Insights from the OSC: Compliance Review of Crypto Platforms

Insights from the OSC: Compliance Review of Crypto Platforms

On December 10, 2024, the Ontario Securities Commission (“OSC”) released Staff Notice 33-757 – Review of Restricted Dealer Crypto Asset Trading Platforms’ Compliance with the Account Appropriateness, Investment Limits and Client Limits Requirements (the “Staff Notice”) summarizing the findings of their compliance review of six registered crypto asset trading platforms (“CTPs”) related to:  (i) account appropriateness assessments; (ii) investment limits; and (iii) client limits.  The Staff Notice sets out the findings of their compliance sweep and also sets out OSC Staff’s views on “suggested practices” for CTPs, with the aim that CTPs use the Staff Notice as a self-assessment tool to assist in strengthening their compliance with Ontario securities laws.  The Staff Notice also sets out OSC Staff’s expectation that CTPs comply with the “letter and spirit” of the requirements applicable to their platforms.

A Brief Background on CTPs

Canadian securities regulators have taken the position that Canadian securities laws apply to CTPs that facilitate or propose to facilitate the trading of instruments or contracts involving “crypto assets” (a general term commonly used by the securities regulators to capture a wide range of digital assets, such as Bitcoin and Ethereum).  This is because the customer’s contractual right to the crypto asset may constitute a security and/or a derivative (referred to as a “crypto contract” by the securities regulators) under Canadian securities laws.  Certain CTPs operating in Canada have been registered as a restricted dealer and granted exemptive relief from certain securities law requirements.  As a condition of the exemptive relief, among other requirements, CTPs are required to conduct certain client assessments and apply investment and client limits. For more general background information on the regulation of CTPs, please see our bulletin here.

Findings Related to Account Appropriateness Assessments

Section 13.3 of National Instrument 31-103 – Registration Requirements, Exemptions and Ongoing Registrant Obligation (“NI 31-103”) requires registrants, including  registered CTPs, to conduct trade-by-trade suitability determinations for clients.  CTPs either conduct such suitability determinations or have obtained exemptive relief from this requirement and instead perform account appropriateness assessments.  Of the six registered CTPs reviewed: (i) four have obtained such exemptive relief and conduct account appropriateness assessments (“account appropriateness model”); and (ii) two conduct trade-by-trade suitability determinations for clients, including the enhanced suitability requirements as a result of the client-focused reforms (the “suitability model”).

The Staff Notice sets out the OSC’s findings with respect to the account appropriateness assessments conducted by the CTPs subject to the review but does not set out any findings with respect to the suitability assessments conducted by the CTPs subject to the review.

CTPs that operate pursuant to the appropriateness model are required to assess whether entering into crypto contracts with the CTP is appropriate for a prospective client. The account appropriateness assessment is required to take into account each of the following factors (the “account appropriateness factors”):

• the client’s experience and knowledge in investing in crypto assets;
• the client’s financial circumstances;
• the client’s risk tolerance; and
• the crypto assets approved to be made available to a client on the platform.

With respect to the conclusions of the OSC’s review, the OSC recommended that CTPs implement the following practices:

• The development and design of onboarding questions that meaningfully capture the account appropriateness factors and for CTPs to follow up with clients where there are any inconsistencies.
• Updating account appropriate assessments at least annually or more frequently if there is a significant change in a client’s circumstances or market conditions. Assessments must also be performed at account opening.
• Maintaining books and records of any changes in a client’s information (including confirmations that there are no changes).
• Establishing policies and procedures for collecting, documenting, and reviewing information required to conduct meaningful account appropriateness assessments.
• Establishing policies and procedures for handling situations where the CTP has determined that it is not appropriate for a prospective client to open an account. These procedures should also aim to prevent clients from “gaming” the onboarding process.

Findings Related to Investment Limits

Except for clients resident in Alberta, British Columbia, Manitoba, and Québec, and “permitted clients” (as such term is defined under applicable securities legislation), CTPs must limit a client’s purchases of crypto assets to a certain maximum amount on the CTP’s platform (referred to as the “investment limit”).  The investment limit varies depending on if the CTP is operating under the account appropriateness model or the suitability model, and excludes purchases and sales of “specified crypto assets” (as at the date hereof, this consists of Bitcoin, Ethereum, Bitcoin Cash, Litecoin, and USDC).

For CTPs operating under the account appropriateness model, the investment limit for each client is a net acquisition limit of $30,000 during a rolling 12-month period.

For CTPs operating under the suitability model, the investment limit during a rolling 12-month period is:

• $30,000 for a client that does not meet the definition of an “eligible crypto investor”;
• $100,000 for a client that meets the definition of an “eligible crypto investor”; and
• No limit for a client that meets the definition of an “accredited crypto investor”[1].

During their review, OSC Staff did not identify any instances where CTPs failed to discharge their obligations with respect to the applicable investment limits.

Findings Related to Client Limits

In addition to investment limits, CTPs operating under the account appropriateness model are required to impose client limits (sometimes referred to as “loss limits”). The Staff Notice clarifies the OSC’s view that the client limits are meant to: (i) be an appropriate and tailored limit on the losses that a client can incur; (ii)  help clients understand the losses they have incurred to date on their investments in crypto contracts; (iii) initiate meaningful action to help limit further losses the client can incur; and (iv) help deter “gambling-like” or excessively risky actions taken by clients when losses are experienced.

In their review, the OSC found that some CTPs only considered one or a few of the account appropriateness factors to set the client limit while others used factors viewed by the OSC as arbitrary and unrelated to the specific client.  In the view of the OSC, these methods of setting client limits were not sufficient and to comply with the conditions of the exemptive relief, CTPs should be using all the account appropriateness factors in assigning client limits that are tailored to each client.

Furthermore, the OSC found that some CTPs did not effectively monitor client limits or perform any meaningful actions once the client limit was met or exceeded. Clients continued to incur further losses without any meaningful action on the part of the CTPs. The OSC expects that as a client approaches, reaches, and exceeds their limit, they should be notified by the CTP and such notification should include tools to mitigate further losses, and should not include messaging that could be construed as a recommendation or advice. Additionally, OSC Staff provided that notifications should be intermittently sent to the client but not so frequently (e.g., daily) as to be easily disregarded by the client. CTPs should also reassess the account to determine whether it is still appropriate for the client.

In summary, the OSC suggested that CTPs implement the following practices:

• Develop an onboarding process that will collect sufficient information to allow the CTP to create an appropriate client limit for each client.
• Consider all the account appropriateness factors to understand the client’s individual situation and establish an appropriate client limit during the onboarding process to be assessed on an ongoing basis.
• Establish a client limit that considers the individual’s situation and is based on a dollar value that can be used in monitoring to the client’s trading activity.
• Make sure the language in the client limit notifications makes them aware that they are approaching their client limit and directs them to educational materials on the risks of excessive trading, while refraining from language that could be construed as a recommendation or advice.
• Monitor the client limit and trading activity of the client. Take appropriate action when the client limit is being approached, met, or exceeded, including issuing timely and meaningful notifications and taking other actions proportional to the risk to the client.
• Ensure adequate procedures are in place to evaluate, monitor, and apply the client limit to individual clients.

CTPs operating in Canada do so pursuant to a relatively novel regulatory framework. The Staff Notice is welcomed guidance from OSC Staff as it clarifies their expectations with respect to several principal regulatory obligations imposed by the standard conditions of exemptive relief and the form of Pre-Registration Activities Undertaking.

About McMillan Crypto

McMillan has a comprehensive understanding of blockchain, cryptocurrency, digital assets and other decentralized technologies. We use an integrative, pragmatic, and proactive approach when providing counsel in connection with an ever-changing regulatory landscape. Our cross-disciplinary team brings together specialists across many fields, including litigation, securities regulation, capital markets, investment funds and asset management, mergers and acquisitions, derivatives, technology, privacy and cybersecurity, intellectual property, consumer protection, anti-money laundering, financial services, tax, and bankruptcy and insolvency.

[1] The terms “eligible crypto investor” and “accredited crypto investor” refer to investors who meet the definition of an “eligible investor” and “accredited investor”, respectively, when including their crypto assets in the calculation of the net financial assets under the applicable securities legislation. See here for more information.

by Jennie Baek, Matthew DeAmorim, Karan Lall (Articling Student)

A Cautionary Note

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2025