EFRI Case Note · Office of the Arbiter for Financial Services (Malta) · 21 October 2026

This article presents EFRI’s preliminary considerations based on the information available as of 21 October 2026. It identifies unresolved questions of responsibility and redress without establishing liability in any individual case. The assessment may change as further facts, documents or decisions become available.

Five months after StablR Ltd suspended redemption of its e-money tokens EURR and USDR, holder complaints against the issuer are pending before Malta’s Office of the Arbiter for Financial Services (OAFS). StablR itself refers complaining holders to the OAFS. As far as EFRI is aware, the Arbiter has not yet ruled on admissibility in these cases, let alone on the merits.

The complaints bring into focus a question that most holders cannot answer: when e-money tokens sit in a custodian’s wallet and the issuer has frozen redemption, who owes the holder what, and where can that claim be enforced? This Case Note sets out the legal architecture under Regulation (EU) 2023/1114 (MiCAR), including two constellations that affect the route to payment: tokens held in a custodian’s pooled wallet alongside unauthorised units, and tokens placed in a yield product under a transfer of ownership. It then examines the issuer’s defence and the complaint route to which StablR itself directs holders. It follows EFRI’s earlier reporting: StablR: Five Months On – No Redemption, No Timetable, and Less Reassurance and StablR: EFRI Takes EURR and USDR Redemption Freeze to EBA and ESMA.

Background

StablR Ltd is authorised by the Malta Financial Services Authority (MFSA) as a financial institution and issues EURR and USDR as e-money tokens under Title IV of MiCAR.

• 24 May 2026: StablR identified unauthorised access to its infrastructure. According to the issuer’s subsequent account, an external attacker used that access to mint EURR and USDR outside the authorised issuance process, without corresponding payment or backing.
• 25 May 2026: StablR announced the suspension of minting and redemption following the incident. Exchanges and trading venues were asked to suspend trading, deposits and withdrawals. Bit2Me says it halted its own operations in the tokens on 24 May.
• 29 May 2026: StablR announced the formal activation of its Recovery Plan.
• 25 August 2026: StablR stated that the reserve assets backing properly issued tokens were unaffected and intact, and disclosed that approximately 6.41 million EURR and 14.33 million USDR created without authorisation remained in circulation. Its notification did not publish the criteria for deciding how holdings would be treated on redemption.
• 19 October 2026: In its first update since 25 August, StablR confirmed that minting and redemption remained suspended and the Recovery Plan remained active. No date for resumption was given; complaints remained open without final responses.

The complaints and StablR’s response

The dispute is already practical. Holders are requesting redemption at par, including where their tokens are held through custodians. In its responses to holders, StablR has relied on Articles 55 and 46(1) MiCAR as the basis for the suspension, stated that the suspension “does not remove the redemption rights of valid holders under Article 49 MiCAR”, and indicated that custodial positions will be verified with the custodians once redemption becomes available. StablR itself directs dissatisfied holders to the OAFS.

That referral puts a concrete question before the Maltese redress system: can holders obtain redemption at par, or compensation where the conditions for liability are established, while the issuer continues to invoke its recovery process? Registration of a complaint does not settle admissibility or the merits, and a claim for interest requires its own legal basis.

The legal architecture: two relationships, two obligations

1. The issuer owes the money

Under Article 48(2) MiCAR, e-money tokens are deemed to be electronic money. Article 49(2) and (4) gives holders a claim against the issuer and requires redemption upon request, at any time and at par value, in funds other than electronic money. Article 49(6) prohibits redemption fees without prejudice to Article 46.

The statutory obligation to redeem at par lies with the issuer. A custodian such as Bit2Me owes custody and the duties attached to that service; it may also face a separate claim if its own conduct gives rise to liability. Those relationships must be distinguished without allowing either institution to use the other as an excuse for leaving the client without an answer.

On-chain, the issuer may see only the custodian’s addresses. In EFRI’s view, however, ordinary custody must be analysed by reference to the client for whom the tokens are held and the rights recorded for that client. StablR’s own reference to “valid holders” and verification through custodians makes the treatment of those client positions central to the dispute.

2. The custodian controls the path to the money

Redemption requires the tokens to be returned to the issuer. Only whoever controls the private keys can move them. For custodial holders, that is the custodian.

Article 75 MiCAR governs this relationship. The custodian must keep a register of positions opened in the name of each client, corresponding to each client’s rights to the crypto-assets; must segregate client assets from its own estate; and is liable for loss of crypto-assets or access resulting from an incident attributable to it, subject to the statutory market-value cap. Under Article 71, it must operate a complaints-handling procedure. Under Article 66(1), it must act honestly, fairly and professionally in the best interests of its clients.

The practical consequence is simple. If the issuer reopens redemption, a custodial holder is paid only if the custodian cooperates. If the custodian releases the tokens, the holder is paid only if the issuer redeems. Both obligations must be enforced.

3. The omnibus problem

Custodians typically hold client tokens in pooled wallets. StablR has said it will verify which tokens in circulation were validly issued, and that it will do so with the custodians. If unauthorised tokens reached a custodian’s pooled wallet before trading was halted, the issuer may decline to redeem that quantity. The question is who bears the consequence.

At the level of the issuer, EFRI’s starting point is the client’s entitlement, rather than the address in which tokens happen to be pooled. Where the client is a holder for Article 49 purposes, a wallet-level discrepancy does not by itself explain why that client’s redemption claim should be reduced. StablR’s statement that properly issued tokens remain fully backed makes documented pre-incident positions particularly relevant. It must explain how such positions will be recognised and what legal basis it would invoke for reducing them.

At the level of the custodian, Article 75(2) requires individual position records, Article 75(4) addresses facilitation of attached rights, and Article 75(7) requires segregation from the provider’s own estate. Bit2Me’s terms likewise say that client ownership and the exact position are determined by its internal register. A later inflow of irregular units credited elsewhere does not, by itself, explain a reduction of an existing entitlement. Pooling is a technical arrangement; EFRI does not accept that it is sufficient justification for making existing clients absorb a loss. The rights of good-faith acquirers of unauthorised units require their own examination and cannot be resolved merely by labelling those units invalid.

Where the custodian’s acceptance, crediting, pooling or later use of irregular tokens caused a loss to existing positions, Article 75(8) becomes central. Liability requires an attributable incident and the relevant loss; it cannot simply be assumed from the presence of irregular tokens. If those conditions are established, EFRI considers that the client’s claim should not depend on the custodian first completing its recourse against the issuer. An issuer-side failure and a separate custody failure can coexist. How the responsible institutions ultimately divide the cost is a matter for them to resolve.

The argument has limits. Article 75 does not make the custodian a guarantor of every risk on the issuer’s side: where a shortfall is attributable solely to the issuer, without any additional failure by the custodian, Article 75(8) does not apply. Nor does a temporary suspension of redemption, by itself, establish a compensable loss.

Bit2Me’s general terms, clause 13.2.1, also contain the counter-argument: an omnibus shortfall may have to be distributed pro rata, expressly without prejudice to Bit2Me’s liability under clause 14 and applicable law. Clause 14.3 refers to intentional misconduct or gross negligence. The currently published version states an effective date of 17 July 2026, after the incident; this does not prove when the relevant wording first appeared. The questions are which terms actually governed the position, whether they were validly incorporated, whether they permit the allocation proposed, and whether any liability restriction is compatible with Article 75(8).

The decisive question remains concrete: on what legal and factual basis may a custodian pass the consequences of irregular tokens received into its infrastructure onto other clients? The issuer and custodian should reconcile the relevant inflows, client credits and rights. Public blockchain data can establish movements between addresses, but client attribution also requires the custodian’s internal records. The client should not be required to identify uniquely numbered token units inside a pooled wallet.

4. Tokens placed in Earn

Bit2Me Earn creates a different relationship where the applicable agreement transfers ownership to a borrower. The current lending terms, last updated 30 June 2026, name Bitcoinforme, S.L., provide for transfer of ownership and leave the client with a credit claim for an equivalent quantity of the same type of crypto-asset. Earlier terms named Devteam Ireland Ltd. The current agreement expressly disclaims an automatic assumption of obligations from previous services, so the agreement and counterparty governing an earlier position must be established.

If ownership was validly transferred, the customer’s principal repayment claim is against the borrower and the ordinary custody analysis cannot simply be carried over to the loaned assets. In EFRI’s view, a borrower should explain how it can fulfil its same-type-and-quantity obligation where deployed assets were affected by unauthorised issuance; an issuer-side incident does not itself determine that contractual question. Calling the arrangement lending also does not answer every regulatory question: Article 50 MiCAR prohibits interest by issuers and by CASPs when providing services related to e-money tokens. Its application requires examination of the actual activity.

The current Earn terms provide an estimated repayment period of one to five business days, with stated extensions and exceptional suspension provisions. Their applicability and conditions must be checked. Bit2Me’s EURR and USDR FAQ now says that no new EMT contributions to Earn are accepted and that existing positions may be moved to Wallet, although external operations remain blocked. It also states that no custodial units have been lost or stolen. These are Bit2Me’s representations, not an independent finding that all obligations have been fulfilled.

The issuer’s case

StablR’s position deserves to be stated at its strongest.

Suspension is a lawful recovery tool. Article 55 MiCAR applies the recovery framework to e-money-token issuers. Article 46(1)(c) expressly lists suspension of redemptions among the available options. The legal question is therefore whether the continuing measure is justified in its actual circumstances.

Equal treatment. Paying individual holders at par while the issuer has not yet separated validly issued from unauthorised tokens risks paying out reserve assets against tokens that were never backed, to the detriment of all other holders.

The supervisor is involved. The MFSA has been notified, and Article 46(4) gives the competent authority power to suspend redemption temporarily where justified by holders’ interests and financial stability. Supervisory involvement is relevant, but does not remove the need to examine the basis, duration and effects of the suspension.

These arguments carry weight. They do not, however, answer three points.

Duration. A recovery measure is, by its nature, temporary and directed at restoring compliance. Five months after the incident, the issuer has published no timetable, no conditions for resumption and no criteria for identifying validly issued tokens.

Proportionality. StablR states that the reserve assets for properly issued tokens are intact. That makes verifiable pre-incident holdings a central issue. EFRI considers that StablR should explain why such holdings cannot be confirmed and whether partial reopening would be feasible. The ability to identify an earlier client position is important evidence, although it does not by itself settle every question of entitlement or reserve allocation.

The redemption-plan question. Under Articles 55 and 47 MiCAR, orderly redemption follows a determination by the competent authority that the issuer is unable or likely to be unable to fulfil its obligations. Five months of suspension is not an automatic statutory trigger. It is, however, a strong reason for the MFSA to explain its assessment of continued recovery and the alternative of orderly redemption. A recovery process that delivers neither access nor a timetable requires more than repeated assurances.

The OAFS is the route StablR itself points to

Jurisdiction over the issuer. The Arbiter for Financial Services Act, Cap. 555, covers financial services providers within its statutory definition, including MFSA-authorised providers. StablR’s own referral makes this route directly relevant. It is for the Arbiter to determine whether a particular complaint meets the jurisdictional and admissibility requirements.

Access without a direct contract. Article 2 includes customers who have sought provision of a financial service, as well as other eligibility categories. EFRI considers that a holder seeking statutory redemption has a substantial argument for access even where tokens were acquired through an intermediary. That argument is not an admissibility ruling. Customer status and, for businesses, the statutory micro-enterprise conditions still require examination.

The supervisor does not replace redress. Supervisory consideration of the incident and an individual claim for redemption or compensation serve different purposes. Referring to the MFSA’s involvement does not answer the holder’s claim against the issuer, just as referring the holder to the OAFS does not establish that the issuer has fulfilled its obligations.

The Arbiter’s task. Article 19(3) requires independent and impartial adjudication by reference to what is fair, equitable and reasonable, with due regard to relevant law. In this dispute, that means examining the interaction of the redemption right, the recovery measures and the evidence concerning the treatment of holdings. Those questions require a reasoned answer.

Cost, scale and transparency. The OAFS currently charges no complaint fee. Article 21(3)(a) limits monetary compensation to EUR 250,000 per claimant for claims arising from the same conduct, with additional interest and costs permitted. The Act also provides for consideration of intrinsically similar complaints together and for appeal. The availability of a procedure is not a guarantee of recovery.

The limits

The forum has real constraints, and holders should know them before filing.

• Larger businesses are excluded. Companies above the statutory size thresholds must go to court.
• The prior complaint is mandatory. The holder must first put the substance of the complaint to StablR and give it a reasonable opportunity to respond. Under Article 21A, the final written reply is normally due within 15 working days; exceptional circumstances beyond the provider’s control require reasons and an indication of timing, with a final reply within 35 working days. A general statement that complaints remain open needs to be assessed against those requirements.
• Time limit. The complaint must be registered in writing with the provider within two years of the day on which the holder first had knowledge of the matters complained of.
• The fraud-victim extension is a separate route. Since 1 October 2025, Cap. 555 includes a specific extension for victims of suspicious fraudulent payment transactions who meet its conditions. A frozen token balance alone does not establish that this extension applies; the ordinary eligibility analysis should not be bypassed.
• Insolvency creates practical risks. The OAFS reported closing 65 cases concerning one provider placed into liquidation. This illustrates a risk to effective redress; it does not establish that every insolvency automatically ends every complaint.
• The custodial relationship remains separate. An award against StablR does not, by itself, resolve a dispute over a custodian’s records, restrictions or liability. The relevant custodian’s conduct may require its own complaint and legal assessment.

What holders can do now

1. Request redemption in writing from StablR, citing Article 49(4) MiCAR, stating the quantity held, the custodian, and the date of the last movement before 24 May 2026. Keep the reply.
2. Allow StablR a reasonable opportunity to respond, then, if eligible, lodge a complaint with the OAFS, attaching the redemption request and StablR’s reply.
3. Complain to the custodian under Article 71 MiCAR, asking it to confirm the position as recorded in its register and that it is unencumbered; to state whether any part of the holding was placed in Earn on 24 May 2026; to state whether its wallets received tokens from addresses linked to the unauthorised issuance between the first unauthorised minting and the suspension of deposits; to state on what legal basis any shortfall would be allocated to clients whose holdings pre-date the incident, and whether it relies on clause 13.2.1 of its terms in the version effective from 17 July 2026; to commit to cooperating in redemption; and to state the basis for the current withdrawal block. If the reply is unsatisfactory, escalate to the custodian’s home-state authority. Bit2Me is authorised as a crypto-asset service provider by the Spanish CNMV.
4. If tokens were placed in Earn, identify the applicable borrower and contract, request repayment in writing and retain the response. The complaint route depends on the actual service and agreement; a lending label does not settle the treatment of related regulated activities, and consumer-law protections depend on the customer’s status.

Our Assessment

The StablR case exposes a practical weakness in the protection promised to e-money-token holders. The redemption right, recovery framework and custody arrangements can leave the customer dependent on institutions that each point to another participant. Five months on, the published information still gives holders no date for access to their money and no published criteria explaining how their positions will be assessed.

StablR itself points dissatisfied holders to the OAFS. EFRI does not share an assumption that this referral guarantees effective redress. We have already criticised the Arbiter’s treatment of provider failures and fraud victims in the OpenPayd cases. Those disputes do not decide the StablR claims, but they explain our scepticism. The test here is whether the Arbiter examines the substance of the issuer’s obligations and gives a reasoned answer on the continued suspension, rather than treating supervisory involvement as sufficient reassurance.

The intermediary remains the pressure point. The custodian holds the keys and the client records needed to turn a redemption entitlement into payment. EFRI’s position is that losses arising from issuer-side control failures and attributable custody failures should be addressed by the responsible institutions, including through recourse between them. An omnibus wallet is not, by itself, a legal justification for passing an unexplained deficit to customers. Custodians should state how they will treat irregular inflows, existing client positions and Earn liabilities, and identify the actual contractual and legal basis for any proposed reduction.

Verification through custodians should produce a reconciled account of affected holdings, with clear criteria and an operational timetable. EFRI calls on StablR and the custodians to complete that work, and on the MFSA and ESMA to address the respective issuer and custody responsibilities. Holders have waited long enough to be told when, on what basis, and by whom they will be paid.