EFRI Briefing · StablR Ltd (MFSA-licensed electronic money institution, C 104007) · StablR notification of 19 October 2026

On 19 October 2026, StablR Ltd published its first update on the cybersecurity incident of 24 May 2026 since 25 August. Its own summary is that there are “no material developments to report”. Minting and redemption of the e-money tokens EURR and USDR remain suspended, the Recovery Plan remains active, and StablR says that it “continues to work with” the Malta Financial Services Authority (MFSA). No date for resuming redemption is given. (StablR, 19 October 2026)

The more informative part of the notice is what it no longer says. EFRI has reported repeatedly on the StablR case and has submitted the matter to the MFSA, the European Banking Authority (EBA) and the European Securities and Markets Authority (ESMA) (EFRI, StablR: EFRI Takes EURR and USDR Redemption Freeze to EBA and ESMA).

What changed between 25 August and 19 October

On 25 August 2026, StablR stated that safeguarded assets “were not affected by the incident and remain intact” and that properly issued EURR and USDR “continue to be fully backed”. It quantified the unauthorised tokens still in circulation at approximately 6.41 million EURR and 14.33 million USDR, created without authorisation and without corresponding payment, and referred to working with the MFSA and its advisers on next steps, “including the orderly resumption of services in due course”.

The 19 October notice is more limited. It states that reserve assets continue to be held in segregated accounts, but does not repeat that they “remain intact”, nor that properly issued tokens remain fully backed. The quantities of unauthorised EURR and USDR are not mentioned, and there is no reference to a resumption of services.

The October notice adds three elements. Complaints are registered under StablR’s Complaints Handling Procedure but “cannot yet receive a final response”. StablR will not comment on individual holdings and will communicate material developments only publicly, to ensure equal treatment of holders. And it warns that StablR will never offer to recover or redeem tokens in return for a fee.

Omissions are not statements. The October notice does not say that reserve assets are impaired, and a shorter announcement may simply reflect the absence of new developments. But for holders who depend on these notices as one of their few sources of information, the disappearance of the most reassuring statements of the August notification is itself relevant.

The legal framework

The redemption right and its suspension. Under Article 49 of Regulation (EU) 2023/1114 (MiCAR), holders of e-money tokens have a claim against the issuer and a right to redemption at any time and at par value, without a redemption fee. MiCAR also expressly recognises that redemption may be suspended. Article 46(1)(c), applied to e-money-token issuers through Article 55, lists the suspension of redemptions as a possible recovery-plan measure; Article 46(4) separately permits the competent authority to suspend redemption where justified having regard to the interests of holders and financial stability. Suspension alone therefore does not establish a breach of MiCAR, and MiCAR prescribes no maximum duration.

That does not mean that a suspension can continue indefinitely without supervisory scrutiny. A recovery measure is intended to restore compliance. The longer redemption remains unavailable, the more pressing the question whether the recovery measures can still achieve that purpose, or whether the next stage of the MiCAR framework must be assessed.

Recovery plan versus redemption plan. A recovery plan under Article 46 is intended to restore the issuer’s compliance and its ability to fulfil its obligations. The redemption plan under Article 47 provides for the orderly redemption of tokens where the competent authority determines that the issuer is unable or likely to be unable to fulfil its obligations. The EBA Guidelines on redemption plans (EBA/GL/2024/13) require that assessment to be made by reference to prudential, financial and operational factors.

Which of those factors fit StablR depends on its status. EURR and USDR are not significant e-money tokens. The reserve-of-assets rules of Articles 36 to 38 MiCAR do not apply to them; funds received in exchange for the tokens are instead safeguarded under Article 54 MiCAR and the Electronic Money Directive. Indicators framed around a reserve of assets therefore cannot be transposed to StablR without adaptation – the functional question remains whether the safeguarded funds cover all recognised redemption claims. Nearly five months after the suspension, there is no public indication that the MFSA has moved from the recovery-plan framework to an Article 47 redemption process.

The unresolved question: the legal status of the unauthorised tokens. StablR’s stated position is that approximately 6.41 million EURR and 14.33 million USDR were created without authorisation and without payment and are therefore not backed. If StablR is right that those units give rise to no redemption claim against the issuer, they do not increase the amount required to satisfy Article 49 claims. That would not by itself establish that all recognised claims are fully covered.

The difficult case is the good-faith purchaser who acquired EURR or USDR through an authorised crypto-asset service provider without any means of knowing whether the units attributed to them trace back to StablR’s authorised issuance process. If a court or competent authority were to conclude that some such purchasers have claims against StablR, the issuer’s liability position could change materially. There is still no public methodology explaining how StablR or the MFSA intends to distinguish lawfully issued from unauthorised units at the level of individual holders – particularly where tokens were held in omnibus custody structures or placed in Earn products. That question is increasingly central to any workable redemption process.

The Maltese licensing perspective. StablR holds its licence under Malta’s Financial Institutions Act (Cap. 376). Article 6(1) allows the MFSA to withdraw, suspend or restrict a licence on several grounds, including where an institution has “ceased to engage in business for more than six months” (Article 6(1)(b)), no longer fulfils the conditions for its licence, fails to comply with the Act, or has insufficient assets to cover its liabilities.

This does not mean that StablR’s licence lapses automatically. StablR continues to conduct recovery, regulatory, compliance and complaint-handling activities, and whether the suspension of minting and redemption amounts to a cessation of business is for the MFSA to decide. If the MFSA were to take that view, the six-month point would be reached on 25 November 2026. The broader issue is not the calendar alone, but whether StablR continues to satisfy the conditions under which an electronic money institution may remain licensed while holders cannot exercise the core redemption right attached to its tokens.

Our Assessment

A suspension that MiCAR permits as a temporary recovery measure becomes, in practical effect, a de facto denial of the redemption right for holders of lawfully issued tokens if it continues for an extended period. Five months without a timetable, without a published claims-validation procedure and without a public explanation from the supervisor change the supervisory question. It is no longer simply whether StablR may continue implementing its Recovery Plan, but whether that process can still restore normal redemption – and, if not, whether the MFSA should assess the conditions for orderly redemption under Article 47.

Three steps would materially improve the position of holders without disclosing confidential supervisory material:

• Publish a claims-validation procedure. An on-chain snapshot as at 24 May 2026, combined with the client records of the crypto-asset service providers that held EURR and USDR for retail customers, can identify documented pre-incident positions and subsequent movements. Such records do not necessarily prove the provenance of individual fungible units, but they are the essential evidence for establishing claims – in substance, a list of affected holders. Without a published methodology for omnibus custody, commingling, Earn products and subsequent transfers, holders cannot know what evidence they will have to provide.
• Clarify the legal basis of the continuing suspension. The MFSA could state whether redemption remains suspended solely as an issuer-led measure under Article 46(1)(c) or whether the Authority itself has acted under Article 46(4), and which criteria it applies in assessing whether the recovery process remains viable.
• Clarify the position of the unauthorised tokens. Holders who acquired EURR or USDR in good faith through regulated platforms need to know whether the units attributed to them carry a claim against StablR, a claim against an intermediary, or no claim against the issuer at all. Until that is resolved, neither the sufficiency of the safeguarded funds nor the operation of any future redemption process can be properly assessed.

EFRI will continue to follow the case and its submissions to the MFSA, the EBA and ESMA. Holders of EURR or USDR who have submitted complaints or redemption requests, or who hold tokens through a crypto-asset service provider, are invited to contact EFRI.