CIRO unveils new crypto custody framework for Canadian trading platforms

In a bid to respond more “quickly to crypto failures,” such as the collapse of QuadrigCX, Canada’s top investment industry regulator rolled out a new digital asset custody rules tightening standards on digital asset custody.

The industry-led Canadian Investment Regulatory Organization (CIRO) said its new Digital Asset Custody Framework is designed to allow it to respond more quickly to risks, including hacking, fraud, weak governance and insolvencies that have left investors exposed in past incidents.

“Many of the expectations in the framework were developed in close consultation with [crypto-asset trading platforms] and their custodians and reflect practices already in place,” a CIRO spokesperson told CoinDesk, adding that transition considerations will be applied on a case-by-case basis.

“The new framework also provides a balance between flexibility and risk management, supporting innovation while ensuring strong investor protection,” the spokesperson added.

Deeply involved in the collapse

The collapse of QuadrigaCX in 2019 remains one of the most notorious failures in Canada’s crypto history, with $123 million still unaccounted for. Its CEO, Gerald Cotten, died, and customer funds were found to be missing. Later investigations described co-founder Michael Patryn as allegedly being deeply involved in the exchange’s operations during the period when misappropriations occurred.

“Custody is one of the most critical points of risk in the crypto ecosystem,” said Alexandra Williams, CIRO’s senior vice president of strategy, innovation and stakeholder protection.

A central feature of the guidance is a tiered, risk-based structure that allows firms to diversify and strengthen custody arrangements while maintaining robust investor protections.

Early signs that expectations must be updated

CIRO said it would treat emerging custody and cyber risks, repeated supervisory issues across firms, or shifts in market practices as early warning signs that expectations may need to be updated.

“If we see that expectations are no longer aligned with how custody risk is manifesting in practice, CIRO would update the framework proactively, rather than wait for a failure to occur,” the regulator said.

Canada has taken a cautious approach to crypto regulation, bringing trading platforms under existing securities rules and emphasizing investor protection through registration, custody and disclosure requirements. More recently, federal moves on stablecoins and an expanded oversight role for the Bank of Canada suggest a slow shift toward a broader national framework for digital assets.

CIRO, a self-regulatory body that set standards for investment dealers, mutual fund dealers and trading activity in Canada, possessing the quasi-judicial authority to investigate misconduct and enforce disciplinary actions, including fines, suspensions, and permanent bans.