Crypto and Stablecoin Compliance in the US and Canada: What Your Team Needs to Know in 2026

Both countries have moved from "regulation by enforcement" to written rules for crypto businesses, and stablecoins now have their own federal statutes. If you operate, or plan to operate, on either side of the border, you have several regimes to satisfy at once.

This guide covers the main obligations, what is still in flux, and how to organize a compliance program around them.

Part 1: The United States

The US has no single crypto regulator. Your obligations depend on what you do (issue, exchange, custody, transmit) and where your customers are.

1. Federal AML/CFT: FinCEN and the Bank Secrecy Act

Most crypto businesses that exchange or transmit value for customers are treated as money services businesses (MSBs). That means:

• Registering with FinCEN as an MSB.
• Maintaining a written, risk-based AML program: designated compliance officer, internal controls, independent testing, and ongoing training.
• Customer identification and due diligence (KYC/CDD), with enhanced due diligence for higher-risk customers.
• Filing Suspicious Activity Reports (SARs) and Currency Transaction Reports where thresholds are met.
• Following the Travel Rule, which requires certain originator and beneficiary information to accompany transfers at or above $3,000.

2. Sanctions: OFAC

OFAC rules apply to every US person, and to many non-US businesses serving US users, regardless of size or license status. You need to screen customers and counterparties, and increasingly wallet addresses, against sanctions lists. You also need geo-blocking and blocking or reporting procedures for when there is a match. OFAC has treated weak sanctions controls as a serious violation on their own, even without intent.

3. State licensing

Federal registration does not replace state licensing. Most states require a money transmitter license (MTL), and some have crypto-specific regimes, most notably New York's BitLicense. Obtaining licenses across dozens of jurisdictions takes time and capital, and each state brings its own bonding, net worth, examination, and reporting requirements. Many companies launch through licensed partners while their own applications are pending.

4. Securities and commodities: SEC and CFTC

Whether a token is a security, a commodity, or neither remains fact-specific and still evolving. Businesses should expect that:

• Token offerings, staking or yield products, and certain trading venues may implicate securities laws.
• Spot and derivatives activity in commodity-type digital assets can bring CFTC anti-fraud and derivatives rules into play.
• Legislative and agency positions on market structure are still shifting, so classification needs to be reviewed regularly rather than decided once.

5. Tax reporting: IRS

US brokers of digital assets face customer tax-reporting obligations, including the new Form 1099-DA regime. Platforms should confirm what applies to their business model and build data collection, such as cost basis and taxpayer identification, into onboarding and transaction systems now.

Part 2: The GENIUS Act and US Stablecoins

The GENIUS Act, enacted July 18, 2025, created the first federal framework for payment stablecoins. Compliance teams should know the following.

Timing. The Act takes effect on the earlier of 18 months after enactment or 120 days after the primary federal regulators issue final implementing rules. Agencies are working through rulemaking. The OCC issued its proposed rule in February 2026, covering licensing applications, permitted activities, the ban on paying interest or yield, reserves, redemption, risk management, and capital. The FDIC followed with a proposal in April 2026 that would generally require redemption within two business days and clarify that reserve deposits are not insured to stablecoin holders on a pass-through basis. In August 2026, Treasury issued a proposal on issuance, offer, and sale, with comments due October 19, 2026. Because the rules are still being finalized, check current status before making binding decisions. GENIUS Act Regulations: Notice of Proposed Rulemaking | OCC +4

Core obligations for permitted payment stablecoin issuers:

• Full reserve backing with permitted high-quality assets, and limits on reusing (rehypothecating) reserves.
• Redemption rights for holders at par.
• No interest or yield paid by the issuer to holders.
• Monthly public disclosure of reserve composition. The disclosures must be examined by a registered public accounting firm and certified by the issuer's CEO and CFO. Eco
• BSA/AML and sanctions programs equivalent to those of financial institutions, including the technical ability to freeze or seize tokens under lawful order.
• Custody and risk-management standards, with federal or state chartering paths depending on the issuer's structure and size.

Practical takeaway: If you issue a stablecoin, you need to decide early whether to pursue a federal path, a state path, or a bank-partnership model. If you only distribute or integrate stablecoins, you should still map which issuers your products rely on and whether they will qualify as permitted issuers.

Part 3: Canada

1. FINTRAC registration and AML obligations

Businesses dealing in virtual currency, including exchanges, transfer services, and many custodial models, are regulated as money services businesses under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. Requirements include:

• Registering with FINTRAC before operating.
• A compliance program with a designated compliance officer, written policies, risk assessment, training, and a two-year effectiveness review.
• KYC and record-keeping, including identity verification and beneficial ownership information.
• Reporting: suspicious transaction reports, large virtual currency transaction reports (generally $10,000 or more received), and terrorist property reports.
• The Travel Rule for virtual currency transfers of $1,000 or more.

Foreign MSBs serving Canadian customers must register too, even without a physical presence in Canada.

2. Provincial securities regulation

Canadian securities regulators, coordinated through the Canadian Securities Administrators, treat many crypto trading platforms and token products as falling within securities or derivatives law. Platforms typically must register or obtain relief, and often agree to conditions on custody, disclosure, and investor limits. Marketing and product design (staking, lending, yield) are frequent enforcement and review topics. Requirements can differ by province, so confirm each market where you have users.

3. The Stablecoin Act

Canada's Stablecoin Act came through Bill C-15, which received Royal Assent on March 26, 2026, and puts stablecoin issuers under Bank of Canada supervision. Key points: Money.ca

• Not yet fully in force. The operative provisions come into force on a date fixed by Governor in Council order. Regulation development is expected to run 12 to 18 months from early 2026, with the framework anticipated to come into force in 2027. CryptoSlatecanada
• Core requirements. Issuers must register with the Bank of Canada, adopt and disclose specified policies and compliance frameworks, maintain a 1:1 reserve of highly liquid assets with a qualified custodian, and meet reporting and verification requirements. Stikeman Elliott
• Redemption and no yield. Holders get at-par redemption rights, and no interest or yield is paid on the coins. Facephi
• Reach. The Act covers fiat-backed stablecoins made available to Canadians, including those from foreign issuers. CryptoSlate
• Exclusions. Certain federally regulated financial institutions, central banks, and closed-loop tokens usable only within one platform are excluded. Lexology
• Layered oversight. Securities regulators continue to oversee trading platforms, and the Bank of Canada may supervise payment service providers that use prescribed fiat-backed stablecoins under the Retail Payment Activities Act. FINTRAC's AML rules continue to apply alongside all of this. CryptoSlate

Part 4: US vs. Canada at a Glance

Part 5: A Practical Compliance Roadmap

1. Map your activities. Are you an issuer, exchange, custodian, wallet, payments provider, or something else? Each maps to different licenses and rules.
2. Build a risk-based AML program that works in both countries. Design one core framework, then add jurisdiction-specific thresholds, reports, and record-keeping.
3. Implement the Travel Rule. Choose a technical solution that handles differing thresholds and counterparty due diligence.
4. Screen for sanctions continuously. Cover customers, counterparties, and on-chain addresses, and document your response process.
5. Plan the licensing timeline. State MTLs, provincial approvals, and issuer registrations take months or longer.
6. If you touch stablecoins, track both statutes. Monitor GENIUS Act final rules and Canadian draft regulations in the Canada Gazette.
7. Keep evidence. Regulators judge programs on documentation: risk assessments, test results, training records, and decisions on alerts.
8. Review regularly. Treat classification, product design, and marketing claims as ongoing reviews, not launch-day checkboxes.

Final Thoughts

The direction in both countries is clear. Regulators expect crypto and stablecoin businesses to operate with the same discipline as traditional financial institutions: full reserves, real AML controls, transparent reporting, and clear accountability. The details of US stablecoin rules and Canada's regulations are still being finalized, so the businesses that do best will be those that build flexible compliance programs and monitor regulatory changes rather than reacting to them. Complyone platform provides you the perfect guidance and help that required by fintechs and startups.

This article is for general information only and is not legal advice. Regulations change quickly; confirm current requirements with qualified counsel before making compliance decisions.