The Canadian government's 60-day public consultation on draft stablecoin regulations, including a proposed ban on yield payments, signals a regulatory approach that could influence how global financial institutions handle these instruments. If you're a compliance officer at a fintech or bank dealing with stablecoins, you need a framework to evaluate your readiness now, not after the rules finalize.
This checklist guides you through core compliance steps for preparing for stablecoin regulation, using Canada's consultation as a reference point while building a framework applicable across jurisdictions.
What This Checklist Covers
You'll assess whether your institution has the controls, policies, and risk frameworks to handle stablecoins under emerging regulatory standards. This isn't about predicting every detail of Canada's final rules; it's about building the foundational compliance infrastructure that regulators globally are starting to demand for digital assets that function like traditional payment instruments.
Prerequisites
Before you start the checklist, confirm:
- Your institution currently holds, transfers, or facilitates customer transactions involving stablecoins (or plans to within 12 months).
- You have access to your AML/CFT policy documentation and transaction monitoring rule library.
- You can identify which business units handle stablecoin activity.
- You know which regulatory body supervises your stablecoin-related activities in each jurisdiction where you operate.
If you're still evaluating whether to offer stablecoin services, complete this checklist anyway. It'll surface the compliance build required before launch.
Compliance Checklist
1. Classification and Scope Documentation
Document which stablecoins your institution handles and how you've classified each one under your existing regulatory framework.
☐ You've created a register of every stablecoin your platform supports, including issuer name, reserve asset type (fiat-backed, commodity-backed, algorithmic), and whether customers can earn yield.
☐ You've mapped each stablecoin to its regulatory treatment: Is it a security? A payment instrument? A derivative? Your legal team has documented the classification rationale for each jurisdiction where you operate.
☐ If you offer yield on stablecoins, you've identified the legal mechanism (lending program, staking arrangement, liquidity provision) and documented which regulations apply.
Good looks like: A spreadsheet listing USDC, USDT, DAI, and any other stablecoins you touch, with columns for issuer, reserve type, yield status, and regulatory classification by country. Your legal memo explains why USDC is treated as a payment token in Canada but might be a security in another jurisdiction.
2. Yield Payment Controls
If Canada's ban on stablecoin yield becomes final and you operate there, you need the operational ability to disable yield by jurisdiction.
☐ Your platform can geofence yield features; you can turn off stablecoin interest payments for Canadian customers without affecting users in other countries.
☐ You've documented every revenue stream tied to stablecoin yield (customer interest paid, spread earned, staking rewards) and modeled the P&L impact of eliminating it in specific markets.
☐ Your customer communications plan addresses how you'll notify affected users if you must disable yield, including contractual obligations and potential customer remediation.
Good looks like: Your engineering team confirms they can deploy a jurisdiction-specific feature flag within two weeks. Your finance team has quantified that Canada represents 8% of stablecoin yield revenue, and you've drafted customer notification templates.
3. Customer Due Diligence for Stablecoin Transactions
Stablecoins move fast and across borders. Your CDD process must account for this.
☐ Your Customer Risk Rating methodology includes stablecoin-specific risk factors: transaction velocity, cross-chain transfers, interaction with decentralized protocols, exposure to mixing services.
☐ You collect and verify beneficial ownership information for any customer holding stablecoins above your institutional threshold (many firms use $10,000 as a trigger, but set yours based on risk appetite).
☐ Your enhanced due diligence procedures cover customers who frequently convert between stablecoins and fiat, or who move stablecoins to external wallets you can't monitor.
Good looks like: Your risk rating model assigns higher scores to customers making daily stablecoin transfers above $50,000 or interacting with non-custodial wallets. Your EDD questionnaire asks business customers to explain their stablecoin use case and expected transaction patterns.
4. Transaction Monitoring Rules
Your existing fiat monitoring rules won't catch stablecoin-specific typologies.
☐ You've deployed transaction monitoring rules that detect structuring across multiple stablecoins (a customer breaking a large transfer into smaller amounts across USDC, USDT, and DAI).
☐ Your rules flag rapid round-tripping between stablecoins and volatile crypto assets, which can indicate layering.
☐ You monitor for Travel Rule compliance gaps, stablecoin transfers to external addresses without originator/beneficiary information.
☐ Your sanctions screening runs in real-time on stablecoin wallet addresses, not just customer names, and you've integrated blockchain analytics to trace funds beyond your platform.
Good looks like: Your monitoring system alerts when a customer deposits $9,500 in USDC, converts to USDT, and withdraws, even though no single transaction hits your $10,000 reporting threshold. You've tuned thresholds based on actual stablecoin transaction patterns, not fiat defaults.
5. Reserve and Solvency Transparency
Regulators increasingly expect you to understand the stability of the stablecoins you offer.
☐ You've obtained and reviewed recent attestation reports for each stablecoin issuer's reserves (monthly at minimum).
☐ You've documented your process for monitoring issuer solvency and de-pegging events, including the threshold at which you'd suspend deposits or withdrawals.
☐ Your risk committee receives quarterly updates on stablecoin issuer financial health and reserve composition changes.
Good looks like: You have a folder with the last three months of reserve attestations for every stablecoin you support. Your policy states you'll halt new deposits if a stablecoin trades below $0.98 for more than 24 hours, and you've tested this circuit breaker.
6. Cross-Border Regulatory Mapping
Canada's approach will differ from the EU's Markets in Crypto-Assets Regulation (MiCA) and any future U.S. framework.
☐ You've identified every jurisdiction where you have stablecoin-active customers and documented the current regulatory status (proposed rules, final rules, or regulatory silence).
☐ You've built a matrix showing which requirements conflict across jurisdictions (for example: yield bans in Canada vs. permissible yield in another country) and how you'll handle conflicts operationally.
☐ You're monitoring the Canadian consultation and have assigned someone to submit comments or track the outcome.
Good looks like: Your compliance calendar flags the end of Canada's 60-day consultation period. Your matrix shows that MiCA requires stablecoin issuers to hold e-money licenses, while Canada's draft rules focus on payment service providers, and you've documented which license category you fall under in each region.
Common Mistakes
Treating all stablecoins identically. A fiat-backed stablecoin with audited reserves presents different risks than an algorithmic stablecoin. Your controls should reflect this.
Assuming your fiat AML/CFT Framework covers stablecoins. It doesn't. Blockchain-specific risks, like mixing services, cross-chain bridges, and DeFi protocol exposure, require purpose-built detection rules.
Waiting for final rules. By the time Canada's regulations are final, you'll be months behind. Build the compliance infrastructure now while you can still influence the rules through consultation.
Ignoring yield mechanics. If you offer stablecoin yield, document the exact legal and technical mechanism. "We pay interest" isn't sufficient, regulators want to know if you're lending customer assets, running a staking pool, or providing liquidity to a protocol.
Next Steps
If you checked fewer than 80% of the boxes above, prioritize the gaps in this order:
- Classification and scope documentation, you can't build controls without knowing what you're controlling.
- Transaction monitoring rules, this is where your AML/CFT exposure sits.
- Cross-border regulatory mapping, conflicting requirements will force operational trade-offs; identify them early.
Schedule a 30-day review to re-run this checklist after Canada's consultation closes. Regulatory clarity is coming, and your readiness timeline just shortened to 60 days, or less.
