Canada Stablecoin Act: Risk, Data Security and Incidents

Video transcript

Canada's Stablecoin Act makes non-bank issuers keep risk management and data security policies. New draft regulations say what they must contain.

The Act passed in March 2026 but is not yet in force. The draft regulations are open for comment and intended to take effect in fall 2027.

The risk policy must cover how you identify risks, detect incidents, detect data breaches, escalate for response and recovery, and keep the reserve at or above par.

Policies get a yearly review. Risk and data security policies also need an independent review every three years, by someone with no role in them.

Any incident, even one at a custodian, goes to the Bank of Canada without delay. That means detection has to work at any hour.

Your registration must describe your smart contracts. Design for minting tied to reserves, burns tied to redemption, privileged roles under quorum, a scoped pause, upgrade control and monitoring.

Neither review is a pentest by name. But a reviewer needs evidence that controls exist, so the practical input is testing.

Penalties reach ten million dollars for a very serious violation, such as failing to maintain adequate reserves.

Read the full article, or talk to Guardian about making your Stablecoin Act policies testable, alongside your counsel.

The Canada Stablecoin Act sets up a federal framework for fiat-backed stablecoins, administered by the Bank of Canada. It covers domestic and foreign issuers that are not financial institutions.

The Department of Finance has now published draft regulations. They turn the Act's policy duties into specific content, review cycles and reporting steps.

This article explains the technical and security side of the Act and the draft regulations. It is not legal advice; confirm how it applies to you with counsel.

Status and Scope

The Act received royal assent on March 26, 2026. It comes into force on a day fixed by order of the Governor in Council (section 97).

The proposed Stablecoin Regulations were published in the Canada Gazette, Part I on October 24, 2026, for 60 days of comment. They are intended to take effect with the Act in fall 2027.

An issuer already issuing the day before the Act takes effect can keep issuing if it applies for registration within 30 days. It must stop if it misses that window or is refused.

The Act applies to anyone who issues a stablecoin, meaning creating it and making it available for purchase, directly or indirectly, by a person in Canada.

The Act does not apply to:

• stablecoins with no actual or reasonably expected interprovincial or international applications (section 10)
• closed-loop stablecoins, financial institution issuers or central banks (sections 11 to 13)
• issuers exempted by the Bank of Canada's Governor under substantially similar provincial or foreign law (section 14)

The Required Policies

Sections 36 and 40 to 43 require five written policies. The draft regulations add content to each and common rules for all.

Each policy under sections 40 to 43 needs a responsible senior officer, resources, allocated roles, training and a plain-language summary.

Summaries are published in English and French, and full policies go to the Bank (sections 19 to 27).

Risk, Data Security and Reviews

Draft section 20(1) sets what the risk management policy must describe. That includes measures to:

• identify and manage internal and external risks linked to its stablecoin activities
• detect incidents and situations that could lead to non-compliance with the Act
• detect breaches of the confidentiality, integrity or availability of protected data
• report those breaches "to the appropriate level for response and recovery"
• keep the reserve at or above the par value of outstanding stablecoins

Draft section 21(1) sets the data security policy's objective: preserving "the integrity and confidentiality" of the issuer's systems and data, including distributed ledgers.

Yearly and independent reviews

Draft section 26 requires a yearly review of the four policies under sections 40 to 43, and before any significant change.

It must evaluate conformity and "the effectiveness of the policies at meeting their objectives".

Every three years, the risk management and data security policies also need an independent review (draft sections 20(3) and 21(3)).

The reviewer must be "a sufficiently skilled individual who has had no role in establishing, implementing or maintaining" the policy.

The issuer records the review and reports "any gaps and vulnerabilities" and the measures taken to the senior officer.

The independent review tests conformity with sections 41 and 42 and the regulations; the yearly review adds effectiveness.

Neither review is a pentest by name. But a reviewer cannot judge whether detection measures exist without evidence, so the practical input is testing.

That means a pentest of the issuance and redemption stack, a review of the token contracts and keys, and detection that has been exercised.

Incident Notices

The Act defines an incident broadly. It covers unplanned events that result, or could reasonably be expected to result, in the reduction, deterioration or breakdown of a stablecoin-related activity.

That includes activity performed by a third party, so an outage at a custodian or key provider can be the issuer's incident.

Under section 49, an issuer that becomes aware of an incident must notify the Bank "without delay". The Bank then notifies the Minister.

Draft section 30 sets the notice's content, including the incident's date, time and impacts, and requires an update after the response.

There is no hour count, so detection and escalation have to work at any hour.

Controls to Design For

Neither the Act nor the draft regulations mention mint functions or admin keys. But the registration application must describe the systems used, including "any smart contracts or computer code" for issuing or redemption (section 17(2)(c)).

The reserve must be worth at least par at the end of each day and sit with a qualified custodian (draft section 17, Act section 39).

Redemption must complete within three business days (draft section 15). Penalties reach $1,000,000 for a serious violation and $10,000,000 for a very serious one, such as failing to maintain adequate reserves.

Controls that make the policies true:

• Mint tied to reserves. Minting only after a confirmed reserve inflow, reconciled daily on every chain.
• Burn tied to redemption. A burn path that cannot be skipped when fiat is paid out.
• Privileged roles under quorum. Multisig or MPC thresholds on mint, burn, pause, freeze and upgrade.
• A scoped pause. One the incident team can use at any hour.
• Upgrade control. Timelocks or review gates, and deployment verification against the reviewed code.
• Monitoring. Alerts on mint, burn, role and upgrade events, and on supply diverging from reserves.

For how the same controls read elsewhere, see our stablecoin regulation guide, the Federal Reserve GENIUS Act proposal and multichain deployment verification.

How to Comment

The notice allows representations "within 60 days after the date of publication," which by our count runs to December 23, 2026.

It strongly encourages the online commenting feature on the Canada Gazette website. You can also email Gloria Wong, Director, Digital Assets, Department of Finance Canada (digitalcurrency-devisenumerique@fin.gc.ca).

Cite the Canada Gazette, Part I, and its date. All representations are published.

Technical points worth raising:

• whether the independent review should cover effectiveness as well as conformity
• whether the data security policy should name smart contract and key controls
• what "without delay" means for incidents that start at a third party

How Guardian Helps

Guardian's regulatory compliance practice assesses issuers provision by provision. It closes gaps in the order an application or examination reads them.

The evidence comes from our engagements: audits with fix review, role maps read from the deployed contracts, deployment verification, pentests with retest and incident exercises.

We are not a law firm; registration strategy and legal interpretation stay with your counsel, and we work alongside them.

Frequently Asked Questions

Is Canada's Stablecoin Act in force?

Not yet. It received royal assent on March 26, 2026, and comes into force on a day fixed by order of the Governor in Council. The government intends the Act and its regulations to take effect in fall 2027.

Who has to register under the Canada Stablecoin Act?

Anyone who creates a stablecoin and makes it available for purchase by persons in Canada, including foreign issuers, unless an exclusion or exemption applies. Financial institutions, central banks and closed-loop stablecoins are outside the Act.

How often must the policies be independently reviewed?

Under the draft regulations, the risk management and data security policies need an independent review at least once every three years. The reviewer must be sufficiently skilled and have had no role in the policy.

Sources

• Canada Gazette, Part I, Vol. 160, No. 43: Stablecoin Regulations, proposed, with Regulatory Impact Analysis Statement (October 24, 2026)
• Department of Finance Canada: Canada's Stablecoin Framework (March 31, 2026)
• Justice Laws: Budget 2025 Implementation Act, No. 1, S.C. 2026, c. 3, Division 45 of Part 5, Stablecoin Act (assented to March 26, 2026)