This Notice summarizes key changes that we are implementing to streamline and enhance our compliance risk assessment process:
- Beginning fall 2021, “Rotational Reviews” or “Selective Review Examinations” will be replaced by an Annual Risk Questionnaire Dealer Member Rule 19.1 - Provision of information and effective December 31, 2021, IIROC Rules 9104 - Examination powers and 9105 - Obligations of Regulated Persons and other persons
- Our risk assessment cycle for determining the compliance risk of each firm, and issuing Risk Trend Reports, will be moved from as of March 31st to as of December 31st
These changes will:
- enhance our risk-based approach by obtaining current and consistent risk information annually from each firm regardless of examination cycle,
- streamline regulatory requirements by coordinating the requests to firms for information and eliminating duplicative processes across Business Conduct, Trading Conduct and Financial and Operations Compliance (Compliance teams), and
- ensure greater consistency in risk assessments for all firms and across all Compliance teams.
One of our key priorities, as outlined in our fiscal year 2022 priorities, is to support industry transformation and modernize IIROC rules and approach to regulation. As part of this initiative, we have been reviewing ways in which to streamline risk assessment processes across our Compliance teams.
Each Compliance team conducts an annual assessment of risk and impact to determine the examination scope and cycle for each firm as at March 31st. The result of this assessment is a consolidated document called a Risk Trend Report (RTR) which is sent to high-risk firms every year, and to all firms once every three years, at the beginning of July.
The information that we input into each Compliance team’s risk model is based on a number of factors including:
- the firm’s business model and activities,
- the firm’s financial performance and trading information and,
- our assessment of the firm’s governance, culture and compliance based on examination reviews and other interactions.
Introduction of the Annual Risk Questionnaire
Beginning fall 2021, all firms will be required to electronically submit an Annual Risk Questionnaire (ARQ). The ARQ requests pertinent and key information necessary for us to assess the compliance risk of the firm.
It is important to note that the ARQ is not an additional process. It is intended to replace or streamline our current processes. For example, one ARQ will be used by each Compliance team:
- prior to commencing field work as part of our regular examination planning process
- to replace the “Rotational Review” or “Selective Review Examination”
- to inform IIROC’s annual risk assessments of Dealer Members.
Each compliance team will rely on the information from the ARQ to improve consistency across the teams and avoid unnecessary duplication.
Changes to the Timing of the Annual Risk Assessment Process and Issuance of the RTR
We have heard feedback from firms that receiving the RTR earlier would be beneficial. As a result, we are moving up the timing of our official assessment of Dealer Member risk from “as at March 31st ” to “as at December 31st ”. This timing will lead to earlier completion of our risk assessments and enable us to provide RTRs earlier in the calendar year to firms.
The following is a brief description of the proposed timeline:
- In September/October 2021, and every year after, the Ultimate Designated Person (UDP) of the Dealer Member will receive an encrypted email with a secure link to the ARQ. The UDP can complete and/or forward the link to other individuals (e.g., CCO and/or CFO) to complete.
- As part of this request, firms will also be asked to submit a copy of their most recent CCO Report to the Board (or equivalent)Dealer Member Rule 38.7 and effective December 31, 2021, IIROC Rules 3915 – Report to Dealer Member’s board of directors and 4913 – Role of board of directors as well as a current corporate organizational chart.
- Firms will be given one month to complete the ARQ.
- The UDP will be required to certify that the information in the ARQ is complete and accurate before submitting it to IIROC.
We will review the submitted ARQ responses over the next few months. If we require additional information or clarification on any responses, the applicable Compliance Manager will contact the firm. The responses to the ARQ will be used in the firm’s risk assessment as at December 31st.
Please note that all firms will be receiving a RTR this year, i.e., as at December 31, 2021, around spring 2022.
Please refer to IIROC’s new website for more information on our Compliance teams and compliance approach and risk models.