Facebook-f Linkedin-in Twitter

Make the Warning Count: Why Stablecoin Rails Need Card-Style Liability Rules

  • EFRI
  • Related News
Stablecoins

EFRI Briefing · 21 October 2026 · Mastercard Stablecoin Security and Qivalis’s planned euro token. This briefing analyses market and regulatory developments; it makes no finding of liability against any institution named.

When a fraud victim’s money leaves a European bank and reaches a scammer’s wallet, the institutions along the way often give the same answer: we could not see it. The sending bank saw an authorised transfer. The payment institution saw an account it had onboarded. The crypto platform saw a conversion. Each processed a segment; the victim is left chasing the whole.

Two October announcements make that answer harder to sustain. On 19 October, Mastercard launched Stablecoin Security, a service that combines payment data with blockchain analytics and scores a stablecoin payment before it is sent. Five days earlier, Qivalis, owned by 37 European banks, announced that De Nederlandsche Bank (DNB) had authorised it as an electronic money institution, clearing the way for a (multi)bank-backed euro e-money token (EFRI, 15 October 2026).

Neither announcement answers the question that decides whether victims are protected: what happens when a material risk warning appears and the payment is executed without an adequate response? Card schemes provide a precedent for contractual loss allocation and defined dispute routes, although they do not guarantee reimbursement for every scam. EFRI’s thesis is that stablecoin rails need binding rules of their own: mandatory screening, documented intervention, and a clear route to compensation when required controls fail.

1. What Mastercard launched, and what it did not

According to Mastercard, the new product Stablecoin Security follows risk across the payment rail, from the initial fiat payment through conversion and movement on the blockchain. It analyses transaction context, source of funds, exposure to restricted parties and scam indicators, and delivers a risk assessment through a platform-agnostic API into the institution’s existing fraud, compliance and case-management workflows. The assessment feeds the decision on whether a payment proceeds or requires review, before it is executed.

The scope is narrower than much of the coverage suggests:

  • The illustrated use case is a bank arranging a stablecoin payment through a service provider. The announcement does not establish whether, or how, a bank handling only a SEPA transfer to an unrelated crypto platform could obtain equivalent coverage of the subsequent token leg. That remains a question for Mastercard.
  • The initial partners are B2B. Borderless.xyz and Keyrails, both from Mastercard’s Start Path Blockchain and Digital Assets programme, place the service in institutional and cross-border payment networks.
  • The rollout starts in North America. Worldwide commercial availability is expected in 2027, including through BVNK, the stablecoin infrastructure provider Mastercard acquired in August 2026. Mastercard and BVNK launched a combined fiat-and-stablecoin “Global Money Platform” on 15 October 2026.
  • The announcement provides no detection or false-positive rates and no complete account of supported blockchains, pricing or which participants receive the intelligence.

Most importantly, Stablecoin Security is, as announced, a service sold to institutions, not a published liability rulebook. The executing institution retains the payment decision. The announcement does not specify contractual consequences for ignoring an alert or promise compensation to victims. Existing legal duties remain relevant.

The unanswered operational questions are concrete. Who receives the score and underlying evidence: the bank, executing provider, receiving institution or token issuer? The card-issuer/acquirer distinction does not answer that. Which fiat and blockchain legs are covered, and which participants are actually identified rather than merely represented by addresses? Does Mastercard receive Travel Rule data, and who resolves missing or conflicting information? Who sets intervention thresholds, can override alerts, and records the reasons? Who handles urgent fraud reports across the chain, and what complaint, disclosure and compensation rights does the victim have?

2. What blockchain screening can, and cannot, do before execution

Blockchain analytics before a payment is executed rests largely on what is already known:

  • List matching: is the destination address flagged as linked to scams, sanctions, mixers or darknet markets?
  • Clustering and attribution: analysts use chain-specific heuristics and external evidence to associate addresses with entities. Interaction with a known address does not, by itself, prove common ownership or control.
  • Indirect exposure: an address that is not itself listed may have sent or received funds within a few hops of known scam addresses.
  • Behavioural features: patterns such as rapid onward transfers may justify closer review, but can also arise in legitimate activity. Their significance depends on context and validation.

Much of this analysis depends on historical information. Fraudsters can use new addresses with little or no attributable history. Those addresses may escape known-address checks, although other signals can still flag them. An unflagged address is not a clean bill of health. Analytics can support prevention, tracing and recovery; none of those capabilities guarantees that the first victim will be protected.

Mastercard cites BIS Working Paper No. 1359, The anatomy of stablecoin transactions (Schär, Kosse, Rice, Shirakami and Siridhasanakul, 11 June 2026), which analyses 593 million event logs from 141 million Ethereum transactions involving USDT, USDC and PYUSD in 2025. Roughly one third of the transactions generate multiple steps; because each emits several transfer events, they account for nearly 60% of all transfer events. That does not mean 60% of transactions are complex, still less fraudulent: trading, lending, arbitrage, liquidity provision and settlement generate complexity too. The study shows why isolated transfer events can mislead analysts.

The consequence is important. Customer-side information can be decisive: a first crypto purchase, unusual payment patterns, detectable signs of remote access, or an immediate withdrawal to an external address. EFRI’s investment-fraud casework repeatedly involves victims coached through payments by call-centre agents. A bank may hold account and payment history without seeing remote-access software or a downstream wallet withdrawal. Institutions should identify which signals they actually hold, which they can lawfully obtain, and how they reach the decision-maker. Blockchain screening is a necessary part of EFRI’s proposed control framework, not a sufficient safeguard on its own.

3. How card schemes turned warnings into liability

Card payments show what turns a control into accountability. Scheme rules bind issuers and acquirers contractually, and the schemes have repeatedly used them to reallocate fraud losses according to whether the available controls were used:

  • 3-D Secure: qualifying authentication can shift liability for certain unauthorised card fraud from the merchant side to the issuer, subject to scheme rules and exceptions. It does not guarantee reimbursement for an authorised investment scam.
  • EMV liability shift: US card schemes introduced counterfeit-fraud liability shifts from October 2015, with qualifications and different timetables for some acceptance environments, to encourage chip adoption.
  • Fraud and chargeback monitoring programmes: merchants and acquirers with excessive fraud or chargeback rates face fees, remediation obligations and, ultimately, exclusion.
  • Chargebacks: cardholders can raise disputes through their issuer, with eligible claims and inter-member loss allocation governed by scheme rules, evidence requirements and deadlines. This is not an unconditional right to recover every fraud loss.

These contractual mechanisms show that networks can make access conditional on controls and attach financial consequences to non-compliance. They operate alongside legislation. EFRI’s proposal borrows that enforceable structure; it does not pretend that existing card protections already cover every authorised scam.

Mastercard does not control participation in a public blockchain. A token transfer does not automatically carry card-scheme dispute rights. Through its own infrastructure and contractual relationships, however, Mastercard can seek to make screening, intervention and loss allocation conditions of participation. It should disclose the boundaries of that authority and require equivalent commitments from contracted providers. A rulebook should cover ignored material warnings, omitted mandatory screening and failures to investigate.

4. The blind spot starts upstream

Any rulebook for stablecoin rails must not distract from where victims’ money is lost today. EFRI’s FINOM/Triventa Case Note documents a British company incorporated eleven days before its account was opened at a DNB-licensed e-money institution. Within six weeks, the account received €314,183.31 in 67 credits, overwhelmingly from private individuals, and passed 99.85% of it onward to Banking Circle accounts. Downstream, the case file identifies a virtual IBAN created in the victim’s own name eight months before the fraudsters contacted him. Banking Circle stated in writing (20 July 2026) that it holds no IP-address logs, device identifiers or comparable technical endpoint records relating to the underlying customers of its clients.

That statement concerns technical records, not all customer or transaction information. But it shows where visibility fails: inside regulated finance, in white-label account structures and virtual IBANs, before any crypto conversion. A risk score at the token stage cannot replace scrutiny upstream. The case for liability rules on stablecoin rails is a case for applying to the new infrastructure the discipline the old one never received.

5. Qivalis: build responsibility into the distribution contracts

Qivalis describes a “B2B2X” model: it will distribute its token through eligible counterparties, including banks, crypto-asset service providers, payment service providers and market infrastructure participants. The detailed operating model has not been published; the MiCA white paper is outstanding. Given the 37-bank ownership structure and the announced model, EFRI considers it likely that participating banks will act as distributors, though not necessarily all of them or on identical terms.

Two features of this model matter.

The distributor sits on both sides. Where a bank holds the customer’s euro account, arranges the conversion and executes the token transfer, it can connect the customer relationship, the payment behaviour and the destination address before execution. Ownership alone does not prove operational visibility: information may sit somewhere in a group or supply chain without reaching the person who decides whether a transfer proceeds. But a bank that chooses to distribute its consortium’s token is responsible for designing the service so that those signals meet.

The issuer should use its distribution contracts to impose binding controls and loss-allocation rules. Qivalis’s published model does not establish that it will contract directly with every downstream distributor or control every secondary-market transfer. EFRI calls for enforceable obligations in its direct distribution agreements, equivalent obligations for contracted downstream distribution, and explicit disclosure of where that contractual protection ends.

An issuer freeze function could help preserve recoverable tokens. Major stablecoin issuers use address-level freezing, but Qivalis’s technical powers and operating policy remain to be explained. Freezing is not itself restitution, and reimbursement must not depend on recovering the original tokens. An institution can compensate a victim without reversing the blockchain transfer.

6. The PSR strengthens liability; the rails still need an operational rulebook

The legal frame is moving in the same direction.

Certain services involving e-money tokens qualify as payment services. In its No Action Letter of June 2025 (EBA/Op/2025/08), the European Banking Authority advised national authorities to treat transfers of e-money tokens carried out on behalf of clients as payment services under PSD2; the transition period for crypto-asset service providers ended on 2 March 2026 (EBA Opinion of 12 February 2026). Recital 16 of the PSD3 final compromise text (Council document 8222/26, 17 April 2026) confirms that crypto-asset transfer services with e-money tokens can qualify as the execution of payment transactions. It also states that exchanging tokens where the provider acts in its own name as buyer or seller is not a payment service, and it refers to specific exclusions to be set out in the Payment Services Regulation.

The PSR compromise (Council document 8221/26, 17 April 2026) links monitoring and intervention to liability. Article 83 requires payer-side monitoring before execution and payee-side monitoring before funds become available, with liability and evidential consequences for failures. Article 65 requires suspension where objectively justified fraud suspicion exists; breaching that duty can leave the provider bearing the loss. Article 69 addresses recipient-side withholding and return, including a mandatory response to clear and incontrovertible fraud grounds.

It is therefore wrong to suggest that the compromise is silent when a warning is ignored. The practical question is whether the warning meets the legal threshold and whether the provider responds adequately. An unusual payment alone is not enough.

These are proposed rules, not a statement of presently applicable PSR obligations. EFRI’s additional demand is a usable scheme rulebook: defined triggers, prompt reimbursement, evidence access and inter-provider allocation. Any token-specific application must respect the final scope and exclusions. A self-hosted destination does not erase the sending provider’s responsibilities or the separate duties of other actors.

Anti-money-laundering law and the Travel Rule complement this framework. Ongoing monitoring is already required under Article 13(1)(d) of Directive (EU) 2015/849; Article 26 of Regulation (EU) 2024/1624 addresses it from 10 July 2027. Regulation (EU) 2023/1113 has applied since 30 December 2024, extending transfer-information requirements to covered crypto transfers, including specific self-hosted-wallet obligations. Originator and beneficiary information helps connect transfers, but is not automatically shared with every participant or Mastercard. Those duties do not themselves create a single compensation route for the victim.

7. What a chargeback can mean on an irreversible ledger

A blockchain transfer cannot be reversed by a scheme operator. That does not make chargeback-style protection impossible; it changes where it sits:

  • At the distributor. Under EFRI’s proposed rules, the executing institution reimburses its customer where failure to apply required screening, investigate material indicators or intervene triggers liability. A reasoned, adequate review is different from an ignored warning. No technical reversal is needed.
  • Between participants. Where the receiving address belongs to another participant on the same rails, the rules allocate the loss between sending and receiving participants, as card schemes allocate it between issuer and acquirer.
  • At the issuer. Where tokens can still be located, an issuer freeze under a published policy preserves them for recovery.

There is a working model for inter-provider allocation. The United Kingdom’s mandatory reimbursement regime for authorised push payment fraud, in force since 7 October 2024, requires the sending provider to reimburse the victim and divides the cost by default equally between sending and receiving providers. Its scope stops at Faster Payments and CHAPS to an account controlled by someone other than the customer; payments to the victim’s own account at a crypto exchange are excluded. The UK Financial Ombudsman Service has filled part of that gap case by case, holding sending banks partly responsible in multi-stage crypto scams where they should have intervened (DRN-5163825, Santander: 50% of payments four to eleven, plus 8% interest; DRN-6069210, Santander, task-based job scam: 50% of payments seven to fifteen, plus 8% interest), while rejecting claims where an intervention would probably not have prevented the loss (DRN-5212954, Halifax). These are individual ombudsman decisions, not court judgments or general reimbursement guarantees. The EU has national dispute-resolution bodies, but no single EU-wide equivalent offering a unified route for these cross-border complaints.

EFRI has proposed the same principle for the EU: the victim is reimbursed first, and the providers allocate liability among themselves (Sixt, Restoring Trust in European Payment Rails: A Framework for a Shared Liability Reform, SSRN 5456554, 8 September 2025, based on 1,750 cases from 20 countries). The Court of Justice has moved in the same direction for unauthorised transactions in Case C-70/25 (EFRI, CJEU Confirms “Refund First”). A rulebook for a new payment rail (be assured: stablecoins have the potential to become a very popular new payment rail) a is the place to apply that principle by design.

8. The strongest case against

The thesis has limits, and they should be stated on their own terms.

Screening has historical blind spots. Fresh addresses may escape known-address checks. Liability rules tied only to an actual on-chain alert would leave a serious gap. They must also cover failure to perform required checks and assess relevant customer-side signals.

False positives and de-risking. Pre-execution screening of every crypto-related transfer will generate false alarms. Institutions facing liability may respond by blocking crypto transfers wholesale, penalising legitimate customers and pushing activity to less regulated channels. Rules must reward proportionate review, not blanket refusal.

Causation. Coached victims sometimes proceed despite warnings. As the contrasting ombudsman decisions show, the effect of an adequate intervention matters. A rulebook must define meaningful intervention and the conditions for reimbursement, instead of leaving every victim to fight an open-ended hypothetical dispute.

Data protection. Combining payment, device and third-party intelligence, and sharing fraud indicators across a consortium, require a lawful basis under the GDPR.

Private standard-setting. If proprietary risk scores from a dominant network define the standard of care, a vendor whose methodology is not public sets the legal benchmark. Scheme rules must therefore be transparent, and supervisors must be able to test them.

Migration. Strict rules on regulated rails may push fraud to unregulated tokens and self-hosted wallets. That is an argument for making the regulated rails trustworthy, not for leaving them without rules.

These objections shape the design of the rules. None of them is a reason to have no rules.

Our Assessment

For EFRI, the significance of Mastercard’s launch lies less in the product than in what it concedes: the payment industry now markets, as a standard compliance service, the capability to see across the boundary between fiat and crypto before money moves. That creates no legal duty and establishes no liability in any individual case. It does make claims of inevitable invisibility harder to defend. And it exposes the real gap: a warning that has no consequence protects no one.

The intermediary is the pressure point. Card payments earned trust not because fraud disappeared, but because the schemes made it predictable who pays when a control is ignored. Stablecoin rails are being built now, by Mastercard on its own infrastructure and by 37 European banks through Qivalis. This is the moment to build accountability into them, before the first victim discovers that every participant points elsewhere.

EFRI therefore calls for the following:

  1. Blockchain screening as a mandatory control. Every institution executing a stablecoin or e-money-token transfer for a customer should screen the destination before execution, combined with customer-side signals, and document the standard it applies. On regulated rails, this should be a condition of participation, not an optional product.
  2. Mastercard: attach consequences to control failures on its contracted rails. Define mandatory screening and investigation, material intervention triggers, justified clearance and loss allocation. A participant should bear the loss where a breach triggers liability under the rulebook, including when it failed to run the required checks. Explain what responsibility Mastercard accepts for its own service failures.
  3. Qivalis: binding distribution agreements. Require direct distributors, and their contracted downstream distribution partners, to apply defined controls and redress rules. Specify who reimburses the victim first and how institutions settle allocation afterwards. Disclose which secondary-market transfers fall outside those commitments.
  4. A chargeback route for victims. Victims should have a defined dispute route through the distributor that executed the transfer, with deadlines, a reasoned decision and reimbursement where the rules assign the loss to that distributor.
  5. A published freeze policy. Qivalis should state whether its token can be frozen, under what conditions, and how victims, their banks and their representatives can report addresses holding stolen tokens, with response times outside office hours and across borders.
  6. A named lead institution for every fraud report. One institution should coordinate each report across the chain: preserve evidence, circulate substantiated alerts lawfully, seek available freezes or recalls, and give the victim a reasoned response, without displacing each participant’s own obligations and potential liability. Victims must not become the unpaid coordinators of the industry’s payment chain.
  7. Records that can be tested. Alerts, review notes, override decisions and their justification must be preserved and available through lawful routes to victims, investigators and courts. Providers should disclose coverage, detection and false-positive rates, response times and recovery outcomes.
  8. Build stronger protection from day one. Qivalis and its distributors should voluntarily contract for robust monitoring, intervention, evidence and reimbursement standards at launch. Supervisors should seek a clear account of those commitments within their mandates. Customers should not have to wait for future legislation to benefit from an enforceable distribution rulebook.

A system that connects risk information but leaves victims to connect responsibility has solved only the industry’s half of the problem. Card schemes showed that rules, not technology alone, create trust. If banks want the credibility of bank-backed money, they must deliver bank-backed accountability.

Sources

More about this topic.

More News

Make the Warning Count: Why Stablecoin Rails Need Card-Style Liability Rules

  • EFRI
  • Related News

More News