CSA/IIROC Staff Notice 21-329: Crypto Trading Platform Guidance

The regulatory treatment described in Staff Notice 21-329 depends on a platform’s functions and business model. The notice separates covered platforms into two main categories:

• Dealer Platforms commonly act as counterparty to client trades, facilitate primary distributions, onboard retail clients, act as agent, or provide custody.
• Marketplace Platforms bring together orders from multiple buyers and sellers using established, non-discretionary methods. A platform may also perform dealer functions and therefore face both marketplace and dealer requirements.

A platform that performs clearing functions may additionally require recognition, registration or exemptive relief as a clearing agency or clearing house. Foreign platforms with Canadian clients are also expected to comply with Canadian securities legislation.

For Dealer Platforms, the appropriate registration category depends on their activities. A platform limited to exempt distributions or trading of Security Tokens without margin or leverage may fit an exempt-market-dealer or, in some circumstances, restricted-dealer category. Dealer Platforms trading Crypto Contracts for retail individuals were generally expected to pursue investment-dealer registration and IIROC membership, now CIRO membership.

Marketplace Platforms are addressed through concepts drawn from National Instrument 21-101, National Instrument 23-101 and National Instrument 23-103, together with market-integrity requirements based on the Universal Market Integrity Rules. A platform exercising exchange-like regulatory functions may need exchange recognition or an exemption. Tailored requirements or discretionary relief are assessed case by case and may include limits on products, client types, activity or investment amounts.

The original notice contemplated a generally two-year interim route under which certain platforms could operate as restricted dealers or exempt market dealers while transitioning. The August 2024 CSA/CIRO statement means that route should now be treated as historical general policy, although regulators left room for case-specific discussions with applicants already working toward full registration.

Staff Notice 21-329 organizes its risk guidance around safeguards that regulators may apply through registration, recognition or exemptive-relief terms. Principal areas include:

• Custody: segregation of client assets and private keys, reliable records, key-management and cold-storage controls, sufficient financial resources and insurance or alternative risk mitigation, custodian due diligence and independent assurance over controls.
• Systems: resilient trading, surveillance and clearing systems, cybersecurity controls, business-continuity planning and, where applicable, independent systems reviews.
• Transparency: public information about operations, fees, access, ownership, custody, conflicts, trading rules, token admission or removal, and treatment of forks and airdrops.
• Market conduct and clients: surveillance for manipulation and deceptive trading, know-your-client and suitability obligations where applicable, anti-money-laundering and counter-terrorist-financing policies, and management and disclosure of conflicts.

The notice remains a foundational statement of how Canadian securities regulators analyze crypto trading platforms, but it must be read with later measures. CSA Staff Notice 21-332 added enhanced pre-registration undertaking expectations in 2023, including stronger custody and segregation commitments and a prohibition on margin, credit or leverage for Canadian clients. CSA Staff Notice 21-333 added interim conditions for certain value-referenced crypto assets.

No enacted or statutory effective date applies to Staff Notice 21-329: it is guidance organizing existing requirements, and the BCSC instrument page leaves the effective-date field blank. Its publication date, current listing and the August 2024 transition update are therefore the most useful status markers.