Canada’s investment regulator CIRO introduces framework for crypto asset custody

The Canadian Investment Regulatory Organization (CIRO), a national, non-profit, self-regulatory organization, has introduced a new regulatory framework for crypto custody to mitigate future risks arising from security breaches, fraud, and weak governance.

Regarding this new regulatory framework, the CIRO issued a statement dated Tuesday, February 3, publicly announcing the release of its Digital Asset Custody Framework, which clearly outlines how dealer members operating crypto asset trading platforms (CTPs) should ensure robust protection of digital assets.

Canada’s top investment industry regulator further explained that the implementation of this framework will be managed temporarily through membership terms and conditions. They preferred this option because it enables fast adjustments to new risks while permanent regulations are being established. 

The CIRO implements a new regulatory framework to safeguard clients’ assets 

The Canadian Investment Regulatory Organization noted that the newly released regulatory framework addresses risks associated with technology, operations, and legal activities, particularly those related to digital assets. 

Following their statement, sources familiar with the situation, speaking on condition of anonymity, revealed that the regulatory agency is trying to avoid scenarios such as the 2019 failure of QuadrigaCX, which resulted in significant losses.

Notably, a core component of the framework is a tiered, risk-based approach for crypto custodians that divides them into four tiers based on specific factors such as capital levels, regulatory oversight, insurance coverage, and operational strength. 

These tiers determine the maximum client assets a custodian can hold. For instance, the limit for top-tier custodians with the best protections is up to 100% while that of the lowest Tier 4 is down to 40%.  Moreover, dealer members may hold up to 20% of their managed client crypto assets.

Apart from these limitations, some additional requirements include firm governance policies that structure governance, ensuring compliance with key management operations, cybersecurity, incident response, and third-party risks. Furthermore, mandatory insurance, independent audits, security compliance reports, and regular penetration testing are also considered essential.

On the other hand, the framework outlined that custody agreements must clearly define liability for any losses resulting from breach of duty or lack of reasonable care.

“The framework takes a risk-based and balanced approach aimed at protecting investors while encouraging market innovation and competition,” CIRO said.

While establishing this framework, the regulatory agency considered contributions from industry partners, such as CTPs and custodians, while also embracing global standards.

It is worth noting that the main aim of this initiative is to strengthen the country’s efforts to enhance investors’ safeguards in the rapidly evolving crypto market, thereby fostering responsible innovation.

Regulatory agencies call to address crypto-related crimes

Reports highlighted that criminal activities in the crypto industry have surged as cryptocurrencies become increasingly popular among individuals. 

To support this claim, sources noted the incident in which the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) assessed a roughly $12 million penalty against local crypto exchange Cryptomus last October for failing to report over 1,000 suspicious transactions linked to darknet markets and wallets. These transactions were reportedly linked to fraud, ransomware payments, and sanctions evasion. 

Apart from Cryptomus, reports also noted that FINTRAC imposed significant penalties on offshore exchanges KuCoin and Binance earlier this year for the same issue. Reports clarified that CIRO functions as a self-regulatory organization with regulatory power to ensure compliance from member firms and individual registrants. The regulatory agency is authorized to investigate allegations of misconduct and to initiate disciplinary proceedings, including fines and suspensions. 

The smartest crypto minds already read our newsletter. Want in? Join them.