Crypto Custody Rules: CIRO Framework Tightens Canada

Canadian regulators are tightening oversight of trading platforms as new crypto custody rules reshape how client assets must be stored and supervised.

CIRO launches interim framework for digital assets

The Canadian Investment Regulatory Organization (CIRO) has issued an interim Digital Asset Custody Framework, setting out detailed expectations for how crypto assets held on trading platforms are safeguarded. The framework, published this week, introduces clear limits on where client assets may be stored and which entities are allowed to hold them.

According to CIRO, the measures are temporary but immediately binding because they are applied through membership conditions. However, the regulator plans to use this interim phase to prepare more permanent rules that will govern crypto asset custody in Canada.

Four-tier structure for custodians

Under the notice, custodians are grouped into a custody tiered system with four levels, based on capital strength, insurance coverage, and operational safeguards. Tier 1 and Tier 2 providers that meet higher standards may hold up to 100% of a Dealer Member‘s client crypto, giving top-rated custodians the broadest permissions.

Moreover, Tier 3 custodians face a lower cap, while Tier 4 custodians are limited to a maximum of 40% of a Dealer Member’s client assets. The structure is designed to align the amount of crypto a custodian can hold with its financial resilience and risk controls, reducing the chance that weaker firms become central points of failure.

Dealer Members that opt to hold assets directly are restricted to just 20% of client assets under strict operational and risk management conditions. That said, this ceiling is meant to discourage overreliance on in-house storage and encourage use of stronger third-party custodians.

Governance, cyber security and insurance tightened

The guidance raises expectations on governance, cyber security, insurance, third-party risk assessments, and audit oversight. Custody agreements must clearly define responsibilities, including who bears the loss if assets are stolen or go missing. Moreover, CIRO emphasizes that boards and senior management must understand and actively oversee crypto custody arrangements.

Reports highlight that third party risk checks will become a core part of regulatory scrutiny. However, platforms are also expected to maintain robust internal controls, including segregation of duties, incident response processes, and comprehensive documentation of custody workflows and key decision points.

CIRO notes that these measures are being put in place to avoid a repeat of past Canadian crypto failures that left investors with substantial losses. The experience of earlier exchange collapses has pushed regulators to harden protections around storage and control of client assets.

Implications for trading platforms and clients

For smaller operators, the new approach to dealer member custody limits could be particularly challenging. Firms that previously relied on low-cost or lightly regulated custodians will now have to decide whether to connect with higher tier providers or scale back the volume of assets they hold, especially for self-custody models.

Moreover, upgrading custody relationships will likely increase operating costs and force more detailed engagement with regulators. CIRO is expected to review compliance documentation, contractual terms, and proof of insurance, making custody arrangements a central component of oversight for any canada crypto exchange regulation discussions.

In practical terms, some platforms may consolidate asset storage with larger, better-capitalized custodians. Others may adjust business models so that core trading services continue, while custody is outsourced under stricter standards and reporting duties.

Concentration limits and oversight of risk

The new custody concentration risk controls aim to prevent a single vulnerable custodian from holding a large share of client crypto across multiple platforms. By capping exposures, the framework seeks to limit systemic fallout if one custodian suffers a security breach, insolvency, or operational failure.

Furthermore, CIRO is applying these restrictions immediately through membership terms, rather than waiting for a full legislative overhaul of canada crypto regulation. This mechanism allows the watchdog to act quickly while a more comprehensive rulebook for digital assets is developed.

In the coming months, firms that operate crypto-asset trading platforms should expect CIRO to request documentation and proof of adherence to the digital asset custody framework. The regulator has signaled it will examine how firms classify custodians, measure exposures under the four tiers, and evidence ongoing monitoring of counterparties.

Raising the bar for crypto custody rules

Overall, the Canadian watchdog’s approach to crypto custody rules combines immediate protections with a phased path toward long-term regulation. The tiered structure, strict self-custody caps, and enhanced governance expectations all point to a more mature oversight regime for digital asset platforms operating in the country.

As CIRO refines this interim framework into permanent standards, trading platforms will have to adapt their systems, contracts, and risk practices. For clients, the changes are intended to deliver stronger safeguards for their assets and reduce the chances of losses when market infrastructure fails.