Dark patterns, withdrawal buttons and personalised disclosure: a new era for financial service contracts concluded at a distance in Hungary

When Hungary’s original act on financial service contracts concluded at a distance was adopted in 2005, consumers contracted by telephone or fax. Today, we buy insurance with three swipes and invest in crypto-assets on the tram. Act XCIX of 2025, which entered into force in June 2026 transposing Directive (EU) 2023/2673, is not a mere update but a paradigm shift: static disclosure is supplemented by personalised information and the era of “three clicks to subscribe, three weeks to cancel” comes to a legal end.

1. Expanded scope: from fintech to crypto-assets

The new act applies to financial service contracts relating to services provided in Hungary. The former concept of a contract “concluded within the framework of organised distance selling” gives way to a technology-neutral definition: a contract concluded without the simultaneous physical presence of the parties, exclusively by means of distance communication.

The definition of “financial service” is significantly broadened. In addition to banking, insurance, investment and voluntary pension fund services covered under the predecessor act, the new law expressly extends to crowdfunding services, crypto-asset services and collective investment securities distribution. The legislator also introduces the concept of “online interface” – defined by reference to the Digital Services Act, which becomes central to the withdrawal button and dark patterns provisions.

2. Two-tier disclosure: general and personalised

The previous regime required a single layer of pre-contractual information. The new act establishes two cumulative tiers: general disclosure and personalised disclosure, one of the act’s most significant conceptual innovations.

Under the general disclosure requirement, the service provider must inform the consumer, in good time before the consumer’s contractual declaration, according to a detailed list of twenty-four information items. New mandatory elements include complaint-handling contact details, the supervisory authority’s website, the consequences of late payment or default and, notably, a warning where pricing is the result of automated decision-making. Where the investment strategy involves environmental or social factors, separate ESG disclosure is required. Information may be presented in layers (“layered disclosure”), but seven key items, including the price and the right of withdrawal, must always appear on the first layer.

The personalised disclosure obligation is entirely new. The provider must offer, free of charge and prior to conclusion, information enabling the consumer to assess whether the specific contract suits their needs and financial situation. In practice, this means that, for a credit agreement, the provider must show the individual consumer what repayment means in their specific financial circumstances.

Particularly noteworthy is the obligation to provide access to human intervention upon request where online tools are used, a direct response to the increasing reliance on chatbots in financial services.

3. Modernised right of withdrawal

The fourteen-day cooling-off period is retained, but the new act adds that withdrawal may be exercised “without adverse consequences” and that termination may not impose costs on the consumer. This does not mean, however, that nothing is payable: the provider remains entitled to claim proportionate consideration for services actually rendered. The consequences of disclosure failures are simplified. If the consumer receives information late, the withdrawal period runs from receipt; if no information is received at all, a long-stop period of one year and fourteen days applies. Crucially, if the consumer was never informed of the existence of the withdrawal right itself, no limitation period applies and the withdrawal right remains exercisable indefinitely.

4. The online withdrawal button

The act devotes an entirely new chapter to withdrawal from contracts concluded via online interfaces. Where the consumer contracts online, the provider must offer a dedicated withdrawal function, prominently placed, continuously available during the withdrawal period and labelled “withdraw from the contract” or equivalent clear wording. A two-step mechanism prevents accidental withdrawals: the consumer first completes a withdrawal form and then confirms via a separate function. The provider must immediately acknowledge receipt on a durable medium. The underlying principle is clear: if subscribing takes one click, cancelling must be equally straightforward.

5. Dark patterns prohibition

Among the act’s most pioneering provisions are the rules against manipulative design of online interfaces. The provider’s online interface must not mislead consumers or materially distort their ability to make free and informed decisions. Three specific prohibitions apply: highlighting certain options when prompting a consumer’s choice; repeatedly soliciting a decision the consumer has already made, as with typical “nag screen” pop-ups and making termination more difficult than subscription. Providers must adopt an internal policy on compliance with these prohibitions, a document likely to be subject to supervisory scrutiny.

Outlook

The act’s consumer protection objectives are difficult to contest. The open question is whether the cumulative burden is proportionate. For a smaller fintech or insurance intermediary, the twenty-four-item disclosure list, personalised information, human intervention, a dark patterns policy and a two-step withdrawal mechanism collectively require substantial resources. Nor is it guaranteed that consumers will actually engage with layered, yet still voluminous, disclosure materials.

The coming years will be a period not only of implementation but also of interpretation, determining whether the new framework can simultaneously ensure a high level consumer protection while allowing digital financial innovation to develop effectively.