CIRO spent its early years building a unified regulatory framework. The 2026 Annual Report shows what comes next: operating that framework nationally, modernizing it, and testing how well it works in practice.
A Significant Year for CIRO
CIRO reports completing all 28 Annual Priorities for Fiscal 2026.
Those priorities focused on regulatory delivery and operations, integration, and the broader objectives in CIRO’s Strategic Plan.
The year included major developments in national registration, proficiency, rule consolidation, Québec oversight, digital assets, Client Focused Reforms, investor protection, market regulation, technology, and regulatory efficiency.
The significance is not in any single initiative.
Taken together, the report shows a regulator that is moving beyond the mechanics of combining its predecessor organizations and toward operating a more unified national regulatory model.
For firms, that changes the compliance question.
It is becoming less about adapting separately to former IIROC and MFDA structures and more about whether governance, supervision, systems, registration, and controls are ready for a more integrated regulatory environment.
Registration Is Becoming More National
One of the most important structural developments is the expansion of CIRO’s registration responsibilities.
CIRO states that the CSA delegated additional registration functions during the year. The report describes a move toward a single national registration model intended to harmonize requirements and create a more streamlined experience for firms and registrants.
CIRO’s CEO also describes the objective as creating a single point of access that can make registration processes and underlying systems faster and more efficient.
For firms, registration should increasingly be treated as part of business planning rather than an administrative step that comes later.
A change in ownership, business activity, individual responsibilities, supervisory structure, or regulated activity may have registration consequences.
The practical discipline is simple: regulatory analysis should begin when the business decision begins.
The New Proficiency Regime Is Now Live
CIRO launched its new Investment Dealer proficiency regime on January 1, 2026.
The new model separates learning from assessment and moves from a course-based structure to an exam-centric model supported by Fitch Learning.
CIRO describes the implementation as smooth and identifies the new regime as a major milestone of the year.
The broader compliance issue is not limited to passing an examination.
Proficiency ultimately sits within supervision.
Firms still need to consider whether people performing regulated functions have the knowledge and capability required for their work.
That should connect to onboarding, role changes, training, continuing education, supervision, and changes in products or regulatory obligations.
A new examination model does not replace those responsibilities. It changes one part of the framework used to establish proficiency.
Rule Consolidation Is Approaching Completion
CIRO also moved significantly closer to completing the consolidation of its rulebook.
During Fiscal 2026, CIRO published Phase 5 of the Rule Consolidation Project and then published the proposed consolidated CIRO Rules for comment.
The Chair describes this as an important milestone in completing the integration of CIRO’s predecessor organizations. The CEO similarly notes that consolidation is almost complete and that completing this work should allow CIRO to direct resources toward the next generation of regulatory issues.
For dealers, rule consolidation should eventually trigger more than a legal review.
Firms will need to determine where the final rules affect:
policies and procedures
supervisory responsibilities
forms and documentation
system logic
training
internal references
testing and monitoring
A policy can often be amended quickly.
Changing the process underneath it can take considerably longer.
That is why implementation planning should begin with the control environment rather than end with a revised manual.
Québec Is Moving Further Into the National Model
The report also highlights significant changes in Québec.
Following legislative changes in 2025, oversight of mutual fund representatives moved further into the CIRO framework.
CIRO also expanded its examination process to include Mutual Fund Dealer firms with activities in Québec.
CIRO describes the development as an important step toward harmonizing oversight of mutual fund dealers and their representatives across Canada.
For firms operating nationally, harmonization can reduce duplication.
But it can also reveal differences in historical regional practices.
A useful question for national firms is whether policies may appear consistent on paper while operations, supervision, documentation, or escalation still differ from one jurisdiction to another.
Client Focused Reforms Remain a Supervisory Issue
CIRO identifies the Phase 2 Client Focused Reforms review as one of its completed regulatory priorities.
Working with the CSA, CIRO published findings and guidance based on the review.
That matters because Client Focused Reforms are no longer primarily an implementation exercise.
The more important question now is whether the processes firms created are producing the outcomes regulators expect.
For dealers, that means continuing to examine how Know Your Client information is collected, how products are understood, how suitability decisions are supported, how conflicts are addressed, and whether the evidence in the file reflects the process described in the policy.
A compliance framework is much stronger when a firm can demonstrate what actually happened, not simply what should have happened.
Digital Assets Are Firmly Inside the Regulatory Framework
CIRO also completed several priorities involving crypto asset trading platforms.
During the year, it published a Digital Asset Custody Framework and related custody guidance.
CIRO also conducted an operational resiliency exercise involving crypto platform Members and their ability to respond to and recover from potential disruptions.
The report also confirms that CIRO regulates crypto marketplace platforms and crypto dealer platforms alongside its responsibilities for traditional securities markets.
The direction is important.
Digital assets are increasingly being addressed through the same core regulatory concepts that apply elsewhere: custody, resilience, market integrity, supervision, financial responsibility, and investor protection.
For firms operating in this area, innovation does not sit outside the compliance framework.
It sits inside it.
Technology and Artificial Intelligence Are Becoming Regulatory Questions
Technology appears repeatedly in the report.
CIRO followed up on its survey of Member use of technology and third parties to determine how it can support firms adopting technologies such as generative AI.
CIRO also launched InnovateSafe, a regulatory sandbox intended to allow new ideas and business practices to be tested without requiring a lengthy exemption process.
That combination is notable.
CIRO is signaling openness to innovation while continuing to consider the regulatory implications of how technology is used.
For firms, that means technology governance should not begin and end with Information Technology.
When technology affects a regulated process, firms still need to understand:
What activity is being performed.
What data is being used.
What decisions the technology influences.
Who owns the process.
What controls apply.
How outputs are reviewed.
What happens when the system does not operate as expected.
The tool may change.
Accountability does not.
Cyber Resilience Has Become a Strategic Priority
CIRO’s August 2025 cyber security incident receives substantial attention in the Annual Report.
CIRO states that its regulatory oversight, market regulation, and market surveillance functions were not disrupted.
Both the Chair and CEO describe the incident as creating broader lessons around cyber resilience, data collection, data exchange, data retention, and how information should be protected across the financial and regulatory system.
As of March 31, 2026, CIRO had recorded approximately $4.2 million in incident response expenses, net of eligible insurance coverage.
CIRO’s Fiscal 2027 outlook also includes significant further investment in its cyber resilience program.
This offers a broader governance lesson for regulated firms.
Cyber security is no longer only a technical control issue.
It touches business continuity, data governance, third parties, incident response, management oversight, legal risk, operational resilience, and the ability to continue critical activities when something goes wrong.
That is the more useful way for firms to think about cyber readiness.
Market Regulation Is Becoming More Data Intensive
CIRO’s market responsibilities remain substantial.
During the year, trading activity on equity marketplaces regulated by CIRO included approximately 740 million transactions, 361 billion shares, and approximately $7.36 trillion in trading value.
CIRO also continued strengthening its short selling regime, proposed mandatory close-out requirements, modernized Market Regulation guidance, and developed tools and processes to identify trading data quality issues and support Dealer Member compliance.
The practical implication is significant.
As the regulator improves its ability to analyze trading data, firms should expect greater emphasis on the quality of their own data, surveillance, investigation, and escalation processes.
Poor data quality is not simply an operational inconvenience when the same data supports regulatory supervision.
Enforcement Remains Material
The enforcement figures in the report are also worth attention.
During Fiscal 2026, CIRO reported 9 firm decisions and 39 individual decisions.
Firm sanctions included approximately $4.1 million in fines, approximately $4.3 million in disgorgement, and $285,000 in costs.
Individual sanctions included approximately $6.3 million in fines, approximately $959,000 in disgorgement, 16 suspensions, and 10 permanent bars.
CIRO also states that it now has fine collection authority across every province and territory in Canada.
That strengthens the practical reach of CIRO enforcement.
For firms, the relevant lesson is not simply the size of the sanctions.
Compliance deficiencies become more serious when issues are repeated, poorly supervised, inadequately remediated, or allowed to continue after warning signs appear.
A mature compliance program should therefore treat remediation as part of risk management rather than as a closing step after a review.
Investor Protection Is Expanding Beyond Enforcement
CIRO’s investor protection work also extends beyond disciplinary proceedings.
During Fiscal 2026, CIRO supported research and education initiatives, partnered with nonprofit organizations, published research on how self-directed investors use social media, supported research on women and investing, and advanced efforts to return disgorged funds to harmed investors.
The report also shows monetary sanctions funding public-interest initiatives, including financial education, complaint support, investor advocacy, research, and proficiency infrastructure.
This matters because regulatory expectations increasingly reflect investor outcomes, not just technical compliance.
How firms communicate, design products, supervise advice, manage conflicts, and use technology all feed into that broader investor protection objective.
CIRO Regulates a Very Diverse Membership
As of March 31, 2026, CIRO reported 250 Dealer Members.
That included 148 Investment Dealers, 90 Mutual Fund Dealers, and 12 dual-registered Dealers.
The membership also varies considerably in size.
The report shows firms ranging from businesses with less than $5 million in annual revenue to organizations generating more than $1 billion.
This diversity helps explain CIRO’s continued emphasis on efficiency and reducing unnecessary regulatory duplication.
But proportional regulation does not mean informal regulation.
Smaller firms often have fewer people performing more functions.
That makes clear ownership, escalation, documentation, and control evidence particularly important.
Regulatory Efficiency Is Part of the Story Too
The Annual Report does not present regulatory expansion without also addressing regulatory cost and efficiency.
CIRO states that investments made during Fiscal 2026 helped reduce regulatory complexity and administrative duplication.
It also reports a 1 percent reduction in business-as-usual fees for Fiscal 2027.
At the same time, total Member fees are budgeted to rise because CIRO has taken on additional registration and Québec responsibilities and continues to invest in technology, cyber resilience, market infrastructure, and other strategic priorities.
That distinction matters.
The regulatory system can become more efficient even as the regulator takes on more responsibilities.
Dealers should expect both developments to occur at the same time.
The Fiscal 2027 Outlook Shows Where Resources Are Going
CIRO has budgeted operating expenses of approximately $188.2 million for Fiscal 2027, representing a 10 percent increase over the Fiscal 2026 budget.
The report attributes the increase primarily to investments in cyber resilience, newly delegated registration and Québec responsibilities, strategic initiatives, technology, market system upgrades, and higher market volumes.
CIRO has budgeted Member fees of approximately $148.6 million, an increase of 6.3 percent over the Fiscal 2026 budget, while reducing the business as usual component by 1 percent.
The numbers help show where the next phase of regulation is being built.
Cyber resilience, technology, national registration, market infrastructure, and expanded responsibilities are not peripheral projects.
They are becoming part of CIRO’s operating model.
Leadership Is Also Entering a New Chapter
The Annual Report arrives during an important leadership transition.
Andrew Kriegler has announced his intention to retire as President and CEO.
The report reflects on his role in bringing CIRO together following the amalgamation of its predecessor organizations and notes that the Board is undertaking the process of selecting the organization’s next leader.
That timing is significant.
CIRO’s next President and CEO will inherit an organization where much of the original integration work is advanced, but where several major areas are still evolving.
Those include rule consolidation, technology, artificial intelligence, cyber resilience, investor protection, market regulation, regulatory efficiency, and the continued expansion of CIRO’s national responsibilities.
What Dealers Should Be Reviewing Now
The Annual Report is most useful when firms convert it into questions about their own operations.
Registration
Are regulatory consequences considered early when ownership, activities, people, or business structures change?
Rule consolidation
Does the firm have a process to identify changes that require more than a policy amendment?
Proficiency
Can the firm demonstrate that Approved Persons remain capable of performing the functions assigned to them?
Client Focused Reforms
Does the evidence in client files support what the firm says its processes are designed to do?
Technology and AI
Does each material use have clear ownership, controls, testing, and escalation?
Cyber resilience
Can critical activities continue during a serious operational disruption?
Market supervision
Are surveillance, trading data, and escalation processes keeping pace with increasingly sophisticated regulatory tools?
Regulatory change
Can the firm identify, assess, implement, and test regulatory changes in a disciplined way?
These are not separate themes.
Together, they describe the operational environment CIRO is building.
The Next Chapter Is About Whether the Framework Works
CIRO’s early years were necessarily dominated by amalgamation and integration.
The 2026 Annual Report shows how far that work has progressed.
Registration is becoming more national. The consolidated rulebook is approaching another major milestone. A new proficiency regime is operational. Québec is moving further into the CIRO model. Technology and generative AI are now part of the regulatory discussion. Cyber resilience is receiving substantial attention. Market supervision continues to evolve. Investor protection remains central.
The practical implication for dealers is increasingly clear.
The next stage of regulatory readiness is not simply having the right framework. It is demonstrating that the framework works.
Policies remain important.
But regulators can also look at the people responsible for them, the systems supporting them, the data they produce, the controls operating underneath them, and the evidence showing whether those controls actually function.
That is where the next chapter of compliance is likely to be lived.
