Canada Tightens Cryptocurrency Custody Rules

Canada is introducing new cryptocurrency custody rules aimed at strengthening investor protection and reducing the risk of losses.

The Canadian Investment Regulatory Organization (CIRO) has announced new requirements for how brokerage firms operating digital asset trading platforms store cryptocurrencies. The new guidelines, known as the Digital Asset Custody Framework, are designed to standardize client asset protection and limit potential losses.

According to the regulator, the changes are intended to better safeguard investors against hacking attacks, fraud, and weak internal controls. Initially, the rules will be implemented as interim membership conditions, allowing regulators to respond more quickly to emerging risks before permanent regulations are established.

A key feature of the new framework is its risk-based approach. Crypto asset custodians are divided into four tiers. The safest institutions may hold 100% of client assets, while those in the lowest tier are limited to just 40%. If assets are held directly within the brokerage firm itself, the cap is set at 20% of total client funds.

The framework also requires firms to implement robust governance standards, including controls over cryptographic keys, cybersecurity measures, incident response procedures, and third-party risk management. Mandatory safeguards include insurance coverage, independent audits, security reports, and regular penetration testing. Custody agreements must clearly define liability for losses resulting from negligence.

CIRO emphasizes that the new rules are intended not only to enhance investor protection but also to support innovation in the digital asset market. The framework draws on lessons learned from the QuadrigaCX case, which exposed significant weaknesses in digital asset management practices.