The Investment Regulatory Authority of Canada (CIRO) has announced a comprehensive new regulatory framework for cryptocurrency custody services, marking a significant step in formalizing digital asset protection standards. The "Digital Asset Custody Framework" establishes clear rules for member brokerage firms that operate cryptocurrency trading platforms (CTPs), mandating how they must safeguard client assets.
The primary goal of the framework is to prevent losses stemming from hacking, fraud, and poor corporate governance. CIRO stated it will implement these rules through membership terms as a temporary measure, allowing for a faster response to emerging risks while permanent regulations are being finalized.
At the core of the new regulation is a risk-based tiered system that categorizes crypto custody institutions into four levels. A custodian's tier is determined by criteria including capital strength, regulatory oversight, insurance coverage, and operational resilience. This tier directly dictates the percentage of client assets a custodian is permitted to hold.
Custodians achieving the highest security level (Tier 1) can hold 100% of client assets. This allowance decreases for lower tiers, dropping to just 40% for custodians classified in Tier 4. The framework also imposes strict limits on in-house custody by brokerage firms themselves, capping it at a maximum of 20% of the total value of client assets.
The rules mandate robust governance policies covering key management, cybersecurity, incident response, and third-party risk management. Additional compulsory requirements include insurance coverage, independent audits, regular security reports, and penetration testing. Custody agreements must now clearly define liability for losses resulting from negligence.
CIRO emphasized that this move aims to strengthen investor protection while still supporting innovation in the crypto sector. The regulator explicitly noted that lessons learned from the catastrophic collapse of the Canadian crypto exchange QuadrigaCX directly informed the development of this new framework.
