2024-01-18
The Canadian securities regulatory authorities issued draft amendments to Policy Statement 81-102 to clarify the definition of crypto assets and update regulatory expectations for investment funds. The changes permit mutual funds to invest in crypto assets listed on recognized exchanges or derivatives while imposing strict custody standards requiring specialized infrastructure, segregated key storage, and robust cyber security measures. Additionally, the amendments specify that SOC-2 Type II reports satisfy external audit requirements for custodians holding crypto assets and update French legal terminology throughout the document.
AMENDMENTS TO POLICY STATEMENT TO REGULATION 81-102 RESPECTING INVESTMENT FUNDS
2 “(2) The Canadian securities regulatory authorities expect that custodians and sub-custodians responsible for the custody of portfolio assets that are crypto assets implement policies and procedures that address the unique risks concerning safeguarding of crypto assets compared to other asset types. We would expect these policies and procedures to include: (a) having specialist expertise and infrastructure relating to the custody of crypto assets; (b) storing private cryptographic keys in segregated wallets or in an omnibus wallet visible on the blockchain so that unique public and private keys are maintained on behalf of an investment fund, so long as in each case the custodian or sub-custodian’s books and records clearly reflect the investment fund’s ownership of the crypto assets held by it; (c) using hardware devices to hold private cryptographic keys that are subject to robust physical security practices, with effective systems and processes for private key backup and recovery; (d) using signing approaches, such as the use of multi-signature technology, that minimise single point of failure risk; (e) maintaining robust systems and practices for the receipt, validation, review, reporting and execution of instructions from the investment fund; (f) maintaining website security measures that include two-factor authentication, strong password requirements that are cryptographically hashed, encryption of user information and other state-of-the-art measures to secure client information and protect the custodian and sub-custodian’s website from hacking attempts; (g) maintaining robust cyber and physical security practices for their operations, including appropriate internal governance and controls, risk management and business continuity practices. “(3) For the purposes of section 6.5.1 of the Regulation, the Canadian securities regulatory authorities generally consider offline storage to mean the storage of private cryptographic keys in a manner that prevents any connection to the internet. “(4) Subsection 6.6(3.1) of the Regulation requires the custodian or subcustodian of an investment fund that holds crypto assets on behalf of the investment fund to maintain insurance with respect to its custody of crypto assets of a type and in an amount that a reasonably prudent person would maintain. The Canadian securities regulatory authorities expect this to include using their best judgement, consistent with their custodial or sub-custodial obligations and standard of care to the fund to determine whether the insurance maintained by the custodian or sub-custodian is sufficient or appropriate in the circumstances, including taking into account how the insurance compares to industry standards. The Canadian securities regulatory authorities also remind investment fund managers of the need to understand the material terms and amounts of such insurance coverage and make their own determination of whether they consider the insurance sufficient considering the relevant circumstances, consistent with their fiduciary obligation to the investment fund.”. 6. Section 8.3 of the Policy Statement is amended: (1) by inserting“(1)” at the beginning of the first paragraph; (2) by adding, after the first paragraph, the following: “(2) Subsection 6.7(1.1) of the Regulation requires a custodian or sub-custodian of an investment fund that holds portfolio assets of that investment fund that are crypto assets to obtain a report prepared by an external auditor to assess its internal management and controls. The provision does not specify the exact report that must be obtained. However, it is the view of the Canadian securities regulatory authorities that a Service Organization Control 2 Type II report, generally referred to as a “SOC-2 Type II” report, prepared in accordance with the framework
3 developed by the American Institute of Chartered Public Accountants, will satisfy this requirement, though other comparable reports may also be considered from time to time.”.