The Investment Regulatory Authority of Canada (CIRO), one of Canada’s top regulatory bodies in the investment sector, has announced new rules for cryptocurrency custody services.
The newly published “Digital Asset Custody Framework” sets clear standards for how member brokerage firms operating cryptocurrency trading platforms (CTPs) should protect client assets.
CIRO stated that the new framework aims to prevent losses resulting from hacking attacks, fraud, and inadequate corporate governance. The rules will be implemented through membership terms as a temporary measure until permanent regulations are finalized. This is intended to allow for a faster response to emerging risks.
At the heart of the regulation is a risk-based system that categorizes crypto custody institutions into four tiers. These tiers, determined by criteria such as capital strength, regulatory oversight, insurance coverage, and operational resilience, will determine how much of a client’s assets custodians are allowed to hold.
Custodians with the highest security level can hold 100% of client assets, while this rate drops to 40% for the lowest level, Tier 4. In-house custody by brokerage firms is limited to a maximum of 20% of the value of client assets.
The framework also mandates strong governance policies in areas such as key management, cybersecurity, incident response, and third-party risks, as well as compulsory insurance, independent audits, security reports, and regular penetration testing. It will also be mandatory to clearly define liability for losses due to negligence in custody agreements.
CIRO emphasized that this step aims to strengthen investor protection while also supporting innovation. The organization stated that lessons learned from the past QuadrigaCX case guided this framework.
*This is not investment advice.
