CIRO Crypto Custody Framework: Tiers, Limits and Evidence

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. CIRO’s interim framework, effective February 3, 2026, makes crypto platform dealers use approved custodians in four tiers, capped at 100%, 100%, 75% and 40% of their crypto. Dealers may self-custody up to 20%, under Tier 4 standards.

Watch: CIRO Crypto Custody Framework: Tiers, Limits and Evidence 1:43

Video transcript

Since February 3, 2026, CIRO dealers running crypto trading platforms must use approved custodians in four tiers, each with a cap on how much crypto it may hold.

Tiers 1 and 2 may hold up to 100 percent. Tier 3 is capped at 75 percent and Tier 4 at 40. The dealer itself may keep 20 percent.

Canadian custodians need at least 10 million Canadian dollars in capital, more for Tier 1. But CIRO's reported view is that capital alone does not address custody risk.

Tier placement turns on evidence: Type 2 assurance reports, independent penetration testing, insurance in a prescribed form, and regulator information sharing for Tiers 1 to 3.

Self-custody must meet Tier 4 requirements. So the dealer's own wallets need a SOC 2 Type 2 report covering signing, storage procedures, pentests and key ceremony records.

Key policies only count if the controls work. Generate keys offline in a recorded ceremony, keep most value cold, use a signing quorum no one person can meet, and prove recovery with a real restore.

CIRO expects weekly limit checks, but a price move alone can cause a breach. So value holdings daily, alert at 90 percent of a cap, keep a rebalancing runbook, and log every breach.

Guardian's custody and key management reviews produce the evidence each tier asks for. Read the full guide, or talk to Guardian at guardian.security.

On February 3, 2026, the Canadian Investment Regulatory Organization (CIRO) published its Digital Asset Custody Framework. The guidance note took effect the same day.

It covers dealer members that operate crypto-asset trading platforms (CTPs). Approved custodians sit in four tiers, and each tier caps how much of a dealer’s crypto it may hold.

Tier placement turns on capital, oversight and evidence: assurance reports, pentests, insurance and key controls. This guide covers the tiers and that evidence.

This article explains the technical and security side of CIRO’s Digital Asset Custody Framework. It is not legal advice; confirm how it applies to you with counsel.

Status and Scope

CIRO’s release says the requirements “will be imposed through terms and conditions of membership.” CIRO calls the framework interim, pending permanent rules.

McCarthy Tétrault notes that platforms applying for dealer membership must show compliance too.

The framework splits digital assets in two:

Crypto assets, held with tiered custodians or internally.
Tokenized assets, including stablecoins, held with an Acceptable Securities Location plus digital safeguards.

This guide covers crypto assets. As McMillan notes, custodians need not join CIRO, but must meet its criteria to be approved.

Investment Executive reports that CIRO will amend the classifications as needed to align with the Canadian Securities Administrators (CSA).

For the federal stablecoin rules, see our guide to the Canada Stablecoin Act.

The Four Custodian Tiers

Each tier caps the share of a dealer’s crypto one custodian may hold. CIRO wants to avoid “over-concentration at crypto custodians with lower risk capacity.”

Holder	Maximum share	What sets it apart
Tier 1	100%	Highest capital; enhanced oversight, technology and resilience controls
Tier 2	100%	Lower capital; highest oversight, insurance and resilience standards
Tier 3	75%	Tier 2 capital; lighter technology and cyber assurance
Tier 4	40%	Baseline requirements; the benchmark for internal custody
Dealer itself	20%	Internal custody, held to Tier 4 standards

Canadian custodians need at least C$10 million in capital, or C$100 million for Tier 1.

McCarthy Tétrault and the Canadian Web3 Council put foreign custodians at C$100 million, or C$150 million for Tier 1.

Capital alone does not settle it. The Canadian Web3 Council reports that CIRO can require a Tier 1 custodian to meet Tier 2 standards.

The Council also reports CIRO’s view that capital thresholds alone do not address crypto custody risk.

What Custodians Must Evidence

The tier criteria mix capital, regulation and proof that controls work. Summaries by McMillan, McCarthy Tétrault and the Canadian Web3 Council list, among others:

SOC 2 or ISAE 3000 Type 2 assurance reports;
independent penetration testing;
insurance in a prescribed form; and
information-sharing arrangements with a regulator, for Tiers 1 to 3.

Assurance is where the tiers part. Tier 3 faces lighter technology assurance, cybersecurity and resilience requirements than Tier 2.

McMillan adds three details from CIRO’s table:

Tier 2 needs more assurance than Tier 1, since it may hold 100% with less capital.
Tier 2 must evidence third-party risk and continuity controls; Tier 3 may give a representation.
Tiers 3 and 4 may use specie insurance for cold storage.

The Block reported that the framework requires governance policies on key management, cybersecurity, incident response and third-party risk.

It added that custody agreements must set out liability for losses from negligence or preventable failures.

Read each Type 2 report closely. Check that its scope covers the wallet and signing systems, not just corporate IT, and that its period is recent.

Then read the complementary user entity controls. Those are the controls the dealer must run itself. Our guide to SOC 2 for crypto companies covers scoping.

Internal Custody

A dealer may hold crypto itself, up to 20% of the value it holds for clients and its own account.

The Canadian Web3 Council notes that proprietary positions funded from risk-adjusted capital fall outside the cap.

Internal custody must use satisfactory custody technology and meet Tier 4 requirements. McCarthy Tétrault reads that as the same SOC 2 reporting and storage procedures a Tier 4 custodian needs.

So the dealer’s own wallet stack needs the evidence it would ask of a custodian:

a SOC 2 Type 2 report whose scope covers wallets and signing;
written storage procedures for each wallet type;
a pentest of every system that can move funds; and
ceremony records for every key in use.

For what to ask of an outside custodian, see our guide to choosing a crypto custodian.

Keys and Segregation

CIRO expects dealers to run daily segregation calculations.

McCarthy Tétrault adds that CIRO does not prescribe how to segregate. It wants client assets identifiable, traceable and recoverable in an insolvency, with deficiencies resolved promptly.

Next, the keys. A key management policy only counts if the controls behind it work. In our view, that means:

Generation. Keys or shares created offline, in a recorded key ceremony.
Storage. Most value in cold storage; hot wallets sized to daily outflows.
Signing. A quorum no single person can meet, with signers seeing the full transaction.
Recovery. Backups proven by an actual restore, on a schedule.
Addresses. An inventory mapping each wallet to client or firm assets.
Access. Departed staff and lost devices removed from the quorum the same day.

Monitoring the Limits

CIRO expects dealers to check the value held at each custodian at least weekly, so they never unknowingly exceed a limit.

Breaches must be reported and remediated. Repeated or unresolved breaches can bring supervisory action.

McCarthy Tétrault adds that dealers also report holdings and custody locations, at a frequency CIRO sets.

It lists the possible responses: custody restrictions, lower limits or an Early Warning Level 2 designation.

Limits are measured by value, so a price move can breach one without a single transfer. Weekly is the floor; build for daily.

Value each custodian’s holdings daily from your own price source.
Alert well before a cap, for example at 90% of it.
Keep a rebalancing runbook with pre-approved destination wallets.
Log each breach: when found, when fixed, when CIRO was told.

How Guardian Helps

Guardian’s regulatory compliance assessments cover custody and safeguarding: segregation, key generation and storage, signing thresholds, cold storage ratios and recovery.

Key generation, storage, use and compromise response are levelled against the CryptoCurrency Security Standard (CCSS). Each custody provision gets the control that meets it, the evidence that proves it, and any gap.

A Guardian OpSec audit maps where keys live, who holds which share and what a quorum requires in practice.

For institutions, Guardian also pentests the cloud accounts, web apps, APIs and SDKs on the path to custody. The legal reading stays with your counsel.

Frequently Asked Questions

When did CIRO's Digital Asset Custody Framework take effect?

On February 3, 2026. CIRO said the guidance note was effective immediately and that the requirements are imposed through terms and conditions of membership. CIRO describes the framework as interim, pending permanent rules.

How much crypto can each custodian tier hold?

Tier 1 and Tier 2 custodians may hold up to 100% of a dealer member's crypto assets, Tier 3 up to 75% and Tier 4 up to 40%. A dealer may hold up to 20% itself, under Tier 4 standards.

Can a CIRO dealer member keep crypto in its own wallets?

Yes, up to 20% of the value of crypto it holds for clients and its own account. That internal custody must use satisfactory custody technology and meet the requirements that apply to Tier 4 custodians.

How often must custody limits be checked?

At least weekly, CIRO expects, so a dealer never unknowingly exceeds a limit. Breaches must be reported and remediated, and repeated or unresolved breaches can bring supervisory action. Because limits are measured by value, daily checks are safer.

Sources

Get your custody evidence tier-ready

Guardian tests the keys, signing and systems behind your custody arrangements and maps the evidence to what CIRO’s tiers ask for.

Talk to Guardian Explore institutional security