The Canadian Investment Regulatory Organization, or CIRO, has issued a new Digital Asset Custody Framework that sets out how client digital assets must be held by Dealer Members operating crypto-asset trading platforms in Canada. The guidance covers cryptocurrencies, tokenized assets, and stablecoins, and it takes immediate effect.
A tiered structure for custody risk
CIRO said the framework uses a tiered, risk-based model. Firms are given room to design custody arrangements that fit their business models and technology stacks, but the standard for protecting client assets is not relaxed. The guidance focuses on how assets are safeguarded, how segregation is maintained, and how oversight should work when a platform relies on a third-party custodian.
The regulator said the framework was developed with input from industry participants and informed by regulatory developments in other jurisdictions. In CIRO’s view, digital asset custody brings a set of technological, operational, and legal risks that cannot be treated as a simple extension of traditional securities custody.
Past crypto failures shaped the new guidance
CIRO directly tied the framework to weaknesses exposed by earlier failures across the crypto sector. The regulator pointed to losses linked to hacking, fraud, weak governance, and insolvency. It said shortcomings in custody arrangements have been a major source of investor harm during periods of market stress, which is why the new guidance raises expectations around asset segregation and supervision, especially where custody is outsourced.
CIRO also highlighted several risks specific to digital assets. Private key management is one. Dependence on technology infrastructure is another. Cross-border legal enforceability also remains a challenge. Those issues sit at the center of the new framework and explain why the regulator chose to publish more explicit custody expectations.
Custody oversight moves into focus for 2026
Reviewing and strengthening custody requirements for crypto assets held by CIRO Members operating crypto trading platforms has already been identified as one of the regulator’s public priorities for 2026. The release of the framework shows that custody will remain a key area of supervisory attention.
Because the guidance is already in force, affected firms are expected to assess their current custody models against the new standards without delay. CIRO said members will need to show that their arrangements align with the framework as part of ongoing oversight. Instead of creating a standalone rule change, the regulator is applying the framework through membership terms and conditions, a structure it said allows a faster response as digital asset markets keep changing.