Crypto Journalist
Amin Ayan
Crypto Journalist
Share
Canada’s top investment industry watchdog has rolled out a new set of rules aimed at tightening how crypto assets are held and safeguarded, as regulators move to limit losses linked to hacks, fraud, and weak governance.
Key Takeaways:
- Canada introduced new interim crypto custody rules to curb losses from hacks and fraud.
- Custodians now face tiered limits based on capital strength, oversight, and resilience.
- The framework adds stricter governance, insurance, and audit requirements while supporting innovation.
The Canadian Investment Regulatory Organization (CIRO) on Tuesday published its Digital Asset Custody Framework, outlining detailed expectations for dealer members that operate crypto asset trading platforms.
The framework is designed as an interim measure and will be enforced through membership terms and conditions, allowing CIRO to react more quickly to emerging risks while longer-term rules are developed.
Canada Introduces Tiered Custody Rules
CIRO said the framework directly addresses the “technological, operational, and legal risks unique to digital assets,” drawing on lessons from past failures, including the collapse of QuadrigaCX in 2019, which left thousands of customers unable to recover funds.
At the core of the new regime is a tiered, risk-based structure for crypto custodians. Under the model, custodians are placed into one of four tiers based on factors such as capital strength, regulatory oversight, insurance coverage, and operational resilience.
Top-tier custodians may hold up to 100% of client crypto assets, while lower-tier providers face progressively tighter limits, with Tier 4 custodians capped at 40%.
Dealer members that choose to custody assets internally are limited to holding no more than 20% of the total value of client crypto.
The framework also imposes a broad set of operational requirements. These include formal governance policies covering private key management, cybersecurity controls, incident response procedures, and third-party risk management.
Custodians must carry insurance, undergo independent audits, provide security compliance reports, and conduct regular penetration testing.
Custody agreements are required to spell out liability in cases where losses stem from negligence or preventable failures.
CIRO said the approach is intended to be proportionate, balancing stronger investor protection with room for innovation and competition.
The rules were developed in consultation with crypto trading platforms, custodians, and other industry participants, and were benchmarked against international practices.
Canada Steps Up Crypto Enforcement After Major FINTRAC Fines
The move comes amid heightened scrutiny of crypto compliance in Canada. In October, the country’s financial intelligence agency, FINTRAC, fined local exchange Cryptomus roughly $126 million for failing to report suspicious transactions tied to darknet markets and fraud.
Earlier in the year, FINTRAC also imposed penalties on offshore platforms KuCoin and Binance for similar breaches.
As a self-regulatory body, CIRO has the authority to investigate misconduct among its members and impose sanctions, including fines and suspensions.
As reported, Canada is preparing to roll out its first comprehensive framework for fiat-backed stablecoins under the 2025 federal budget, closely mirroring the regulatory path taken by the United States earlier this year.
The Bank of Canada is expected to spend $10 million over two years, starting in fiscal year 2026–2027, to oversee the rollout.
The move comes just months after the US passed its GENIUS Act in July, a landmark stablecoin bill that heightened global regulatory momentum.
