CIRO Supervisor cheat sheet

CIRO is the pan-Canadian self-regulatory organization formed from the merger of IIROC and the MFDA; it writes and enforces investment dealer and mutual fund dealer rules under CSA oversight.

The supervisory framework rests on three pillars: written policies and procedures, a designated supervisor with defined authority, and documented evidence that supervision occurred.

Supervision must be proportionate to risk: higher-risk activities (new accounts, leveraged or exempt products, discretionary trading) require more frequent and more senior review.

A supervisor's approval authority cannot be delegated to the same person whose work is being reviewed; independence of the reviewer is a core control.

Ethical duties owed to clients: act honestly and in good faith, act with care and diligence, manage conflicts in the client's favour, and avoid misleading communications.

Conduct expectations extend to fitness: registration requires demonstrated integrity, and reportable events (bankruptcy, criminal charges, civil judgments) must be disclosed promptly.

A compliance system requires an annual risk assessment, a testing/monitoring plan, and escalation paths to the ultimate designated person and chief compliance officer.

Breaches are assessed by severity, repetition, client harm, and whether the conduct was deliberate; remediation and self-reporting mitigate penalty.

Account opening requires identity verification, a signed client account agreement, a completed KYC profile, and documented suitability of the account type before the first trade.

New account documentation must be reviewed and approved by a designated supervisor before or promptly after activation, per firm policy thresholds.

Account types carry distinct controls: cash, margin, registered (RRSP/TFSA/RRIF), discretionary, corporate, and institutional accounts each have separate approval and documentation standards.

Third-party authorization (POA, trading authority, trusted contact person) requires signed documentation, verification of the authorized person's identity, and supervisory approval.

Changes to a client's KYC information must be documented, dated, and re-approved; an unsigned or unverified update cannot support a suitability determination.

Account restrictions, holds, or freezes must be recorded with the reason, the approver, and the release conditions.

Dormant or inactive accounts require periodic review; reactivation triggers refreshed KYC and suitability reassessment.

Supervisors must review account documentation for completeness and consistency between stated objectives, risk tolerance, and the products actually traded.

KYC core elements: identity, age, financial situation (income, assets, liabilities), investment knowledge, investment objective, risk tolerance, time horizon, and liquidity needs.

Suitability requires a reasonable-basis assessment of the product and a client-specific assessment matching the product to the KYC profile at the time of the trade.

Risk tolerance and risk capacity are distinct: tolerance is willingness to accept volatility; capacity is ability to absorb loss given financial circumstances.

Concentration limits and leverage must be assessed against total portfolio, not only the individual trade.

Suitability must be reassessed on trigger events: material KYC change, product change, market-driven drift, or a shift in the client's circumstances.

Documentation must show the reasoning behind the recommendation, not merely a checkbox that the trade was suitable.

Client communications must be accurate, balanced, and free of misleading performance claims; complaints and instructions must be logged.

Where the client directs an unsuitable trade, the firm documents the client instruction, warns the client, and applies any firm-specific unsolicited-trade controls.

Best execution requires reasonable efforts to obtain the best available price considering price, speed, certainty of execution, cost, and order size.

Order handling rules prioritize client orders over proprietary orders; front-running and trading ahead of client orders are prohibited.

Order records must capture time of receipt, time of entry, time of execution, quantity, price, client identifier, and the routing venue.

Supervisors review for excessive trading (turnover and cost-to-equity), churning indicators, unauthorized trades, and trades outside stated objectives.

Trade correction and cancellation protocols require documented approval, client notification where applicable, and an audit trail.

Cross trades, principal trades, and agency cross transactions require disclosure, client consent where required, and price fairness verification.

Restricted and watch lists must be checked before order entry; a breach requires escalation and a documented investigation.

Best-execution reviews should be periodic, sample-based, and consider order types, venues, and market conditions specific to each security class.

Product due diligence must occur before a product is approved for sale; it evaluates structure, fees, liquidity, risk, and the target client segment.

Exempt-market and prospectus-exempt products require verification of accredited-investor or minimum-amount status and signed risk acknowledgment.

Leveraged, inverse, and structured products require enhanced suitability review, disclosure of payoff mechanics, and often a holding-period or approval restriction.

Mutual fund and segregated fund sales require disclosure of the compensation structure; deferred sales charge and low-load schedules carry specific redemption rules.

Institutional account onboarding requires documented investment policy constraints, authorized signatories, and trade allocation methodology.

Product shelf reviews must be periodic; products that no longer fit the approved shelf are removed and client holdings assessed for remediation.

New or novel products require senior approval and a documented rationale for the target market and any restrictions.

Supervisors must detect off-shelf or unauthorized product sales and treat them as a reportable control failure.

All marketing material must be fair, balanced, and not misleading; performance claims require the time period, whether returns are gross or net of fees, and the benchmark.

Hypothetical or projected performance must be labelled as such and must not imply that past results guarantee future outcomes.

Pre-approval by a designated supervisor is required before publication or distribution of advertising and client-facing sales communications.

Social media and digital communications are subject to the same review, retention, and supervision standards as print materials.

Testimonials and third-party ratings require disclosure of any compensation paid and the criteria used.

Sales-practice reviews look for high-pressure tactics, unsuitable switching between products, excessive trading, and misrepresentation of guarantees.

Communications must be retained for the required retention period and be retrievable for regulatory review.

Complaints about marketing or sales conduct feed into the firm's complaint and investigation process and must be tracked to resolution.

Conflicts must be identified, disclosed in a manner the client can understand, and managed or avoided in the client's best interest; disclosure alone does not resolve a material conflict.

Compensation structures that reward volume or product-specific sales create conflicts; supervision must test whether recommendations are influenced by compensation.

Outside business activities and personal financial dealings with clients require prior written approval and ongoing monitoring.

Personal trading by employees (including family accounts) is subject to pre-clearance, restricted lists, and holding-period rules.

Gifts and entertainment must fall within firm limits, be logged, and be assessed for whether they could influence a recommendation.

Referral arrangements and finder's fees must be disclosed and documented; undisclosed referral compensation is a conflict and a compliance breach.

Proprietary product sales, principal trading, and underwriting participation require specific conflict controls and supervisory review.

Supervisors must maintain an up-to-date register of outside activities and conflicts and review it at least annually.

AML program elements: designated compliance officer, written policies, risk-based client due diligence, ongoing monitoring, recordkeeping, and training.

Client identification and verification is required at onboarding; enhanced due diligence applies to high-risk clients, PEPs, and correspondent relationships.

Suspicious transaction indicators include unusual cash activity, structuring, rapid movement of funds, activity inconsistent with the KYC profile, and reluctance to provide information.

Suspicious transaction reports are filed to the financial intelligence unit; tipping off the client about a report is prohibited.

Large cash and electronic funds transfer reporting thresholds are jurisdiction-specific and must be applied per the local regime.

Fraud detection controls include identity verification, device and IP monitoring, signature and authority checks, and call-back verification for disbursements.

Red flags must be escalated to the AML officer; the decision to file or not file, and the rationale, must be documented.

Sanctions and terrorist-financing screening must be performed at onboarding and on an ongoing basis against applicable lists.

A complaint is generally any expression of dissatisfaction about a product or service; it must be logged, acknowledged, investigated, and resolved within defined timelines.

Complaint records must capture the date received, the substance, the investigation steps, the outcome, and client notification.

Investigations require independence, preservation of evidence, documented interviews, and a written conclusion with findings and remediation.

Serious misconduct must be reported to the regulator within required timeframes; self-reporting and cooperation are mitigating factors.

Enforcement tools include cautionary letters, fines, suspensions, conditions on registration, and revocation, plus disgorgement of profits.

Sanctions are determined by factors including harm to clients, financial benefit obtained, prior disciplinary history, and cooperation.

Remediation plans must identify root cause, corrective controls, owners, and completion dates, and be verified by compliance.

Clients must be informed of the outcome of their complaint and of any available dispute-resolution or ombudsman route.

Records must be accurate, complete, current, and retained for the period required by securities law; retention periods are set by regulation, not firm preference.

Client and order records must be retrievable within required timeframes and produced to the regulator on request.

Electronic communications and business records must be captured, archived in a non-rewritable format, and searchable for supervisory review.

Regulatory reporting includes financial filings, capital and risk reporting, reportable events, and large-trader or position reporting where applicable.

Cybersecurity controls include access management, encryption, monitoring, incident response, and vendor due diligence.

Technology changes (new systems, algorithm changes, outsourcing) require pre-implementation risk assessment and supervisory sign-off.

Business continuity and disaster recovery plans must be tested periodically and address record availability and order handling during outages.

Audit trails must be tamper-evident; alteration or deletion of records without authorization is a serious breach.