The quiet advantage of ‘boring’ regulation: Why regulated CEXs may be better positioned to withstand market stress than unregulated ones

None of these scenarios are new. They are familiar failures of custody, governance, accounting, or risk management. Crypto simply allowed them to develop faster, across borders, or behind technical language that made ordinary financial misconduct sound innovative.

At Ndax, we view regulation as a framework that establishes requirements around governance, custody, compliance, and risk management. Regulation cannot eliminate every risk, but it creates defined obligations and oversight in areas that have contributed to past crypto-platform failures.

In an industry where customer assets can disappear behind a private wallet, an affiliated trading firm, or an unverifiable balance sheet, regulation is not merely a compliance obligation. It also establishes requirements around how a platform manages custody, risk, and client assets.

That is why one of regulation’s less visible contributions to the crypto industry may also be one of its least exciting. Registration, scrutiny, audits, capital requirements, custody rules, reconciliations, insurance, and asset segregation do not generate excitement during a bull market. But they become the center of attention when withdrawals stop.

Regulation does not guarantee a centralized exchange will survive. What it can do is establish requirements relating to governance, custody, risk management, recordkeeping, and oversight that may help identify or mitigate certain risks before they become significant, including some of the types of risks that were highlighted by the failures of platforms such as Mt. Gox, QuadrigaCX, and FTX.

Mt. Gox was once the go-to Bitcoin exchange. When it imploded in 2014, it initially reported that approximately 850,000 BTC were missing. More than 24,000 customers lost access to hundreds of millions of dollars in crypto and cash, and the insolvency process continued for years.

The important lesson was not simply that crypto is hackable. Research later challenged the exchange’s defense that transaction malleability explained most of the loss. The deeper problem was that customers had no reliable way to assess the exchange’s custody practices, financial position, or internal controls before it was too late.

Canadian users received their own version of the lesson through QuadrigaCX. A review by the Ontario Securities Commission (OSC), the securities regulator for Ontario, Canada’s most populous province, concluded that the platform’s collapse was due to fraud committed by co-founder Gerald Cotten, who operated without proper oversight or internal controls.

More than 76,000 clients were owed a combined C$215 million, while only C$46 million in assets were recovered or identified. Clients collectively lost at least C$169 million.

Quadriga was widely described as a story about private keys becoming inaccessible after Cotten’s reported death. But the OSC found that the problems extended well beyond inaccessible private keys: Cotten created falsified balance, traded against clients, used client assets on other platforms, covered shortfalls with new deposits, and took money for personal use.

This was not primarily a technical failure. It was an old-fashioned fraud that could have happened decades ago. But it was repackaged as a modern-day scheme that operated through a crypto interface.

FTX appeared to be the opposite of Quadriga. It had celebrity endorsements including Tom Brady and Kevin O’Leary, institutional investors led by Sequoia Capital and SoftBank, a global brand, and founder Sam Bankman-Fried’s face on the cover of Forbes and Fortune.

While this made for great marketing, none of it really mattered when U.S. authorities found that billions of dollars in customer deposits were diverted to its sister company, Alameda Research. Alameda received special treatment on FTX, including an effectively unlimited line of credit funded by customers. Bankman-Fried was later sentenced to 25 years in prison and ordered to forfeit more than $11 billion.

FTX is the clearest argument against treating reputation, trading volume, or venture-capital backing as substitutes for oversight. It failed because insiders could override the controls that were supposed to protect customers.

The experiences of several crypto platforms highlight that users may face risks that are difficult to independently assess when information regarding custody arrangements, liabilities, governance practices, or related-party relationships is limited. Users cannot inspect a platform’s private keys, reconcile its liabilities, or determine whether an affiliated company has privileged access to their deposits. “Trust us” is not a substitute for supervision.

Ndax is registered as an investment dealer under applicable securities laws across Canada, approved to operate an alternative trading system, and is a member of the Canadian Investment Regulatory Organization (CIRO).

Ndax provides an Order Execution Only (OEO) service. Ndax executes clients’ instructions but does not provide investment advice. Clients decide when and what to trade.

These registrations and memberships are accompanied by regulatory requirements covering areas such as custody, capital, recordkeeping, compliance, and client asset handling. Ndax’s custody disclosure makes it clear that at least 80% of client crypto assets are held in cold and warm storage with acceptable third-party custodians. The assets are maintained in segregated omnibus accounts in trust for clients and kept separate from the assets of Ndax, its affiliates, and the custodians’ other clients.

Client Canadian-dollar balances are held separately in trust accounts at regulated Canadian financial institutions. Ndax reviews annual SOC 2 reports, which are independent assurance reports examining a service provider’s security and operational controls, from critical custody infrastructure providers.

Ndax also maintains at least C$1 million in crime and financial institution bond insurance for crypto held through its custody solution. Insurance coverage is subject to policy terms, conditions, exclusions, deductibles, coverage limits, and claims procedures and may not apply to all losses or circumstances.

Custody controls, regulatory reporting, reconciliations, and governance processes may receive less attention than product features or market performance, but they form part of the regulatory and operational requirements applicable to a registered platform.

Quadriga operated behind the scenes with one person controlling wallets. The end result was fake balances, undisclosed trading against clients, misuse of client assets, and the movement of client assets without meaningful independent oversight or internal controls.

FTX, meanwhile, gave Alameda Research special privileges that were not available to ordinary customers, including access to a customer-funded line of credit and exemptions from certain risk controls.

Canadian regulatory requirements address areas such as asset segregation, custody arrangements, reconciliations, capital, recordkeeping, compliance, and independent assurance.

CIRO’s 2026 Digital Asset Custody Framework sets tiered requirements for crypto custodians covering capital, regulatory status, insurance, SOC 2 assurance, cybersecurity, operational resilience, and legal treatment in insolvency.

It also limits how much a dealer can hold with lower-tier custodians or through internal custody.

A regulated company can still suffer a cyberattack, operational failure, fraud, or insolvency. Crypto assets held on Ndax are not protected by the Canada Deposit Insurance Corporation (CDIC), which insures eligible deposits held at member banks, or the Canadian Investor Protection Fund (CIPF), which provides limited protection for eligible client assets if a member investment firm becomes insolvent.

Ndax’s disclosures state that eligible fiat balances may receive CIPF protection, but crypto assets themselves are excluded from both CIPF protection and Canadian deposit insurance.

Ndax also acknowledges that Canadian bankruptcy law does not provide complete certainty over the treatment of crypto assets. In other words, exactly how customer crypto would be treated during an insolvency is not yet fully settled under Canadian law.

Regulation cannot prevent every failure, cyber incident, operational disruption, or insolvency. Similarly, governance controls, audits, and risk-management frameworks cannot eliminate risk. Their purpose is to help identify, manage, and mitigate risks and support informed decision-making.  Their purpose is to identify, manage, and mitigate risks that could otherwise contribute to financial or operational failures.

Those disclosures instead illustrate an important part of the regulatory framework: firms are expected to communicate not only the protections that apply, but also their limitations. Clear disclosure helps users understand where regulatory and investor protections end rather than assuming registration eliminates all risk.

One potential benefit of operating within a regulatory framework is that firms are subject to ongoing obligations, oversight, documentation requirements, and compliance expectations that are intended to promote accountability.

The broader takeaway is that regulation supplements management assurances with enforceable obligations, external oversight, documentation requirements, and potential regulatory consequences.

Bull markets reward speed. Platforms compete to list more assets, provide leverage, expand internationally, and make trading feel as convenient as possible. Compliance departments, custody reviews, capital buffers, and reconciliations look like costs.

Bear markets reveal what those costs bought.

During periods of market stress, platforms with effective custody, reconciliation, recordkeeping, and risk-management practices may be better positioned to address operational challenges and respond to client requests.

Ndax is not protected from market downturns simply because it is regulated. No exchange is. Ndax is subject to regulatory requirements relating to governance, custody, compliance, risk management, and client asset protection.

That is the quiet advantage of “boring” regulation. It does not promise that nothing will ever go wrong. It makes it harder for a platform to gamble with customer assets, hide the damage, and call the result innovation.

After Mt. Gox, QuadrigaCX, and FTX, boring does not mean a lack of ambition. For a centralized exchange, strong regulatory oversight may be an important indicator that a platform has implemented governance, custody, and risk-management measures intended to support its long-term operations.