Project Samara & the Canadian Tokenization Pathway. The validation moment.

Executive summary

On March 6, 2026, the Bank of Canada completed Project Samara: a full-lifecycle tokenized bond trial with C$100 million in issuance, executed with Royal Bank of Canada, TD Bank, and Export Development Canada. Issued by Export Development Canada, with RBC and TD as participants, settled in Bank of Canada wholesale central-bank money (Staff Analytical Paper 2026-8). The trial covered issuance, primary bidding, coupon payments, secondary trading, and redemption, the full bond lifecycle, on tokenized settlement infrastructure, with Canadian Tier-1 banks and a Crown corporation as counterparties. No regulator has endorsed 4orm or KCS.

The strategic significance of Samara is not the C$100-million notional value. It is the architecture it validated. Samara established that tokenized institutional settlement can be operated in Canada within the existing regulatory perimeter, with existing Tier-1 counterparties, under existing securities law, with full audit and supervision. The architectural question, can this work here, is now answered. The remaining question is operational: who runs it at scale, and under what governance.

Samara was a central-bank pilot. It is not, by design, the production rail. The Bank of Canada built it to test the architecture, not to operate the market. The participants, RBC, TD, EDC, are not, individually, going to host the multi-institution rail every other Canadian financial institution must connect to. The CSA's formal launch of Project Tokenization in Q2 2026 moved the question from "if" to "who builds it." What Project Samara validated is now, with deliberate intention, an institutional vacuum. That vacuum is the structural opportunity 4orm Finance is being built to occupy, and the operational pathway this report maps.

The remainder of this report does three things: it details what Samara actually did, layer by layer; it identifies the four architectural decisions Samara forces every Canadian successor to make; and it places Samara inside the broader regulatory pathway, Alberta's Financial Innovation Act, the CIRO Custody Framework, CSA Project Tokenization, RPAA, OSFI's capital treatment, that, together, define the Canadian tokenization runway through 2030.

1 · What Project Samara actually was

Project Samara was the third in a sequence of Bank of Canada digital-finance trials, following the CBDC research program and the wholesale settlement work the Bank ran with the BIS Innovation Hub. The earlier programs focused on the cash leg, what a tokenized Canadian dollar looks like as a settlement instrument, what its operational and policy implications are, what the design constraints are for a wholesale digital currency. Samara was the first to attach a tokenized asset leg to that cash work and run the full settlement lifecycle.

The bond instrument was C$100 million in face value, structured as a short-tenor Crown-backed obligation through Export Development Canada, a Canadian Crown corporation with statutory borrowing authority and a deep institutional debt-issuance track record. EDC's participation is significant: it gave Samara a Crown counterparty without using the Government of Canada balance sheet directly, which would have required a different sign-off pathway. EDC's bond-issuance authority is the closest available proxy for sovereign issuance in a pilot context.

RBC and TD operated as primary counterparties. RBC participated as the lead arranger and secondary-market market-maker; TD as the secondary participant. Both banks were running their pre-existing tokenized settlement infrastructure pilots, distinct from but compatible with the Samara test environment, and the protocol-level translation between bank-internal ledgers and the Samara test rail was one of the engineering deliverables of the project.

The lifecycle stages Samara executed:

Issuance. Tokenized representation of the bond was minted to an EDC-controlled wallet under a smart-contract framework that encoded the bond's economic terms, coupon rate, payment schedule, redemption mechanics, as on-ledger functions rather than off-ledger documents. The audit trail begins at issuance and is continuous.

Primary bidding. RBC and TD submitted bids on the tokenized issuance through a primary-market interface that recorded each bid as a settled on-ledger transaction. The bidding process was atomic against a tokenized cash leg.

Coupon payments. Two scheduled coupon payments were executed during the trial. The coupon was disbursed automatically via smart-contract function call against the tokenized cash leg held by the counterparties, with reconciliation against the bank-internal ledgers happening through API integration.

Secondary trading. Limited secondary trades were executed between RBC and TD during the trial window. The trades cleared atomically, delivery-versus-payment in a single transaction, replacing the standard T+2 or T+1 cycle with what the participants described as near-real-time settlement.

Redemption. At the end of the trial period, the bonds were redeemed against the tokenized cash leg, the asset-side tokens were burned, and the participating wallets reconciled against bank-internal ledgers. The full lifecycle audit trail was preserved.

The verified participant set, EDC as issuer, RBC and TD as bank counterparties, and the Bank of Canada as settlement-leg operator, was the second deliverable alongside the lifecycle proof. Public reporting names the Bank of Canada, EDC, RBC, and TD as participants. OSC, AMF, and CIRO were engaged in the pilot context; their involvement does not constitute an endorsement of any commercial platform. Samara did not just prove the technology works; it proved the institutional stack can be assembled under existing Canadian law.

2 · What Samara proved

Project Samara lifecycle. Issuance, primary bidding, coupon, secondary, redemption, verified participants.

Samara proved five things, all of which had previously been treated as open questions in the Canadian institutional tokenization conversation.

One, tokenized settlement can operate inside the Canadian regulatory perimeter. This is the headline. Samara ran a live transaction with real institutional counterparties under real Canadian securities law, with EDC, RBC, TD, and the Bank of Canada as named participants. The regulatory perimeter does not need to be expanded for tokenized institutional settlement to operate. It needs to be applied with the architectural discipline Samara demonstrated. No regulator has endorsed 4orm or KCS.

Two, Tier-1 Canadian banks are operationally ready. RBC and TD did not approach Samara as an experimental exercise. Both banks have been running internal tokenized-settlement infrastructure pilots since 2024, and Samara is the first time those pilots have interoperated with a counterparty's pilot under a Bank of Canada framework. The integration work, bank-internal ledger reconciliation against an external tokenized rail, is the engineering reality the production system must replicate. Samara proved it can be done.

Three, the cash leg works. Samara's tokenized cash component was operated under bank-issued tokenized deposits, not a stablecoin or a CBDC. The distinction matters. Tokenized deposits sit inside existing banking regulation, the bank's existing capital framework, and the existing payments rail architecture. They do not require new policy authority to operate. Samara validated the model that BMO subsequently announced for production rollout in partnership with CME and Google Cloud, and that 4orm Finance has positioned tokenized CAD deposits as the platform's settlement asset.

Four, full lifecycle is feasible. Many tokenization pilots prove one stage of the lifecycle in isolation. Samara proved all of them in sequence, with real counterparties, under regulatory observation. This is the operational difference between "tokenization is technically possible" and "tokenization is operationally viable as institutional infrastructure." Samara closed the difference.

Five, the architecture is composable. The Samara framework was not a closed system. The architecture is documented at a layer of abstraction that allows other Canadian institutional participants to interoperate with it, other banks, other custodians, other issuers, other regulators. The composability is the feature that allows Samara to be the reference architecture for a production system rather than just a one-off pilot. Composability is the design choice that turns a pilot into infrastructure, and the Bank of Canada made the choice deliberately.

3 · What Samara intentionally did not do

The architectural decisions Samara did not make are as important as the ones it did. Three are particularly relevant for the operational pathway.

Samara did not operate at production scale. C$100 million is a meaningful pilot size but a small fraction of what the Canadian wholesale debt market clears in a typical week. Production scale requires throughput, latency, and operational-risk characteristics that pilots do not have to demonstrate. The transition from Samara's architecture to production-scale infrastructure is a real engineering exercise, and it is the layer 4orm Finance is being built to operate.

Samara did not designate the operating entity. The Bank of Canada is not in the business of running production financial infrastructure. The OSC, AMF, and CIRO are not in the business of operating markets. Samara intentionally left the operating-entity question open. The CSA's launch of Project Tokenization in Q2 2026 made the open question formal. The institutional answer is a separately governed, regulator-aligned, multi-institution platform, operating under CIRO marketplace and custody frameworks, structured as HoldCo / OpCo / CustodyCo, capitalized to the tier requirements of the published framework. 4orm Finance is being built to that specification.

Samara did not build the marketplace. Secondary trading in Samara was limited to two counterparties under a controlled framework. A live marketplace, with multi-bank counterparties, transparent pricing, fractional ownership for institutional investors, multi-corridor settlement, CIRO marketplace oversight, is an order of magnitude harder. Samara validated that the trade can clear. It did not stand up the venue where the trade clears. The marketplace is the largest single component of the institutional vacuum Samara created.

4 · The four architectural decisions Samara forces

Any Canadian operator building on the Samara architecture must make four decisions explicitly. Each is a fork that produces a different platform shape, and each maps to a specific element of the 4orm Finance design.

Decision one, single-institution rail or multi-institution rail. JPMorgan Kinexys is the global reference point for a single-institution rail. JPMorgan owns the platform, operates the platform, and is the systemic counterparty on every settlement. It works for JPMorgan because JPMorgan is the largest US investment bank and can support that posture. No Canadian bank, individually, can or wants to take that posture, and a single-Tier-1-owned rail would not be acceptable to the others as a counterparty. The indicated structure for Canada is a neutral multi-institution rail. Samara, by composing across RBC, TD, and EDC, validated the multi-institution model. 4orm Finance's architecture is built on that decision.

Decision two, direct settlement or correspondent settlement. A production rail can clear settlement directly between institutional wallets, or it can clear settlement through a correspondent layer that intermediates between institutions. Direct settlement is faster and lower cost; correspondent settlement is more compatible with existing institutional operations and risk frameworks. Samara's hybrid, direct on-rail settlement, with bank-internal reconciliation through API, is the production-relevant design and the basis for 4orm Finance's settlement layer.

Decision three, entity separation. CIRO's February 2026 Custody Framework specified three-entity separation: HoldCo (holding entity), OpCo (operating entity), CustodyCo (custody entity). Samara did not formally implement entity separation because the pilot operated under Bank of Canada permissioning rather than CIRO custody permissioning, but the production rail must. 4orm Finance is being structured as HoldCo / OpCo / CustodyCo from inception. Retrofitting entity separation onto a platform that did not start with it is a serious operational task and one of the structural reasons platforms designed for production from inception have an advantage.

Decision four, the cash leg. The choice between tokenized bank deposits, a regulated stablecoin, and (eventually) a wholesale CBDC is the most consequential single decision in the platform design. Tokenized deposits, the option Samara used and BMO announced for production, are the institutional path. They sit inside existing banking regulation, they preserve the bank's role in the settlement chain, and they are the option the Canadian banking sector is operationally aligned around. 4orm Finance's settlement asset is tokenized CAD deposits, by design.

5 · Where Samara sits in the broader regulatory pathway

Samara is the most visible single event in the Canadian tokenization regulatory pathway, but it is one of several aligned developments through 2025 and 2026. The cumulative picture is what makes the case for domestic infrastructure structurally complete.

Retail Payment Activities Act (RPAA), live since September 2025. Brought non-bank payment service providers under Bank of Canada supervision, with fund-safeguarding and operational-risk requirements. RPAA is the cash-rail supervision layer that sits underneath any tokenized payment activity.

OSFI crypto-asset capital and liquidity guidance, finalized 2025. Gave regulated Canadian financial institutions a clear rulebook for how to capitalize crypto-asset and tokenized-asset exposures. Without this framework, bank participation in tokenization at scale would have been capital-prohibitive.

Alberta Financial Innovation Act, in force 2026. Created Canada's first regulatory sandbox for digital-finance innovation, streamlining the legislative pathway. Alberta has positioned itself as the operational jurisdiction for the next generation of Canadian tokenization activity, and the sandbox is the layer that allows live testing without the friction of a federal pilot framework.

CIRO Digital Asset Custody Framework, published February 2026. Specified the structural requirements for qualified Canadian digital custody, three-entity separation, tiered capital, weekly proof-of-reserves, segregated client assets. The framework is the custody layer of the production stack.

Project Samara, completed March 6, 2026. The settlement and lifecycle validation.

CSA Project Tokenization, formally launched Q2 2026. The national regulatory initiative that elevates tokenization from a series of provincial sandbox activities into a coordinated federal framework. CSA Project Tokenization is the layer that takes the Samara architecture and asks the operational question: who builds the production version, under what governance, and on what timeline.

The picture, in sequence: payments supervision (RPAA), capital treatment (OSFI), sandbox testing (Alberta), custody framework (CIRO), settlement validation (Samara), production initiative (CSA Project Tokenization). The five preceding layers exist. The sixth, the operating entity that builds at production scale, is the layer the institutional opportunity sits in.

6 · What this means for the institutions that participate

The institutional posture toward Project Samara depends on the institution's role in the stack. Six perspectives matter.

Tier-1 banks. RBC, TD, BMO, Scotiabank, CIBC, National Bank, the institutions that already participated in Samara, those that announced production tokenized infrastructure separately, and those that are running quieter internal pilots. The relevant decision is not whether to engage; that decision was already made. The decision is the operating-rail architecture the bank's tokenization operations connect to. A neutral multi-institution rail is the indicated structure precisely because it allows each bank to participate without owning the rails or accepting a competitor as the systemic counterparty.

Crown corporations and institutional issuers. EDC's participation in Samara is the template. CMHC, the provincial finance corporations, and the federal Crown agencies have institutional debt programs that can plausibly migrate to tokenized rails on a Samara-compatible architecture. The production decision is the same as for Tier-1 banks: which operating rail.

Asset issuers. Pineapple Financial, AuCan Gold, T-RIZE, Ocree Capital, the firms already in market with tokenized institutional assets. Samara did not directly involve any of them, but the regulatory pathway Samara validated is the framework these issuers must operate within. The operating rail decision matters because the rail determines the institutional counterparty pool the issuer can reach.

Custodians. Tetra Trust, Balance Trust, Brane Trust. The CIRO framework defines what qualified Canadian digital custody is. Samara validated that institutional settlement can clear with qualified custody as an integrated layer. The custodians' role in the production stack is well-defined; the relevant decision is interoperability with the operating rail.

Regulators. The OSC, AMF, CIRO, OSFI, FINTRAC, and the Bank of Canada. Each contributed a specific permission to Samara, and each will need to contribute to the production framework. CSA Project Tokenization is the coordination layer. The regulators' role in 2026 to 2027 is articulating the governance under which the operating entity is permissioned.

KCS Capital and 4orm Finance. The independent technology and research firm developing the operating-rail technology, and the separately governed regulated entity operating it. 4orm Finance is being built to the Samara architecture, under the CIRO custody framework, with tokenized CAD bank deposits as the settlement asset, structured as HoldCo / OpCo / CustodyCo, capitalized to the tier requirements published in the CIRO framework. This report is part of the public record of why that structure is the indicated structure.

7 · The constructive read

The way to read Samara is not as the end of the validation question. It is the beginning of the operational one. The Bank of Canada has done what only a central bank can do: it has put the institutional stack and the regulatory perimeter in the same room and proved they can interoperate, on a real asset, with real Tier-1 counterparties, under real Canadian securities law, with full lifecycle audit. That has now been done. The question of whether the architecture works is closed. The question of who operates it at production scale is the question every Canadian financial institution will be answering across 2026 and 2027.

The companion KCS Briefs The Shift Has Begun (October 2025) and Canada's New Budget Signals a Safer Path (November 2025) develop the policy backdrop. The companion research reports Canada's $1.9B RWA Infrastructure TAM (March 2026) and The CIRO Digital Asset Custody Framework, Explained (April 2026) develop the economic and structural sides of the institutional opportunity Samara opens.

The closing observation is the one the Bank of Canada implicitly made by the way it scoped the project. The architecture is validated. The operating entity is not. The validation belongs to the central bank and the regulators. The operating entity belongs to a separately governed firm built to the standards Samara set. That firm is what 4orm Finance is being built to be, and the standards are what KCS Capital's research is structured around.

Background & Sources

• Project Samara, $100 million tokenized bond trial, March 6, 2026, Bank of Canada program announcements and contemporaneous reporting.
• Participating counterparties: Royal Bank of Canada, TD Bank, Export Development Canada; participant public statements.
• Verified participants: Export Development Canada (issuer), Royal Bank of Canada, TD Bank; settlement leg operated by the Bank of Canada (Staff Analytical Paper 2026-8). OSC, AMF, and CIRO engaged in pilot context; no endorsement of any commercial platform.
• CSA Project Tokenization launch, Q2 2026, Canadian Securities Administrators.
• CIRO Digital Asset Custody Framework, February 2026, CIRO.
• Retail Payment Activities Act milestones, Bank of Canada.
• OSFI crypto-asset capital and liquidity treatment, OSFI.
• the Alberta Financial Innovation Act, Government of Alberta.
• BMO tokenized cash and deposit infrastructure announcement with CME and Google Cloud, 2026 public statements.
• JPMorgan Kinexys volume and platform disclosures, JPMorgan public statements, 2024 to 2026.

This report is original market intelligence produced by KCS Capital and is provided for informational purposes only. It does not constitute investment, financial, legal, or tax advice, or an offer or solicitation to buy or sell any security or financial product. Regulatory references describe publicly reported developments and are not legal analysis. KCS Capital Inc. is an independent technology and research firm; 4orm Finance operates as a separate regulated entity with independent governance, structured as HoldCo / OpCo / CustodyCo per the CIRO Digital Asset Custody Framework.