The Canadian Investment Regulatory Organization (CIRO) has issued new guidance on digital asset custody by dealer members running crypto-asset trading platforms.
“Custody is one of the most critical points of risk in the crypto ecosystem,” Alexandra Williams, senior vice-president of strategy, innovation and stakeholder protection at CIRO, said in a release on Tuesday. “This new framework gives firms the flexibility to operate and innovate responsibly.”
The interim guidance note, which the regulator hopes to eventually replace with permanent rules, outlines specific requirements for security, reporting and institutional-grade infrastructure for digital asset custody.
The crypto custodian requirements are laid out in a tiered system, which is based on how much a custodian manages in terms of client assets and links custody limits directly to crypto custodian capability and risk profile, as observed below.
- Tier 4 custodians meet basic requirements for limited custody exposure. They may hold up to 40% of a dealer member’s crypto assets.
- Tier 3 custodians have more robust requirements and may hold up to 75% of a dealer member’s crypto assets.
- Tier 2 custodians meet the highest standards for regulatory oversight, insurance and operational resilience, and can hold 100% of a dealer member’s crypto assets.
- Tier 1 custodians also meet the highest standards for enhanced controls, tech assurance and capital requirements. They may also hold 100% of a dealer member’s crypto assets.
“This graduated approach allows dealer members to diversify custody arrangements while avoiding over-concentration at crypto custodians with lower risk capacity,” the guidance note said.
Dealer members can self-custody up to 20% of the value of crypto assets they hold for clients and their own account, with requirements for internal controls.
The guidance also identifies the minimum capital requirements for crypto custodians, depending on whether they’re established in Canada or outside of the country.
For Canadian custodians in tiers 2, 3 and 4, it’s expected that they must have at least $10 million in capital, while tier 1 Canadian custodians must have at least $100 million in capital. Foreign custodians in tiers 2, 3 and 4 are expected to have at least $100 million in capital, whereas tier 4 foreign custodians must have at least $150 million in capital.
Since crypto asset values can fluctuate significantly, the regulator said it expects dealer members to monitor asset values in their custody at least weekly to avoid unknowingly exceeding custody limits.
The guidance also specifies that tokenized assets, which represent traditional instruments like equities, bonds and deposits, continue to be governed by existing legislation, so they follow the traditional custody framework in addition to digital custody rules. The dual requirements ensure tokenized assets keep the legal characteristics of their traditional form while being protected in digital custody.
CIRO said it’ll amend classifications and requirements as necessary to align with the Canadian Securities Administrators to avoid any inconsistent or duplicative requirements.
“This approach allows CIRO to respond quickly to risks highlighted by past failures in the crypto sector, where contributions of losses, such as hacking, fraud, inadequate governance and insolvency, lead to investor vulnerability and losses,” the regulator said.