Cryptocurrency Exchange Rules

A Summary of Proposed New Rules for Cryptocurrency Exchanges
Cryptocurrency exchanges, depending on how they operate and the crypto assets they make available for trading, may already be subject to securities and/or derivatives regulation. Canadian regulators are proposing new rules to govern cryptocurrency exchanges aimed to curtail the risks associated with those trading platforms. The consultation paper was published on March 14, 2019 and can be found here:
https://www.osc.gov.on.ca/en/SecuritiesLaw_csa_20190314_21-402_crypto-asset-trading-platforms.htm
At the time of writing this, it’s unclear when any new regulations would come into effect.
Part 3 of the Proposed Regulations: Risks Related to Platforms
Any start-up considering crypto assets, as a potential avenue for financing, need to be aware of the risks associated with these Platforms.[1] These include:

• Investors' crypto assets may not be adequately safeguarded
• Processes, policies and procedures may be inadequate
• Investors' assets may be at risk in the event of a Platform's bankruptcy or insolvency
• Investors may not have important information about the crypto assets that are available for trading on the Platform
• Investors may not have important information about the Platform's operations
• Investors may purchase products that are not suitable for them
• Conflicts of interest may not be appropriately managed
• Manipulative and deceptive trading may occur
• There may not be transparency of order and trade information
• System resiliency, integrity and security controls may be inadequate

PART 5 of the Proposed Regulations: The Proposed Platform Framework
The regulators are looking to have Platforms that build consumer confidence, expand business in Canada and globally, foster greater market integrity, provide clarity, and protect investors.[2] These are objectives are similar to those of traditional exchanges such as the TSX and the TSX-V. Currently there are no Platforms recognized as an exchange or otherwise authorized to operate as a marketplace or dealer in Canada.[3]
The consultation paper seeks input from the fintech community, market participants, investors and other stakeholders looking at how regulatory requirements may be tailored for crypto-asset trading Platforms operating in Canada. Comments are due by May 15, 2019 and include the following areas:
5.2.1 Custody and Verification of Assets
The regulations contemplate requiring that Platforms obtain SOC Type II reports as well as yet-to-be determined standards specific to crypto assets if they are seeking registration as an investment dealer and IIROC membership.
Traditional custodians that hold assets for clients typically engage an independent auditor to perform an audit of the custodian's internal controls and prepare an assurance report, such as SOC 1 and SOC 2 Reports, pertaining to the design of the controls (Type I Report) and a report assessing whether such controls are operating as intended (Type II Report).
There have been challenges with crypto asset custodians and Platforms obtaining SOC 2, Type II Reports, in part due to the novel nature of crypto asset custody solutions and the limited period of time that Platforms have been in operation to allow for the testing of internal controls.
5.2.2 Price Determination
Platforms will be required to foster price discovery for the crypto assets they offer for trading. Where the Platform or an affiliate acts as a market maker and provides quotes, the mechanisms for determining those quotes are expected to be available to participants. When trading as a market maker against its participants, a Platform will also be required to provide participants with a fair price.
5.2.3 Market Surveillance
The regulations propose that Platforms not permit dark trading or short selling activities, or extend margin to their participants.
The existing types of marketplaces have different regulatory responsibilities. Exchanges are responsible for conducting market surveillance of trading activities on the exchange and enforcing market integrity rules. All of the existing equity exchanges have retained IIROC to monitor trading activity and enforce market integrity rules.
Alternative trading systems, by contrast, are not permitted to conduct market surveillance or enforcement activities and are required to engage a regulation services provider (RSP). IIROC currently acts as an RSP to all equity and fixed income marketplaces.
5.2.4 Systems and Business Continuity Planning
Marketplaces are currently required to:

• have adequate internal and information technology controls over their trading, surveillance and clearing systems and information security controls that relate to security threats and cyber-attacks;
• maintain business continuity and disaster recovery plans to provide uninterrupted provision of key services;
• ensure that marketplaces have adequate internal and technology controls in place over their trading, surveillance and clearing systems and that their systems function as designed, marketplaces are required to engage an entity with relevant experience both in information technology and in the evaluation of related internal controls to conduct an independent systems review (ISR).

Platforms will also be required to comply with the systems and business continuity planning requirements applicable to existing marketplaces in NI 21-101.
5.2.5 Conflicts of Interest
Platforms will be required to identify and manage potential conflicts of interest and will be required to disclose whether they trade against their participants, including acting as a market maker, and the associated conflicts of interest. To the extent Platforms are required to become IIROC Members, they will also be subject to requirements in the Universal Market Integrity Rules aimed at mitigating the risks associated with trading against their participants.
5.2.6 Crypto-asset Insurance
Dealers are required to maintain bonding or insurance against specific risks and in specified amounts. This requirement may not address the specific operational risks of Platforms.
There may be significant difficulty and costs for a Platform to obtain insurance, in part due to the limited number of crypto asset insurance providers, and the high risk of cyber-attacks. Therefore, some Platforms have indicated that they are considering limited coverage that only extends to certain crypto assets, crypto assets in "hot wallets" or "cold wallets", loss as result of hacking, or loss from insider theft.
5.2.7 Clearing and Settlement
All trades executed on a marketplace are required to be reported and settled through a clearing agency.
Without exemptive relief, this requirement would also apply to Platforms that are marketplaces. However, currently there are no regulated clearing agencies for crypto assets that are securities or derivatives.
The regulators are considering whether an exemption from the requirement to report and settle trades through a clearing agency is appropriate. In these circumstances, Platforms will still be subject to certain requirements applicable to clearing agencies and will therefore be required to have policies, procedures and controls to address certain risks including operational, custody, liquidity, investment and credit risk. The Regulators plan to revisit such exemptions in the future, as the space continues to develop and evolve.
Some Platforms may operate a non-custodial (decentralized) model where the transfer of crypto assets that are securities or derivatives occurs between the two parties of a trade on a decentralized blockchain protocol (e.g. smart contract). These types of Platforms will be required to have controls in place to address the specific technology and operational risks of the Platform.
Criticism
Evan Thomas, a lawyer at Osler, Hoskin & Harcourt LLP who specializes in blockchain technology warns that “the cost, time and other practical difficulties of complying with many of the regulatory requirements contemplated by the paper would effectively shut out many innovative crypto asset trading platforms from the Canadian market.”[4]

Colin Patterson is a third year student at the Faculty of Law, University of Calgary, and is a JD and CPA candidate.

References
[1] https://www.osc.gov.on.ca/en/SecuritiesLaw_csa_20190314_21-402_crypto-asset-trading-platforms.htm
[2] https://www.osc.gov.on.ca/en/NewsEvents_nr_20190314_csa-consult-on-regulatory-framework-crypto-asset-trading-platforms.htm
[3] Supra note 1
[4] https://www.theglobeandmail.com/business/article-canadian-regulators-propose-framework-to-govern-cryptocurrency/