SKN |  Canada’s investment watchdog rolls out crypto custody rules to avoid another QuadrigaCX

Canada’s investment industry regulator has introduced a new set of crypto custody rules aimed squarely at preventing a repeat of past failures such as the collapse of QuadrigaCX, one of the country’s most infamous crypto scandals.

The Canadian Investment Regulatory Organization (CIRO) said its Digital Asset Custody Framework takes effect immediately and is designed to tighten standards around how crypto assets are held, safeguarded and governed by registered firms. The regulator framed the move as part of an effort to respond more quickly to emerging risks in the digital asset market, including hacking, fraud, weak governance and insolvency.

Learning from QuadrigaCX

The 2019 collapse of QuadrigaCX remains a defining moment for Canada’s crypto regulation. More than $123 million in customer assets were left unaccounted for after the exchange failed, following the death of its CEO Gerald Cotten. Subsequent investigations found serious governance failures and alleged misconduct during the period when customer funds went missing.

CIRO officials said custody failures like QuadrigaCX highlighted the need for clearer, enforceable standards around how client crypto assets are stored and controlled.

“Custody is one of the most critical points of risk in the crypto ecosystem,” said Alexandra Williams, CIRO’s senior vice president of strategy, innovation and stakeholder protection, underscoring why the regulator is focusing on this area first.

A tiered, risk-based approach

Rather than imposing a single rigid model, CIRO’s framework introduces a tiered, risk-based structure for digital asset custody. The goal is to allow crypto trading platforms and custodians to innovate, while still meeting higher expectations around asset segregation, governance, operational resilience and protection against loss.

CIRO said many of the expectations in the framework were developed in close consultation with crypto trading platforms and custodians, and in several cases reflect practices already being used. Transition timelines, the regulator added, will be handled on a case-by-case basis to avoid unnecessary disruption.

According to CIRO, the balance it is trying to strike is flexibility without compromising investor protection, particularly as custody models evolve and new technologies are adopted.

Ongoing updates promised

The regulator emphasized that the framework is not static. CIRO said it will actively monitor emerging custody and cybersecurity risks, repeated supervisory issues across firms and broader shifts in market practices as signals that the rules may need to be updated.

“If we see that expectations are no longer aligned with how custody risk is manifesting in practice, CIRO would update the framework proactively, rather than wait for a failure to occur,” a spokesperson said.

This forward-looking stance reflects Canada’s broader approach to crypto regulation, which has generally favored caution. The country has brought crypto trading platforms under existing securities rules and placed heavy emphasis on registration, custody and disclosure. More recently, federal discussions around stablecoins and an expanded oversight role for the Bank of Canada suggest a gradual move toward a more comprehensive national digital asset framework.

CIRO, which has quasi-judicial authority to investigate misconduct and impose fines, suspensions or permanent bans, said the new custody rules are intended to reduce the likelihood that Canadian investors face another large-scale crypto loss rooted in poor controls and opaque asset handling.