included in an authorisation application does not exhaust these continuing obligations. Custody arrangements must connect key and access controls with contractual responsibilities, recovery and procedures addressing discrepancies between internal records and blockchain positions.

The Transfer of Funds Regulation adds originator and beneficiary information requirements for covered operations. These must integrate with due diligence, sanctions and transaction monitoring. Automation or a P2P label does not itself exclude regulation: assessment must identify who actually provides each service and controls the customer relationship.

How to prepare the application and operations

Pre-application work for NBS should specify services, organisation, responsible personnel and systems. The team needs to explain its model, anti-money laundering arrangements and technology controls at meetings. Check which audit requirement applies according to the proceeding’s start date and status.

For custody, demonstrate how positions are attributed and returned to clients, reconciling contracts and records. Issuance additionally needs instrument classification, documentation and legal transfer mechanics. Provider authorisation and statutory protection do not replace those operational arrangements.

To understand how this framework applies to your project, discuss your case with our team.