Canadian Regulator Sets Tighter Crypto Custody Standards to Curb Losses

Canada’s top investment industry watchdog has rolled out a new set of rules aimed at tightening how crypto assets are held and safeguarded, as regulators move to limit losses linked to hacks, fraud, and weak governance.

The Canadian Investment Regulatory Organization (CIRO) on Tuesday published its Digital Asset Custody Framework, outlining detailed expectations for dealer members that operate crypto asset trading platforms.

The framework is designed as an interim measure and will be enforced through membership terms and conditions, allowing CIRO to react more quickly to emerging risks while longer-term rules are developed.

Canada Introduces Tiered Custody Rules

CIRO said the framework directly addresses the “technological, operational, and legal risks unique to digital assets,” drawing on lessons from past failures, including the collapse of QuadrigaCX in 2019, which left thousands of customers unable to recover funds.

At the core of the new regime is a tiered, risk-based structure for crypto custodians. Under the model, custodians are placed into one of four tiers based on factors such as capital strength, regulatory oversight, insurance coverage, and operational resilience.

Top-tier custodians may hold up to 100% of client crypto assets, while lower-tier providers face progressively tighter limits, with Tier 4 custodians capped at 40%.

Dealer members that choose to custody assets internally are limited to holding no more than 20% of the total value of client crypto.

The framework also imposes a broad set of operational requirements. These include formal governance policies covering private key management, cybersecurity controls, incident response procedures, and third-party risk management.

CIRO has published a new Digital Asset Custody Framework, setting clear expectations for the custody of #digitalassets by Dealer Members operating  #cryptoplatforms (CTPs) in Canada. Read more in our news release: https://t.co/E0MFRnwnfN pic.twitter.com/3hzlg4yZ2u

— CIRO / OCRI (@CIRO_OCRI) February 3, 2026

Custodians must carry insurance, undergo independent audits, provide security compliance reports, and conduct regular penetration testing.

Custody agreements are required to spell out liability in cases where losses stem from negligence or preventable failures.

CIRO said the approach is intended to be proportionate, balancing stronger investor protection with room for innovation and competition.

The rules were developed in consultation with crypto trading platforms, custodians, and other industry participants, and were benchmarked against international practices.

Canada Steps Up Crypto Enforcement After Major FINTRAC Fines

The move comes amid heightened scrutiny of crypto compliance in Canada. In October, the country’s financial intelligence agency, FINTRAC, fined local exchange Cryptomus roughly $126 million for failing to report suspicious transactions tied to darknet markets and fraud.

Earlier in the year, FINTRAC also imposed penalties on offshore platforms KuCoin and Binance for similar breaches.

As a self-regulatory body, CIRO has the authority to investigate misconduct among its members and impose sanctions, including fines and suspensions.

As reported, Canada is preparing to roll out its first comprehensive framework for fiat-backed stablecoins under the 2025 federal budget, closely mirroring the regulatory path taken by the United States earlier this year.

The Bank of Canada is expected to spend $10 million over two years, starting in fiscal year 2026–2027, to oversee the rollout.

The move comes just months after the US passed its GENIUS Act in July, a landmark stablecoin bill that heightened global regulatory momentum.