OSC Staff Notice 33-757 – Review of Restricted Dealer Crypto Asset Trading Platforms’ Compliance with the Account Appropriateness, Investment Limits and Client Limits Requirements

What’s in the Notice

Staff of the Ontario Securities Commission (Staff or we) conducted a focused compliance review (the Sweep) of the know-your-client (KYC), account appropriateness assessment, and Client Limit (defined below) practices of crypto asset trading platforms (CTPs) based in Ontario and registered as restricted dealers. This notice summarizes our findings from the Sweep and provides guidance (including Staff’s views as to practices that may be considered to be “suggested practices”) to CTPs to assist them in meeting their regulatory obligations (the Notice).

We strongly encourage CTPs to use this Notice to improve their understanding of, and compliance with, their KYC, account appropriateness assessment, and Client Limit obligations. We also suggest that CTPs use this Notice as a self-assessment tool to strengthen their compliance with Ontario securities law.

Highlights of the Notice

We expect CTPs to comply with the letter and spirit of the conditions set out in the exemptive relief decisions (Decisions)^[1] granting them relief from certain securities law requirements, including those conditions related to account appropriateness assessments, investment limits and Client Limits for clients.^[2] Among other areas, CTPs are expected to:

• ensure that the maximum amount of crypto assets, excluding Specified Crypto Assets (defined below), that a client, except those clients resident in Alberta, British Columbia, Manitoba, and Quebec, may purchase and sell (calculated on a net basis and is an amount not less than $0) in the preceding 12 months does not exceed the investment limit.
• conduct a meaningful account appropriateness assessment that takes into account the Account Appropriateness Factors (defined below) specific for each client, as described in the Decision.
• assign a Client Limit to each client which considers all the Account Appropriateness Factors and is used to monitor the client’s ongoing trading activity.
• ensure actions taken when a client meets or exceeds their Client Limit are timely, meaningful, and proportional to the client’s activity to ensure that the client is made aware that their activity is likely subjecting their investments to excessive risk given their individual circumstances.

Outline of this Notice

The following is an outline of this Notice:

• Background
• Purpose of the Sweep
• Account Appropriateness Assessments
• Investment Limits
• Client Limits
  • What are Client Limits?
  • Determination of Client Limits
  • Monitoring & Application of the Client Limits

Background

KYC and suitability determination obligations are fundamental obligations owed by registrants to their clients and are cornerstones of our investor protection regime. As outlined in CSA Staff Notice: 31-336 Guidance for Portfolio Managers, Exempt Market Dealers and Other Registrants on the Know-Your-Client, Know-Your-Product and Suitability Obligations, we expect registrants to comply not only with the letter of the requirements themselves, but also with the spirit of the requirements.

As set out in CSA Staff Notice 21-327 Guidance on the Application of Securities Legislation to Entities Facilitating the Trading of Crypto Assets (Staff Notice 21-327) and Joint Canadian Securities Administrators (CSA) / Investment Industry Regulatory Organization of Canada Staff Notice 21-329 Guidance for Crypto-Asset Trading Platforms: Compliance with Regulatory Requirements (Staff Notice 21-329), securities legislation applies to CTPs that facilitate or propose to facilitate the trading of instruments or contracts involving crypto assets because the user's contractual right to the crypto asset may itself constitute a security and/or a derivative (Crypto Contract).

Exemptive relief from the prospectus requirement has been granted to allow registered CTPs to purchase, hold, stake, deposit, withdraw and sell crypto assets for clients through Crypto Contracts. In addition, certain registered CTPs that do not provide recommendations or advice to clients, or do not conduct trade-by-trade suitability determination for clients, have been granted exemptive relief from the trade-by-trade suitability determination requirements under section 13.3 of National Instrument 31-103 Registration Requirements, Exemptions and Ongoing Registrant Obligations (NI 31-103). As a condition of the relief, among others, CTPs are required to perform account appropriateness assessments (see Account Appropriateness Assessments below), and apply investment limits (see Investment Limits below) and Client Limits (see Client Limits below).

Staff conducted a Sweep of six registered CTPs whose principal regulator is the Ontario Securities Commission, to assess their compliance with the terms and conditions of their Decisions. These terms and conditions included obligations in the following areas:

• custody arrangements over clients’ crypto assets,
• account appropriateness of client accounts, or suitability determination, for trading in Crypto Contracts,
• corporate governance structures,
• insurance bonding policies, and
• management of material conflicts of interest.

Four of the six registered CTPs obtained relief from the trade-by-trade suitability determination requirement in section 13.3 of NI 31-103 and were conducting account appropriateness assessments (account appropriateness model). The remaining two CTPs did not obtain relief from the suitability determination requirements and were subject to the trade-by-trade suitability determination for clients, including the enhanced suitability requirements as a result of the client-focused reforms in respect of s. 13.3 of NI 31-103 (suitability model).

Purpose of the Sweep

The purpose of the Sweep was to:

• review and assess the CTPs’ compliance with KYC and account appropriateness or suitability determination obligations (as applicable),
• enhance Staff’s knowledge regarding CTPs’ compliance with KYC, account appropriateness assessments or suitability determination obligations, and to determine whether there is a need for additional guidance, and
• highlight to registered CTPs and those applying for registration, the importance of these obligations and improve the level of compliance and investor protection.

This Notice will focus on our findings from the Sweep and provide guidance to CTPs to assist them in meeting their regulatory obligations in the areas of account appropriateness assessments, investment limits, and Client Limits.

For guidance on our findings from the other areas reviewed as part of the Sweep, please refer to our Summary Report for Dealers, Advisers and Investment Fund Managers under OSC Staff Notice 33-755 and OSC Staff Notice 33-756.

Account Appropriateness Assessments, Investment Limits, and Client Limits

1. Account Appropriateness Assessments

CTPs operating under the account appropriateness model are required to consider all the following factors (the Account Appropriateness Factors) in conducting the account appropriateness assessment:

1. the client’s experience and knowledge in investing in crypto assets
2. the client’s financial circumstances
3. the client’s risk tolerance
4. the crypto assets approved to be made available to a client on the platform

Pursuant to the conditions of their exemptive relief, CTPs must perform an account appropriateness assessment prior to opening a client account, on an ongoing basis, and at least every twelve months. The account appropriateness assessment should be performed more frequently than every twelve months if there is a significant change in a client’s circumstances or a significant change in market conditions.

To meet the account appropriateness assessment obligation, CTPs are expected to take reasonable steps to collect information and establish the Account Appropriateness Factors for each prospective client. CTPs may use an onboarding questionnaire and any such questionnaire should be developed and designed with this in mind. CTPs should use the collected information to conduct a meaningful account appropriateness assessment using all the Account Appropriateness Factors for each client and determine whether it is appropriate for the CTP to enter into a Crypto Contract with the client.

During the Sweep, Staff found instances where a CTP took a mechanical "tick box" approach to collecting Account Appropriateness Factors without following up on any inconsistencies or otherwise conducting a meaningful assessment of the Account Appropriateness Factors. In addition, Staff observed that some CTPs did not update clients’ Account Appropriateness Factors on an ongoing basis, thereby assessing account appropriateness on outdated information. These failures sometimes resulted in accounts being opened or maintained for clients where the account was not appropriate for the client.

In circumstances where the CTP has determined that entering into a Crypto Contract with and opening an account for the client is not appropriate, this should be clearly communicated to the client and the CTP should not open an account for the client at that time. In addition, CTPs should establish policies and procedures for handling situations where the CTP has determined that it is not appropriate for the prospective client to open an account, including preventing a client from gaming the onboarding process.

In reference to record keeping, CTPs must maintain books and records that evidence any changes in a client’s information (or a confirmation that there are no changes). In addition, CTPs should establish policies and procedures for collecting, documenting, and reviewing information necessary to conduct a meaningful account appropriateness assessment.

2. Investment Limits

Except for clients resident in Alberta, British Columbia, Manitoba and Québec, and permitted clients (as defined under NI 31-103), CTPs must limit a client’s purchases of crypto assets (that are not Specified Crypto Assets^[3]) to a maximum amount on the CTP’s platform. This is referred to as the investment limit.

For CTPs operating under the account appropriateness model, the maximum amount of crypto assets that a client may purchase and sell (calculated on a net basis) in the preceding 12 months must not exceed a net acquisition cost of $30,000.

For CTPs operating under the suitability model, the maximum amount of crypto assets that a client may purchase and sell (calculated on a net basis) in the preceding 12 months must not exceed:

• $30,000 for a client that does not meet the definition of an eligible crypto investor,
• $100,000 for a client that meets the definition of an eligible crypto investor, and
• no investment limit for a client that meets the definition of an accredited crypto investor.

The investment limit cannot be less than $0 and excludes purchases and sales of Specified Crypto Assets.

During the Sweep, Staff did not identify any instances where CTPs failed to discharge their obligation to limit a client’s purchases of crypto assets (that are not Specified Crypto Assets) to the applicable maximum amount on the CTP’s platform.

3. Client Limits

What are Client Limits?

CTPs operating under the account appropriateness model are required to establish Client Limits as a condition of their Decision^[4]:

…[t]he Filer has adopted and will apply policies and procedures to conduct an assessment to establish appropriate limits on the losses that a Client can incur, what limits will apply to such Client based on the Account Appropriateness Factors (the Client Limit), and what steps the Filer will take when the Client approaches or exceeds their Client Limit. This assessment of the Client Limit takes into consideration the Account Appropriateness Factors. After completion of the assessment, the Filer will implement controls to monitor and apply the Client Limits.

Referred to as the loss limit in some earlier Decisions, the purpose of the Client Limit is to mitigate the risk of clients incurring significant realized and unrealized losses while trading in Crypto Contracts on CTPs (the Client Limit). It is meant to:

• be an appropriate and tailored limit on the losses that a client can incur,
• help clients understand the losses they have incurred to date on their investments in Crypto Contracts, and
• initiate meaningful action to help limit further losses the client can incur.

It is also used to help deter “gambling-like” or excessively risky actions taken by clients when losses are experienced, such as “doubling down” on existing crypto asset positions.

Determination of Client Limits

When assigning a Client Limit for each client, the CTP is required to consider all Account Appropriateness Factors of the respective client and determine a Client Limit that is appropriate for the client in light of their individual circumstances.

During the Sweep, however, Staff noted numerous instances where CTPs assigned Client Limits that were not meaningfully tailored to each client’s individual circumstances. For example:

• Client Limit was determined based on consideration of only one or a few Account Appropriateness Factors. For example, Staff noted that some firms used risk tolerance as the sole Account Appropriateness Factor in determining a tailored Client Limit, which does not provide a complete picture of the client’s circumstances.
• Client Limit was based on arbitrary and dynamic factors such as (a) a specific change in the trailing price of each crypto asset offered by the CTP (e.g., 20% drop in the price of Bitcoin over a trailing 60-day period), (b) a specific change in the market value of a client’s portfolio, or (c) a specific change in the market value of a client’s portfolio relative to the adjusted book value of a client’s crypto asset holdings (e.g., market drop causing a 20% (un)realized loss calculated using a client’s adjusted book value).

In Staff’s view, such approaches do not appropriately consider and reflect the client’s ability to tolerate losses and are not meaningfully tailored to each client’s individual circumstances.

To comply with the conditions of the Decisions, CTPs should assign Client Limits that are tailored to each client based on the respective client's Account Appropriateness Factors (e.g., setting a dollar amount that reflects what the client can afford to lose, which may be expressed as a percentage of the client’s net financial assets).

Monitoring & Application of the Client Limits

During the Sweep, Staff also found instances where CTPs did not effectively monitor the Client Limits or perform any meaningful action once a Client Limit was met or exceeded. In those instances, clients were able to freely pursue further transactions after exceeding their Client Limit, without any meaningful action taken by the CTPs to deter further losses.

As a condition of the Decisions, CTPs are required to monitor clients’ accounts against their Client Limit. As the client begins to incur losses, this should trigger progressive layers of intervention by the CTP to help warn the client that they are approaching their Client Limit and notify the client of their accumulated losses to date. Staff do not expect trading activity for the client to be immediately blocked or limited as they approach their Client Limit.

If the Client Limit is reached, the CTP should inform the client and provide them with appropriate tools to mitigate further losses. Staff expect this deterrence to be proportionate to the losses incurred by the client with the expectation that the CTP would inform the client that further trading activity may be detrimental and provide steps the client should consider. Part of this deterrence may include temporarily limiting activities related to pursuing further transactions in Crypto Contracts given the losses incurred to date. CTPs should also conduct a reassessment on whether the account remains appropriate for the client.

Client notifications should be timely to ensure that clients are made aware of the losses they have incurred to date relative to their Client Limit. Clients that continue to exceed their Client Limit should continue to receive notifications intermittently to meaningfully make clients aware of their losses. However, CTPs should ensure the notifications are not so frequent (e.g., daily) that the clients disregard the persistent notifications.

As a condition of the Decisions, CTPs cannot provide recommendations or advice to any client or prospective client. Thus, CTPs should refrain from using language in the notifications that may be construed as advice. Notifications should be used to point to the losses accumulated to date at the time of the notification and educate clients on how they can reduce further losses.

The design of an appropriate Client Limit system should ensure that the outcomes taken as a client approaches, meets, or exceeds their Client Limit makes the client aware of their accumulated losses and reassesses the client’s appropriateness for continued trading in Crypto Contracts. CTPs are expected to demonstrate on a reasonable efforts basis that meaningful interventions have been added to protect clients in situations where their losses on the platform appear to be disproportionately detrimental relative to their individual circumstances.

Conclusion

The suggested practices identified in this Notice are intended to provide additional Staff guidance on how we expect CTPs to comply with the conditions related to account appropriateness, investment limits and Client Limits in the Decisions. CTPs are encouraged to use this Notice as a self-assessment tool to assess their compliance with these obligations and make any appropriate adjustments to their compliance program.

Staff will continue to monitor CTPs’ compliance with the conditions of their respective Decisions alongside compliance with other fundamental registrant obligations in securities legislation. Where instances of non-compliance are noted, we will take appropriate action.

Questions

If you have any questions regarding this Notice, please refer them to any of the following:

Jennifer Lee-Michaels
Senior Legal Counsel
Trading and Markets
[email protected]