Stablecoin Regulation in 2026: Six Regimes Compared
Quick answer. The GENIUS Act takes effect January 18, 2027, MiCA and Hong Kong's regime already apply, and Singapore, the UK and Canada are still finalizing. All require full, segregated reserves; newer texts add key, freeze, audit and incident rules.
Video transcript
Stablecoin rules now mostly agree on the economics. Where the six regimes differ is technology: who holds the keys, who can freeze an address, and who audited the contract.
The US GENIUS Act takes effect in January 2027. MiCA has applied since 2024, Hong Kong licensed its first issuers in April, and Singapore, the UK and Canada are still finalizing.
In the US, the OCC's final rule requires checks that smart contracts operate as intended, independent testing, and private key management. Issuers must also be able to freeze and burn under lawful orders.
MiCA sets no issuer freeze duty. Its security demands come through DORA instead, with protection of cryptographic keys, major incident reporting and resilience testing.
Hong Kong goes furthest. No single party may perform high risk operations, significant keys sit in hardware security modules, and contracts need a third party audit at least yearly and on every upgrade.
What should issuers do now? Map which regimes apply. Inventory who can mint, freeze and upgrade on every chain. Harden keys, audit on every change, and reconcile supply against reserves daily.
Guardian has run more than fifty engagements on USDT0 since January 2025, plus twelve for Ethena, covering code, deployments, multisig and offchain infrastructure.
Read the full guide for the side by side requirements table, or talk to Guardian about one evidence pack for every regime.
Most stablecoin regimes now agree on the economics: one-to-one reserves, redemption at par, no interest.
They differ on technology: who holds the mint and upgrade keys, who can freeze an address, and who audited the contract.
This article explains the technical and security side of these six regimes. It is not legal advice; confirm how it applies to you with counsel.
Where Each Regime Stands
| Jurisdiction | Status on November 4, 2026 | Next date |
|---|---|---|
| United States | Law; OCC rule final; FDIC, NCUA, Federal Reserve and Treasury issuance rules proposed | Effective January 18, 2027 |
| European Union | MiCA stablecoin titles applying since June 30, 2024 | CASP legacy exposures cleared by January 8, 2027 |
| Hong Kong | Stablecoins Ordinance in force since August 1, 2025; two licensees | Licensing ongoing |
| Singapore | Policy final (2023); legislation proposed in P015-2026 | Subsidiary legislation and a Notice to come |
| United Kingdom | FCA rules made (PS26/10); Bank of England code in draft | Bank code by end-2026; FCA rules in force October 25, 2027 |
| Canada | Stablecoin Act passed, not in force; regulations proposed | Comments due December 23, 2026 |
United States: The GENIUS Act
The GENIUS Act makes it unlawful for anyone but a permitted payment stablecoin issuer to issue a payment stablecoin in the US.
- Reserves: at least one-to-one in cash, deposits, Treasuries of 93 days or less and similar assets.
- Custody: only supervised custodians may hold reserves or "the private keys used to issue permitted payment stablecoins".
- Technology: section 4(a)(4) directs regulators to set principles-based operational and IT risk standards.
- Freeze: the capability to comply with lawful orders to seize, freeze, burn or prevent transfer.
Our freeze requirements comparison covers that duty, and our post on GENIUS freeze mandates and the SEC's central party test what it means for decentralization.
The OCC's final rule requires a board-approved security program with independent testing, checks that smart contracts operate as intended, and private key management (12 CFR 15.13(b)).
The FDIC, NCUA and Federal Reserve rules are proposals, as is Treasury's issuance rule, which covers how exchanges assess foreign issuers.
See Is USDT GENIUS Act Compliant? and our foreign stablecoin due diligence checklist.
European Union: MiCA
MiCA splits stablecoins into e-money tokens (EMTs), which reference one official currency, and asset-referenced tokens (ARTs).
EMT issuers must be credit or electronic money institutions with a notified white paper (Article 48). They redeem at par at any time without a fee and pay no interest (Articles 49 and 50).
ART reserves must be segregated, independently audited every six months and held by a separate custodian (Articles 36 and 37).
For issuers and CASPs, DORA adds protection of cryptographic keys, major incident reporting and resilience testing (Articles 9(4)(d) and 19). Our post on whether smart contract audits count under DORA covers the testing side.
MiCA sets no issuer freeze duty. ESMA's 8 October 2026 opinion says CASPs should provide no services for non-MiCA compliant EMTs or ARTs (see our post on it).
Hong Kong and Singapore
Hong Kong
The Stablecoins Ordinance took effect on August 1, 2025, and the HKMA granted the first two licenses on April 10, 2026.
Hong Kong goes furthest on technology:
- no single party may perform high-risk token operations (paragraphs 6.5.2 to 6.5.4)
- certified hardware security modules, and air-gapped generation and storage for significant keys (6.5.7)
- a third-party contract audit at least yearly and on every deployment or upgrade (6.5.5)
- redemption within one business day
Singapore
MAS finalized its stablecoin framework on August 15, 2023. Consultation paper P015-2026 (closed October 16, 2026) proposes the Payment Services Act amendments to give it legal effect, and more.
That includes a trace, freeze and/or burn capability and stress testing at least quarterly.
The UK and Canada
United Kingdom
The FCA's PS26/10 sets final rules for non-systemic UK-issued qualifying stablecoins, in force October 25, 2027 (see our post on the UK's 2027 crypto deadlines).
Issuers must:
- back every coin from the point it is minted
- hold the backing pool on statutory trust, in accounts with third-party custodians
- reconcile at least once each business day
- redeem by the end of the next business day
Issuers that HM Treasury recognizes as systemic are also regulated by the Bank of England, whose Code of Practice is still in draft.
Canada
Canada's Stablecoin Act received royal assent in March 2026 and is not yet in force. The proposed Stablecoin Regulations, published October 24, 2026, take comments for 60 days, to December 23, 2026.
They would require Bank of Canada registration, reserves at a Canadian qualified custodian, redemption within three business days, and incident notices to the Bank.
The draft adds yearly policy reviews, and independent reviews of the risk management and data security policies every three years. Our Canada Stablecoin Act guide covers the detail.
Security Rules Compared
| Reserve custody | Key management | Freeze and burn | Audits and testing | Incident reporting | |
|---|---|---|---|---|---|
| US | Supervised custodians only, for reserves and issuing keys | Key management, backup and recovery (OCC) | Lawful orders; block, freeze and reject | Smart contracts validated; independent testing; monthly reserve examination | Customers and OCC told if accessed data, including private keys, may be misused |
| EU | Separate ART custodian; 30% of EMT funds at credit institutions | DORA protection of cryptographic keys | No issuer duty in MiCA | Six-monthly reserve audits (ARTs; e-money institutions' significant EMTs); DORA testing | DORA major ICT incident reporting |
| Hong Kong | Trust; licensed bank or acceptable custodian | HSMs, air-gapped significant keys, logs, tested recovery | Authorization levels, no single party; freezing on official requests | Contract audit at least yearly and on every upgrade; pentests | Timely notice to the HKMA; reserve breaches immediately |
| Singapore | Reserves at least par (proposed legislation) | Existing technology risk rules | Trace, freeze and/or burn (proposed) | Reserve audit; quarterly stress tests (proposed) | Existing technology risk rules |
| UK | Statutory trust; third-party custodian; daily reconciliation | CASS 17 (PS26/11) | Not addressed in PS26/10 | Daily reconciliations; Bank code pending | Operational resilience rules (PS26/13) |
| Canada | Canadian qualified custodian, bankruptcy remote (proposed) | Data security policy, reviewed every three years (proposed) | Not specified in the proposed regulations | Monthly accountant opinion; triennial policy reviews (proposed) | Notice of incident to the Bank of Canada |
On a multichain coin, every control applies per deployment. Our guide to multichain stablecoin deployment verification covers checking that they match.
What issuers should do now
- Map applicability. List each entity, coin and market against these regimes, noting law or proposal.
- Inventory privileged functions. Who can mint, burn, freeze, pause and upgrade, on every chain.
- Separate roles by risk. A fast, narrow freeze; slower, higher-threshold burns, role changes and upgrades.
- Harden keys. Hardware security modules, air-gapped significant keys, tested recovery, complete logs.
- Audit on every change. At least yearly and on every upgrade, bytecode matched to the audit.
- Rehearse incidents. Key loss, exploit and depeg, with each regulator's notice route.
- Reconcile daily. Supply on every chain against reserves, escalating gaps the same day.
For MiCA, DORA, NYDFS and VARA controls, see our crypto regulatory compliance guide.
How Guardian Helps
Guardian's Regulatory & Compliance assessments map your activities and markets to the regimes that reach them. Each provision is listed by citation, with the control and evidence that meet it.
Since January 2025, Guardian has run more than fifty engagements on USDT0, the omnichain deployment of USDT. They cover code, deployments, multisig and offchain infrastructure.
For Ethena, Guardian has run twelve engagements, including the onchain minting contracts behind xUSD, the timelock and the Safe execution guard.
Frequently Asked Questions
What is the main stablecoin regulation in the US?
The GENIUS Act, effective January 18, 2027, after which only permitted payment stablecoin issuers may issue payment stablecoins there. The OCC's rule is final; the FDIC, NCUA, Federal Reserve and Treasury issuance rules are proposals.
Do stablecoin regulations require a freeze function?
The GENIUS Act requires the capability to comply with lawful orders to seize, freeze, burn or prevent transfer. The HKMA governs freeze operations, Singapore has proposed trace, freeze and burn capability, and MiCA sets no issuer duty.
Which stablecoin regulators require smart contract audits?
The HKMA requires a third-party contract audit at least yearly and on every deployment or upgrade. The OCC requires validation that smart contracts operate as intended, plus periodic independent testing.
Sources
- GovInfo: Public Law 119-27, the GENIUS Act (July 18, 2025)
- Federal Register: OCC GENIUS Act final rule (October 23, 2026)
- Federal Register: Federal Reserve GENIUS Act proposed rule (September 29, 2026)
- Federal Register: FDIC GENIUS Act proposed rule (April 10, 2026)
- Federal Register: NCUA GENIUS Act proposed rule (May 18, 2026)
- Federal Register: Treasury issuance, offer and sale proposed rule (August 18, 2026)
- EUR-Lex: Regulation (EU) 2023/1114 (MiCA) (May 31, 2023)
- EUR-Lex: Regulation (EU) 2022/2554 (DORA) (December 14, 2022)
- ESMA: Opinion on non-MiCA-compliant ARTs and EMTs (8 October 2026)
- HKMA: Guideline on Supervision of Licensed Stablecoin Issuers (August 2025)
- HKMA: AML/CFT Guideline for Licensed Stablecoin Issuers (August 2025)
- HKMA: Granting of stablecoin issuer licences (April 10, 2026)
- MAS: MAS finalises stablecoin regulatory framework (August 15, 2023)
- MAS: Consultation Paper P015-2026 (September 1, 2026)
- FCA: PS26/10, Crypto Regime: Stablecoin issuance (June 2026)
- Bank of England: Sterling-denominated systemic stablecoins, policy statement and draft Code of Practice (June 22, 2026)
- Canada Gazette, Part I: Stablecoin Regulations, proposed (October 24, 2026)
- Guardian: USDT0 client story
- Guardian: Ethena client story
Meet every stablecoin regime with one evidence pack
Guardian maps your stablecoin's keys, roles, contracts and reserves to the GENIUS Act, MiCA, HKMA and MAS provisions they answer, and tests that each control holds.