Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Ratings apply to this deployment only. Treat them as unverified for other chains. Why this deployment: The only card program tied to a contract is the Fiat24-issued "Bitget Wallet Card (Fiat24)" (Mainland China; closed to new signups, existing cards active). Onchain, Fiat24Account.walletProviderMap(8088) = "Bitget", and Bitget-referred accounts (e.g. #119154) are debited by Fiat24CardAuthorization 0xe2e3B88B... at Arbitrum block 512546136. Excluded: the other regional programs (EEA/UK, LatAm, APAC, South Asia), whose issuers and funding contracts are not disclosed.
Offered only in the countries listed. Checked 2026-10-09. Not scored.
Scoped to the Fiat24-issued programme this file assesses, which Bitget's help centre files under Mainland China. The documents disagree: the card page FAQ still lists "mainland China" among regions where the card is currently available, but help article 802 says users in Mainland China can no longer apply for a new card (existing users unaffected). Taking the more restrictive reading, this programme serves existing Mainland China cardholders only and is closed to new applicants. Fiat24's own coverage list (info.fiat24.com/api/fiat24/getCountries, checked 2026-10-09) does not include CN as an eligible domicile, which is consistent with the closure. Bitget's other regional programmes (EEA and UK; ten Latin American countries; APAC; South Africa; Pakistan and Bangladesh, per the card page) use different issuers that this file does not assess, so they are not listed.
Conversion. The token is converted into a fiat balance at top-up; card spend comes from that fiat balance.
Platform token. Issued by the provider or its own ecosystem. Its value and liquidity depend on that provider, which may also control supply.
Bitget Wallet Card's Mainland China program (the one scored here) is Fiat24's Mastercard, which spends Fiat24 cash tokens on Arbitrum: USD24, EUR24, CHF24 and CNH24 (RMB). They are tokenised deposits issued by SR Saphirstein AG (Fiat24), the card issuer, backed one-to-one by cash deposits; transfers are gated by Fiat24's KYC status and sanctions checks, so they are classed as platform tokens rather than freely circulating stablecoins. Crypto becomes fiat at top-up: the wallet swaps the user's asset into Arbitrum USDC and Fiat24's top-up contract converts it into a cash token. At spend, Fiat24's card-authorisation contract debits the balance in the transaction currency if Direct Pay is on for it; otherwise it converts from the user-selected default card currency. No default is fixed by Fiat24.
Checked 2026-10-12
Evidence (4)1 verified · 3 documented
Verified
Fiat24CardAuthorization validXXX24Tokens() returns true for USD24, CHF24, EUR24 and CNH24 (EUR24 check shown).
Fiat24's developer guide names the four cash tokens, their issuer and their deposit backing, and lists all four as supported for the debit card on Arbitrum.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Documented
Spending rules; the matching currency balance is charged first (Direct Pay), otherwise the user's chosen default card currency is converted and debited.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 1 of 5 Partial or better
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Neutral settlement, disclosed filtering reaching Weak: Edge filtering is disclosed in docs only, or the neutrality of the settlement layer cannot be shown from code.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
A single EOA holds the admin and operator roles on the card authorizer and the cash tokens. It can pause card authorizations or all transfers of a currency, and Fiat24 operators can set an individual account to Soft- or Hard-Blocked, which the token contract enforces on every transfer. The terms allow card blocks and account suspension without notice. EOA-held role that can target individual accounts with no notice, so 0.
Evidence (5)3 verified · 2 documented
Verified
EUR24 hasRole(OPERATOR_ROLE, 0x1272c99bEFa7a70f935Edca81BF9a6E85C6D9D59) = true; that address is an EOA (no code, nonce 1350) and also holds DEFAULT_ADMIN_ROLE, which can pause() the token. In the Sourcify-verified Fiat24Token source, transfers require the Fiat24Account status to be Live, and an operator can sendToSundry() any holder's balance.
Fiat24CardAuthorization hasRole(DEFAULT_ADMIN_ROLE, 0x1272...9D59) = true and the same EOA holds OPERATOR_ROLE, which can pause() every card authorization; paused() = false at this block.
Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Card settlement is a pull executed only by Fiat24's authorizer key after the card network authorizes the payment. Neither the cardholder nor the merchant can settle a card payment by calling the contract. Plain token transfers between Fiat24 accounts are a separate P2P feature, not card settlement.
Evidence (2)2 verified
Verified
authorize(), increment(), advice() and reverse() in the verified Fiat24CardAuthorizationMarqeta implementation each revert unless msg.sender has AUTHORIZER_ROLE; hasRole(AUTHORIZER_ROLE, 0xec659e857089E301C87965ED4839B74Ea835755a) = true, and that address is an EOA with nonce 7130096.
Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Every card payment needs Fiat24's closed authorization service and key, Marqeta processing and Mastercard. None is public, and there is no fallback operator. Closed and single-vendor, so 0.
Evidence (3)1 verified · 2 documented
Verified
The only observed caller of authorize() is this EOA (nonce 7130096), Fiat24's card authorizer; no code for the service that drives it is public.
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
Bitget's help centre names this program "Bitget Wallet Card (Fiat24)"; article 802 says Mainland China signups are closed and existing users are not affected. Both pages are client-rendered, so their text is archived.
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Address filtering sits inside the settlement layer itself: the cash tokens check an onchain sanctions oracle and the account's KYC status on every transfer, including the card pull. Judgment call: the check is visible in Sourcify-verified source, but no Fiat24 or Bitget document discloses contract-level screening or its list source, so this takes the lower anchor, 0, rather than 1.
Evidence (2)1 verified · 1 documented
Verified
EUR24 sanctionCheck() = true and sanctionContract() = 0x40C57923924B5c5c5455c48D93317139ADDaC8fb (Sourcify-verified SanctionsList); the verified tokenTransferAllowed() reverts any transfer to or from a listed address and requires Live account status for the sender.
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The four cash tokens are enumerated in the contract and in Fiat24's developer docs. Bitget's card pages do not tell cardholders about the issuer's operator powers, the sanctions oracle or Arbitrum's sequencer. Enumerated in code, assumptions not stated, so 2.
Evidence (2)1 verified · 1 documented
Verified
validXXX24Tokens() returns true for USD24 0xbE00f3db..., CHF24 0xd41F1f0c..., EUR24 0x2c5d06f5... and CNH24 0x7288Ac74...; these are the card's settlement currencies.
Fiat24's developer guide lists the cash-token addresses on Arbitrum and Mantle; neither it nor Bitget's card pages state the issuer's freeze powers or Arbitrum sequencer assumptions to cardholders.
Does the deployed bytecode match public source, and can a third party rebuild it? O1
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The settlement contracts are verified on Sourcify, mostly as partial (metadata) matches; CHF24 is a partial match and the CNH24 proxy is not on Sourcify. No public repository or build script reproduces the bytecode. Partial match without a build script, so 2.
Evidence (1)1 verified
Verified
Sourcify: card authorizer proxy exact_match, implementation 0x96AA3D05... match (partial); EUR24 and USD24 proxies and implementations (0x7aFe16b7..., 0x98BEC5F5...) match (partial); Fiat24Account proxy exact_match, implementation 0x78726B1e... match; ProxyAdmin 0x50873C85... match. Implementation slots read at the pinned block.
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Only the contracts are public (through Sourcify). The Bitget card screens, Fiat24's backend, the authorizer and the API are closed, and no SDK is published. Contracts only, so 1.
Evidence (2)2 verified
Verified
The bitgetwallet org's 12 repos are swap, bridge, staking and trading-API SDKs (this one is the Go client for Bitget Wallet's trading APIs); none contains card code. GitHub users fiat24, Fiat24, fiat24-ag and fiat24ag return 404.
Are ABIs, event schemas, an API schema, and a payee data export in a non-proprietary format all in the repo? O4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Interfaces are documented on a hosted docs site, not versioned in a repo. No payee export format is specified. Documented only, so 1.
Evidence (1)1 documented
Documented
Fiat24's developer guide documents contract addresses and functions (approve, authorize flow, payouts, top-up) on a hosted docs site, with the API reference on a separate hosted page.
Does every repository needed to run the product carry an OSI-approved license? F1
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Required components (authorizer, backend, card processing, issuer) are closed, so F1 is 0. The verified contracts carry MIT SPDX headers, but they are not in any public repo.
Evidence (1)1 documented
Documented
Fiat24 grants users only a limited, non-transferable licence to its web app and API; the backend, authorizer and card processing have no published source.
Does a production deployment need a proprietary plugin or hosted-only service? F3
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The card cannot run without Fiat24's hosted authorizer, backend and card processor, none of which has an open alternative. Core cannot run without proprietary components, so 0.
Evidence (1)1 verified
Verified
Card debits only run through authorize() called by Fiat24's AUTHORIZER_ROLE key; the contracts alone cannot process a card payment.
Does the flow collect anything beyond addresses, amounts, token, and chain? P2
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Full KYC is required and disclosed in Fiat24's and Bitget Wallet's privacy policies; the legal basis (Swiss AML) is stated in the terms but not limited in code or a repo document. Disclosed in policy, so 1.
Evidence (2)2 documented
Documented
Fiat24 collects identity documents, contact data and transaction data for onboarding.
What do calldata and events reveal about who paid whom for what? P3
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Every card spend is public and linked to the cardholder's account number, address, card id and amount, though not to the merchant. The linkage is disclosed in the terms. Account tags in events, disclosed, so 1.
Evidence (2)1 verified · 1 documented
Verified
The Authorized event indexes the account number (#730612) and holder address, and logs the card id, currency and amount; the calldata also carries the transaction currency and amount. Fiat24 account numbers map to Swiss IBANs.
Which third parties see a request during a payment, and can they be swapped out? P4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Third parties in the card flow (Fiat24, Marqeta, Mastercard, the KYC vendor) are disclosed by category in Fiat24's policy, and none can be swapped. No trace was run. Docs only, so 1.
Evidence (1)1 documented
Documented
The policy discloses sharing with service providers (payment processing, customer service and others) and for KYC and AML compliance, by category; Marqeta appears only in the contract name, and the sanctions oracle is not mentioned.
Who holds funds between payer and payee, and can the provider redirect them? S1
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The card balance is a Fiat24 deposit represented by tokens in the user's address, not an asset the user controls: the issuer's operator EOA can move any balance, and card pulls land in Fiat24-held EOAs. "Self-custody" here means only that the wallet key signs; the provider can redirect funds, so 0.
Evidence (2)1 verified · 1 documented
Verified
In the verified Fiat24Token source, sendToSundry(from, amount) lets any OPERATOR_ROLE holder move a holder's balance to the sundry account
Who can change the contract code, and with how much notice? S2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Every settlement contract is upgradeable at once by a single EOA, with no timelock. EOA admin, so 0.
Evidence (2)2 verified
Verified
The EIP-1967 admin slot of the card authorizer, EUR24, USD24 and Fiat24Account proxies all hold ProxyAdmin 0x50873C85...; its owner() is EOA 0x1272c99bEFa7a70f935Edca81BF9a6E85C6D9D59. No timelock or Safe sits in between.
How large an allowance does the SDK ask users to grant, and for how long? S3
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Almost all Bitget cardholders on this program have an unlimited allowance to the authorizer, which only Fiat24's key can spend through. Neither Bitget nor Fiat24 discloses that. Judgment call: the app's default is inferred from onchain allowances, not from Bitget code (closed); 188 of 195 sampled accounts are unbounded, so "unbounded, undisclosed", 0.
Evidence (2)1 verified · 1 documented
Verified
USD24 allowance(0x03746aaDcD9472F6778CfF0Bd07C37C69E5F4187, card authorizer) = 2^256-1 for Bitget-referred account
If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Derived. S1 = 0 (operator can move balances), C2 = 0 (only Fiat24's key settles), C3 = 0 (closed single-vendor backend), O3 unknown. The balance is a deposit claim on Fiat24; turning it back into money needs Fiat24's payout operator, and even token transfers depend on Fiat24-set account status. Funds depend on provider liveness, so 0.
Evidence (1)1 verified
Verified
Cash-token transfers require a Live sender status set by Fiat24 operators, and cash payouts to a bank account need Fiat24's CASH_OPERATOR_ROLE to complete (cashPayoutOK).
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
? No evidence
Sets the pillar rating
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No checkable evidence settles this yet, so it counts as 0.
Security audits 3
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
Shared Fiat24 contracts, Mantle's fork: fee manager, Arbitrum and Tempo deposit paths via LayerZero, DelegationVault, batch double-booking in Fiat24CardAuthorizationMarqeta, BufferPool, CryptoRelay and Fiat24Token changes since ad90880. at 66f0ff1590 Reviews changes made in Mantle's private fork; the Arbitrum contracts this file scores do not contain them.
Shared Fiat24 contracts, Mantle's fork: new DelegationVault, double-booking in Fiat24CardAuthorizationMarqeta and Fiat24CryptoDeposit_Avax (changes since b670bb8). at ad908801e2 Reviews changes made in Mantle's private fork; the Arbitrum card authorizer has no double-booking functions.
No
1 medium and 1 low, both fixed; 5 recommendations, 3 notes
Shared Fiat24 contracts, Mantle's fork: Fiat24CryptoDeposit (and variants), Fiat24CardAuthorizationMarqeta (card authorize/increment/reverse), Fiat24CryptoRelay, FiatTokenBeacon and FiatTokenFactory. at 8fa9f76352 Same contract names and card functions (authorize, increment) as the Arbitrum implementation 0x96AA3D05..., but the audited private repository cannot be compared with the Arbitrum source, so whether the deployed card authorizer matches is unknown.
Unknown
1 high (fixed), 2 medium, 6 low, 6 recommendations, 7 notes; most medium and low confirmed rather than fixed
Compiled from: Bitget's card page and help centre (no audit mentioned), Fiat24's developer and legal docs (no audit or security page), GitHub (no public Fiat24 contracts repository; the Arbitrum sources are on Sourcify only), and auditor portfolios. The only published reports found are BlockSec's three audits of Mantle's fork of the Fiat24 contracts (private repository mantle-xyz/fiat24contracts, client Mantle), listed below as the closest shared code. None is stated to cover the Arbitrum deployment: the Arbitrum Fiat24CardAuthorizationMarqeta implementation 0x96AA3D05... was deployed at block 276754432 (November 2024) and lacks the double-booking functions the 2026 reports review. No report was found for Fiat24Account, the cash tokens' Arbitrum code or the ProxyAdmin set-up. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 14 evidenced, 0 attested, 0 absent, 0 not applicable, 31 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Fiat24 pricing for individuals (from 1 June 2024); the terms make the Pricing page part of the contract and say fees may change without notice.
card
payer
Low-value transaction fee 0.15 USD, EUR or CHF per card payment below 10 (CNH 1.00 below CNH 70)
Fiat24 price adjust plan, in force from 15 June 2026.
card
payer
Refund processing fee 1 USD, EUR or CHF (7 CNH) per card refund, capped at the refund amount
Fiat24 MasterCard Debit page, from 15 May 2026.
card
payer
No annual or monthly card fee
Bitget card page, stated for all regional programmes; Fiat24's card page lists no issuance fee.
fx
payer
Free between EUR24, USD24, CHF24 and CNH24 balances; card conversion rate not stated
Fiat24 Money Exchange page; the card debits the matching currency balance first ("Direct Pay"), else converts to the default card currency.
cashout
payer
Bank payout free; 10 EUR or 10 CHF if the payout is returned; minimum payout 100 EUR or 100 CHF
Fiat24 Cash Payout page.
limit
none
Card 10,000 EUR/day, 20,000 EUR/month (Standard); account 30,000 USD/30 days for new individuals
Fiat24 MasterCard Debit and Individual Account pages; higher card tiers for 3 and 4 digit NFTs.
network
payer
Arbitrum gas for approvals and top-ups
Fiat24 terms, fee schedule clause d; varies with network conditions.
Fees are Fiat24's, the issuer of this programme. Bitget's card FAQ says assetback 'typically covers most top-up and currency conversion fees' and that standard fees apply beyond the monthly allowance, without stating them; it does not say which programme that refers to. No card FX margin is published by Fiat24, so that component is unknown, not zero. Premium account NFTs cost 1,500 or 15,000 F24 to mint.
Documented
Fiat24 pricing for individuals, top-up fee by NFT length.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Evidenced
Provider-custodial
Agrees with S1 (score 0): the balance is a Fiat24 deposit claim represented by EUR24/USD24/CHF24/CNH24 tokens in the cardholder's address; Fiat24's operator EOA can move any balance with sendToSundry, transfers need a Fiat24-set Live status, and bank payouts need Fiat24's cash operator. Judgment call: recorded as provider_custodial rather than hybrid because the asset itself is a bank liability the issuer controls, not a token the user can exit with.
FinTech licence under Article 1b of the Swiss Banking Act Accepting public deposits up to the FinTech licence limits (no lending, no interest); issuer of the Fiat24 Mastercard debit card and the cash tokens.
FinTech licensees are supervised by FINMA directly for anti-money-laundering purposes, so no self-regulatory organisation membership was looked for. FINMA's register shows no licence number. The provider file's context notes that Swiss deposit protection does not apply to Fiat24 deposits. Bitget Wallet's own entities and any licences they hold were not looked up: Bitget is the referring wallet, not a party to the Fiat24 card contract.
Documented
FINMA register search for "Saphirstein" returns one entry, SR Saphirstein AG, Zürich, in the category of licensed persons under Article 1b BA (FinTech licence). The page is client-rendered, so the search API response is archived.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Cash-out options
Evidenced
Where
Method
Partner
Fee
Limits
everywhere offered
card spend
SR Saphirstein AG (Fiat24) as issuer, Mastercard
0.15 per payment below 10 in the card currency; refunds 1 USD/EUR/CHF or 7 CNH
10,000 EUR per day, 20,000 EUR per month (Standard tier); virtual card only, no PIN, so no ATM withdrawals
everywhere offered
bank transfer
SR Saphirstein AG (Fiat24)
Free; 10 EUR or 10 CHF if returned
EUR and CHF only; minimum 100; only to a bank account that has first deposited into the Fiat24 account; payee bank not in a restricted country
ALL means the availability list, which is CN (existing cardholders only). Whether Mainland China cardholders can use the EUR/CHF bank payout in practice depends on having deposited from an IBAN first, which the payout page says is required; no CNH payout is documented.
Documented
Fiat24 MasterCard Debit page, card format, limits and fees.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
First deployment
Evidenced
2024-11-12 (block 273715521): Fiat24CardAuthorization proxy 0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14 on Arbitrum One (card debits). The EUR24 cash token it debits dates from block 4699193 (2022-01-16).
The card authorizer is the settlement contract for card payments; Fiat24 docs announced the Mastercard debit card for December 2024. Bitget's referral of accounts (walletProviderMap 8088) has no deployment of its own.
Verified
The receipt of tx 0x53392365...57a7 (sender 0x1272...9D59, the Fiat24 admin EOA) has contractAddress 0xe2e3B88B...5b14 in block 273715521, timestamp 1731420531 (2024-11-12 14:08:51 UTC); Sourcify's creation data gives the same transaction and block.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Operating entity
Evidenced
SR Saphirstein AG (Fiat24), CH-ZH · CHE-256.014.995 · register
The cardholder contracts with SR Saphirstein AG under the Fiat24 account and card terms; Bitget Wallet is the referring wallet and is not a party to them.
Documented
Swiss UID register, SR Saphirstein AG (SR Saphirstein Ltd), Bellerivestrasse 245, 8008 Zürich, Aktiengesellschaft, commercial register status active, reference CH-020.3.046.001-4, last checked by the register 22.09.2026.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Unknown
Absence of a found incident is not evidence that none occurred.
Searched: Fiat24 user manual, developer docs and release notice, legal pages, status.fiat24.com (history is client-rendered and failed to load), Bitget help articles on this programme. No incident disclosure found; Fiat24 publishes no incident log and its contracts are not in a public repository with advisories.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Product changes affecting users
Evidenced
2025-02-01: Fiat24 API stops returning Visa card fields; cards are Mastercard only. source
2026-04-21: Current Fiat24 terms for users and clients take effect. source
2026-05-15: Card refund processing fee introduced (1 USD/EUR/CHF, 7 CNH; first charged 21 May 2026). source
2026-06-05: New individual clients capped at 30,000 USD per month, limit upgrades suspended. source
Undated changes not listed. Bitget help article 802 closes new Mainland China sign-ups for this programme, and Fiat24's individual account page says it is not accepting new individual clients "due to maintenance works"; neither gives a date. The contracts are upgradeable by one EOA (S2), and implementation changes were not enumerated.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Unknown
not computed on 2026-10-19: eth_getLogs: Too Many Requests
Spec checked against the Authorized log in tx 0x568b9d28...e21f (word 2 USD24 0xbE00f3db..., word 3 = 484, i.e. 4.84 USD). Not computed; the maintainer runs scripts/volumes.mjs.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown
No ISO 27001 statement found for SR Saphirstein AG in the Fiat24 user manual, developer docs, legal pages or fiat24.com, or for Bitget Wallet on its card and security technology pages.
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown
No hosting or support organisation certification found.
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Unknown
No SOC 2 or ISAE report or statement of availability found.
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Unknown
No audit of the Fiat24 contracts, backend or card authorizer found (CROPS S6 unknown). Bitget's security technology page cites CertiK and SlowMist audits of Bitget Swap and the NFT marketplace, not the card.
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Unknown
No penetration-test report or attestation found.
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Unknown implied from the component list
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Unknown implied from the component list
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Unknown implied from the component list
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Unknown implied from the component list
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Unknown
The Fiat24 terms, card terms and privacy policy oblige the client to report incidents to Fiat24 but contain no commitment by Fiat24 to notify clients of security or data incidents.
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown implied from the component list
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Unknown implied from the component list
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Evidenced
Status page at status.fiat24.com (uptime monitor with status update history); no post-mortem found. source 1
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Evidenced
Account access is by wallet signature from the address holding the Fiat24 account NFT (one factor, the wallet key); online card payments may require 3-D Secure with a one-time password sent by email. source 1 · source 2
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown implied from the component list
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown implied from the component list
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown implied from the component list
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Unknown implied from the component list
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Evidenced
A custom header with tokenid, network, a personal_sign signature by the NFT holder's wallet, the signed text and a deadline; no OAuth, OpenID Connect, SAML or JWT. source 1 CROPS C3
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Evidenced
Platforms (beta Authorized Access Model) call the same APIs with a header signed by the address holding the platform NFT, after the client authorises that NFT; there are no API keys, and rotation would mean moving the NFT. Server-to-server links between Fiat24, Marqeta and Bitget are not documented. source 1
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Evidenced
Signed request headers carry a deadline of at most 20 minutes; a card display token is valid for 5 minutes. source 1
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown implied from the component list
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Evidenced
The privacy policy states only "industry standard security measures"; no data classification, encryption at rest or TLS version is stated. source 1
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown implied from the component list
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
Fiat24 retains personal data as long as needed for the stated purposes and as required by law, with no fixed periods; deletion on termination is not stated. Balances and transactions are recorded on a public blockchain and cannot be deleted. source 1 CROPS P2 · CROPS P3
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
The privacy policy describes SR Saphirstein AG as the company that collects, uses, shares and stores users' personal information; it does not use the terms controller or processor or mention a DPIA. Bitget Wallet's own policy covers its app separately. source 1
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown implied from the component list
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown implied from the component list
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Unknown implied from the component list
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown implied from the component list
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Unknown implied from the component list
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Unknown implied from the component list
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Unknown implied from the component list
B9.3 Tests run in CI Do the CI workflows run the test suite?
Unknown implied from the component list
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
Unknown implied from the component list
B9.5 Versioned releases Are releases tagged with immutable semantic versions?
Unknown implied from the component list
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Unknown implied from the component list
B9.7 Changelog Is a changelog maintained with the code?
Unknown implied from the component list
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Unknown implied from the component list
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Evidenced
Fiat24's developer integration guide documents the logical and integration views (contracts, account NFT, cash tokens, card authorisation, API, onboarding); no infrastructure view. source 1 CROPS O4
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
SR Saphirstein AG (Fiat24), Zurich, Switzerland, CHE-256.014.995; terms under Swiss law with the ordinary courts of Zurich. Bitget Wallet is not a party to the card contract. source 1 · source 2
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Evidenced
Fiat24 charges per-use fees (crypto top-up percentage, card refund and low-value transaction fees, premium NFT mint fees); its price adjust plan cites rising operational and compliance costs. No annual report was found. source 1 · source 2
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
Fiat24 may close an account with two months' notice (immediately if the balance is zero) or without notice on breach, legal order or suspected crime; suspension is shown only as account status. The client may close the account in the dApp once all balances are zero; bank payouts need Fiat24's cash operator (S4). source 1 · source 2 CROPS S4
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Evidenced
Automated screening is in the payment path, the cash tokens check an onchain sanctions list on every transfer (C4) and the card system blocks cards on detected unusual activity; neither document says whether AI or a learned model is used. source 1 CROPS C4
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Evidenced
The only documented control is a user override, unblocking the card in the dApp (each block or unblock locks the status for 24 hours); monitoring, validation, decommissioning and bias evaluation are not documented. source 1
Scope of assessment
Components in the payment path
Component
Role
Public
Licence
Operator
Required
Fiat24CardAuthorization contract (debits the cardholder's cash tokens)
contracts
Yes
MIT
SR Saphirstein AG (Fiat24); admin EOA 0x1272...9D59
Yes
Fiat24 cash tokens EUR24, USD24, CHF24, CNH24 and Fiat24Account NFT
ledger
Yes
MIT
SR Saphirstein AG (Fiat24)
Yes
Fiat24 card authorizer key (sole AUTHORIZER_ROLE holder, an EOA)
signer
No
proprietary
SR Saphirstein AG (Fiat24)
Yes
Fiat24 backend and API (api.fiat24.com; KYC, status, payouts)
backend
No
proprietary
SR Saphirstein AG (Fiat24)
Yes
Marqeta card processing (named in the authorizer contract)
other
No
proprietary
Marqeta
Yes
Fiat24 (SR Saphirstein AG) as card issuer and account provider
card-issuer
No
proprietary
SR Saphirstein AG
Yes
Mastercard (card network)
card-network
No
proprietary
Mastercard
Yes
Fiat24 KYC and onboarding (vendor not named)
kyc
No
proprietary
SR Saphirstein AG (Fiat24)
Yes
Bitget Wallet app (Card tab, top-up, referrals)
frontend
No
proprietary
Bitget Wallet
No
Cardholder's Arbitrum address holding the account NFT and cash tokens
wallet
Yes
none
Cardholder
Yes
Repositories
None found. Absence of public code is itself a finding.
Bitget Wallet Card is a family of regional card programs; the card page says issuing partners vary by region, and Bitget names none on the page. Eligibility rests on the one program tied to verified contracts: the Fiat24-issued card for Mainland China (Bitget help articles 482 and 802, archived; new signups closed, existing cards unaffected). Onchain, Fiat24Account.walletProviderMap(8088) returns "Bitget", and Bitget-referred accounts were the largest group of card payers in the sampled window. Scores describe that program at Arbitrum block 512546136. The EEA/UK/LatAm cards top up a separate card balance that "the card provider" credits (help article 281, logged in docs/research/bitget-wallet-card.md; press reports name Immersve for the EEA/UK card, third-party claim); no contract or repo ties those programs to the product, so they are not scored. The "self-custody" framing is a claim: the Fiat24 balance is a deposit token Fiat24 can gate and move. Arbiscan returns 403 to scripted requests, so explorer links point to Blockscout and Sourcify. No browser trace was run.
