Catenaa, Friday, February 06, 2026- Canada’s investment industry regulator unveiled new rules for digital asset custody, aiming to prevent losses from hacking, fraud, and governance failures.
The Canadian Investment Regulatory Organization (CIRO) published its Digital Asset Custody Framework on Tuesday.
The framework applies to dealer members operating crypto trading platforms and will initially be enforced through membership terms, allowing rapid response to emerging risks while permanent regulations are developed.
The framework introduces a tiered, risk-based system for custodians, ranking them from Tier 1 to Tier 4 based on capital, regulatory oversight, insurance coverage, and operational resilience.
Top-tier custodians may hold 100% of client assets, while Tier 4 custodians are capped at 40%. Dealer members’ internal custody is limited to 20% of client assets.
Additional requirements include governance policies covering key management, cybersecurity, incident response, and third-party risks. Custodians must also maintain insurance, submit independent audits and compliance reports, perform regular penetration testing, and clearly define liability for preventable losses.
CIRO said the rules balance investor protection with market innovation and competition. The framework draws on lessons from prior failures, such as the 2019 collapse of QuadrigaCX, and incorporates feedback from industry participants and international standards.
The move comes amid heightened regulatory scrutiny in Canada. FINTRAC fined domestic exchange Cryptomus $126 million last October for failing to report suspicious transactions, while offshore platforms KuCoin and Binance faced similar penalties earlier in 2025.
CIRO has authority to investigate misconduct and impose fines, suspensions, or other disciplinary actions on member firms and registrats.
