Canada’s top investment industry regulator announced new rules on digital asset custody aimed at preventing future losses arising from hacking, fraud, and inadequate governance.
The Canadian Investment Regulatory Organization’s (CIRO) Digital Asset Custody Framework, published on Tuesday, sets clear expectations for how dealer members operating crypto asset trading platforms (CTPs) must safeguard crypto assets.
CIRO said the framework will be enforced through the terms and conditions of membership as an interim measure, allowing for quicker adaptation to emerging risks while broader, permanent rules are developed.
The self-regulatory industry organization noted that the rules address “technological, operational, and legal risks unique to digital assets,” drawing lessons from past incidents like the 2019 collapse of QuadrigaCX that led thousands of people to lose their life savings.
Tiered structure
As its core feature, the framework introduces a tiered, risk-based structure for crypto custodians, categorizing them into four tiers based on factors such as capital levels, regulatory oversight, insurance coverage, and operational resilience.
The tiers determine the proportion of client assets a custodian can hold — up to 100% for top-tier custodians with the strongest safeguards, and down to 40% for baseline Tier 4. Meanwhile, internal custody by dealer members is capped at 20% of the value of crypto assets they hold for clients.
Additional requirements include robust governance policies covering key management, cybersecurity, incident response, and third-party risks, as well as mandatory insurance, independent audits and security compliance reports, and regular penetration testing. Custody agreements must also clearly establish liability for losses arising from negligence or preventable failures, the framework states.
“The framework reflects a risk-based and proportionate approach designed to balance investor protection with market innovation and competition,” CIRO said. It was developed in consultation with industry stakeholders, including CTPs and custodians, and in consideration of international practices.
This move aims to bolster Canada’s efforts to strengthen investor protections in the country’s evolving crypto market while supporting responsible innovation.
Last October, the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) fined local crypto exchange Cryptomus around $126 million for failing to report over 1,000 suspicious transactions linked to darknet markets and wallets involved with fraud, ransomware payments, and sanctions evasion. It also fined offshore exchanges KuCoin and Binance earlier in the year for similar reasons.
CIRO is a self-regulatory body with enforcement authority over its member firms and individual registrants, and is empowered to investigate misconduct and impose disciplinary actions, including fines and suspensions.
© 2026 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.