CIRO Compliance Report for 2026: Helping Dealers with Compliance

1. Dealer Operations and Risk Management

1.1 Cybersecurity Risk

Cybersecurity continues to be a key business risk for all dealers, regardless of size and complexity, due to its potential impact on operations. As we shared in August 2025, CIRO experienced firsthand a sophisticated cyber-attack, which has become increasingly common. In 2026, CIRO will conduct another cybersecurity table-top exercise, similar to previous years, to help firms, particularly small and mid-sized dealers, identify emerging cyber and operational risks, learn best practices for managing evolving threats, and incorporate lessons learned from CIRO’s own recent incident.

Dealers must implement the necessary controls to protect clients’ personal information and assets, as well as their own critical systems and applications.

Investment Dealer and Partially Consolidated (IDPC) Rule 3703 mandates that investment dealers report any cybersecurity incidents that meet specific criteria. While we have observed a consistent flow of incident reports, there has been an increase in cases involving third-party service providers affecting our dealers. Fortunately, most have managed to minimize significant disruptions to their operations. When engaging with third-party service providers, it is crucial for dealers to assess risks at all stages: before, during, and after the engagement. To assist in this, we issued Guidance Note GN-2300-21-003: Outsourcing Arrangements, outlining what functions can be outsourced and our expectations for managing risks associated with the use of third-party services.

The most valuable asset in managing cybersecurity risk is a dealer’s personnel. While many dealers have implemented effective preventative and detective measures, inadequate training can make staff the weakest link in cybersecurity defense. We have seen instances where employees have fallen victim to phishing attempts, allowing unauthorized access to dealer systems. Continuous training for all staff is highly recommended to enhance awareness and reduce vulnerability to these attacks, with the implementation of multi-factor authentication as a second layer of protection.

During regularly scheduled examinations for investment dealers, we continue to look at:

• how dealers demonstrate compliance with the cybersecurity incident reporting requirements,
• how cybersecurity risk is managed, and
• how we incorporate our assessment into the applicable risk score for dealers.

Each year, we observe a decline in findings related to cybersecurity incident reporting requirements. This trend was anticipated, as these issues were among our most significant findings following the issuance of Guidance Note GN-3700-22-0001: Compliance with Cybersecurity Incident Reporting Requirements issued in February 2022. We are now seeing substantial progress in the remediation of these cybersecurity-related findings. The rapid pace of technological innovation continues to transform the cybersecurity landscape, introducing both opportunities and challenges for organizations worldwide. Among these advancements, Artificial Intelligence (AI) has emerged as a pivotal force, influencing cybersecurity strategies on multiple fronts. AI-driven solutions enhance defensive capabilities through improved threat detection, predictive analytics, and automated incident response. At the same time, adversaries are leveraging AI to develop more sophisticated attack techniques, increasing the complexity of the threat environment.

This dual impact underscores the need for dealers to adopt a proactive and adaptive approach to cybersecurity. Understanding how AI shapes both offensive and defensive dynamics is critical for building resilient systems and mitigating emerging risks.

1.2 Crypto Asset Trading Platforms (CTPs)

We continue to work with Crypto Asset Trading Platforms (CTPs) to transition them into CIRO membership. This involves conducting a rigorous due diligence review and providing interpretive guidance, particularly when it comes to records and custom-built systems. We perform field examinations of approved CTPs in their first year to validate key controls and compliance with terms and conditions, and in subsequent years to broaden our understanding of these controls and processes and develop a risk-based program for testing CTPs’ key processes and compliance infrastructure.

On February 3, 2026 CIRO published Guidance Note 26-0033: Notice on CIRO's Digital Asset Custody Framework. The crypto custody framework will utilize a matrix of technical and operational requirements that will qualify custodians, with limits imposed on customer assets held at these crypto custodians. In conjunction with the custody framework, segregation practices for CTPs will be standardized based on current best practices. We look to codify certain expectations on how CTPs move customer assets into segregation, and how they deal with proprietary interests in segregated locations that are necessary for operational purposes.

CTPs continuously respond to evolving markets and technology by offering new services and making changes to their operational processes, some of which CIRO is planning to permit under InnovateSafe, a regulatory sandbox initiative that allows CIRO-regulated firms to safely test innovative products and technologies in a controlled environment with CIRO oversight. The first of two key areas under consideration for InnovateSafe is offering lending services to retail clients collateralized by crypto assets in their trading account. Secondly, stablecoins offer a strong use case to improve CTPs’ ability to settle efficiently with liquidity partners and clients outside of standard banking hours, which would improve their resiliency. The regulatory environment for the use of stablecoins is changing rapidly in both Canada and the United States as both countries have recently introduced legislation that would oversee and regulate the usage of stablecoins as a form of payment.

CTPs and the crypto ecosystem are in a period of rapid growth and change both in Canada and globally. We will continue our work to stay abreast of these developments while continuing to monitor, through ongoing dialogue and scheduled field examinations, CTPs’ activities in the context of their approvals, offering guidance and testing for adherence to the conditions under which they were approved.

1.3 Reconciliations at Mutual Fund Dealers

During recent financial compliance examinations of Level 4 mutual fund dealers, we continued to identify deficiencies regarding the reconciliations of assets held by dealers on behalf of clients. Deficiencies have ranged from (i) incomplete or improperly performed reconciliations, to (ii) no reconciliations prepared at all for non-FundSERV positions, to (iii) no review of acceptable securities locations. Mutual Fund Dealer Rules require nominee name positions and trust bank accounts to be reconciled monthly, and senior personnel are required to review and approve the reconciliations. In addition, margin for adverse unresolved differences or unconfirmed positions must be provided in accordance with the Notes and Instructions to Statement B of Form 1.

Separate financial compliance examinations of Level 2 and Level 3 mutual fund dealers, which commenced January 1, 2025, have also identified instances where (i) the dealer’s own investment positions were not reconciled to third-party month-end statements, and (ii) the reconciliation of operating bank account balances to month-end bank statements was not formally documented and/or retained.

Mutual fund dealers are reminded to reconcile both client assets and the dealer’s own assets to third-party information at least monthly. To the extent that assets are unresolved or unconfirmed, dealers must be prepared to maintain sufficient regulatory capital to cover the required margin provisions. In addition, the dealer’s policies and procedures manual should meet CIRO’s minimum standards and be implemented in practice by dealer staff. Dealers’ monthly reconciliation processes will remain a focus of financial compliance examinations.

1.4 Interim Risk Adjusted Capital Calculations at Mutual Fund Dealers

Mutual Fund Dealer Rules require that a dealer’s capital position be calculated at least monthly. To avoid or correct any potential capital deficiencies, more frequent intra-month Risk Adjusted Capital (RAC) estimates should be calculated when items could significantly affect the capital position. Planned business activities requiring capital and other adjustments, such as year-end audit entries, should be included in RAC estimates well in advance of the month-end filing deadline. Maintaining or operating at only the minimum capital level bears the risk of triggering early warning and the imposition of restrictions under Mutual Fund Dealer Rules.

Dealers are responsible for always having and maintaining RAC greater than zero. In addition, the dealer’s policies and procedures manual should meet CIRO’s minimum standards and be implemented in practice by dealer staff. Financial compliance examinations will review whether a dealer’s internal controls over monitoring capital are appropriate compared to the business activity.

1.5 Artificial Intelligence (AI)

Artificial intelligence (AI) is becoming increasingly important in enabling dealers to manage complexity, improve efficiency, and strengthen decision-making. The use of AI in daily activities offers a practical way to reduce manual effort.

As part of our FinOps examination approach, we will be enquiring about the use of AI in dealers’ operations. To the extent dealers are using AI, we will be reviewing the operational controls they implemented to ensure AI is working as designed.

Dealers should also assess whether any use of AI and/or automation of its regulatory functions is a material business change thereby requiring advance written notification to CIRO and/or an update to firm registration information through filing a Form 33-109F5 Change of Registration Information. For further details, refer to Guidance Notice GN-2200-21-001: Reporting of material changes to business activities

2. Trading

2.1 Short Selling and Extended Failed Trades

Short selling and extended failed trades remain a key area of focus for CIRO.

Amendments to Universal Market Integrity Rules (UMIR) 3.3 took effect on April 4, 2025, introducing a positive obligation for participants to have a reasonable expectation to settle on settlement date before entering any order that would result in a short sale on a marketplace. These changes were detailed in Rules Notice 24-0394: Amendments Respecting the Reasonable Expectation to Settle a Short Sale and further clarified in Guidance Note GN-URPart3-24-002: Guidance on UMIR Requirements Related to Short Selling and Failed Trades.

Participants must ensure their policies and procedures reflect these requirements and maintain robust processes and testing to ensure short sales are properly marked and a reasonable expectation is obtained prior to the entry on a marketplace. When issues are identified, prompt corrective action is expected to prevent recurrence.

Under UMIR 7.10, participants must report to CIRO any trade executed on a marketplace that fails to settle on the settlement date and remains unresolved for 10 trading days thereafter. Each participant must review failed trades to determine root causes and implement corrective measures. Non-participant dealers that route orders through an executing firm are also expected to supervise this activity under IDPC rules.

Trading Conduct Compliance (TCC) will continue reviewing participants’ procedures and internal testing to confirm controls are in place to prevent improper short sales and address extended failed trades. CIRO’s market compliance teams have adopted a proactive oversight approach, contacting dealers when potential issues are identified. Dealers must be able to demonstrate their reasonable expectation to settle and how it was formed.

2.2 Cross-Asset Surveillance

CIRO maintains a Memorandum of Understanding (MoU) with the Montréal Exchange (MX) to access TMX-listed derivatives data and integrate it with equity and debt market data. This enables CIRO to identify potential manipulative trading activity across asset classes as part of its cross-asset surveillance program.

Under UMIR Policy 7.1 Part 5, participants must implement and maintain a supervision system to ensure orders entered on a marketplace are not part of a manipulative or deceptive practice, nor an attempt to create an artificial price or misleading appearance of trading activity. UMIR 2.2 further prohibits orders or trades that could reasonably be expected to create:

1. a false or misleading appearance of trading activity or interest in a security or derivative, or
2. an artificial bid, ask or sale price for a security or derivative.

Participants trading across multiple asset classes must have policies and procedures to detect potential manipulative activity and conduct regular internal testing of activity that spans across asset classes. If the testing identifies possible violations, these findings must be escalated for investigation.

TCC will continue reviewing participants’ procedures and testing the controls in place to confirm they are effective in detecting manipulative trading across asset classes.

2.3 Order Markers and Client Identifiers

Since July 2021, investment dealers have been required to include client identifiers on applicable client orders for listed securities. Our reviews continue to identify challenges in the accurate application of order markers, particularly regarding:

• client identifiers for client orders (legal entity identifier if the client is eligible or account number), and
• designations such as Direct Electronic Access (DEA), Routing Arrangement (RA), Foreign Dealer Equivalent (FDE), and Order Execution Only (OEO).

We encourage dealers to review the Resources available on the CIRO website to assist them in meeting these requirements.

Participants must maintain policies and procedures to determine applicable designations and identifiers for each order entered on a marketplace. Regular internal testing should confirm accuracy. Errors identified must be corrected through the Regulatory Marker Correction System (RMCS). While post-trade corrections are important, accuracy at order entry is critical for effective supervision.

TCC reviews participants’ procedures to ensure all applicable designations and identifiers are addressed and that processes for detecting and reporting issues are in place. RMCS activity, including frequency and patterns, will be assessed to determine whether controls for accurate order marking at order entry are effective.

3. Conduct and Supervision

3.1. Client Focused Reforms (CFR) – Phase 2 Sweep Report

The joint CSA-CIRO Phase 2 CFR Sweep report was published on December 10, 2025. The report provides a summary of common deficiencies identified during the sweep regarding the CFR enhancements associated with Know Your Client (KYC) information collection, Product Due Diligence (PDD), Know Your Product (KYP) and Suitability Assessments. In particular, the most common deficiency identified for CIRO dealers was a failure to have policies and procedures that are tailored to the firm’s business model, and which are detailed and actionable. Policies and procedures that simply reiterate the principles-based rules, without providing any additional detail regarding specific processes the firm has implemented, are inadequate. We strongly encourage dealers to review the report and assess their own policies, procedures, and practices. BCC examinations will focus on assessing whether dealers have taken steps to rectify any deficiencies identified in the report that may be applicable to their firm. CIRO is also developing additional guidance that will assist firms in areas where deficiencies were commonly identified.

3.2 Dealer Arrangements with Finfluencers

In December 2025 we also published a joint CSA-CIRO Staff Notice regarding the activities of finfluencers in Canadian capital markets. Although much of the notice was directed at finfluencers themselves, and therefore not within the direct purview of CIRO, a section of the notice dealt with registrants that work with finfluencers. The notice provides guidance to CIRO dealers who have entered into any type of arrangement with one or more finfluencers. In particular, the report highlights the following responsibilities on CIRO dealers:

• performing adequate due diligence on the finfluencer prior to engaging their services or entering into an agreement,
• establishing written agreements, including referral agreements, that set out the purpose of the arrangement and each party’s roles and responsibilities,
• taking direct steps to ensure that the finfluencer is sufficiently well informed to be able to discuss the firm and its products and services in a way that is fair, balanced, substantiated and not misleading (e.g., by containing untrue statements, unjustified promises of specific results or failing to fairly present risks),
• verifying on an ongoing basis that any claims or statements made by the finfluencer about the firm or the firm’s products and services are fair, balanced, substantiated and not misleading, and taking corrective action if they are not,
• ensuring that employees are adequately trained regarding any direct involvement with finfluencers and, through ongoing monitoring, identifying any unapproved involvement of employees with finfluencers on the firm’s behalf, and
• identifying, disclosing and addressing any material conflicts of interest in the best interest of the client.

BCC examination procedures have been enhanced to include a review of controls implemented by dealers who have entered into arrangements with finfluencers.

3.3 Order Execution Only (OEO) Guidance

On August 12, 2025, CIRO published for comment proposed guidance intended to replace the current Guidance Note 3400-21-003: Guidance on Order Execution Only Account Services and Activities. The proposed guidance, as outlined in Rules Bulletin 25-0227, proposes material changes to the existing regime following significant and continuous growth in the number of do-it-yourself (DIY) investors in the industry. Both the investing public and OEO dealers have called for updates to the current guidance to better serve and support clients in these channels. When the new guidance is finalized in 2026, BCC will update our test procedures to reflect the new regime.

3.4 Anti-Money Laundering (AML) Compliance

Under the existing MoU between CIRO and FINTRAC, both organizations share information on dealer compliance with the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). The MoU aims to:

• facilitate information exchange to support each party’s mandate, and
• reduce compliance burden for CIRO registrants.

BCC examinations use a risk-based approach to review Anti-Money Laundering (AML) compliance. A five-year analysis shows the most common deficiency is failure to conduct effective biennial AML Compliance Effectiveness Reviews, which often leads to broader AML issues. BCC will continue to focus on the quality of these reviews.

Additionally, BCC will emphasize integration of the Government of Canada’s 2025 National Risk Assessment (NRA) and FINTRAC’s sector-specific NRA into dealers’ Money Laundering/Terrorist Financing risk assessments. Dealers must apply NRA findings to identify high-risk areas (e.g., bribery, corruption, high-risk jurisdictions, product vulnerabilities) and implement targeted controls to meet PCMLTFA obligations.

3.5 BCC Examinations

BCC made several notable observations during their recent examinations that may impact the effectiveness of dealers’ compliance systems. The following examples are not exhaustive. Dealers should review their policies, procedures, and practices considering these findings to maintain strong compliance frameworks.

Employee Supervision – Outside Activities & Client Communications

Effective supervision of employees and agents is critical to ensuring compliance with regulatory obligations and safeguarding investor interests. Recent examinations identified gaps in supervisory practices, including inadequate review of outside activities and the assessment of those activities for potential conflicts of interest, as well as identification of client communications through non-approved channels.

Dealers should implement a robust process for reviewing outside business activities, including assessing them for potential conflicts of interest. They should enforce strict controls over approved communication channels and deploy monitoring tools to detect any use of non-approved platforms. In addition, dealers must provide regular training to employees on reporting requirements, disclosure obligations and approved communication practices to ensure consistent compliance.

Conflicts of Interest – Identification & Management

Managing conflicts of interest remains a cornerstone of investor protection. Recent examinations revealed gaps in how dealers identify, assess and disclose conflicts, including:

• disclosing conflicts in client documents but failing to maintain adequate assessments in internal records,
• reviewing conflicts in internal registries without providing adequate disclosure to clients, and
• absence of a centralized conflict of interest repository, resulting in inconsistent recordkeeping and missed updates during periodic reviews.

Dealers should conduct comprehensive due diligence, including a documented assessment of potential conflicts of interest, and maintain clear evidence of their review. To support consistent oversight, dealers are encouraged to maintain a centralized conflicts-of-interest register that ensures all conflicts are properly recorded, assessed, and updated on a regular basis. Disclosure practices should be strengthened so that information provided to clients is clear, timely, and easily accessible. Dealers should also maintain written procedures for identifying, addressing, and disclosing conflicts of interest, ensuring that these policies remain current and accurately reflect the dealer’s business practices and operational realities.

Supervision Systems

BCC raised concerns about the adequacy of daily and monthly trade supervision. Supervisors relied on supervision systems that produced incomplete reports, omitting key elements required under CIRO rules and failing to confirm what was reviewed or when the reviews occurred.

Dealers should implement supervision systems that generate a complete audit trail, clearly documenting what was reviewed, by whom, and when the review occurred. Dealers should establish a process for periodic integrity testing of these systems to ensure data accuracy and completeness. In addition, dealers should provide training to supervisors on proper use of these systems and audit trail requirements.

Referral Arrangements

Effective controls over referral arrangements are essential to ensure compliance with regulatory requirements. Recent examinations identified deficiencies where dealers failed to conduct due diligence, including assessing potential conflicts of interest prior to onboarding referral entities, and did not provide required referral disclosures to clients at account opening or before services were delivered.

Dealers should conduct thorough due diligence, including a documented assessment of potential conflicts of interest, and retain evidence supporting the review. They should also implement a reliable process to verify that referral disclosures are provided to clients before account opening or the initiation of any services and maintain clear documentation confirming delivery. In addition, dealers should ensure that staff receive appropriate training on referral arrangement requirements and related disclosure obligations, promoting consistent and compliant practices across the organization.

4. Registration and Proficiency

4.1 Update on Delegation of Registration Categories

Essential to CIRO’s mandate is its registration and approval function. CIRO gained enhanced registration functions in 2025 for investment dealers, mutual fund dealers and associated individuals under a delegation initiative with the Canadian Securities Administrators (CSA).

National delegation from CSA jurisdictions of registration functions for mutual fund and investment dealers is nearly complete. CIRO’s Registration department now handles the registration function for the majority of individuals who work in Canada’s securities industry. This includes registration reviews of the compliance mind and management and executives of dealers, such as chief compliance officers, ultimate designated persons, chief financial officers as well as supervisors and branch managers. The team approves registration applications for portfolio managers at CIRO dealers, who have discretionary authority over client accounts, and a wide range of advisors and other individuals. The department also processes various registration information updates for dealers. CIRO materially added to its staffing resources nationally to support these increased functions.

The department carries out CIRO’s gatekeeping role for the ongoing protection of investors. In appropriate cases, Registration staff will recommend that supervisory terms and conditions be imposed on an individual’s registration or other regulatory action, up to and including refusal of registration, where an individual’s conduct raises suitability or investor protection concerns.

CIRO’s Registration department will continue to drive efficiencies and burden reduction through its national platform with the aim of providing a consistent and harmonized approach to registration to meet the evolving needs of investors and dealers across Canada.

More information on the delegation initiative can be reviewed on CIRO’s website:

• CIRO’s Information Notice
• Frequently Asked Questions

4.2 Dealer Acquisitions

CIRO was also delegated the authority by CSA members in most jurisdictions to review acquisition notices under sections 11.9 and 11.10 of National Instrument 31-103 Registration Requirements, Exemptions and Ongoing Registrant Obligations, where CIRO has been delegated registration functions for a dealer that is involved in the transaction.1 We remind dealers and filing counsel that notice must be provided to CIRO where required, and CIRO must provide its non-objection to a proposed acquisition, in addition to any approval also required under CIRO rules, prior to the transaction closing.

Notice under sections 11.9 and 11.10, where applicable, must be provided to both CIRO and the securities regulatory authority for the dealer’s principal jurisdiction if a CIRO dealer is also registered in a registration category that has not been delegated to CIRO. CIRO coordinates with CSA members to achieve efficient reviews for these matters.

Dealers can support efficient reviews as follows:

• Notice and approvals: Dealers should provide the required notices to CIRO pursuant to the applicable section of National Instrument 31-103, and seek non-objection to the proposed transaction, where CIRO has been delegated registration functions for a dealer that is involved in the transaction. Providing notice under NI 31-103 does not displace the requirement for dealers to request approval of proposed transactions under the relevant CIRO rules. Both the notice and the request for approval can be included in the same filing.
• Pre- and post-transaction charts: Dealers should include detailed pre-transaction and post-transaction organizational charts with their notices or requests for approval, which clearly outline how the transaction will impact the ownership structure of the dealer. The corporate organizational charts must include the percentage of ownership for each entity on the chart and the ultimate individual owners of the dealer.
• Complete information: When Investor Application Forms and Investor Notification Forms are required, filers must ensure that these forms are fully completed. This includes providing all names in full. Providing middle initials, incomplete dates of birth, or failing to provide residential addresses, can delay CIRO’s review of the transaction.

Filers should also communicate known transaction dates to CIRO at the outset of filings and at the earliest time. Dealers seeking to expedite transactions mid-review should be aware that CIRO conducts due diligence checks which require sufficient lead time.

Additional resources:

• For information on notifying CIRO of a change in ownership of the Dealer or its holding companies, refer to the Notice of Ownership Changes page of CIRO’s website
• For information on notifying CIRO of a material change in business, refer to the Notice of Business Changes
• All other changes should be submitted to CorporateFilings@ciro.ca

4.3 Supporting Documents for Individual Registration Filings

We encourage filers to include supporting documents when making individual registration filings on material issues or to provide CIRO with these documents as soon as possible.

Disclosures in registration filings pertaining to resignations and terminations, regulatory, criminal, civil or financial disclosures, or any material information about an individual, will generally trigger a detailed review by CIRO, as these items typically affect the individual’s suitability for registration or continued approval. While the review of these filings typically takes longer, filers can help cut down review times by providing supporting documents with the filings or as soon as possible.

CIRO typically requests that individuals provide the following when making material filings:

• Explanation Letter: An explanation letter signed by both the individual and a supervisory member of the dealer’s compliance department explaining the circumstances leading up to the relevant disclosure. In some cases, CIRO will also request letters from the dealer and the individual explaining why they believe the individual is or remains suitable for registration.
• Supporting Documents: Specific supporting documents relating to the circumstances, such as a copy of the criminal charges or release/bail conditions (regarding Item 14 Form 33-109F4 Registration of Individuals and Review of Permitted Individuals – Criminal Disclosure); Statement of Claim and Statement of Defence (regarding Item 15 Form 33-109F4 – Civil Disclosure); and Consumer Proposal Statement of Affairs, CRA Direction to Pay or similar documents (regarding Item 16 Form 33-109F4 – Financial Disclosure).

A list of supporting documents that CIRO typically reviews is outlined in this guidance.

4.4 Common Deficiencies

We are seeing some common deficiencies in registration filings which are listed below. Dealers should address these issues to achieve greater efficiency in their registration processes. This will help avoid unnecessary communications back and forth between CIRO staff and filing representatives, and filings being returned to dealers. Repeat deficiencies may also highlight the need for dealers to exercise greater diligence:

• Reportable Activities and Conflicts of Interest: Dealers are reminded to submit filings that adequately address the requirements under Item 10 Reportable Activities, of the Form 33-109F4 and conflicts of interest, particularly Item 3 Description of the Reportable Activity and Your Roles and Responsibilities, of Schedule G. For example, where individuals are to provide a description of their relationship with an entity, this should not be filled out with the approval category, such as “Registered Representative”. Rather, the nature of the relationship should be described (e.g., if the individual is an employee, agent, or if there is another specified relationship).

  In addition, careful consideration should be given to provide an appropriate level of disclosure under Item 5 Conflicts of Interest, of Schedule G. Dealers should avoid boilerplate responses. Filers must consider existing and reasonably foreseeable material conflicts of interest and existing and potential client confusion, as set out in the Schedule G instructions. Filers should also adequately respond to the questions regarding whether dealers and relevant entities have procedures for identifying and addressing material conflicts of interest, and whether individuals are complying with those procedures.

• Legal Name: Individuals must provide their full legal names in Item 1.1., Legal Name, of Form 33-109F4. Filing incorrect information in this field (e.g. short forms and anglicized names) will result in delays as new background checks may need to be conducted. Filers should use item 1.2 for other personal names and 1.3 for use of other names in accordance with the form’s instructions.

Dealers are encouraged to contact Registration staff on filing processes where questions arise.

4.5 Business Emails and Reinstatement Form 33-109F7

We remind dealers and individuals to ensure that individual business email addresses listed under Item 2 Residential Address of the individual registration form, Form 33-109F4 are up to date and not personal email addresses. The business email address field is also used for initiating background check processes, and inaccurate email addresses can cause registration delays.

The reinstatement form, Form 33-109F7 Reinstatement of Registered Individuals and Permitted Individuals, does not include the individual’s business email address field. As such, we encourage authorized filing representatives of dealers to contemporaneously submit with Form 33-109F7 a Form 33-109F5 Change of Registration Information notice to update the individual’s Item 2 business email address to the email address at their new sponsoring firm. This better ensures that the individual’s business email address field can be up to date upon reinstatement and promotes an efficient review.

4.6 Timely Disclosure of Registration Information

Dealers and individuals are reminded to update individual registration information on the National Registration Database within the timeframes set out in parts 3 and 4 of National Instrument 33-109 Registration Information. Timelines for key updates can be as short as 15 days, while others were lengthened to 30 days for burden reduction. Dealers are also required to submit their firm registration information updates under required timelines to CorporateFilings@ciro.ca.

CIRO treats late disclosures seriously and adopts CSA Staff Notice 33-320 The Requirement for True and Complete Applications regarding the obligations to keep registration information up to date. We had an instance where an individual was the subject of a Canada Revenue Agency requirement to pay, but notice was not provided under Item 16 Financial Disclosure, of Form 33-109F4 within 15 days as required. It is not acceptable for a notice to be simply provided after the requirement to pay or consumer proposal has been satisfied. Failure to make timely disclosure may bring an individual’s integrity or proficiency into question and could result in recommendations for regulatory action, such as supervisory terms and conditions on registration.

4.7 New Proficiency Model Applicable to Investment Dealer Approved Persons

The new assessment-centric proficiency model was implemented on January 1, 2026. Dealers should review the new IDPC rules along with the relevant guidance documents on the dedicated Proficiency page of CIRO’s website.

Information relating to the guidance documents can be found in the Rules, Guidance and Bulletins section of the Proficiency page.

Information relating to the new exams can be found in the Exam Hub section of the Proficiency page.

Dealers should communicate the new requirements to their employees and Approved Persons. Dealers should also have appropriate policies and procedures to ensure timely completion and reporting of the Conduct Training for new Approved Persons and existing Approved Persons. For more information, please refer to CIRO’s website.

4.8 Proficiency Exemptions

We remind dealers that before filing an exemption application, they should review our Guidance Notice on Proficiency Exemption Requests. We encourage dealers to review the notice, and contact Registration staff as needed, before submitting an exemption application.

4.9 Continuing Education (CE) Requirements

The end of the current Continuing Education (CE) cycle was November 30, 2025, for mutual fund dealer Approved Persons and December 31, 2025, for investment dealer Approved Persons.

We continue to work towards a harmonized CE program for all CIRO registrants. We published Bulletin 26-0005 on the approval of the Phase 1 CE Harmonization project with the intent to implement phases 1 and 2 at the same time. Over the course of the next few months, we will publish our proposed phase 2 amendments.

5. Membership Issues

5.1 Review of Material Changes to Business Activities

IDPC Rules require investment dealers to inform CIRO in writing before making any material changes to their business activities. Refer to Guidance Notice GN-2200-21-001: Reporting of material changes to business activities for more information regarding the purpose of notification, and which business changes require notice to CIRO. In February 2025, we made enhancements to the tools available for dealers to prepare notices of material changes in business activities. The new updated tools are intended to increase efficiency for dealers, provide greater transparency on what is considered in CIRO’s review, and reduce unnecessary processing delays as the timing of our review is dependent on the quality of the dealer’s submission and responsiveness to follow-up queries from CIRO staff. We encourage dealers to refer to the Notice of Business Changes page of CIRO’s website and Tools for Notifying CIRO of Business Change webcast for further information and guidance.

5.2 Service Standards

In conjunction with the enhanced tools for dealers, we have also established service standards associated with CIRO’s processing of Membership Applications and material business changes for current dealers. Our service standards are designed to ensure transparency and consistency, providing firms with a clear understanding of what to expect during CIRO’s review of their Membership Application or material business change. We will publish the results of our performance to these service standards on a quarterly basis. The results for Q3 FY26 are available at the bottom of the service standards page.

CIRO is reviewing its service standards for individual registration filings and intends to publish its targets and report on the achievements later this year.

5.3 Dual-Registered Dealers

CIRO has approved dual-registration applications for several dealers, allowing them to be registered as an investment dealer and mutual fund dealer within a single legal entity. This has included approval of exemptive relief from certain IDPC Rule requirements to minimize disruption to the dealer’s existing business operations. Further information on the exemptions granted is available in the Exemptions granted by CIRO in 2024 summary.

Dealers interested in dual-registration should refer to the guidance on Becoming a Dual-Registered Firm, available on CIRO’s website and the CSA Dual Registered Firm - Guide.

• 1The Manitoba Securities Commission has not delegated authority for reviews under sections 11.9 and 11.10 of NI 31-103 where it is the principal regulator for an affected firm. The British Columbia Securities Commission is considering delegation of registration-related authorities in 2026. Please note that firms having a Commodity Futures Act registration in Manitoba or Ontario must also provide notice to the Manitoba Securities Commission or Ontario Securities Commission respectively and seek their non-objection, regardless of the firm's head office location, as this category of registration is not covered under Multilateral Instrument 11-102 Passport System, and the Ontario Securities Commission has not delegated the authority to review proposed transactions for registration categories under the Ontario Commodity Futures Act.