Canada has built its crypto rulebook one layer at a time. The 2026 Stablecoin Act is the newest layer, adding further requirements to existing regulation.
Canada has spent a decade building one of the strictest compliance regimes for crypto in the world, one layer at a time. It brought virtual currency businesses into its anti-money-laundering law before most countries had taken a position at all. It put crypto trading platforms under securities oversight. It set custody standards. In March 2026 it added the newest layer: a federal framework for stablecoin issuers, supervised by the Bank of Canada.
If you run compliance for any crypto business touching Canada, whether you issue tokens, run an exchange, or move funds across borders, that pattern matters more than any single rule. Canada stacks its crypto rules. The latest in the stack is the Stablecoin Act.
How Canada got here
The Act did not arrive out of nowhere. It is the latest step in a steady tightening that has been running for years:
- 2020. The first phase of amendments to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) came into force on 1 June 2020, requiring businesses dealing in virtual currency to register with FINTRAC (the Financial Transactions and Reports Analysis Centre of Canada) as money services businesses. This brought virtual currency exchange and transfer services into the anti-money-laundering regime for the first time.
- 2021. A second phase came into force on 1 June 2021, adding the substantive virtual currency duties: know-your-client and recordkeeping obligations, large virtual currency transaction reports for transfers over CAD 10,000, and travel-rule records carrying sender and recipient details on transfers of CAD 1,000 or more. The same phase extended the full set of domestic money services business obligations to foreign money services businesses serving Canadians.
- 2023. The Canadian Securities Administrators confirmed that stablecoins, which it calls value-referenced crypto assets, may be securities or derivatives. Platforms could only continue offering them under set conditions, and issuers of fiat-backed coins had to give undertakings to regulators. This was Canada's first stablecoin-specific regime, delivered through securities law.
- February 2026. CIRO (the Canadian Investment Regulatory Organization) published its Digital Asset Custody Framework, setting tiered custody and operational-resilience expectations for registered trading platforms, stablecoins included.
- March 2026. Bill C-15 added the Stablecoin Act, the first federal prudential framework for stablecoin issuers, supervised by the Bank of Canada. A companion bill that received Royal Assent the same day raised anti-money-laundering penalties across the board, up to 40 times their previous maximums.
What the Stablecoin Act requires
Under the Act, an issuer offering stablecoins to people in Canada, domestic or foreign, has to meet a set of prudential requirements overseen by the Bank of Canada. In broad strokes, an issuer must:
- register with the Bank and appear in a public registry it maintains
- hold a 1:1 reserve of high-quality liquid assets in the reference currency, with a qualified custodian
- publish and honour a redemption policy that lets holders redeem at par
- maintain policies covering corporate governance, risk management, data protection, and recovery and resolution
- provide information to the Bank on an ongoing basis and when asked
The Act also bars issuers from paying yield or interest directly to holders, which is likely to reshape the digital-dollar savings products several platforms currently market.
These requirements are not live yet ; the Bank's supervisory mandate received Royal Assent on 26 March 2026, but the detailed requirements arrive through regulations still to be published, with the full framework not expected to bite until 2027.
Two different regulators at once
FINTRAC has already confirmed that stablecoin issuers will be required to register with it as money services businesses dealing in virtual currency, in addition to registering with the Bank of Canada. So an issuer serving Canadians is now answering to two supervisors at once:
- the Bank of Canada, on prudential grounds: reserves, redemption, governance, resolution
- FINTRAC, on anti-money-laundering grounds: client identification, recordkeeping, suspicious transaction reporting, large virtual currency transaction reporting, travel-rule records, and a written compliance programme
These are separate filings, separate examinations, and separate enforcement regimes. An issuer can be prudentially sound and still fail its FINTRAC obligations, or the reverse. The Act is additive. Your obligations as a virtual currency dealer stay exactly where they were.
And depending on what a firm does, the count climbs higher. A platform that lists stablecoins, custodies client assets, and moves payments can also sit under the CSA on the securities side and CIRO on custody. The Stablecoin Act did not create that patchwork. It added one more supervisor to a map that was already layered.
It reaches beyond Canadian-incorporated firms
The Act, and the anti-money-laundering regime beside it, both extend to foreign issuers. If a business is incorporated outside Canada but makes stablecoins available to persons in Canada, directly or indirectly, it is in scope. FINTRAC's foreign money services business rules carry the same registration, reporting, and client-identification requirements as they do for domestic firms. A Canadian-facing website, CAD settings, or Canadian payment options can be enough to bring an offshore issuer into the perimeter.
For platforms that list stablecoins rather than issue them, the issuance duties do not apply directly. But those platforms still carry their own full anti-money-laundering obligations, and they now have a new due-diligence question: is the stablecoin on our venue issued by a registered entity, and can we evidence that. Once the Bank's public registry exists, "we did not check" stops being a defensible position.
Previous penalties signal the seriousness of compliance failures
If the runway to 2027 tempts anyone to wait, the enforcement backdrop should change the calculation. The 2026 amendments raised FINTRAC's administrative monetary penalties sharply: a minor violation now tops out at CAD 40,000, up from 1,000; a serious violation at CAD 4 million, up from 100,000; a very serious violation at CAD 20 million, up from 500,000.
Through 2026, FINTRAC revoked more than 50 money services business registrations, with crypto businesses over-represented, for failures such as lapsed registration, no designated compliance officer, missing suspicious transaction reports, and generic written programmes that did not reflect the firm's actual activity. Revocation removes the legal right to operate, and operating without a valid registration is a criminal offence.
So the enforcement posture is already firm on the anti-money-laundering side that applies today, while the prudential side that applies tomorrow is being built - but both of these point in the same direction.
What this asks of your monitoring
Behind the multi-regulator structure, the demand is consistent: an issuer or platform touching stablecoins in Canada has to see its flows clearly, in near real time, and act on what it sees before funds move on.
- Being registered with FINTRAC and having a successful programme, are not the same. The revocated firms had indeed registered, but could not evidence a functioning monitoring and reporting process behind it.
- The reporting obligations assume you can detect. Suspicious transaction reports, large virtual currency transaction reports, and travel-rule records all presuppose you can identify the relevant activity as it happens, not on a quarterly look-back.
- The registry turns counterparty checks into a standing duty. Platforms will be expected to know whether the issuers behind the assets they list are registered, and to keep knowing as that status changes.
What to check now
A short readiness list while the detailed rules are still being written:
The framework is staggered by design. The AML obligations are current and enforced now. The prudential obligations are being drafted and will land through late 2026 into 2027. Firms that treat the gap as breathing room, rather than as preparation time, are the ones most likely to appear in the next revocation list.
Confirm your FINTRAC registration and the programme behind it can withstand an examination today. Map which of your products, and which counterparties, will fall under Bank of Canada supervision as the regulations firm up. And make sure the monitoring underneath both regimes is one capability, not two bolted together, because the two regulators will be reading the same flows from different angles.
It helps to put this in an international frame; The European Union's MiCA gives a firm licensed in one member state a passport across the bloc. The United States spreads authority across the SEC, the CFTC, FinCEN, and state regulators. Canada sits between the two, with no single licence and no single statute, but coordinated provincial securities law, federal AML rules, and now sector-specific stablecoin supervision all applying at the same time. For a firm used to a one-regulator jurisdiction, that is the real adjustment: not any single rule, but the number of supervisors reading the same activity from different angles.
Canada has built the most demanding compliance environment for crypto businesses in the G7, and it built it in layers. The Stablecoin Act is the newest one, not a replacement for what came before. Reading it that way, as an addition to a decade of regulation rather than a fresh start, is the difference between preparing for 2027 and reacting to it.
This is the gap we work on at Nominis: giving compliance teams one monitoring layer that serves both the prudential and the anti-money-laundering view of the same flows, screens counterparties against risk and registration signals, and surfaces activity in time to act before funds move. If it would help to see how firms in your position are approaching the multi-regulator picture, we are always glad to continue the conversation.
All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at [email protected].
.png)