Stablecoin Due Diligence Checklist for Institutions

By the Guardian team Updated November 2026 6 min read

Quick answer. Check six things before integrating a stablecoin: the issuer's license, reserves and attestations, redemption terms, who can mint, freeze or upgrade it, its chains and bridges, and operations. Keep dated evidence for each, and recheck after upgrades.

Watch: Stablecoin Due Diligence Checklist for Institutions 1:43

Video transcript

A stablecoin is a claim on an issuer, carried by a contract the issuer can change. Your due diligence must cover both.

AML screening tells you who touched a coin. This checklist asks what can break the coin itself.

Check six things, from the issuer's license and reserves to redemption, contract controls, chains and operations. Keep dated evidence for each.

Concentration is a reserve risk. When Silicon Valley Bank closed in 2023, Circle said 3.3 billion dollars of USDC reserves remained there.

A peg holds because someone can redeem. Tether's direct redemption has a one hundred thousand dollar minimum, so test a small redemption first.

Next, who can change your coin? USDC splits its powers across six roles. Check whether one key, a multisig or a timelock holds each.

In March 2026, an attacker reached Resolv's signing key and minted about 80 million USR. The contract enforced no maximum mint, and USR fell as low as 20 cents.

One ticker can mean several contracts with different owners. Check each bridge route's verifiers, set your own alerts, and recheck after upgrades.

For disclosure, Guardian has run more than fifty engagements on USDT zero. On Polygon, its verification caught a migration plan that would have left USDT zero underbacked.

Guardian also pentests the apps, APIs and cloud around your integration. Read the full checklist, or talk to Guardian at guardian.security.

A stablecoin is a claim on an issuer, carried by a contract the issuer can change. Due diligence has to cover both.

AML screening tells you who touched a coin. This checklist covers what can break the coin itself: thin reserves, slow redemption, a stolen mint key or a weak bridge.

The GENIUS Act and the OCC's rule implementing it take effect on January 18, 2027. In the EU, MiCA's e-money token rules have applied since June 30, 2024.

This article explains the technical and security side of the GENIUS Act and MiCA. It is not legal advice; confirm how they apply to you with counsel.

Issuer and License

Start with who owes you the dollar.

Under the GENIUS Act, a permitted US issuer is a subsidiary of an insured depository institution, a federal qualified issuer or a state qualified issuer.

The state route covers issuers with up to $10 billion outstanding. Above that, a federal transition or a waiver applies.

In the EU, ESMA expected trading platforms to stop offering e-money tokens from issuers not authorized in the EU by the end of Q1 2025. Custody and transfer could continue.

Check:

The legal issuer on each chain. A bridged version may come from someone else.
Its license, regulator and register entry in each market you serve.
Holder rights in insolvency. GENIUS gives holders priority over other creditors for required reserves.

Reserves and Attestations

Next, what backs it. The GENIUS Act sets a floor for US issuers:

Reserves of at least 1 to 1, in US currency, insured deposits, Treasury bills of 93 days or less, certain repos and government money market funds.
No pledging, rehypothecation or reuse of reserves, with narrow exceptions.
Monthly reserve composition published online, examined by a registered public accounting firm and certified by the CEO and CFO.

Circle, for example, says most USDC reserves sit in the Circle Reserve Fund, a government money market fund managed by BlackRock. The rest is cash, "mostly among a handful of the world's largest banks".

Circle discloses holdings weekly, with monthly assurance from a Big Four firm under AICPA attestation standards.

Concentration is a reserve risk

On March 10, 2023, California regulators closed Silicon Valley Bank. Circle said $3.3 billion of about $40 billion in USDC reserves remained there.

USDC fell about 2% below its peg on some DeFi platforms, The Block reported that night.

Check:

The latest attestation: date, firm, standard and any qualification.
Named reserve custodians and banks, and the share held at each.
Onchain supply on every chain against reported circulation, on the same date.

Redemption

A peg holds because someone can redeem. Find out whether that someone is you.

GENIUS requires a public redemption policy with "clear and conspicuous procedures for timely redemption". Fees must be disclosed in plain language, with 7 days' notice before they change.

Direct access can carry a high bar. Tether's fee page sets a $100,000 minimum and a redemption fee of the greater of $1,000 or 0.1%. Tether keeps sole discretion to approve accounts.

Check:

Can you redeem with the issuer, or only through a venue?
Minimums, fees, cut-off times and the time to payout.
What happens to redemptions during a pause, a freeze or a bank holiday.
A small test redemption, before you depend on it.

Contract Controls

Then the contract: who can change your coin? Circle's USDC design splits the powers:

USDC role	What it can do
Master minter	Adds minters and sets their allowances
Minter	Mints within its allowance; burns only tokens it holds
Pauser	Stops transfers, mints and burns
Blacklister	Blocks transfers to or from an address, and its mints and burns
Owner	Reassigns every role except admin
Admin	Upgrades the implementation behind the proxy

A pause does not stop blacklist changes, role changes or upgrades, so Circle can fix what caused it.

Mint limits matter. On March 22, 2026, an attacker reached Resolv's privileged signing key in its AWS KMS environment and minted about 80 million USR.

The contract enforced no maximum mint, per Chainalysis. USR fell as low as $0.20.

Check, on every deployment:

Every privileged role, and whether a single key, multisig or timelock holds it.
Mint caps per minter and any onchain check of output against deposits.
What a freeze blocks: sending, receiving, permits and bridge paths.
Who can upgrade the code, and with how much notice.
Deployed bytecode matched against the audited source.

To test freeze, seize and burn paths step by step, use our GENIUS Act foreign issuer checklist. For the issuer's side of the design, see stablecoin security for issuers.

Chains and Bridges

One ticker can mean several contracts with different owners.

Under Circle's Bridged USDC Standard, a third-party team deploys the token and holds its roles. Circle has the option, not the obligation, to take it over, and bridged forms "are not issued by Circle".

Messaging layers add their own trust. LayerZero warns that a single DVN can "forge messages" never sent on the source chain, and recommends at least two independent DVNs.

Check:

Each deployment: native, bridged or omnichain, and who controls it.
The verifier set, rate limits and admin keys on every bridge route.
Whether a freeze on one chain follows coins to another.

Our multichain deployment verification guide has the chain-by-chain method.

Operational Resilience

Last, the people and systems behind the contract.

Incident history, with post-mortems and how fast the issuer paused or froze.
A SOC 2 Type 2 report, or equivalent, covering mint and key systems.
A contact that answers at any hour for freezes and lawful orders.
Your own alerts on role changes, upgrades, pauses and outsized mints.
Recheck triggers: an upgrade, a new chain, a license change or a qualified attestation.

For what each market requires of issuers, see our stablecoin regulation guide.

How Guardian Helps

Disclosure: since January 2025, Guardian has run more than fifty engagements on USDT0, the omnichain deployment of Tether's USDT.

Guardian's deployment verification matches proxies, implementations and admins byte-exact against audited source, checks roles, peers and DVNs, and runs fork tests on live state.

On Polygon in August 2025, that work caught a migration plan that would have left more USDT0 circulating than USDT backing it. It was fixed before the transactions ran.

For banks and fintechs, Guardian pentests the apps, APIs and cloud around a stablecoin integration. Risk Monitoring then watches what is deployed, who can change it and what drifted since review.

Frequently Asked Questions

What is stablecoin due diligence?

A review of a stablecoin before you hold, accept or list it. It covers the issuer and its license, reserves and attestations, redemption terms, contract controls, chains and bridges, and the issuer's operations, with dated evidence for each.

Is a reserve attestation the same as an audit of the stablecoin?

No. An attestation reports on the reserves backing the coin. It does not test the token contract, the keys that can mint it or the chains it runs on. Pair it with a contract review and onchain supply checks.

Who can freeze a stablecoin?

Whoever holds the freeze role in the contract. In USDC that is the blacklister, and the owner can reassign it. Check who holds it on each chain, and what a frozen address can still do.

How often should stablecoin due diligence be repeated?

On a schedule matched to your exposure, and on triggers: an upgrade, a role change, a new chain or bridge, a qualified attestation, a change of license or an incident.

Sources

Check a stablecoin before you integrate it

Guardian reviews the deployments, roles, bridges and upgrade paths behind a coin before you depend on it.

Talk to Guardian Explore Guardian for fintechs