The Review Looked Beyond Policies

The CSA and CIRO reviewed 105 firms across a range of registration categories, including investment dealers, mutual fund dealers, exempt market dealers, portfolio managers, restricted portfolio managers and investment fund managers.

The review focused on three areas at the centre of the Client Focused Reforms:

• Know Your Client;

• Know Your Product; and

• suitability determinations.

The regulators acknowledged that many firms had invested significant resources in implementing the CFR requirements. But they also found firms whose processes had not been fully updated, and in some cases the deficiencies were serious enough to lead to further regulatory action.

That distinction matters.

CFR compliance is no longer an implementation project. Firms are now expected to demonstrate that the processes developed several years ago are operating consistently.

KYC Needs to Produce Usable Information

A recurring theme in the notice is that collecting information is not the same as collecting enough information.

Staff identified weaknesses in how some firms assessed risk tolerance and risk capacity, gathered financial information, and kept KYC information current.

Examples included firms that did not obtain enough detail about a client’s financial assets to properly assess concentration, particularly where illiquid or sector-specific investments were being offered.

Staff also identified cases where information for spouses was collected on a combined basis even though each spouse held individual accounts. That left the firm without sufficient individual KYC information to support suitability decisions for those accounts.

The broader lesson is straightforward:

KYC information has to be detailed enough to support the decision the firm is asking it to support.

A field being completed does not necessarily make the underlying information sufficient.

Keeping KYC Current Requires Evidence

Staff also found firms that had not updated KYC information within required timelines or after learning of significant changes in a client’s circumstances.

Examples included changes such as retirement, job loss and divorce.

Another problem was documentation. Some firms said periodic KYC reviews had occurred, but could not adequately demonstrate when the discussion took place or what information had been reviewed. Others had not taken reasonable steps to obtain client confirmation of changes to KYC information.

This is an important examination-readiness point.

If a firm relies on a conversation, review or supervisory step as part of its control framework, there should normally be enough evidence to establish that the step actually occurred.

A process that cannot be reconstructed later is difficult to defend.

KYP Cannot End When a Product Is Approved

Staff Notice 31-368 also identifies weaknesses in firms' product due diligence and KYP processes.

Some firms told regulators that committees had discussed and approved securities but did not retain evidence of the discussion or approval. Others maintained approved product lists without documenting the assessment or rationale supporting inclusion.

The review also found weaknesses after initial approval.

Some firms did not have an adequate process for identifying significant changes to securities. Others monitored complex or illiquid products too infrequently, relied passively on issuers or product manufacturers to notify them of changes, or could not provide evidence that monitoring had taken place.

That exposes an important distinction.

Product approval is an event. KYP is an ongoing obligation.

A strong framework should address both.

The firm needs to understand why a security was approved in the first place, what developments could change that assessment, how those developments will be detected, and what happens when a material change is identified.

Suitability Is Broader Than Matching a Product to a Risk Profile

The suitability findings are particularly important.

The CFR requirements require firms to consider more than whether a product appears consistent with a client's stated objectives and risk profile.

Before taking an investment action, relevant considerations include:

• the client's KYC information;

• the firm's KYP assessment;

• the effect on concentration and liquidity;

• the impact of costs on the client's investment return; and

• a reasonable range of alternative actions available through the firm.

The investment action must also put the client's interest first.

Staff found that firms often addressed KYC and KYP but did not have adequate processes to ensure the other factors were considered.

That included inadequate consideration of concentration and liquidity, costs, and reasonable alternatives.

In some cases, firms also lacked a process for looking at concentration and liquidity across multiple accounts held by the same client.

The practical implication is significant.

A suitability control built primarily around matching product risk to client risk may no longer be enough.

Concentration and Liquidity Deserve Particular Attention

The notice gives considerable attention to concentration and liquidity.

Staff found firms without appropriate thresholds or limits to assess concentration across securities, issuers, sectors or asset classes.

The findings included exempt market dealers selling highly concentrated or illiquid investments without adequate controls to assess overall client exposure, as well as investment dealers lacking processes to identify, monitor and control positions in illiquid securities.

CIRO and the CSA do not prescribe one universal concentration threshold.

The appropriate control will depend on the firm, its products and its clients.

But firms should be able to explain how concentration and liquidity are assessed, what triggers additional review, and what evidence is retained when higher concentrations are considered suitable.

The higher the exposure, the more important that explanation becomes.

Costs and Reasonable Alternatives Cannot Be an Afterthought

Staff also found firms that did not require registered individuals to consider lower-cost alternatives available through the firm.

One example involved situations where lower-MER series of an investment fund were available but were not incorporated into the firm's process for considering reasonable alternatives.

Some firms also lacked systems for identifying when clients became eligible for lower-cost investment options after reaching particular asset thresholds.

This is one of the areas where the CFR standard becomes operational very quickly.

It is not enough for a firm to state that cost is considered.

The process should tell registered individuals when cost comparisons are required, what alternatives should be considered, and how the conclusion should be evidenced.

Client-Directed Trades Still Require a Process

Another area worth attention is client-directed trades.

Staff found that many firms were unclear about the steps required when a client wants to proceed with an investment action that is not suitable or does not put the client's interests first.

The rules require the registrant to assess the trade, explain the determination to the client, recommend a suitable alternative that puts the client's interests first and, if the client nevertheless chooses to proceed, document the client's instruction.

Staff found both inadequate suitability assessments and inadequate documentation in this area.

Calling an order "client directed" does not remove the firm's suitability responsibilities.

Generic Policies Remain a Problem

Perhaps the most important finding sits above all of the individual CFR requirements.

Some firms had policies that were outdated, generic, or insufficiently tailored to their actual operations. In some cases, the policies simply repeated the regulatory requirements without explaining how the firm intended to comply or what documentation was required.

CIRO returned to this point in its 2026 Compliance Report.

It identified policies and procedures that were not tailored to the dealer's business model, or were not sufficiently detailed and actionable, as the most common CFR deficiency among CIRO dealers. CIRO also stated that its Business Conduct Compliance examinations will focus on whether dealers have addressed applicable deficiencies identified in the Phase 2 Sweep.

That makes Staff Notice 31-368 more than historical reading.

It is effectively a checklist of issues firms should expect to be tested against.

What Compliance Teams Should Do With 31-368

The most useful response is not another wholesale rewrite of the compliance manual.

Start with the findings.

Take a sample of client files, product approvals, KYC updates, and suitability decisions and test whether the firm can answer questions such as:

• Can we show how the client's risk profile was determined?

• Is the financial information detailed enough to support the suitability assessment?

• Can we prove required KYC reviews occurred?

• Can we reconstruct why a product was approved and how it is being monitored?

• Are concentration, liquidity and costs actually considered in suitability decisions?

• Can we demonstrate that reasonable alternatives were considered where relevant?

• Are client-directed trades being handled and documented correctly?

• Do our policies explain what our people actually need to do?

The point is not to produce more documentation for its own sake.

It is to determine whether the firm's processes produce evidence of compliance when tested.

From CFR Implementation to CFR Effectiveness

Staff Notice 31-368 marks an important shift in the CFR conversation.

The question is no longer whether firms amended their forms, policies and procedures when the reforms came into force.

The question is whether those changes work.

That means looking at actual client files, actual product decisions and actual supervisory records.

For firms preparing for their next compliance examination, 31-368 provides a useful starting point: compare the regulator's findings against current practice and identify the gaps before an examiner does.