This content first appeared in the AUM Law Regulatory Update newsletter (October 2026 edition) in collaboration with BLG’s Investment Management Group. Sign up for this newsletter today!
Cybersecurity, artificial intelligence, fee practices and the quality of regulatory filings feature prominently in the Ontario Securities Commission’s (OSC) latest account of its registration and examination work. OSC Staff Notice 33-762, released on October 7, 2026, reports on the Registration, Inspections and Examinations Division’s (RIE) activities for the fiscal year ended March 31, 2026 (Staff Notice). For Ontario dealers, advisers and investment fund managers, the publication offers both a retrospective of the year’s examinations and a forward-looking indication of the issues most likely to attract regulatory attention. Firms registered with the Canadian Investment Regulatory Organization (CIRO) and other market participants may also find the observations in the Staff Notice useful when testing their own controls.
RIE’s recent work included focused reviews relating to the Client Focused Reforms (CFRs), digital engagement and cybersecurity, together with examinations of selected regulated entities and coordinated risk-based reviews of certain CIRO dealer firms. Rather than treating the Staff Notice as a catalogue of isolated deficiencies, firms can use it as a benchmark for assessing whether their governance, supervision and recordkeeping operate effectively in practice.
Artificial intelligence is one area to watch. Following its earlier survey, RIE began examining selected registrants’ use of AI. Early observations included firms operating without dedicated AI governance, weak controls over externally supplied AI tools, and marketing claims that were not adequately supported. RIE expects to publish further findings soon, which may inform later guidance.
The risk assessment questionnaire (RAQ) remains an important input into examination planning. A newly registered firm assessed as presenting elevated risk may be reviewed earlier after registration than a lower-risk peer. This makes consistency across the RAQ, financial information, internal reporting and the firm’s other data especially important.
RIE also revisited examinations of exempt market dealers that distributed securities of non-reporting corporate issuers under the offering memorandum exemption where required annual financial statements had not been delivered to the OSC. The work considered how dealers had applied their Know-Your-Client (KYC), Know-Your-Product (KYP) and suitability obligations to those offerings. Separate findings on this topic are expected to be released during the OSC’s 2026–2027 fiscal year.
Two recurring control issues have immediate practical implications:
- First, related to employment agreements, such agreements (or severance and related agreements) should not discourage employees from communicating possible misconduct to the OSC or another regulatory authority; provisions that impede whistleblowing may lead to enforcement action.
- Second, related to the insurance requirements for registrants, insurance limits must be reassessed as the business changes. Firms whose assets under management have grown should confirm that coverage has kept pace with the applicable requirements.
Other findings included incomplete KYC information relating to leverage used for managed account clients; insufficient product analysis for alternative investments in managed accounts; excessive exposure to a single issuer or sector; management fees that were charged but did not match the client agreement or disclosed schedule; and disclosure that did not clearly explain how and when fees were charged. Discretionary managers should also have controls for identifying and resolving departures from investment policy statements. Firms should separately consider whether operational changes (such as introducing a fully paid securities lending program) require an update on Form 33-109F5 to firm information previously provided on Form 33-109F6.
