Can a registrar hold a good standing domain hostage, and refuse to transfer it to another registrar?

That's the fear of many domain name owners. But many domain
registrar transfer failures occur due primarily to their own naivete
or their not understanding fully how the entire process works
down to the last detail.

There's at least one registrar out there that actually won't allow
the domain name to transfer away from them unless the transfer
contact on record confirms the request. While many would think
this is against ICANN transfer rules, the CEO of that registrar has
clarified it with ICANN first before going ahead when the transfer
rules finally took effect last November 12.

I'm sure some of you know who I'm referring to. But to the CEO's
credit, not one fraudulent transfer has occurred. (well, at least he
said not one has happened, yet...)

The important thing is to fully understand how your current one
operates, especially when about to transfer out. Of course, some
people may be paranoid enough to think that asking them about
it may "trigger" the current registrar to automatically lock the
domain name.

On the other hand, there's always the slightest chance that there
is a rouge registrar or two out there that may indeed "hold your
domain name hostage". If that's so, be damn sure to be ready,
able, and willing to prove such a thing occurred and complain to
ICANN about it.

I don't think they can hold a domain hostage, from what I experienced, we can stop the transfer and lock the domain up only after faxing to our registrar the evidence that they did not pay for the domain. Only the domain, the registrar will not care about hosting fees etc.

Did the registrar state that there is a specific problem?
Some common, perfectly legal, stumbling blocks:

Minimum 60 days between transfers, per ICANN

Domain locked: May require a two step process to first request and confirm unlock, and then to request the transfer.

Confirmation of authority to request the transfer or the unlock. Usually they send email to the whois-listed email address. If this is wrong or non-functional, process becomes highly difficult.