CanadaCIRO Guidance Note GN-2300-21-003, outsourcing arrangements
CIRO Guidance Note GN-2300-21-003
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.ciro.ca/news-room/publications/outsourcing-arrangements-0Guidance, not a law: the Canadian Investment Regulatory Organization's reading of CIRO Rule 3900, supervision. It binds nobody by itself; the law it reads does.
Guidance on an AI sector rules rule, addressed to private bodies.
- Enforcement body
- Canadian Investment Regulatory Organization (CIRO)
- Instrument type
- guidance published by a regulator
- Obligation class
- Governance
- Audit expectation
- periodic
- Who audits it
- Self
- Where the report goes
- Filed with regulator
As of .
What the regulator expects
- It reaches you if you are a Dealer Member of the Canadian Investment Regulatory Organization (CIRO) that outsources an activity to a service provider, whether or not the provider is also a Dealer: CIRO says you retain the responsibility to ensure that those activities are conducted in accordance with the applicable rules and securities legislation, and that you must, at a minimum, supervise the activities the provider performs on your behalf in a manner similar to the supervision that would be required if you performed them yourself.
- CIRO says the rules effectively prohibit outsourcing most client-facing activities, among them a Registered Representative's assessment of the information collected from the client for know-your-client purposes (sections 3202 through 3209) and a Registered Representative's performance of suitability assessments (sections 3402 through 3406).
- CIRO expects you to formally assess the initial and ongoing appropriateness of an outsource service provider for a core activity that may be outsourced, including the management and maintenance of Dealer information systems, and recommends formal due diligence policies and procedures proportionate to the materiality and risk of the activity.
- CIRO says you should never enter into an outsourcing arrangement that diminishes your ability to fulfill your obligations to clients and regulators, impedes effective supervision by regulators, unduly or inappropriately concentrates your outsourced activities in one or a few providers, or allows the provider to outsource to a third party without your knowledge or without your retaining responsibility for the performance of the outsourced activities.
- CIRO says you should enter into written outsourcing contracts that clearly describe all material aspects of the arrangement, maintain a centralized list of the providers to which core activities have been outsourced with copies of the agreements, and establish and carry out a comprehensive outsourcing risk management program.
- CIRO says you should perform outsourcing agreement reviews on a risk-based schedule and, where practical and available, obtain and provide to the regulator a report on the adequacy of internal controls for each outsourcing arrangement relating to a core Dealer activity.
What this law does
CIRO Guidance Note GN-2300-21-003 is dated and states an effective date of . Its stated objectives are to summarize the existing requirements and guidance relating to entering into and maintaining outsourcing arrangements and to identify the Dealer Member business activities that may not be outsourced and those that may be outsourced.
The note states that, other than the rules that govern specific arrangements, no IIROC Rule directly references outsourcing arrangements. A Dealer that outsources activities to an outsource service provider retains the responsibility to ensure that those activities are conducted in accordance with the applicable IIROC Rules and securities legislation, whether or not the provider is also a Dealer.
To carry out that responsibility the note says a Dealer must, at a minimum, supervise the activities performed on its behalf by the outsource service provider in a manner similar to the supervision that would be required if the Dealer performed them itself.
The note says the IIROC Rules effectively prohibit the outsourcing of most client-facing activities of the Dealer, among them a Registered Representative's assessment of the information collected from the client for know-your-client purposes and a Registered Representative's performance of suitability assessments.
Core activities that may be outsourced include the management and maintenance of Dealer information systems, and for each such activity IIROC expects the Dealer to formally assess the initial and ongoing appropriateness of the outsource service provider.
IIROC recommends that Dealers adopt formal due diligence policies and procedures relating to outsourcing arrangements, and the note says the extent of due diligence may be proportionate to the materiality and risk of the activities proposed to be outsourced.
The note says a Dealer should never enter into an outsourcing arrangement that diminishes its ability to fulfill its obligations to clients and regulators, impedes effective supervision by regulators, unduly or inappropriately concentrates its outsourced activities in one or a few providers, or allows the provider to outsource to a third party without the Dealer's knowledge or without retaining responsibility for the performance of the outsourced activities.
A Dealer that has outsourced activities should enter into written outsourcing contracts that clearly describe all material aspects of the arrangement, maintain a centralized list of the providers to which core activities have been outsourced with copies of the agreements, and establish and carry out a comprehensive outsourcing risk management program.
The note says a Dealer should perform outsourcing agreement reviews on a risk-based schedule and, where practical and available, obtain and provide to IIROC a report on the adequacy of internal controls for each outsourcing arrangement relating to a core Dealer activity.
Rule 1404 of the Investment Dealer and Partially Consolidated Rules states that guidance published by CIRO is generally intended to present acceptable methods that can be used to comply with specific Corporation requirements and that Dealer Members may use alternate methods that demonstrably achieve the overall objective of those requirements. CIRO states that its rules guidance notes remain effective and will be updated to reference the Investment Dealer and Partially Consolidated Rules.
CIRO's Phase 5 rule consolidation proposal states that the Investment Dealer and Partially Consolidated Rules have no equivalent requirements for service arrangements and that the note includes similar expectations to the requirements it proposes.