Regulation should matter before it is too late

Regulation should be part of the initial due diligence. Crypto investors often spend significant time evaluating risk. They rightfully consider volatility, liquidity, market cycles, macro conditions, adoption, concentration, and long-term portfolio fit.

By all means, those questions are extremely important. But for users executing transactions of any size, platform risk deserves the same level of scrutiny. The issue is not whether crypto can be made risk-free. Like any asset class, it simply cannot.

The issue is whether the venue used to access crypto operates with the governance, controls, custody standards, disclosures, and accountability expected when meaningful capital is involved.

Ndax is a regulated crypto trading platform. Ndax provides an Order Execution Only service. Ndax executes clients’ instructions but does not provide investment advice. Clients decide when and what to trade. Ndax is registered as an Investment Dealer under Canadian securities legislation in all provinces and territories.

Regulation is not a guarantee against loss, poor execution, market volatility, operational failure, or custody risk. But regulation does change the standard by which a platform operates.

For OTC clients, business owners, family offices, and high-balance households, the platform decision should include more than price, speed, and asset access. It should include regulatory status, custody arrangements, fiat handling, insurance limitations, execution process, documentation, support, and operational controls.

QuadrigaCX showed what can happen when platform trust exists without sufficient governance and controls. The Coldcard situation showed that self-custody can also carry technical and operational risks that are not always visible to the user. Together, these cases reinforce the same point: serious crypto exposure requires a serious platform standard.

In 2019, QuadrigaCX collapsed after the alleged death of its founder, Gerald Cotten. At the time, Quadriga was one of Canada’s largest crypto trading platforms. The Ontario Securities Commission later said the collapse caused losses for approximately 76,000 investors, who collectively lost at least $169 million. The OSC described the platform’s collapse as stemming from fraud by Cotten.

Quadriga was not simply a case of market volatility. It exposed failures in governance, custody, internal controls, recordkeeping, and client-asset handling. For clients, the most important lesson was not that a specific platform failed. Rather, the lesson was that platform structure matters more than many assume.

A trading venue is not only an interface. It is a set of controls, responsibilities, systems, people, records, custody arrangements, and obligations. When those elements are weak, users may not discover the weakness until they need access, recovery, documentation, or accountability.

By then, the question is no longer theoretical. The unfortunate reality is that it is too late.

The July 2026 Coldcard situation raised a different kind of risk. This was not an exchange failure, nor was it a platform collapse or an alleged misuse of client funds by a trading venue.

It was a self-custody issue.

According to CoinDesk, a major Bitcoin wallet flaw drained 594 BTC in a short sweep, with the vulnerability tied to certain Coldcard firmware causing devices to skip hardware randomness and fall back to predictable software-based key generation.

Coldcard’s parent company, Coinkite, has an historical disclosure, according to The Block, that describes a random-byte fallback issue that created weak entropy for device-generated seeds and states that affected seeds require migration.

The natural takeaway is that self-custody by default is not a bad choice. Rather, self-custody is not a complete risk-management framework on its own. It introduces its own operational requirements, including seed generation, device integrity, firmware updates, backup procedures, address management, physical security, inheritance planning, and recovery discipline.

A user can hold a device offline, place it in a safe-deposit box where it is difficult for others to access, but still be exposed to a vulnerability created earlier in the custody process.

Regulation is often treated as a concern that becomes urgent only after a failure. That is the wrong thinking process.
For larger crypto transactions, regulatory status should be part of pre-trade due diligence. Before funds are wired, before an OTC trade is discussed, before assets are withdrawn, and before a custody approach is selected, clients should understand who they are dealing with and what framework applies.

Of course, a regulated platform is not risk-free. Registration does not imply an asset is suitable, nor does it stabilize crypto prices or guarantee execution outcomes. However, it does change the baseline thinking.

A regulated platform operates inside a defined framework. It is subject to registration requirements, supervision, disclosures, compliance obligations, custody expectations, recordkeeping standards, and ongoing oversight. That matters when the client is not just placing a small test trade, but moving significant capital through a venue.

For an OTC client, the trading platform is more than just a place to access liquidity, it is part of the risk stack.

A serious client should be able to answer the following questions before using a platform for larger transactions:

• What is the platform’s regulatory status in Canada?
• Is the platform registered as an Investment Dealer?
• Is it a CIRO member firm?
• Does it operate as an Order Execution Only platform?
• How are client crypto assets held?
• What role do third-party custodians play?
• What protections apply to eligible cash?
• What protections do not apply to crypto assets?
• How are deposits, withdrawals, and settlements processed?
• What documentation is available after execution?
• What controls exist around account access, withdrawals, approvals, and support?
• What process is available for larger transactions?
• These questions are not administrative details. They are part of the client’s operating risk assessment.

The platform standard changes as transaction size increases. A small crypto purchase of $500 may be primarily about access, convenience, and basic account setup. A larger transaction of $500,000 introduces a different set of considerations: source of funds, funding method, timing, execution quality, liquidity, slippage, settlement, custody destination, account records, and support.

A larger order may require coordination, strategy, and timing considerations before execution. The client may need to move funds through Canadian banking rails, evaluate the execution process, and understand fees, spreads, and the potential for slippage. They may also need guidance on whether to hold assets on a platform or withdraw to self-custody, and maintain records for internal or external review.

This is why regulation, custody, documentation, and operational controls matter before the trade. They are not post-trade concerns.

For clients who have already decided that direct crypto exposure belongs in their portfolio, treasury, or broader financial strategy, the next question is execution. That decision should not be limited to price, speed, or asset access.

It should also include the platform’s regulatory status, custody framework, reporting standards, operational controls, and ability to support larger transactions with an appropriate process.

Ndax is a regulated crypto trading platform built for Canadians. Ndax is registered as an Investment Dealer under Canadian securities legislation in all provinces and territories, is a CIRO member firm, and operates within the Canadian regulatory framework. Ndax also provides an Order Execution Only service. Ndax executes users’ instructions but does not provide investment advice. Users decide when and what to trade. This means the platform is not meant to replace, complement, or supplement a user’s financial advisor, accountant, investment committee, board, or internal approval process.

Instead, Ndax is providing a Canadian trading infrastructure for users who have already made their own decision to access crypto directly. For larger transactions, Ndax Wealth provides OTC execution support for clients who require a more structured process than a standard retail order workflow.
 

Quadriga and Coldcard show that asset risk is only one category. Platform risk, custody risk, operational risk, governance risk, technology risk, and recovery risk can be just as important.

Quadriga showed the consequences of trusting a platform without adequate governance and controls. The Coldcard situation showed that even self-custody can carry hidden technical and operational risks that may not become visible until after losses occur.
The conclusion is not that every client should use the same custody or execution model. The conclusion is that serious crypto exposure requires a serious platform standard.

For some clients, that may mean using a regulated platform for execution and withdrawing to self-custody. For others, it may mean maintaining assets on a platform that provides custody disclosures and operational controls. Some may use a combination of both, depending on transaction size, liquidity needs, reporting requirements, and internal governance.
The important point is that these decisions should be made early and not after a failure.

Regulation does not make crypto risk disappear. It does not stabilize prices, guarantee execution outcomes, or make any asset suitable for a particular client. But for higher-balance users, businesses, family offices, and institutions, regulation should be part of the initial due diligence process, not a concern raised only after a failure.