Custody risk: platforms, contracts and your own keys compared

Custody comes down to who can move the asset

On a blockchain, whoever controls the private key for an address can move what it holds. When you buy crypto on a trading platform, the platform or its custodian usually controls those keys and records what you are owed. When you deposit into DeFi, a smart contract holds the tokens. When you self-custody, you hold the keys yourself.

Each arrangement creates a different kind of trust. With a platform, you trust a company and its custodians. With a contract, you trust code and whoever can change it. With self-custody, you trust your own security habits. The Ontario Securities Commission's investor site notes that when a platform controls an asset on your behalf, the arrangement may itself fall under securities law.

Three custody models side by side

The table compares the models on the questions that matter most when something goes wrong. Many people use all three at once, and it helps to know which risk applies to which balance.

The models also overlap. A platform may deploy client assets into smart contracts, and a self-custodied wallet becomes contract custody the moment its tokens are deposited into a protocol. Following each balance to the place where its keys actually sit is the clearest way to see your exposure.

What Canadian rules expect of platforms

Canadian securities regulators require crypto trading platforms that serve Canadians to register, including platforms located outside Canada. Platforms still being reviewed can operate under a pre-registration undertaking. The CSA keeps a public list of authorized platforms, last updated September 18, 2026, and a separate list of undertakings.

On February 3, 2026, the Canadian Investment Regulatory Organization (CIRO) issued a tiered, risk-based digital asset custody framework for dealer members that operate crypto trading platforms. It applies through terms of membership as an interim framework, takes effect immediately, and covers crypto assets and tokenized assets, including stablecoins. The OSC's investor site explains that platforms generally must keep most client crypto, at least 80%, with an acceptable third-party custodian rather than in their own wallets.

These rules apply to registered platforms. They do not reach a smart contract you interact with directly, or an unregistered offshore service. The regulation overview explains how to check a platform's status.

What deposit insurance does and does not cover

The Canada Deposit Insurance Corporation insures eligible deposits, such as savings accounts and GICs, up to $100,000 per insured category at each member institution. Its list of products that are not covered includes cryptocurrencies, including stablecoins. CDIC also notes that fintech companies are not CDIC members.

The Canadian Investor Protection Fund, which protects some client property when an investment dealer fails, also excludes crypto assets. The OSC's investor site warns that if a platform becomes insolvent, recovering crypto may take years and may be partial or nothing at all.

Yield programs and the lending you do not see

When a platform pays interest on deposited crypto, the money usually comes from lending those assets to someone else or deploying them in DeFi. That turns you from an owner of an asset into a lender to the platform, and your outcome depends on its borrowers and risk management.

In October 2025, the CSA reminded crypto-backed lending platforms that they may need registration and a prospectus, and cautioned investors to check registration or exemptive relief before using them. A recurring failure pattern in the sector has been a lending platform that froze withdrawals after its borrowers could not repay, leaving depositors as creditors.

Pricing counterparty risk: an illustrative breakeven

One way to think about custody risk is to ask how likely a loss would need to be before a higher yield stops being worth it. In this illustration, $10,000 sits on a platform paying 5% on a stablecoin for one year, with a 0.5% fee, compared with a 3.5% GIC. Assume a 30% marginal tax rate on both.

After fees and tax, the stablecoin earns 4.5% × 70% = 3.15%, against 3.5% × 70% = 2.45% for the GIC. If a custody failure would cost 50% of the balance, the yearly chance of that failure at which the two break even is (3.15% − 2.45%) ÷ 50% = 1.4%. At a 2% estimate, the expected stablecoin outcome is about $10,215, below the GIC's $10,245; if the failure happened, the balance would fall to about $5,158.

Nobody knows the true probability, which is the point. The stablecoin vs GIC calculator lets you test your own assumptions, and the scenarios page shows similar trade-offs across other strategies.

Self-custody moves the risk; it does not remove it

Holding your own keys removes platform insolvency from the picture, but adds new ways to lose access: a lost recovery phrase, a stolen device, or a signature on a malicious transaction. The OSC's investor site notes that if you hold crypto directly and lose your private key, the asset simply becomes inaccessible.

Self-custody also means DeFi deposits are custody decisions in their own right: moving tokens from your wallet into a contract hands control to that contract. Wallet security covers the practical side.

Records worth keeping whatever the custody model

The Canada Revenue Agency asks crypto users to keep records of each transaction, including dates, values in Canadian dollars and wallet addresses, for at least six years from the end of the last tax year they relate to. It advises exporting platform activity regularly in case a platform closes, stops serving Canada or you lose access.

Those records are also your evidence if you ever need to make a claim in an insolvency. They feed directly into the ACB calculator at tax time.

Questions to ask before you deposit

• Is the platform on the CSA list of authorized platforms, or operating under an undertaking?
• Who holds the keys to your assets, and is a third-party custodian named?
• Does the platform lend out or deploy your deposits to pay a yield?
• What would your position be in an insolvency: owner of segregated assets or general creditor?
• Which balances are in DeFi contracts, and who can upgrade those contracts?
• If you self-custody, how is your recovery phrase stored and backed up offline?
• Are you exporting transaction records regularly?