The Alabama Securities Commission has ordered crypto lender Celsius to explain how it is not violating state securities laws. It has four weeks to comply.

In an order dated Sept. 16, the state regulator said it believes Celsius violated state laws through its “Earn Rewards” program. Texas and New Jersey state regulators announced similar findings on Friday, with New Jersey filing a cease-and-desist and Texas announcing it would hold a hearing in February to determine if a cease-and-desist should be ordered.

Celsius has 28 days to respond to the Alabama regulator and show cause why the regulator should not impose a cease-and-desist order. If the company does not respond, the regulator will assume Celsius is waiving its right to a hearing and immediately move to impose sanctions.

A Celsius spokesperson told CoinDesk via email:

Earlier Friday, CEO Alex Mashinsky said in an ask-me-anything that he looked forward to explaining the company’s business to regulators.

“They should be cheering for us as we’re effectively helping redistribute wealth and provide opportunity for everybody, not just the 1%,” he said on Friday.

Read more: Celsius CEO Eager to ‘Educate’ Securities Regulators in Brewing Legal Fight

Read the full order below:

UPDATE (Sept. 18, 3:21 UTC): Adds statement from Celsius.