Canada tightens crypto-asset custody rules across the board, moving to prevent a repeat of 'QuadrigaCX'

Canada’s investment regulators have moved to curb investor losses stemming from hacks, fraud and weak internal controls by immediately implementing a new regulatory framework governing crypto-asset custody.

According to CoinDesk on the 3rd (local time), CIRO (the Canadian Investment Regulatory Organization), Canada’s self-regulatory body for investment regulation, said it has introduced the “Digital Asset Custody Framework” targeting crypto trading platforms and custodians, and that it will take effect immediately.

CIRO said the framework was designed to respond more swiftly to risks that have repeatedly surfaced in crypto markets in the past—such as hacking, fraud, weak governance and insolvency—citing the 2019 collapse of QuadrigaCX as a representative failure case.

At the heart of the new guidance is a risk-based, phased custody structure. It aims to reduce reliance on a single custody model while enabling more diversified and sophisticated asset safekeeping methods, alongside stronger investor-protection standards. The strategy is to manage custody risks without stifling innovation.

A CIRO official said many of the standards included in the framework were developed through close consultations with crypto trading platforms and custodians, and reflect to a significant extent practices already in use in the market. “The goal is to support innovation while ensuring robust investor protection by striking a balance between flexibility and risk management,” the official added.

CIRO said it will proactively update the framework if new custody or cyber risks emerge or if recurring issues are identified during supervision, treating them as early warning signals. This clarifies a regulatory approach centered on preventive action rather than post-incident response.

QuadrigaCX is regarded as the worst incident in the history of Canada’s crypto market, after roughly $123 million in customer assets disappeared at the time of its bankruptcy in 2019. Customers lost access to their assets following the death of CEO Gerald Cotten, and subsequent investigations also raised suspicions that co-founder Michael Patryn was deeply involved in exchange operations during the period when funds were allegedly misappropriated.

Canada has so far maintained a conservative regulatory stance by bringing crypto trading platforms under the existing securities regulatory framework, focusing on registration, custody and disclosure requirements. More recently, discussions around stablecoins and moves to expand the Bank of Canada’s supervisory role have also emerged, fueling talk of a potential shift toward a more comprehensive digital-asset regulatory regime.