CIRO Director and Executive cheat sheet

CIRO is the Canadian Investment Regulatory Organization, formed by amalgamating the Investment Industry Regulatory Organization of Canada (IIROC) and the Mutual Fund Dealers Association of Canada (MFDA), effective January 1, 2023.

CIRO is a national self-regulatory organization (SRO) recognized by the Canadian Securities Administrators (CSA); it is not a government agency and does not have statutory rule-making force independent of CSA recognition and approval.

Mandate elements: protect investors, foster fair, efficient and competitive capital markets, regulate dealer and marketplace conduct, set proficiency and capital standards, and enforce rules through discipline.

CIRO regulates investment dealers (including those operating alternative trading systems and marketplaces) and mutual fund dealers, plus their registered representatives and approved persons.

Governance architecture includes a Board of Directors with a substantial proportion of independent directors, board committees (audit, governance, human resources, risk), and an executive leadership team led by the President and CEO.

Member regulation is exercised through dealer membership categories; firms must be members to operate, and membership carries ongoing obligations (capital, insurance, compliance reporting, rule adherence).

CIRO operates alongside, not above, the CSA: provincial and territorial securities regulators retain ultimate statutory authority, approve CIRO rules, and can intervene in SRO decisions.

CIRO's investor protection mandate is supported by the Canadian Investor Protection Fund (CIPF), which covers client assets within defined limits on member insolvency; CIPF is separate from CIRO.

Industry and public representation on governance bodies is balanced so that public (non-industry) directors hold meaningful influence over rule approval and discipline policy.

Rule hierarchy: statute (e.g., provincial Securities Acts) > CSA national instruments and policies > CIRO rules and guidance > firm-level policies and procedures; a lower level cannot conflict with a higher one.

CIRO rules are organized into functional areas including membership, business conduct, capital and financial reporting, trading and market integrity, and enforcement; the Investment Dealer and Mutual Fund Dealer rule sets are distinct.

National Instrument 31-103 governs registration requirements for firms and individuals; CIRO rules layer SRO-specific obligations (capital, conduct, proficiency) on top of registration.

Dual-membership firms must satisfy both dealer rule sets; where obligations overlap, the more stringent requirement generally governs to avoid regulatory arbitrage.

CIRO guidance (bulletins, notices, interpretations) is not a rule but signals expected conduct and is used by staff and hearing panels in assessing reasonableness.

Rule application is purposive: panels interpret rules in light of their investor-protection objective rather than narrow literalism, and may consider industry practice and prior decisions.

Exemptive relief may be granted by CIRO staff or a hearing panel where strict application would be impractical; relief is generally conditional, time-limited, and disclosed.

Material rule changes require CSA approval and public comment; firms are bound once changes take effect, with transition periods specified in the notice.

Compliance with securities legislation and CIRO rules is cumulative: satisfying one does not excuse failing the other, and both can generate separate proceedings.

Directors owe fiduciary duties to the organization: act honestly and in good faith in its best interests, exercise care, diligence and skill of a reasonably prudent person, and avoid conflicts.

The CEO and executives owe duties of loyalty, good faith, and candor to the Board; they must not usurp corporate opportunities or misuse confidential information.

Board responsibilities include oversight of strategy, risk appetite, financial reporting integrity, executive compensation, succession planning, and compliance culture.

Directors must ensure adequate internal controls and compliance systems exist; failure to oversee a compliance function can itself be a breach even absent personal misconduct.

Independence requirements mean a defined proportion of directors must have no material relationship with the organization; independent directors should lead key committees.

The audit committee, composed of independent directors with financial literacy, oversees external audit, internal controls, and whistleblower mechanisms.

Executives must certify or attest to regulatory filings and internal control effectiveness where required, and must escalate material compliance failures to the Board.

Confidentiality and information barriers: directors and executives must not trade on or disclose material non-public information obtained through their roles.

Succession and competency: boards must maintain a skills matrix and ensure directors have sufficient industry, financial, and regulatory literacy to discharge oversight.

Core ethical duties: act with integrity, honesty, fairness, and in the client's best interest; avoid, disclose, or manage conflicts in that order of preference.

A conflict of interest exists where a personal, financial, or other interest could reasonably be seen to impair objectivity; the test is reasonable perception, not actual bias.

Material conflicts must be disclosed to clients in a manner they can understand before or at the time of the transaction, and client consent may be required.

Personal trading by registered representatives is restricted: pre-clearance, blackout periods, minimum holding periods, and prohibitions on front-running and insider trading.

Gifts and entertainment are governed by thresholds and approval requirements; anything that could influence judgment must be declined or disclosed to the firm.

Outside business activities and private placements require prior written approval to prevent conflicts, diversion of opportunity, and undisclosed dual roles.

Referral arrangements and compensation from third parties must be disclosed; undisclosed referral fees are a conflict and a rule violation.

Conflicts at the firm level (proprietary trading, underwriting, market-making) are managed through information barriers, restricted lists, and disclosure rather than elimination.

Ethical decision framework: identify the conflict, assess materiality, consult the firm's policies and compliance, document the decision, and disclose or recuse as required.

Every member firm must maintain a compliance system proportionate to its size, complexity, and risk profile, with a designated Chief Compliance Officer (CCO) accountable to senior management.

Core compliance system components: written policies and procedures, a compliance manual, training, monitoring and surveillance, testing, recordkeeping, and escalation protocols.

The CCO must have sufficient authority, resources, and independence, with a reporting line to the CEO or Board and direct access to the audit or risk committee.

Annual compliance reports to CIRO are required, describing the firm's compliance structure, significant deficiencies, and remediation steps.

Supervision obligations require documented review of representatives' conduct, including trade review, correspondence review, and periodic branch and desk inspections.

Recordkeeping rules require retention of client records, order and trade records, complaints, and communications for prescribed periods, retrievable on regulatory request.

Complaint handling must be documented, timely, and fair, with a defined escalation path and reporting to the firm's compliance function.

Training must be role-specific and recurring, covering conduct rules, conflicts, anti-money laundering, privacy, and cybersecurity awareness.

Compliance testing should be risk-based and independent of the business line being tested; findings must be tracked to remediation with executive accountability.

Risk categories for dealers include market, credit, liquidity, operational, compliance/legal, reputational, and technology/cyber risk; each requires identification, measurement, monitoring, and mitigation.

Minimum capital and early warning requirements are set by CIRO rules (risk-adjusted capital, margin, and financial reporting triggers); breaching early warning thresholds requires immediate notification.

The three lines of defense model: business lines own risk, the risk/compliance function oversees and challenges, and internal audit provides independent assurance.

Internal controls include segregation of duties, dual authorization, reconciliation, access controls, and exception reporting; no single person should control a transaction end to end.

Business continuity and disaster recovery plans must be tested and documented, with recovery time objectives defined for critical systems and client access.

Cyber and information security controls include vulnerability management, incident response plans, breach notification, and vendor/third-party risk assessment.

Risk appetite statements, set by the Board, translate into limits and tolerances that management must monitor and report against periodically.

Insurance (including fidelity and professional liability coverage) is a required control for member firms, with minimum coverage levels prescribed by rule.

Incident and loss reporting to CIRO is mandatory for significant events, including fraud, system failures, and material control breakdowns.

CIRO enforcement process stages: detection/investigation, staff notice of allegations, settlement or hearing, hearing panel decision, and penalty or sanction.

Hearing panels are independent of CIRO staff; they determine liability and impose sanctions based on the rule violation, harm caused, and aggravating/mitigating factors.

Available sanctions include fines, suspensions, permanent bans, conditions on registration, disgorgement, costs, and orders to complete remedial training.

Settlement agreements must be accepted by a hearing panel, which assesses whether the proposed penalty is reasonable and in the public interest.

Penalty factors include the seriousness of the misconduct, client harm, the respondent's experience, prior discipline, cooperation, remorse, and remediation.

Self-reporting and cooperation generally mitigate sanctions; concealment, obstruction, and repeat misconduct aggravate them.

Member firms are responsible for the conduct of their representatives and can face discipline for inadequate supervision even absent personal wrongdoing.

Appeal rights exist: parties may appeal hearing panel decisions to an appellate panel or, in some circumstances, to the courts or securities commissions.

Reporting obligations: firms must report disciplinary events, regulatory actions, terminations for cause, and material changes in circumstances to CIRO within prescribed timelines.

Marketplace operators must maintain systems that ensure fair and orderly trading, including order entry controls, price and volume limits, and halt/auction mechanisms.

Surveillance systems must detect manipulative and deceptive trading, including spoofing, layering, wash trading, and marking the close.

Marketplace rules require disclosure of order handling, routing, and best execution practices, with monitoring to confirm compliance.

Significant system changes and new products require pre-launch testing, risk assessment, and notice to CIRO before deployment.

Marketplace participants must implement pre-trade risk controls and credit limits to prevent erroneous orders and systemic disruption.

Incident response for marketplaces includes immediate notification to CIRO, root cause analysis, and remediation reporting.

Audit trails must be complete, time-synchronized, and retained for the prescribed period to support regulatory reconstruction of trading.

Marketplace governance must include an independent oversight or regulatory liaison function with authority to escalate concerns.

Boards must set and model the firm's conduct culture; tone at the top is a recognized factor in regulatory assessments of compliance effectiveness.

Executive compensation structures should align with risk and long-term performance, avoiding incentives that reward excessive risk-taking or short-term sales.

Whistleblower programs must provide confidential, retaliation-free reporting channels with Board or audit committee oversight.

Directors must receive timely, accurate information from management to exercise effective oversight; information suppression is a governance failure.

Board minutes should document challenge, deliberation, and decisions on material compliance and risk matters.

Executive accountability frameworks assign named responsibility for control functions and require attestation of compliance.

Conflicts at the board level require recusal and independent approval; interested directors must not vote on matters in which they have a material interest.

Regulatory expectations include periodic board review of compliance reports, enforcement trends, and remediation status of identified deficiencies.

Individual registration requires sponsorship by a member firm, completion of prescribed proficiency courses and exams, and approval by CIRO and the applicable securities commission.

Continuing education requirements include annual compliance and professional development credits; failure to complete can result in suspension of registration.

Approved person status carries additional obligations, including disclosure of outside activities, personal financial circumstances affecting suitability, and regulatory history.

Firms must conduct background and reference checks before sponsoring an applicant and must notify CIRO of terminations for cause.

Supervision of new representatives includes heightened monitoring during a defined probationary period and documented proficiency verification.

Registration categories determine permitted activities; a representative may not perform activities outside their approved category without additional qualification.

Fitness for registration considers integrity, financial solvency, and disciplinary history; a firm cannot sponsor an individual it knows to be unsuitable.

Best interest standard: recommendations must be suitable and prioritize the client's interest over the firm's or representative's interest.

Suitability assessment requires knowledge of the client (objectives, risk tolerance, financial circumstances, time horizon) and the product.

KYC and suitability documentation must be updated on material life changes and at defined intervals.

Product due diligence must assess cost, risk, liquidity, and complexity; complex or high-risk products require enhanced disclosure and suitability review.

Compensation conflicts, such as trailing commissions or sales contests, must be disclosed and managed so they do not drive unsuitable recommendations.

Proprietary product recommendations require disclosure of the conflict and evidence that suitable non-proprietary alternatives were considered.

Client complaints alleging misrepresentation or unsuitability must be investigated and, where warranted, remediated promptly.

Firms dealing with clients in another province or country must comply with the registration and conduct rules of that jurisdiction, in addition to CIRO rules.

Cross-border arrangements with foreign dealers require written agreements allocating supervisory responsibility and disclosure to clients.

Anti-money laundering obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act apply alongside CIRO rules; FINTRAC is the AML regulator.

Privacy obligations under PIPEDA and provincial privacy laws govern collection, use, and disclosure of client information.

Sanctions and trade restrictions (e.g., Special Economic Measures Act) require screening of clients and transactions.

Record-sharing with foreign regulators is subject to legal constraints, client consent requirements, and regulator-to-regulator protocols.

A firm cannot use a foreign affiliate to avoid CIRO obligations; the member firm remains accountable for activities conducted through affiliates on its behalf.

CIRO staff have authority to compel production of records and attendance for interviews during investigations; failure to cooperate is itself a disciplinary offence.

Investigations are confidential; tipping off a subject or destroying records during an investigation constitutes obstruction.

Staff may issue a notice of hearing setting out allegations; the respondent has the right to know the case and respond.

Hearing panels apply a balance of probabilities standard and must give reasons for their decisions.

Interim orders, such as suspension pending hearing, may be imposed where there is risk to the public or the integrity of the process.

Legal privilege protects certain communications, but firms cannot use privilege to withhold records required by rule.

Parallel proceedings can occur (CIRO, securities commission, criminal); outcomes in one may be relevant but are not binding on the others.

Restitution and disgorgement orders aim to return funds to harmed clients where identifiable.

Risk-adjusted capital rules require firms to hold capital against market, credit, and operational risk exposures, calculated per prescribed formulas.

Liquidity requirements ensure firms can meet obligations as they come due, with monitoring of cash flow, client free credits, and funding concentration.

Client assets must be segregated from firm assets; commingling is prohibited and reconciliation is required regularly.

Early warning triggers require notification and remediation plans before a firm breaches minimum capital.

Monthly and annual financial reporting to CIRO is mandatory, with CEO/CCO attestation of accuracy.

Stress testing should model adverse market and liquidity scenarios and inform capital planning.

Subordinated debt and other capital instruments must meet prescribed terms to count toward regulatory capital.

Audit requirements: firms must be audited by an approved auditor, and material audit findings must be reported to the audit committee and CIRO.

Executives must ensure timely, accurate regulatory filings and must not certify information they know or should know is misleading.

Material events affecting the firm's financial condition, operations, or compliance must be reported to CIRO promptly.

Boards must oversee disclosure controls and procedures to ensure information reaching regulators and the public is reliable.

Related-party transactions require independent review and disclosure to prevent self-dealing.

Executives must establish and maintain a compliance reporting cadence to the Board, including key risk and conduct indicators.

Failure to escalate known compliance failures can expose executives to personal discipline and the firm to supervisory sanctions.

Board committees must document their oversight activities and report to the full Board.

Branch managers are responsible for day-to-day supervision of representatives, including trade review, client contact, and complaint escalation.

Supervisory structures must be documented, with clear reporting lines and defined escalation thresholds.

Remote and satellite offices require equivalent supervision; physical distance does not reduce supervisory obligations.

Trade review must identify unsuitable, unauthorized, or excessive trading, with documented follow-up on exceptions.

Client communications, including email and social media, must be reviewed under a risk-based supervision program.

Supervision failures are among the most common enforcement findings; documented, timely follow-up is the key defense.

Supervisory performance should be measured and reviewed, with consequences for repeated failures to address identified issues.

Gift and entertainment limits are set by firm policy within regulatory expectations; acceptance above threshold requires written approval.

Outside business activities, including directorships and paid advisory roles, require prior approval and ongoing disclosure.

Personal financial dealings with clients (loans, private investments) are generally prohibited absent explicit approval.

Political contributions may trigger pay-to-play restrictions and require disclosure and pre-clearance.

Charitable and community activities should be assessed for conflicts where they intersect with client or issuer relationships.

Referral and finder arrangements must be documented and disclosed; undisclosed compensation is a conflict violation.

Recusal is required where a representative's personal interest could affect objectivity on a client matter.

Market manipulation prohibitions cover spoofing, layering, wash trading, painting the tape, and other deceptive order activity.

Insider trading prohibitions apply to material non-public information obtained through any relationship, including employment or family.

Best execution obligations require reasonable efforts to obtain the best available price considering price, speed, certainty, and cost.

Order handling rules require fair allocation, timely execution, and disclosure of routing and priority practices.

Short selling rules impose locate requirements and restrictions on abusive short selling.

Marketplace conduct rules require orderly markets, including circuit breakers, halts, and error trade policies.

Surveillance and reporting obligations require firms to monitor for manipulative activity and report suspicious transactions.

Sanction objectives: specific deterrence, general deterrence, protection of the public, and remediation of harm.

Fines are calibrated to the seriousness of the conduct, the benefit obtained, and the respondent's ability to pay.

Costs awards may be imposed on the respondent to cover the expense of the proceeding.

Conditions on registration can include restricted activities, enhanced supervision, or mandatory retraining.

Appeals must be filed within prescribed timelines and generally do not stay the original order unless a stay is granted.

Publication of decisions serves deterrence and transparency; settlement agreements are generally published.

Compliance with sanctions is monitored, and non-compliance can lead to further discipline, including permanent bans.

Operational resilience requires firms to identify critical operations and set impact tolerances for disruption.

Third-party and vendor risk management includes due diligence, contractual controls, ongoing monitoring, and exit planning.

Change management controls require testing, approval, and rollback plans for system and process changes.

Data governance controls ensure accuracy, availability, and protection of client and regulatory data.

Fraud risk controls include segregation of duties, reconciliation, and monitoring of unusual transactions.

Incident management requires documented response, escalation, and post-incident review with lessons learned.

Resilience testing should include scenario exercises and recovery validation for critical systems.

Boards approve strategy and risk appetite and monitor management's performance against both.

Risk oversight includes review of top and emerging risks, risk concentrations, and the effectiveness of the risk function.

Boards must ensure the risk and compliance functions have adequate stature, resources, and independence.

Executive performance evaluation should include compliance and risk metrics, not only financial results.

Succession planning for the CEO and key executives is a board responsibility, with documented plans.

Boards should review regulatory examination findings and confirm remediation is complete and sustainable.

Board education on regulatory developments is expected to maintain effective oversight capability.

Records must be retained for prescribed periods, generally six to seven years depending on record type, and be readily retrievable.

Client records include KYC documentation, suitability assessments, account agreements, and transaction confirmations.

Electronic records must be preserved in a form that prevents alteration and supports audit.

Privacy rules require consent for collection and disclosure, with limits on use and safeguards for security.

Breach notification obligations apply where there is a real risk of significant harm from a privacy breach.

Access controls and audit logs protect client information and support investigations.

Records must be produced to CIRO on request; failure to produce is a disciplinary matter.

Complaints must be logged, acknowledged, investigated, and resolved within defined timelines.

Complainants must be informed of the firm's dispute resolution options, including arbitration or the Ombudsman for Banking Services and Investments (OBSI).

Complaint records must be retained and reported to CIRO as required.

Complaints alleging misconduct must be escalated to compliance and, where appropriate, reported to CIRO.

Firms must not discourage or obstruct complaints; retaliation against complainants is prohibited.

Root cause analysis of complaints should inform changes to supervision and product governance.

Firms and individuals must cooperate fully with CIRO investigations, including providing records and attending interviews.

Self-reporting of misconduct, where prompt and complete, is a mitigating factor in sanctioning.

Remediation steps taken before or during an investigation are considered in penalty assessment.

Failure to cooperate, misleading staff, or destroying evidence are independent violations that can increase sanctions.

Undertakings and compliance agreements may resolve matters without a full hearing in appropriate cases.

Monitoring of compliance with undertakings is conducted by CIRO staff, with breach leading to further proceedings.

Conduct risk is the risk that firm behavior harms clients or markets; it is managed through culture, incentives, and supervision.

Product governance requires assessment of target markets, suitability, and ongoing product review.

Incentive design should avoid rewarding sales volume at the expense of suitability.

Conduct metrics, such as complaint rates and supervisory exceptions, should be monitored and reported to the Board.

Vulnerable client protections require enhanced diligence and communication safeguards.

Conflicts between firm revenue and client interest must be identified and managed through disclosure and controls.

Directors and executives must act with integrity and avoid conduct that brings the organization into disrepute.

Codes of conduct must apply to directors and executives, with enforcement mechanisms and disclosure of waivers.

Insider trading policies must cover directors, executives, and their related persons, with blackout periods and pre-clearance.

Related-party and conflict transactions require independent approval and disclosure.

Executives must set a tone that encourages escalation of concerns without fear of retaliation.

Board ethics committees or governance committees oversee compliance with the code of conduct.

Training programs must be risk-based, role-specific, and refreshed periodically.

Mandatory topics include conduct rules, conflicts, AML, privacy, cybersecurity, and whistleblower protections.

Training completion must be tracked and reported to management and the Board.

New representatives require onboarding training before client-facing activity.

Supervisors require additional training on supervision, escalation, and documentation.

Training effectiveness should be assessed through testing and monitoring of conduct outcomes.

Enforcement begins with detection through surveillance, complaints, referrals, or self-reporting.

Staff investigations gather evidence and may result in a notice of hearing or a settlement proposal.

Settlements require panel approval and must be in the public interest.

Hearings are conducted by independent panels with procedural fairness protections.

Decisions and reasons are published to support transparency and deterrence.

Appeals are available within prescribed timelines and grounds.

Sanctions are enforced and monitored, with non-compliance leading to further action.

AML programs require a designated compliance officer, risk assessment, policies, training, and independent review.

Client identification and verification (KYC) is mandatory, with enhanced due diligence for high-risk clients.

Transaction monitoring must detect unusual activity, with investigation and reporting of suspicious transactions to FINTRAC.

Large cash and electronic funds transfer reporting obligations apply under prescribed thresholds.

Recordkeeping for AML purposes must meet FINTRAC requirements and be available on request.

Fraud controls include verification of client identity, monitoring of account changes, and protection against unauthorized access.

Executives are responsible for maintaining constructive relationships with regulators, including timely and accurate communication.

Boards should be informed of material regulatory developments, examinations, and enforcement matters.

Misleading a regulator is a serious breach of duty and can result in personal discipline.

Executives must ensure that regulatory commitments and undertakings are tracked and fulfilled.

Board oversight includes review of the firm's regulatory standing and any conditions on registration.

Transparency with regulators about identified deficiencies supports remediation and mitigates sanctions.

Compliance testing should be risk-based, independent, and documented.

Testing plans should cover high-risk areas such as suitability, conflicts, AML, and supervision.

Findings must be reported to senior management and the Board, with remediation plans and timelines.

Repeat findings indicate control weakness and require escalation.

Testing results should inform adjustments to the compliance program and training.

External reviews may be required by CIRO where deficiencies are significant.

Remediation plans must address root causes, not just symptoms, and include measurable milestones.

CIRO may require independent monitors or consultants to oversee remediation.

Progress reporting to CIRO is required until remediation is verified complete.

Failure to complete remediation can result in escalated sanctions, including restrictions on business activity.

Remediation should be embedded in governance, with Board oversight and executive accountability.

Lessons learned should be incorporated into policies, training, and controls to prevent recurrence.