3rd November, 2026
By Cyrus Tong
By mid-2026, seven jurisdictions have each built a different definition of stablecoin legitimacy.
- The United States under the GENIUS Act.
- The European Union under MiCA and EMI (Electronic Money Institution) frameworks.
- The United Kingdom under the FCA and Bank of England’s dual-authority framework.
- Hong Kong under the HKMA’s Stablecoins Ordinance.
- Singapore under MAS’s finalised single-currency framework.
- Canada under Bill C-15’s Bank of Canada supervision.
- The UAE under not one but three separate regulatory authorities, depending on which currency the token references and which free zone the business sits in.
Seven jurisdictions.
Seven different reserve requirements.
Seven different redemption frameworks.
Seven different supervisory structures, and in most cases, no formal mutual recognition between any of them.
The compliance professional who approaches this landscape as a single unified problem to be solved will spend the rest of their career solving the wrong problem.
The one who understands that each jurisdiction requires its own regime assessment, and that the interaction between those regimes is where the most consequential compliance risk lives, is the one building infrastructure that will actually hold.
The Two Categories of Regulatory Risk
The most useful analytical distinction in assessing this landscape is the separation of settled regimes from those still being written, because each demands a fundamentally different compliance posture.
MiCA and EMI rules for issuers have been live and shaping the market.
The grandfathering window that allowed crypto service providers to operate under national law closed on July 1, 2026.
The EU compliance obligation is now monitoring and tracking evolving guidance and counterparty licensing status against a framework whose core architecture is established under MiCA and EMI.
Singapore’s MAS framework was finalised in 2023 and is widely regarded as the region’s most mature, even if adoption trails the regulation.
The United States, Canada, and the UAE sit in a different category entirely.
The GENIUS Act was signed in July 2025, but implementing rules are still being finalised ahead of the January 18, 2027 effective date.
Canada’s Bill C-15 received royal assent in March 2026, but substantive rules are not expected until 2027.
The UAE’s VARA was established in March 2022, the CBUAE’s Payment Token Services Regulation went live in August 2024, the ADGM regime became effective in January 2026, and the DIFC is not yet permitting issuance.
For compliance functions, this distinction determines the resourcing model.
Settled regimes require monitoring capability.
Regimes still being written require the flexibility to adapt as draft rule text changes before effective dates, and the judgment to begin building compliance infrastructure now rather than waiting for certainty that will not arrive until the deadline is imminent.
The UAE’s Three-Regulator Structure Is Not a Transition
The UAE deserves specific attention because its complexity is structural, not temporary.
Three regulators govern stablecoin activity in the UAE depending on what the token does and where the business sits.
- VARA covers foreign-currency tokens in Dubai outside the DIFC.
- The CBUAE covers dirham-pegged tokens under its Payment Token Services Regulation.
- The ADGM and DIFC run separate regimes entirely.
For any compliance function assessing the UAE, the first step is not reserve composition analysis or redemption rights assessment.
It is identifying which of the three regulators applies to the specific token and business structure in question.
Skipping that step means every subsequent compliance analysis is built on an incorrect foundation.
This is not a transitional complexity that will resolve as the market matures.
It reflects the UAE’s federal and free-zone regulatory architecture, which means it is the permanent operating environment for any institution with UAE stablecoin exposure.
The Same Stablecoin Is Three Different Compliance Problems
This analysis offers a practical illustration that every compliance function with multi-jurisdiction stablecoin exposure should internalise.
Consider a treasury team holding one stablecoin relationship across US, EU, and Canadian entities simultaneously.
- In the US, holders will have a statutory redemption right once GENIUS Act implementing rules are finalised.
- In the EU, Circle’s French Electronic Money Institution (EMI) licence already gives EU holders redemption rights governed by MiCA and EMI regulations, backed by a separate EU-domiciled reserve pool.
- In Canada, no equivalent statutory claim yet exists.
Same brand. Same token name. Three materially different levels of legal recourse for the holder.
That EU reserve pool sits apart from the US pool by design.
Circle operates jurisdiction-specific entities rather than one global token, which limits contagion between regimes but also means that a stress event in one region cannot draw on another’s reserves.
The ESRB has recommended the EU restrict multi-issuer schemes on exactly this concentration risk basis.
The compliance implication is precise: knowing that a stablecoin is compliant in one jurisdiction tells you almost nothing about whether it offers equivalent protections in another.
Compliance functions must assess each jurisdiction independently, and cannot assume that a recognised brand carries regulatory equivalence across markets.
Redemption Fails at the Bank, Not the Regulator
The most operationally significant insight is also the one most frequently overlooked in regulatory compliance discussions.
Regulatory approval is necessary but insufficient.
A stablecoin’s fiat redemption leg runs through specific commercial bank partners, and most issuers restrict that banking access to approved distributors and institutional customers.
Understanding which banks an issuer uses, which payment rails apply per market (wire, ACH, SEPA, or local equivalent) and what cutoffs govern each redemption leg is the operational compliance work that determines whether regulatory rights can actually be exercised.
In practice, redemption doesn’t break at the regulator.
It breaks at the bank.
My Take
I have spent over two decades building compliance frameworks across the specific jurisdictions this analysis covers: Hong Kong, Singapore, the UAE, the UK, and multiple engagement points with the US regulatory framework.
And what strikes me most about this landscape is what it makes visible at the aggregate level.
There is no compliant stablecoin.
There are only stablecoins that are compliant in specific jurisdictions, under specific conditions, through specific banking relationships, at a specific point in time when the regulatory framework they operate under has not yet changed.
That is not a criticism of the global regulatory landscape.
It is an accurate description of it, and compliance functions that build their stablecoin infrastructure on any other assumption will discover the gap in the most expensive possible way.
Seven regimes.
Seven ongoing monitoring obligations.
Seven distinct compliance architectures that must be integrated without being conflated.
That is the work.
And it starts not with the regulatory framework but with the honest acknowledgement that no single framework covers all of it.
About the author
Cyrus Tong, an award-winning compliance expert, is the Group Chief Compliance Officer of DCS Group.
