Provides financial services, in Canada

National Instrument 31-103, ss. 11.1, 11.5 · Read the law's page

• It reaches you if you are a registered firm, meaning a registered dealer, a registered adviser or a registered investment fund manager: establish, maintain and apply policies and procedures that establish a system of controls and supervision sufficient to provide reasonable assurance that the firm and each individual acting on its behalf complies with securities legislation and to manage the risks associated with its business in accordance with prudent business practices (section 11.1(1)).
• Provide training to your registered individuals on compliance with securities legislation, including the obligations under sections 13.2, 13.2.1, 13.3, 13.4 and 13.4.1 (section 11.1(2)).
• Maintain records that accurately record your business activities, financial affairs and client transactions and that demonstrate the extent of your compliance with applicable requirements of securities legislation (section 11.5(1)).
• Keep records that demonstrate compliance with your internal control procedures and with your policies and procedures, and records that document the compliance, training and supervision actions you take (section 11.5(2)(d), (e) and (o)).
• Keep records that demonstrate compliance with sections 13.2, 13.2.01, 13.2.1 and 13.3, including records that document correspondence with clients (section 11.5(2)(l) and (n)).
• Keep records that provide an audit trail for client instructions and orders and for each trade transmitted or executed for a client or by you on your own behalf (section 11.5(2)(h)).

CIRO IDPC Rule 3100, ss. 3110-3114 · Read the law's page

• It reaches you if you are a Dealer Member of the Canadian Investment Regulatory Organization (CIRO), which Canada's provincial and territorial securities regulators recognize as a self-regulatory organization, or an Approved Person of one, because a hearing panel that finds a Dealer Member or an Approved Person has contravened a CIRO requirement may impose sanctions on it (Rules 8209 and 8210), and the Rules exclude a Mutual Fund Dealer Member from the term Dealer Member: take reasonable steps to identify existing material conflicts of interest, and material conflicts of interest that are reasonably foreseeable, between you and the client and between each Approved Person acting on your behalf and the client (Rule 3110(1)).
• Address all material conflicts of interest between you, including each Approved Person acting on your behalf, and the client in the best interest of the client, and avoid a material conflict that is not, or cannot be, otherwise addressed in the best interest of the client (Rule 3112(1) and (2)).
• Adequately supervise how your Approved Persons address all material conflicts of interest between the client and the Approved Person (Rule 3112(3)).
• Disclose in writing all material conflicts of interest you identify to the client whose interests are affected if a reasonable client would expect to be informed, describing the nature and extent of the conflict, its potential impact on and risk to the client and how it has been or will be addressed, in a manner that is prominent, specific and written in plain language, before opening an account if the conflict is already identified and otherwise in a timely manner; disclosure alone does not satisfy the duty to address the conflict (Rule 3113).
• Have policies and procedures that specifically address identifying, disclosing and avoiding or otherwise addressing material conflict of interest situations (Rule 3114(1)).
• As an Approved Person, take reasonable steps to identify material conflicts of interest between you and the client and report any you identify promptly to the Dealer Member, address them in the best interest of the client, avoid one that cannot otherwise be so addressed, and do not trade or advise in connection with a material conflict unless it has been addressed in the best interest of the client and the Dealer Member has consented (Rules 3110(2) and (3) and 3111).

National Instrument 31-103, s. 13.4 · Read the law's page

• It reaches you if you are a registered firm, meaning a registered dealer, a registered adviser or a registered investment fund manager, other than an investment fund manager in respect of an investment fund that is subject to National Instrument 81-107: take reasonable steps to identify existing material conflicts of interest, and material conflicts of interest that are reasonably foreseeable, between the firm and the client and between each individual acting on the firm's behalf and the client (sections 13.4(1) and 13.4.2).
• Address all material conflicts of interest between a client and the firm, including each individual acting on its behalf, in the best interest of the client (section 13.4(2)).
• Avoid any material conflict of interest between a client and the firm, including each individual acting on its behalf, if the conflict is not, or cannot otherwise be, addressed in the best interest of the client (section 13.4(3)).
• Disclose in writing all material conflicts of interest you have identified to a client whose interests are affected by them, if a reasonable client would expect to be informed, describing the nature and extent of the conflict, its potential impact on and risk to the client, and how it has been or will be addressed (section 13.4(4) and (5)).
• Present the disclosure in a manner that, to a reasonable person, is prominent, specific and written in plain language (section 13.4(6)).
• Make the disclosure before opening an account for the client if the conflict has been identified at that time, and otherwise in a timely manner upon identification of a conflict not previously disclosed (section 13.4(7)).
• Do not rely on disclosure alone to meet the duty to address a material conflict of interest in the best interest of the client (section 13.4(8)).

CIRO IDPC Rule 3400 · Read the law's page

• It reaches you if you are a Dealer Member of the Canadian Investment Regulatory Organization (CIRO), which Canada's provincial and territorial securities regulators recognize as a self-regulatory organization, or an Approved Person of one, because a hearing panel that finds a Dealer Member or an Approved Person has contravened a CIRO requirement may impose sanctions on it (Rules 8209 and 8210), and the Rules exclude a Mutual Fund Dealer Member from the term Dealer Member: before you purchase, sell, withdraw, exchange or transfer-out securities or precious metals bullion, or transact in derivatives for a retail client's account, take any other investment action for a client, make a recommendation or exercise discretion to take any such action, determine on a reasonable basis that the action is suitable for the retail client, based on the client's information, your assessment of the security or derivative under Rule 3300, the impact on the account including concentration and liquidity, the impact of costs on the client's returns and a reasonable range of alternative actions, and that it puts the retail client's interest first; this does not apply to an order execution only account or a direct electronic access account (Rules 3402(1) and 3404(1)).
• Review the retail client's account and the securities, derivatives or precious metals bullion in it to determine whether those criteria are met, and take reasonable steps within a reasonable time, after a deposit or transfer-in, the designation of a new Registered Representative, Portfolio Manager or Associate Portfolio Manager, a change in the client's information or in a security or derivative in the account, or your review of the client's information under subsection 3209(4) (Rule 3402(2)).
• Determine on a reasonable basis, putting the retail client's interest first, that it is suitable for the client to continue having an account with you and that the scope of products, services and account relationships the client has access to within the account is suitable (Rule 3402(3)).
• Determine on a reasonable basis that the retail client's account portfolio of investments that would result from the investment action you take, recommend or exercise discretion to take is suitable for the client and puts the client's interest first (Rule 3402(4)).
• Carry out a retail client's instruction to take an action that does not satisfy the criteria only after you have informed the client of the basis for the determination and advised the client against proceeding, recommended an alternative action that satisfies the criteria, and received recorded confirmation of the client's instruction to proceed (Rule 3402(5)).
• For an institutional client, make a suitability determination before you accept any order and before you make a recommendation, determine whether the client is sufficiently sophisticated and capable of making its own investment decisions to fix the level of suitability owed, and determine, putting the institutional client's interest first, that continuing to have an account and the scope of products, services and account relationships are suitable, subject to the exemptions in Rule 3404 (Rule 3403(1), (2) and (4)).
• Do not delegate to any other person the responsibility for suitability assessment obligations, which rests primarily with the Registered Representative, Portfolio Manager or Associate Portfolio Manager assigned to the client account (Rule 3406).

CIRO IDPC Rules 3200 and 3300 · Read the law's page

• It reaches you if you are a Dealer Member of the Canadian Investment Regulatory Organization (CIRO), which Canada's provincial and territorial securities regulators recognize as a self-regulatory organization, or an Approved Person of one, because a hearing panel that finds a Dealer Member or an Approved Person has contravened a CIRO requirement may impose sanctions on it (Rules 8209 and 8210), and the Rules exclude a Mutual Fund Dealer Member from the term Dealer Member: take reasonable steps to learn and remain informed of the essential facts relative to every order, account and client you accept, including establishing the client's identity and collecting sufficient information about the client's personal circumstances, financial circumstances, investment needs and objectives, investment knowledge, risk profile and investment time horizon to enable you to meet your obligations under Rule 3400 (Rule 3202(1)).
• Within a reasonable time after you receive that information, take reasonable steps to have the client confirm its accuracy (Rule 3202(3)).
• Take reasonable steps to keep the information current, updating it within a reasonable time after you become aware of a significant change in the client's information, and review it no less frequently than once every 36 months, or once every 12 months for a managed account and a discretionary account (Rule 3209(3) and (4)).
• Do not delegate to any other person the know-your-client responsibility, which rests primarily with the Registered Representative, Portfolio Manager or Associate Portfolio Manager assigned to the client account (Rule 3209(1) and (2)).
• Restrict the access of Registered Representatives, Portfolio Managers, Associate Portfolio Managers and other persons to your systems so that material client information cannot be changed without the required approval (Rule 3215(5)).
• Do not make securities or derivatives available to clients unless you have taken reasonable steps to assess their structure, features, risks, initial and ongoing costs and the impact of those costs, to approve them, and to monitor them for significant changes; this does not apply to an account at a Dealer Member that is a carrying broker, or only provides trade execution, clearing, settlement or custody services, for another Dealer Member, portfolio manager, exempt market dealer or their clients (Rules 3301(1) and 3303(1)).
• Do not purchase or sell securities or transact in derivatives for a client, or recommend securities or derivatives to a client, unless the securities or derivatives have been approved by the Dealer Member and you take steps to understand their structure, features, risks, initial and ongoing costs and the impact of those costs; the understanding requirement does not apply to an order execution only account or a direct electronic access account (Rules 3301(2), 3302(1) and 3303(2)).

National Instrument 31-103, s. 13.3 · Read the law's page

• It reaches you if you are a registrant, other than where the client is a registered firm, a Canadian financial institution or a Schedule III bank, other than a registered dealer buying or selling securities for the client only as directed by a registered adviser acting for the client, and other than a dealer or dealing representative relieved by Part 3 or Part 9 as a member of a self-regulatory organization: before you open an account for a client, purchase, sell, deposit, exchange or transfer securities for a client's account, take any other investment action for a client, make a recommendation to a client or exercise discretion to take any such action, determine on a reasonable basis that the action is suitable for the client and puts the client's interest first (section 13.3(1), (3) and (4)).
• Base the suitability determination on the client's information collected under section 13.2, your assessment or understanding of the security consistent with section 13.2.1, the impact of the action on the client's account including the concentration of securities within the account and the liquidity of those securities, the potential and actual impact of costs on the client's return on investment, and a reasonable range of alternative actions available to you through the registered firm at the time you make the determination (section 13.3(1)(a)).
• Review a client's account and the securities in it to determine whether the criteria in subsection 13.3(1) are met, and take reasonable steps within a reasonable time, after a registered individual is designated as responsible for the account, after you become aware of a change in a security in the account or in the client's information that could result in the security or account not satisfying those criteria, and after you review the client's information under subsection 13.2(4.1) (section 13.3(2)).
• Carry out a client's instruction to take an action that does not satisfy subsection 13.3(1) only if you have informed the client of the basis for the determination that the action will not satisfy it, recommended an alternative action that does, and received recorded confirmation of the client's instruction to proceed (section 13.3(2.1)).

National Instrument 31-103, s. 14.2 · Read the law's page

• It reaches you if you are a registered firm, meaning a registered dealer, a registered adviser or a registered investment fund manager, other than a firm exempted from subsections 14.2(2) to (6) by Part 9 as a member of a self-regulatory organization: deliver to each client all information that a reasonable investor would consider important about the client's relationship with the registrant (section 14.2(1)).
• Include in that information a description of the nature or type of the client's account; a general description of the products and services you will offer, including restrictions on the client's ability to liquidate or resell a security; and a general description of any limits on the products and services you will offer, including whether you will primarily or exclusively offer proprietary products (section 14.2(2)(a), (b) and (b.1)).
• Include in that information a general description of the types of risks a client should consider when making an investment decision, and a description of the conflicts of interest you are required to disclose to a client under securities legislation (section 14.2(2)(c) and (e)).
• Include in that information a statement that you must determine that any investment action you take, recommend or decide on, for the client is suitable for the client and puts the client's interest first, and the information you have collected about the client under section 13.2 (section 14.2(2)(k) and (l)).
• Include in that information the content and frequency of reporting for each account or portfolio, disclosure of the operating charges the client might be required to pay, a general description of the types of transaction charges, and a general description of any benefits received from a person other than the client in connection with the client's purchase or ownership of a security (section 14.2(2)(f), (g), (h) and (i)).
• Deliver the information in writing, except that the description of products and services may be provided orally or in writing, before you first purchase or sell a security for the client or advise the client to purchase, sell or hold a security (section 14.2(3)).
• If there is a significant change in the information delivered, take reasonable steps to notify the client of the change in a timely manner (section 14.2(4)).

National Instrument 31-103, ss. 13.2, 13.2.1 · Read the law's page

• It reaches you if you are a registrant dealing with a client, other than an investment fund manager in respect of its activities as one and other than where the client is a registered firm, a Canadian financial institution or a Schedule III bank: take reasonable steps to establish the identity of the client and, if you have cause for concern, make reasonable inquiries as to the reputation of the client (sections 13.1 and 13.2(2)(a) and (5)).
• Take reasonable steps to establish whether the client is an insider of a reporting issuer or any other issuer whose securities are publicly traded (section 13.2(2)(b)).
• Take reasonable steps to ensure that you have sufficient information about the client's personal circumstances, financial circumstances, investment needs and objectives, investment knowledge, risk profile and investment time horizon to enable you to meet your obligations under section 13.3 (section 13.2(2)(c)).
• Establish the creditworthiness of the client if you are financing the client's acquisition of a security (section 13.2(2)(d)).
• Within a reasonable time after receiving the information, take reasonable steps to have the client confirm its accuracy, and take reasonable steps to keep it current, including updating it within a reasonable time after you become aware of a significant change in the client's information (section 13.2(3.1) and (4)).
• Review the information collected about the client no less frequently than once every 12 months for managed accounts, within 12 months before making a trade for or recommending a trade to the client if you are an exempt market dealer, and in any other case no less frequently than once every 36 months (section 13.2(4.1)).
• If you are a registered firm, do not make securities available to clients unless you have taken reasonable steps to assess the relevant aspects of the securities, including their structure, features, risks, initial and ongoing costs and the impact of those costs, to approve the securities to be made available to clients, and to monitor the securities for significant changes (section 13.2.1(1)).
• If you are a registered individual, do not purchase or sell securities for, or recommend securities to, a client unless you take steps to understand the securities, including their structure, features, risks, initial and ongoing costs and the impact of those costs, to the extent reasonable to enable you to meet your obligations under section 13.3 (section 13.2.1(2) and (2.1)).
• If you are a registered individual, do not purchase securities for, or recommend securities to, a client unless your firm has approved the securities to be made available to clients (section 13.2.1(3)).

CIRO IDPC Rule 3600, ss. 3601, 3602 and 3640 · Read the law's page

• It reaches you if you are a Dealer Member of the Canadian Investment Regulatory Organization (CIRO), which Canada's provincial and territorial securities regulators recognize as a self-regulatory organization, or an Approved Person of one, because a hearing panel that finds a Dealer Member or an Approved Person has contravened a CIRO requirement may impose sanctions on it (Rules 8209 and 8210), and the Rules exclude a Mutual Fund Dealer Member from the term Dealer Member: do not issue, participate in or knowingly allow the use of your name in any advertisement, sales literature or correspondence, terms that reach any written or electronic communication for client use or prepared for distribution to a single current or prospective client, that contains an untrue statement or omission of a material fact or is otherwise false or misleading, contains an unjustified promise of specific results, uses unrepresentative statistics to suggest unwarranted or exaggerated conclusions or fails to identify the material assumptions made, contains any opinion or forecast of future events that is not clearly labeled as such, fails to fairly present the potential risks to the client, is detrimental to the interests of the public, CIRO or its Dealer Members, or fails to comply with Corporation requirements or any applicable laws (Rule 3602(1)).
• Have policies and procedures that specifically address communication with the public and the review and supervision of advertisements, sales literature and correspondence relating to your business, and monitor compliance with them (Rules 3601(1) and 3602(2)).
• Have a designated Supervisor approve before use or publication research reports, market letters, telemarketing scripts, promotional seminar texts (excluding educational seminar texts), original advertisements or original template advertisements, and any material containing performance reports or summaries used to solicit clients (Rule 3602(3)).
• Review all other advertising, sales literature or correspondence through pre-use approval, post-use review or post-use sampling (Rule 3602(4)).
• Retain copies of all advertisements, sales literature and correspondence and all records of supervision for the period set out in section 3803, readily available for inspection by CIRO (Rule 3602(6)).
• Do not hold yourself or your Approved Persons out, including through a trade name, in a manner that could reasonably be expected to deceive or mislead any person or company as to the proficiency, experience, qualifications or category of registration or approval of the Approved Person, the nature of the person's relationship with you or the Approved Person, or the products or services provided or to be provided (Rule 3640(1)).

CIRO IDPC Rule 3800 · Read the law's page

• It reaches you if you are a Dealer Member of the Canadian Investment Regulatory Organization (CIRO), which Canada's provincial and territorial securities regulators recognize as a self-regulatory organization, or an Approved Person of one, because a hearing panel that finds a Dealer Member or an Approved Person has contravened a CIRO requirement may impose sanctions on it (Rules 8209 and 8210), and the Rules exclude a Mutual Fund Dealer Member from the term Dealer Member: retain copies of all records required under Corporation requirements, in durable and accessible form, for a minimum of seven years from the date the record is created, unless Corporation requirements or securities laws relating to the specific type of record require a different retention period (Rule 3803(1)).
• Maintain current records that properly record your business activities, financial position, financial operating results and client transactions and that demonstrate your compliance with securities laws and Corporation requirements, including records that provide an audit trail for client instructions, orders and transactions and for each trade transmitted or transaction executed for a client or on your own behalf, that demonstrate compliance with the know-your-client, account appropriateness, product due diligence, know-your-product and suitability determination requirements and with the complaint handling requirements, and that document correspondence with clients (Rule 3804(1) and (2)).
• Maintain appropriate internal controls to provide reasonable assurance that your records are correct, provide clear and accurate information, and remain current (Rule 3804(3)).
• Make your records available to CIRO on request, in the manner requested (Rule 3804(4)).
• Send each client a quarterly statement if at the end of the quarter the account has a debit or credit balance or holds one or more securities, derivatives or precious metals bullion, and a monthly statement to each client who requests one or who had a transaction during the month, among the other triggers in the rule (Rule 3808(2) and (3)).
• Send each retail client who meets the conditions in the rules an annual performance report and, where the client paid a reportable fee, charge or other payment, an annual fee and charge report, and send all confirmations, statements, reports and other documents required under sections 3803 through 3819 promptly (Rules 3810(1), 3811(1) and 3845(1)).

CIRO IDPC Rule 3900 · Read the law's page

• It reaches you if you are a Dealer Member of the Canadian Investment Regulatory Organization (CIRO), which Canada's provincial and territorial securities regulators recognize as a self-regulatory organization, or an Approved Person of one, because a hearing panel that finds a Dealer Member or an Approved Person has contravened a CIRO requirement may impose sanctions on it (Rules 8209 and 8210), and the Rules exclude a Mutual Fund Dealer Member from the term Dealer Member: establish policies and procedures for a supervisory system to supervise the activities of all your employees and Approved Persons that provides reasonable assurance they comply with Corporation requirements and securities laws, put them in writing, and amend them within a reasonable time after changes in Corporation requirements or securities laws (Rule 3904(1) and (2)).
• Assign sufficient personnel and commit adequate resources to fully and properly apply and enforce your policies and procedures, take reasonable steps to ensure your Supervisors and Executives are fully proficient and understand the products and services of the people they supervise, and have procedures in place that ensure Supervisors are properly performing their supervisory functions (Rule 3905(1), (5) and (6)).
• If a Supervisor delegates supervisory tasks and procedures, keep the Supervisor responsible for their performance, use a delegate qualified by registration, training or experience, inform the delegate in writing of the tasks, ensure the delegate adequately performs them, establish reporting mechanisms, and keep a record of the terms of the delegation and the follow up (Rule 3907).
• Maintain adequate records of supervisory activity, including compliance issues identified and their resolution, and keep records of completed supervisory reviews, with details of inquiries and their resolution, for the period set out in section 3803 (Rules 3908(3) and (5) and 3927(2)).
• Have your Chief Compliance Officer provide a written report to your board of directors at least annually for the purpose of assessing compliance with Corporation requirements and securities laws, and have the board review the report and its recommendations, ensure that action is taken on compliance deficiencies, and keep records of the actions (Rule 3915).
• Effectively supervise account activity, include controls for accessing and amending client records in your policies and procedures, and review account activity as required by Corporation requirements (Rules 3925(1), 3926(5) and 3927(1)).
• If you have retail client accounts, have policies and procedures that specifically address daily and monthly supervision of trading activity in them and the detection of unsuitable trading, undue concentration and excessive trading, among the other matters in the rule, and supervise each Registered Representative, Investment Representative, Portfolio Manager and Associate Portfolio Manager to confirm they comply with the suitability determination under Rule 3400 (Rules 3945 and 3948).

Retail Payment Activities Act (S.C. 2021, c. 23, s. 177), ss. 2, 17 and 76 · Read the law's page

• This binds a payment service provider that performs retail payment activities, being an individual or entity that performs payment functions as a service or business activity that is not incidental to another service or business activity, and that has a place of business in Canada or, having none, performs retail payment activities for an end user in Canada while directing them at individuals or entities in Canada (sections 4 and 5). Among the providers it does not apply to are a bank, an authorized foreign bank in respect of its business in Canada, a credit union or caisse populaire, an insurer, certain trust and loan companies, the Canadian Payments Association and the Bank of Canada (section 9), and it does not apply to the retail payment activities that sections 6 to 8 exclude (reached by declaring that you are a payment provider).
• Establish, implement and maintain, in accordance with the regulations, a risk management and incident response framework that meets the prescribed requirements, to identify and mitigate operational risks and respond to incidents (section 17(1)).
• Give the Bank of Canada all assistance reasonably required to assess the framework, and provide the documents, information and access to data the Bank specifies (section 17(3)).

Retail Payment Activities Act (S.C. 2021, c. 23, s. 177), ss. 2, 18, 19 and 76 · Read the law's page

• This binds a payment service provider that performs retail payment activities, being an individual or entity that performs payment functions as a service or business activity that is not incidental to another service or business activity, and that has a place of business in Canada or, having none, performs retail payment activities for an end user in Canada while directing them at individuals or entities in Canada (sections 4 and 5). Among the providers it does not apply to are a bank, an authorized foreign bank in respect of its business in Canada, a credit union or caisse populaire, an insurer, certain trust and loan companies, the Canadian Payments Association and the Bank of Canada (section 9), and it does not apply to the retail payment activities that sections 6 to 8 exclude (reached by declaring that you are a payment provider).
• Without delay after you become aware of an incident that has a material impact on an end user, on another payment service provider that performs retail payment activities, or on a clearing house of a designated clearing and settlement system, notify that individual or entity and the Bank of Canada of the incident (section 18(1)).
• Give the notice in the prescribed form and manner and include the prescribed information (section 18(2)).
• Provide any follow-up notice the Bank of Canada orders you to give, to the individuals or entities, by the time, and in the form and with the information the order specifies (section 19).

Bank Act, S.C. 1991, c. 46, s. 465 · Read the law's page

• It reaches you if you operate as a bank under the Bank Act; section 581 of the Act states the same kind of duty for an authorized foreign bank.
• Have the directors of the bank establish investment and lending policies, standards and procedures that a reasonable and prudent person would apply in respect of a portfolio of investments and loans, to avoid undue risk of loss and obtain a reasonable return.
• Adhere to those investment and lending policies, standards and procedures.

Critical Cyber Systems Protection Act (S.C. 2026, c. 9, s. 11), ss. 17, 18 and 136 · Read the law's page

• This does not bind anyone yet: the Act is not in force, and it binds a designated operator, being a person, partnership or unincorporated organization that belongs to a class of operators the Governor in Council adds to Schedule 2 in respect of a vital service or vital system named in Schedule 1 (telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems within federal authority, banking systems, and clearing and settlement systems), reached by declaring that you operate an essential service, provide telecommunications services or provide financial services.
• Report a cyber security incident in respect of any of your critical cyber systems to the Communications Security Establishment, in accordance with the regulations, within the period the regulations prescribe, which may not exceed 72 hours (section 17).
• Immediately after reporting, notify the appropriate regulator that the report was made, in the form and manner the regulations prescribe, and give it a copy of the report (section 18).
• Keep records of every cyber security incident you reported under section 17 (section 30).

Critical Cyber Systems Protection Act (S.C. 2026, c. 9, s. 11), ss. 7-9, 12, 15 and 137 · Read the law's page

• This does not bind anyone yet: the Act is not in force, and it binds a designated operator, being a person, partnership or unincorporated organization that belongs to a class of operators the Governor in Council adds to Schedule 2 in respect of a vital service or vital system named in Schedule 1 (telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems within federal authority, banking systems, and clearing and settlement systems), reached by declaring that you operate an essential service, provide telecommunications services or provide financial services.
• Within 90 days after you become a member of a class of operators set out in Schedule 2, establish a cyber security program in respect of your critical cyber systems, with steps to identify and manage organizational cyber security risks, protect those systems from being compromised, detect cyber security incidents and minimize their impact (section 9(1)).
• Notify the appropriate regulator in writing, immediately after the program is established, that it has been established, and provide the program to the regulator within 90 days after you become a member of the class (sections 9(2) and 10).
• Implement the program by taking the steps it includes, and maintain the program (section 12).
• Review the program each year, or on the dates the regulations prescribe, and notify the appropriate regulator whether changes were made (section 13).
• Mitigate any cyber security risk in your supply chain or your use of third-party products and services as soon as it has been identified (section 15).

Office of the Superintendent of Financial Institutions Act, R.S.C. 1985, c. 18 (3rd Supp.), s. 4; Bank Act, S.C. 1991, c. 46, s. 645 · Read the law's page

• It reaches you if you operate as a bank under the Bank Act, a financial institution that the Office of the Superintendent of Financial Institutions supervises.
• If the Superintendent directs the bank under section 645 of the Bank Act, cease or refrain from the act or course of conduct that the direction identifies as an unsafe or unsound practice in conducting the business or affairs of the bank, and perform the acts the direction requires to remedy the situation.
• Have adequate policies and procedures to protect the bank against threats to its integrity or security, and adhere to them; this is the standard that subsection 645(1.1) of the Bank Act applies when it lets the Superintendent direct remedial measures.