The Canadian Investment Regulatory Organization (CIRO) issued immediate interim guidance Tuesday that strictly limits how much crypto a trading platform can hold in-house. The new Digital Asset Custody Framework introduces a four-tier system for third-party custodians and caps dealer members’ self-custody at 20% of client assets, a direct move to force reliance on regulated, well-capitalized vaults.
The Tiered Risk Structure
CIRO’s framework abandons a one-size-fits-all approach for a graduated model based on capital depth and regulatory status. The regulator explicitly links custody limits to a firm’s balance sheet:
- Tier 1 & 2 (100% Limit): Custodians meeting the highest capital thresholds ($100 million for Tier 1 Canadian entities) and SOC 2 Type 2 assurance standards can hold 100% of a dealer’s client assets.
- Tier 3 (75% Limit): Custodians with lower capital buffers (min. $10 million for Canadian firms) are capped at holding three-quarters of a dealer’s book.
- Tier 4 (40% Limit): Baseline custodians are restricted to a minority share of assets.
For foreign custodians, the bar is higher. Tier 4 foreign entities must maintain at least $150 million in capital to offset cross-border enforcement risks.
Forcing Institutional Maturity
The 20% self-custody cap is the framework’s most aggressive component. By forcing dealers to offload 80% of assets to third-party qualified custodians, CIRO is effectively dismantling the vertical integration model that contributed to catastrophic failures like QuadrigaCX and FTX.
“This graduated approach allows dealer members to diversify custody arrangements while avoiding over-concentration at crypto custodians with lower risk capacity,” the guidance note stated.
The rules take effect immediately as terms of membership, bypassing the lengthy standard rulemaking process. This "interim" status allows CIRO to adjust capital requirements real-time as market volatility shifts, rather than waiting for legislative amendments.
