The Canadian Investment Regulatory Organization (CIRO) has published new advice for investment and mutual fund dealers, in the form of a new compliance report, entitled Helping Dealers with Compliance.

“This report highlights the key issues and challenges that CIRO-regulated dealers should prioritize to strengthen investor protection and support robust market integrity,” the regulatory organization states. The report is also intended to help dealers focus their supervision and risk management practices.

Cybersecurity 

Cybersecurity was the first area noted by CIRO, which says the matter continues to be a key risk for all dealers. CIRO intends to conduct cybersecurity tabletop exercises in 2026, “to help firms, particularly small and mid-sized dealers, identify emerging cyber and operational risks, learn best practices for managing evolving threats and incorporate lessons learned from CIRO’s own recent incident.” (The organization noted in August 2025 that it had experienced a cyber-attack.) “Dealers must implement the necessary controls to protect clients’ personal information and assets, as well as their own critical systems and applications.” 

Dealer rules mandate that investment dealers report incidents that meet specific criteria. CIRO notes that it has observed a consistent flow of reports, with an increase in cases involving third-party service providers.

Crypto asset trading platforms, dealer capital positions, trading, cross-asset surveillance, order execution only (OEO) guidance, anti-money laundering compliance, examinations, registration and proficiency, dealer acquisitions, dealer arrangements with “finfluencers” and continuing education and timely disclosure of registration information are all also discussed in the report.

It notes that CIRO has continued to identify deficiencies related to the reconciliation of assets held by dealers on behalf of clients. It also notes instances where the dealer’s own investment positions were not reconciled. “Mutual fund dealers are reminded to reconcile both client assets and the dealers’ own assets to third-party information at least monthly,” they write. “To the extent that assets are unresolved or unconfirmed, dealers must be prepared to maintain sufficient regulatory capital to cover the required margin provisions.” 

AI a focus in future examinations  

The regulator also says it will be enquiring about the use of artificial intelligence (AI) in dealers’ operations. “To the extent dealers are using AI, we will be reviewing operational controls they implemented to ensure AI is working as designed,” the report states. “Dealers should also assess whether any use of AI and/or automation of its regulatory functions is a material business change requiring advanced written notification to CIRO.” 

Client focused reforms  

Finally, the report notes that CIRO published a joint report with the Canadian Securities Administrators (CSA) in December 2025, entitled the CSA-CIRO Phase 2 CFR Sweep report. The report provides a summary of common deficiencies identified related to know your client (KYC) information collection, product due diligence, know your product and suitability assessments. They say the most common deficiency identified for CIRO dealers was a failure to have policies and procedures tailored to the firm’s business model that are detailed and actionable. “Policies and procedures that simply reiterate the principles-based rules, without providing any additional detail regarding specific processes the firm has implemented, are inadequate,” they state.