CIRO Mandates New Custody Framework Effective Immediately
On February 3, 2026, The Canadian Investment Regulatory Organization (CIRO) rolled out a new Digital Asset Custody Framework, imposing stricter standards on how crypto trading platforms hold client assets. The rules, which take effect immediately, create a tiered, risk-based structure for custody. This approach is intended to provide flexibility for firms to innovate while strengthening safeguards against the primary risks in the digital asset space, including hacking, weak governance, and fraud. A CIRO spokesperson confirmed that many of the new expectations were developed in consultation with crypto platforms and that transition periods will be considered on a case-by-case basis.
Framework Targets QuadrigaCX-Style Risk After $123M Loss
The new regulations are a direct response to catastrophic failures in Canada's crypto market, most notably the 2019 collapse of the QuadrigaCX exchange. The incident left $123 million in customer funds unaccounted for after the sudden death of its CEO, exposing severe operational and security flaws. CIRO's new framework is explicitly designed to prevent a repeat of such an event by providing the regulator with tools to react more quickly to emerging threats before a failure occurs.
Custody is one of the most critical points of risk in the crypto ecosystem.
— Alexandra Williams, CIRO’s Senior Vice President of Strategy, Innovation and Stakeholder Protection.
This move reinforces Canada's cautious regulatory posture toward the crypto industry, which prioritizes investor protection through stringent registration and disclosure requirements. By formalizing custody standards, regulators aim to build a more resilient market infrastructure and increase investor confidence.
