CSA Grants Exemptive Relief for Immediate-Delivery Stablecoin Trading

On July 30, 2026, the Ontario Securities Commission granted zerohash llc time-limited exemptive relief from the dealer registration requirement so that it can buy and sell certain value-referenced crypto assets (VRCAs), commonly referred to as stablecoins, with Canadian clients through an immediate-delivery model.

The decision is notable because Zero Hash will not custody the customer's fiat or crypto assets. The purchased crypto asset is to be delivered immediately to the client in a manner consistent with the Canadian Securities Administrators' existing “immediate delivery” guidance. Nevertheless, Zero Hash sought relief on the basis that its dealings in specified fiat-backed stablecoins could still cause it to be considered to be in the business of trading securities.
That is an important development, but it should not be overstated.

The decision does not represent a court, securities tribunal or legislature deciding that ordinary fiat-backed stablecoins are securities. It is an exemptive-relief decision requested by a company seeking regulatory certainty against the background of a position that CSA staff have maintained for several years.

And, viewed alongside other recent developments in Canadian crypto regulation, it highlights an increasingly uncomfortable question: what exactly is the coherent principle defining the outer boundary of Canadian securities regulation of crypto assets?

Zero Hash operates financial infrastructure that enables banks, brokerages and fintech companies to interact with crypto assets through APIs. Its services include trading, payments, custody, settlement, liquidity and compliance infrastructure.

For its proposed Canadian immediate-delivery business, however, the model is narrower.

Zero Hash represented that:

• it would buy and sell crypto assets with Canadian clients;
• the assets would be immediately delivered;
• it would not hold client fiat or crypto assets;
• it would not provide custody;
• it would deal only in crypto assets that are either specified VRCAs or are not securities or derivatives; and
• it would not provide credit, margin or leverage for the VRCA transactions.
  Zero Hash is already registered with FINTRAC as a foreign money services business, but it is otherwise not registered under Canadian securities legislation.

The OSC granted relief from the dealer registration requirement for transactions involving Specified VRCAs.

A Specified VRCA is defined by reference to an issuer having filed the type of undertaking contemplated by CSA Staff Notice 21-333.

At present, the practical examples are USDC and QCAD.

The Relief Is Narrow and Temporary

This is not a general exemption for stablecoin businesses.

The decision contains numerous conditions, including that Zero Hash:

• maintain its FINTRAC foreign MSB registration;
• remain compliant with Canadian AML laws;
• maintain its applicable New York virtual-currency licensing;
• not offer leverage;
• not otherwise carry on registrable securities activities;
• provide transaction reporting to the OSC;
• notify the OSC of specified regulatory actions;
• address investor-protection concerns identified by it or the OSC; and
• pay applicable OSC participation fees.

The exemption expires four years after the July 30, 2026 decision.

The decision's headnote also expressly says that the relief is based on Zero Hash's particular circumstances, was granted partly to foster innovative business in Canada, and “should not be viewed as a precedent.”

That last point is important.

This Was Not an Enforcement Case Finding That Stablecoins Are Securities

There is a meaningful difference between:

1. a regulator successfully proving in a contested proceeding that an asset is a security or derivative; and
2. a market participant asking for exemptive relief because regulators have told the industry that they consider the activity potentially subject to securities legislation.

The Zero Hash decision is the second.

The decision itself says the filer “may reasonably be considered to be in the business of trading in securities” by entering into the proposed VRCA transactions.

It does not contain a contested legal determination that USDC, QCAD, or fiat-backed stablecoins generally satisfy the statutory definition of a security.

No court was asked to decide that issue. No provincial securities tribunal was asked to decide it after an adversarial hearing. And no provincial legislature has enacted a rule simply deeming all fiat-backed stablecoins to be securities.

Instead, the foundation remains the CSA staff position.

In Staff Notice 21-332, CSA staff stated that VRCAs may constitute securities and/or derivatives and that fiat-backed crypto assets will generally meet the definition of a security and/or derivative in several jurisdictions. The Zero Hash decision repeats that position.

The distinction is not academic.

Staff notices are extremely important to anyone operating in a regulated industry because they communicate how regulators intend to administer and enforce the legislation. But regulatory guidance is not the same thing as a binding judicial determination of what the legislation means.

Even commentary supporting the significance of the Zero Hash decision acknowledges that the CSA's characterization of fiat-backed stablecoins has not itself been endorsed by a securities tribunal or court.

The Strange Result: Immediate Delivery Solves the Crypto Contract Problem—Except for Stablecoins

The decision becomes more interesting when placed beside the CSA's crypto contract doctrine.

The CSA's position has long been that an underlying crypto asset does not itself need to be a security for securities legislation to apply.

If a platform retains custody or control and the customer merely obtains a contractual claim to the crypto asset, the contractual right itself may constitute a security or derivative—a Crypto Contract.

The corollary was supposed to be important.

Where the underlying asset is not a security or derivative and the transaction results in genuine immediate delivery to the customer, the platform may operate outside securities regulation.

CSA Staff Notice 21-327 generally associates immediate delivery with the customer obtaining ownership, possession and control and being able to use or deal with the crypto without further reliance on the platform, while ceasing to bear the platform's insolvency, fraud, performance and proficiency risks.

The Zero Hash decision expressly acknowledges that Immediate Delivery Platforms exist in Canada on this basis.

But stablecoins receive different treatment.

Even though Zero Hash proposes to immediately deliver the stablecoin and retain no custody over it, the filer still required dealer-registration relief because CSA staff consider the stablecoin itself potentially to be a security or derivative.

In other words:

Immediate delivery may eliminate the Crypto Contract, but it does not solve the problem if regulators characterize the underlying stablecoin itself as a security or derivative.

That distinction explains the Zero Hash relief.

It also exposes a much larger inconsistency emerging elsewhere in the Canadian crypto market.

The DEX Trading Problem

Consider what is now happening with in-app decentralized-exchange trading.

Wealthsimple, one of Canada's registered CTPs, now allows Canadian users to buy and sell thousands of crypto assets on DEXs from inside the Wealthsimple application. Wealthsimple describes these assets as being held in a separate self-custody wallet rather than its centralized custodial platform.

That distinction is plainly important.

But the practical relationship between the customer and the platform remains unusually close.

At launch, Wealthsimple says that:

• the wallet is automatically created through its app;
• the customer accesses the wallet through the Wealthsimple experience;
• DEX tokens cannot currently be sent to an external wallet;
• DEX tokens cannot currently be received from an external wallet;
• the wallet cannot be accessed through another platform; and
• if a user closes the Wealthsimple account while DEX assets remain in it, the user may lose access to those assets.

At the same time, Wealthsimple says that it cannot access the assets or sign transactions and therefore characterizes the wallet as self-custodial.

That may provide a technically meaningful basis for treating the assets differently from Wealthsimple's ordinary custodial crypto holdings.

But it creates an obvious policy question.

Wasn't one of the central purposes of the Crypto Contract concept to regulate the risks created when a user depends on a platform to obtain, access and deal with crypto assets rather than receiving the economic equivalent of possession and control?

If a consumer cannot export the asset, cannot import the asset, cannot access the wallet through another platform and relies on continued access to the CTP's software to interact with it, the distinction between that arrangement and the risks the Crypto Contract doctrine originally sought to address becomes considerably less intuitive.

That does not necessarily mean the DEX arrangement legally constitutes a Crypto Contract. Private-key architecture matters, and a customer having exclusive signing authority is not trivial.

But the contrast is striking.

A stablecoin provider that immediately delivers a stablecoin to the customer and does not retain custody seeks securities-law relief because CSA staff view the underlying stablecoin itself as potentially a security.

Meanwhile, a customer can participate in an embedded DEX environment offered through a registered Canadian platform, acquire extremely speculative long-tail tokens, have no ordinary external withdrawal capability at launch, and be told that those transactions occur outside the centralized regulatory framework because the wallet is technically self-custodial. Wealthsimple expressly says that its usual CSA purchase limits and loss limits do not apply to those DEX transactions because they occur outside its centralized infrastructure.

There may be a technically defensible line between the two arrangements.

Whether it is a coherent investor-protection line is another question.

This Is Not Actually a New CSA Position on Stablecoins

The Zero Hash relief should also not be presented as the CSA suddenly expanding its jurisdiction over stablecoins.

The regulators have been saying essentially the same thing since 2023.

CSA Staff Notice 21-332 stated that VRCAs may be securities and/or derivatives and that fiat-backed crypto assets generally meet one or both definitions in several Canadian jurisdictions.

Staff Notice 21-333 then established the interim system under which registered CTPs can permit clients to buy, deposit or enter into Crypto Contracts involving specified VRCAs where the issuer has provided an undertaking acceptable to CSA staff.

The Zero Hash decision is therefore better understood as the logical application of the CSA's existing position to an immediate-delivery platform.

What would actually be new would be a contested enforcement proceeding against an issuer or non-custodial business that rejects the CSA's characterization of its stablecoin.

That has much greater legal significance because the regulator would then have to establish that its interpretation follows from the actual statutory definitions.

Why Hasn't There Been a Stablecoin Test Case?

This is where the Canadian industry's frustration is understandable.

If the legal proposition is that an ordinary, fully reserved fiat-backed stablecoin constitutes a security or derivative even when it is immediately delivered and does not involve an investment contract with an intermediary, regulators should be capable of defending that proposition under the governing legislation.

Instead, the practical regime has largely developed through:

• staff notices;
• pre-registration undertakings;
• issuer undertakings;
• exemptive-relief applications;
• terms and conditions imposed on registered CTPs; and
• regulated entities choosing compliance rather than litigating the issue.

That approach is effective from a supervisory perspective.

It is less satisfying from a rule-of-law perspective.

A regulator can develop an enormously influential legal interpretation without ever being required to establish it in a contested proceeding because regulated businesses generally cannot afford the uncertainty of simply ignoring the regulator and waiting to be sued.

That does not mean the CSA's legal interpretation is necessarily wrong.

It does mean that the industry's practical acceptance of the position should not be confused with judicial confirmation that the position is correct.

The Federal Stablecoin Act Makes This Even More Important

The issue will become considerably harder to ignore when Canada's new federal Stablecoin Act framework becomes operational.

The Act received Royal Assent on March 26, 2026, although its substantive framework is not yet in force and implementing regulations are still being developed. The federal government expects the regime to become operational in 2027.

Under that framework, non-financial institution issuers of fiat-backed stablecoins will be supervised by the Bank of Canada and subject to requirements concerning:

• registration;
• 1:1 reserves;
• reserve asset quality and segregation;
• redemption at par;
• governance;
• risk management;
• data security; and
• recovery and resolution.

This is precisely the type of prudential and payments-oriented regulatory framework the stablecoin industry had been asking governments to create.

It gives regulators an obvious way to regulate the risks that are actually distinctive to fiat-backed stablecoins: reserves, redemption, issuer failure, operational resilience and payment-system risk.

But the Federal Government Is Explicitly Contemplating Continued Securities Regulation

Anyone hoping the Stablecoin Act would automatically displace the CSA's involvement should pay close attention to Finance Canada's own guidance.

Finance Canada says the new framework will complement existing federal and provincial regimes. More specifically, its current explanation says that securities regulators will continue regulating the exchange and trading of fiat-backed stablecoins on securities exchanges and crypto-trading platforms.

That is a fairly clear warning that the federal government does not presently view the Stablecoin Act as occupying the entire field.

Section 3 of the Stablecoin Act also illustrates the narrower nature of the federal securities carve-out. It provides that issuing a stablecoin in accordance with the Act does not constitute “dealing in securities” for purposes of specified provisions of certain federal financial institution statutes. It does not purport to amend the definition of “security” in every provincial Securities Act.

So the possibility of overlapping regulation is very real:

Bank of Canada regulation of the issuer + FINTRAC regulation + potentially RPAA regulation of payment functions + provincial securities regulation of trading and distribution.

For an asset deliberately designed to function as digital money, that is an extraordinary amount of regulatory overlap.

The Stablecoin Act Was Supposed to Give Securities Regulators an Off-Ramp

From an industry-policy perspective, the federal framework presented an obvious opportunity.

The CSA's intervention in stablecoins originally arose in an environment in which Canada did not have a dedicated prudential regime governing stablecoin reserves and redemption.

That vacuum is disappearing.

Once an issuer is:

• registered with the Bank of Canada;
• maintaining a regulated 1:1 reserve;
• offering redemption at par;
• segregating reserve assets;
• complying with governance and operational requirements; and
• subject to federal supervision,

the policy justification for additionally treating the token itself as a security becomes harder to explain.

There may still be securities-law issues surrounding particular stablecoin arrangements. Yield-bearing tokens, structured products, investment schemes, tokenized securities or unusual redemption structures can obviously raise different questions.

But a properly regulated fiat-backed payment token is a different proposition.

The federal Stablecoin Act gives securities regulators an elegant opportunity to distinguish regulated payment stablecoins from investment products rather than continuing an interim framework developed before dedicated legislation existed.

Industry participants had good reason to hope they would take it.

Finance Canada's present guidance suggests that outcome cannot yet be assumed.

What Does the Zero Hash Decision Mean for Immediate-Delivery Platforms?

For businesses currently relying on the immediate-delivery concept, the message is relatively straightforward.

Immediate delivery continues to matter enormously.

If the underlying crypto asset is not itself a security or derivative, genuine immediate delivery can mean the platform does not create the Crypto Contract that brings many custodial CTP arrangements under securities regulation. The Zero Hash decision expressly recognizes that Immediate Delivery Platforms continue operating in Canada on that basis.

But businesses cannot stop the analysis there.

They must separately consider whether regulators may characterize the underlying asset itself as a security or derivative.

For stablecoins, the CSA's current answer remains yes—or, more precisely, that VRCAs may be securities or derivatives and that fiat-backed VRCAs generally satisfy those definitions in several jurisdictions.

The Zero Hash decision demonstrates that immediate delivery does not presently provide an escape from that position.

What Does It Mean for Stablecoin Issuers?

For issuers, the decision reinforces the unusual environment in which Canadian stablecoin businesses currently operate.

The federal government has enacted a dedicated Stablecoin Act but has not yet brought its substantive framework into force.

The CSA continues operating its interim VRCA regime.

Registered CTPs remain subject to VRCA-specific conditions.

And an immediate-delivery intermediary dealing only in specified stablecoins has now obtained dealer-registration relief rather than relying solely on the fact that it does not custody the assets.

Issuers therefore need to think simultaneously about:

• the Stablecoin Act;
• Bank of Canada registration;
• FINTRAC;
• the RPAA where applicable;
• provincial securities and derivatives laws;
• CSA issuer undertakings;
• CTP distribution requirements; and
• the legal characterization of the token itself.

That is hardly the regulatory simplicity one might expect from legislation intended to establish a nationally consistent stablecoin framework.

What Does It Mean for Crypto Trading Platforms?

CTPs should also pay attention to the decision because it underscores how much turns on the characterization of the asset, the contract, and the custody architecture as three separate questions.

A platform needs to ask:

1. Is the underlying token itself a security or derivative?
2. If not, does the user's contractual arrangement with the platform nevertheless create a Crypto Contract?
3. Has there actually been immediate delivery?
4. Who controls the private keys?
5. Can the customer independently access or transfer the asset?
6. Does the customer remain exposed to the platform's insolvency, operational or performance risks?

The rapid development of embedded self-custody and DEX functionality is going to make these questions increasingly difficult.

The line between “the platform holds your crypto” and “you hold the crypto entirely independently of the platform” is no longer as technologically clean as it once appeared.

Regulators May Eventually Have to Defend the Stablecoin Theory

For now, the industry should treat the CSA's stablecoin position as regulatorily very real.

Ignoring it because it has not yet been judicially tested would be imprudent.

But regulators should also recognize the inverse proposition: the longer a major legal classification is maintained almost entirely through staff guidance, undertakings and negotiated relief, the more legitimate it becomes for the industry to ask when that interpretation will actually be tested.

The Zero Hash decision does not answer whether a fiat-backed stablecoin is legally a security.

It demonstrates what happens when a sophisticated business decides it cannot afford to find out the hard way.

If securities regulators are confident that an immediately delivered, non-yielding, fully reserved fiat-backed payment token falls within existing provincial definitions of a security or derivative, a contested case would ultimately provide considerably more legal certainty than another staff notice.

And if the legal argument cannot withstand that scrutiny, the existence of the federal Stablecoin Act makes 2027 an increasingly sensible time to reconsider the policy.

Final Thoughts

The Zero Hash relief is important, but not because Canadian securities regulators have suddenly declared stablecoins to be securities.

They had already articulated that view.

What the decision does is extend the practical consequences of that view to a business that has deliberately structured itself around immediate delivery with no customer custody.

That makes the current regulatory contrast harder to ignore.

On one side, an immediately delivered stablecoin can still trigger securities-law dealer concerns because the CSA views the token itself as potentially a security or derivative.

On the other, the Canadian market is experimenting with in-app DEX structures in which customers technically hold assets through self-custodial wallets, yet remain heavily dependent on the platform's software environment to access and transact with those assets.

There may be defensible legal distinctions between those models.

But if the objective of the Crypto Contract doctrine was to regulate substantive platform dependence and investor risk rather than labels and technical architecture, the Canadian framework is beginning to produce some very strange outcomes.

The forthcoming Stablecoin Act provides an opportunity to simplify at least one part of the picture.

Whether Canadian securities regulators actually take that off-ramp may become one of the most consequential digital-asset regulatory questions of 2027.