For banks and credit unions in the US and Canada, digital money is arriving on a regulatory timetable. The GENIUS Act takes effect on January 18, 2027, and Canada's Stablecoin Act is targeted for fall 2027. The institutions that use the time to build compliance in, screening on-chain activity before it settles and choosing deliberately how they join tokenized deposit networks, will be the ones members and counterparties trust.
I took that view to Central 1's Momentum 2026 conference in Montreal (October 26-28), where leaders from across Canada's credit union system gathered. On Innovation Day, I spoke on a Deloitte-organized panel, "The Future of Money: Stablecoins, Tokenized Deposits and the Next Generation of Banking," alongside Kevin Luh of Deloitte Canada and Isak Penttilä of Movitz Payments. Marie-Eve Noel, a senior advisor at Deloitte, moderated the discussion.
Interest was high, but many in the room had not yet seen digital money as an answer to the pressures they already face: consolidation, transaction costs and member retention. It can be an answer, for institutions that make five decisions before the rules take effect:
- Which tokenized deposit rail to join
- How to use the window before 2027
- Where code stops working as a compliance tool
- Where to screen
- How early to build compliance in
1. Stablecoins and tokenized deposits will coexist
For a century, the deposit has been the product banks protect most, and tokenization turns it into software. The useful questions are whose liability it is, what rail it runs on and who knows who is holding it.
A tokenized deposit remains a liability of a regulated bank or credit union, usually on a permissioned network where every participant is identified before joining. A stablecoin is a liability of its issuer, and it can move across public blockchains to wallets no institution has verified.
That difference matters. Even so, every institution will deal with stablecoins, whether or not it ever issues one. Members already move funds to and from cryptoasset exchanges, and some business clients will want to pay or be paid in stablecoins.
The largest banks are now building shared rails, which adds a strategic question for everyone else. In Canada, the Big Six banks announced a tokenized deposit project on September 22, 2026. In the US, large banks plan a shared tokenized deposit network operated by The Clearing House for the first half of 2027. Joining a shared rail early, or connecting later on terms set by others, is a choice worth making deliberately.
Member retention came up repeatedly in Montreal. Several attendees worried that members see the big banks as the innovators and assume credit unions can't afford to keep pace. That concern makes the decision more pressing, because a shared rail lets credit unions offer the same services without each one building them alone.
2. Spend the window before 2027 on financial crime, yield and scope
The US moved first: The GENIUS Act became law in July 2025, and on October 21, 2026, the OCC finalized its implementing rule. Both take effect on January 18, 2027, and clear rules are giving US banks the confidence to start building.
Canada is close behind. The Stablecoin Act received royal assent in March 2026, and draft regulations were published in the Canada Gazette on October 24, 2026, with comments due by December 23. Issuers will register with the Bank of Canada, hold high-quality liquid reserves at least equal to par with a Canadian custodian and process redemptions within three business days. The framework is targeted to take effect in fall 2027.
Financial crime rules should keep pace with prudential rules. The OCC's final rule leaves Bank Secrecy Act, anti-money laundering (AML) and sanctions requirements to a separate rulemaking. FinCEN and OFAC proposed those requirements in April 2026, and as proposed they would apply 12 months after the final rule, so the detailed AML rules will follow the prudential ones.
Canada has kept the two together so far. The same bill that created the Stablecoin Act brought issuers into FINTRAC's regime as money services businesses dealing in virtual currency. In both countries, though, issuer rules cover the issuer. Screening the stablecoin payments a bank's own members send and receive stays with that bank's AML program.
The yield debate is a deposit debate. The GENIUS Act bars issuers from paying interest or yield solely for holding, using or retaining a stablecoin, and the OCC's final rule offers no safe harbor for existing rewards programs, judging each arrangement on its facts. Canada's draft bans yield tied to holding but allows rewards tied to use, so the two regimes already differ. Where each line settles will shape how much money moves out of bank deposits.
Scope will matter as much as substance. Canada's Act reaches foreign issuers that offer stablecoins to people in Canada, whatever the reference currency, though the Bank of Canada can exempt issuers that operate under substantially similar regimes. Most stablecoin activity today is in US-dollar tokens, so the way Canada treats the GENIUS Act will matter more to Canadian institutions than its rules for Canadian-dollar coins.
3. Programmable money needs intelligence beyond the code
Programmability is the most exciting part of this shift to digital money. Payments can release automatically when conditions are met, and transfer rules can be written into the token itself.
But if you can code a rule into money, you can also code a mistake into it. A smart contract bug or a compromised upgrade key can stop payments or send them to the wrong place, and boards will need to understand those risks.
Code also has limits as a compliance tool. A token can check whether a wallet is on an approved list. It cannot tell you that the wallet received funds from a sanctioned mixer three hops ago. Catching that takes on-chain risk management that looks beyond the token's own rules.
One distinction deserves more debate: Programmable payments put logic around money, while programmable money puts logic inside it. Once restrictions travel with the dollar, whoever controls the token decides what that dollar can be spent on, and boards should settle that before they launch.
4. Closed networks are only as closed as their connections
On a public blockchain every transaction is visible, but someone still has to work out what it means. Once a tokenized deposit network links to public chains or stablecoins, risk moves to wherever identity checks don't reach, so access controls have to extend to those links.
Institutions adopting digital money will need infrastructure that covers several jobs:
- Continuous monitoring, with wallet screening and cross-chain tracing at bridges and swaps between assets, where illicit funds often try to disappear
- Due diligence on counterparties such as exchanges and stablecoin issuers, along with a view of how concentrated an institution's exposure is to any single issuer
On many blockchains a payment is final once it settles. Screening therefore has to happen before settlement, which makes on-chain risk management a preventive control as much as an investigative one.
For credit unions, this doesn't require building a specialist team from scratch. Shared infrastructure is how the sector has always competed at scale, and Central 1 is the proof. The US is building the same logic into the GENIUS Act: Credit unions can issue stablecoins only through an NCUA-licensed subsidiary.
In traditional finance the risk data sits inside the bank. On-chain, much of the most useful risk data sits on the ledger itself, outside every bank, which makes it a natural candidate for shared services.
5. Build compliance in from the start
The institutions moving fastest bring compliance into product design from day one, because that is what lets them scale with regulators' confidence. Much of that work is operational, which is where several treasury questions from the conference’s audience landed.
Tokenized money settles around the clock, while most treasury, liquidity and compliance teams still work business hours. When collateral moves in seconds, so can stress: USD Coin (USDC) briefly lost its dollar peg in March 2023 when Silicon Valley Bank failed. Faster settlement also shrinks the window to stop a bad payment, so monitoring has to run in real time.
In Montreal, the appetite to learn was large, but few attendees described near-term plans to adopt digital assets, with more pressing issues ranking higher. Those priorities make a small first step more realistic than a large program.
For many institutions on both sides of the border, the most immediate digital asset risk sits in cryptoasset activity that is already moving through members' accounts, often unmonitored, well before any product launch. A practical path starts there, moves to tokenized deposits on a closed network of known participants, then expands into public-chain activity once controls are proven.
Along the way, boards should be asking:
- Where does our perimeter end?
- What is our exposure if a counterparty's wallet is tainted?
- Can we stop a suspicious payment and report it in real time?
Institutions that shift compliance early will earn members' trust
The likeliest future is coexistence: tokenized deposits inside the regulated perimeter, regulated stablecoins for cross-border payments and open networks, and possibly wholesale central bank money as the settlement anchor. Interoperability between them is where the competition will happen.
Compliance will shift with it, from periodic account reviews to continuous, wallet-level risk assessment. Institutions that make that shift before the US and Canadian rules take effect will be the ones members and counterparties trust when digital money becomes ordinary money.
Elliptic builds the operating system for on-chain risk. It screens wallets, transactions and counterparties before funds settle, so banks and credit unions can move from closed pilots to open networks with those controls already in place. If you’d like to learn more, read our guide on Digital asset compliance for financial institutions.
Share
Looking for a framework to onboard VASPs?
FAQs
The GENIUS Act takes effect on January 18, 2027. The Office of the Comptroller of the Currency (OCC) issued its final implementing rule on October 21, 2026, and the rule takes effect the same day as the Act. From that date, permitted payment stablecoin issuers must back their stablecoins with reserves, honor holders’ redemption rights and meet governance, risk management, audit and reporting requirements.
