As the wealth management industry evolves, Dealer Members (Dealers) have been looking at ways to use, or increase the use of automation in their businesses, particularly to support their compliance activities. A number of Order Execution Only (OEO) Dealers have requested clarity about the use of automation (e.g. algorithm logic) in their account opening approval process and compliance with our rules. This Guidance Note is to assist OEO Dealers in understanding their regulatory obligations when using automation in their account opening approval process.
This Guidance Note applies only to OEO Dealers, and only to the account opening approval process for trading accounts that do not allow:
- trading in contracts-for-differences or over-the-counter derivatives
- options trading strategies other than low-risk strategies based on long calls, long puts, covered calls, or protective (long) puts (referred to in this Guidance Note as permitted accounts).
In addition, this Guidance Note is limited to automation that is rules based and does not have intelligent decision-making capability based on machine learning or other software tools using artificial intelligence techniques.
Use of automation in the account opening approval process
Supervisor Approval Requirement
IIROC Dealer Member Rule 2500.II.A.21 [IIROC Rule subsection 3214(3)] provides that the applicable Supervisor must approve each new account no later than one business day after completing the initial trade for the account (Supervisor Approval Requirement). The Supervisor Approval Requirement does not expressly prohibit the use of automation or the delegation of tasks.
While delegation of tasks related to the Supervisor Approval Requirement is allowed unless otherwise stated, the applicable Supervisor cannot delegate the responsibility for those tasks, and remains responsible for meeting the Supervisor Approval Requirement. Consequently, the applicable Supervisor needs to understand how the automation process works and what the Supervisor’s role and responsibilities are. In some cases, more than one Supervisor may be involved. For example, in the case of permitted accounts using option trading strategies described above, the Designated Options Supervisor has responsibility for the oversight of the options trading component, and so needs to understand how the automation process works, and what the Designated Options Supervisor’s role and responsibilities are.
We view the use of automation to review and approve new permitted account applications at OEO Dealers – i.e. without the applicable Supervisor manually reviewing and approving each application – to be consistent with the Supervisory Approval Requirement, in the circumstances discussed in this Guidance Note, and where the OEO Dealer has appropriate compensating controls, and policies and procedures, in place.
Generally, the new account application process requires collection of the same information from the applicant whether it is a manual or an automated process. In the automated process, the algorithm compares the applicant’s information to the OEO Dealer’s account application criteria (we expect the criteria would be the same whether a manual or an automated process is used). If there are no inconsistencies between the information collected and the criteria, or there are no other relevant factors (discussed below) that arise, the application is approved. If there are inconsistencies between the information collected and the criteria, or other relevant factors arise, that the automated process cannot resolve, the application is flagged and sent to the applicable Supervisor(s) for manual review and approval.
In designing its automated process, an OEO Dealer should take into account its business model and product offerings, and factors relating to an applicant that would give rise to a manual review. Examples of factors that could give rise to a manual review include:
- the applicant not being an individual, or the age of majority
- a trading authorization being used
- an applicant applying to use options trading strategies and not having an appropriate level of knowledge and trading experience
- the applicant being an insider.
Compensating controls, and policies and procedures
We expect an OEO Dealer to have compensating controls, and policies and procedures2, which ensure that:
- the automated process is designed to identify inconsistencies and other relevant factors in the information provided in an application and, if such issues cannot be resolved through the automated process, route the application for manual review and approval
- factors that trigger a manual review are clearly articulated
- the automated process is functioning as designed by implementing appropriate periodic testing and audit procedures to confirm that, among other things, accounts approved through the automated process would have been approved if subject to manual approval
- if using an automated system provided by a third party provider, the OEO Dealer documents the testing it did, and its oversight of the third party service provider
- all necessary information required for all applicable client identification regulatory requirements – i.e. know-your-client and anti-money laundering – is collected, complete and accurate
- the automated process is updated as appropriate and issues requiring compliance and technical input or oversight are identified and resolved
- the role and responsibilities of the applicable Supervisor are clearly set out, and the Supervisor is properly trained on the function and use of (this does not mean the coding and technology behind) the automated process
- the applicable Supervisor approves the automation process and any changes to it, and retains responsibility under the Supervisory Approval Requirement whether automation is used or not.
As always, when assessing the adequacy and appropriateness of its compensating controls and policies and procedures, each OEO Dealer should consider its business model, the types of products it offers, and the nature of its clients.
We do not expect OEO Dealers to make a business model change submission to us concerning the use of automation that is within the scope of this Guidance Note. We ask OEO Dealers considering the use of automation in the account opening approval process that fall outside the scope of this Guidance to speak with us.3 The Business Conduct and Compliance team will be reviewing automated processes as part of regular OEO Dealer examinations, in order to ensure compliance with the Supervisor Approval Requirement.
Other relevant guidance
We refer OEO Dealers to other IIROC guidance that may assist them in their compliance activities including:
- Guidance on order execution only services and activities generally is set out in Notice 18-0076 - Guidance on Order Execution Only Services and Activities
- Guidance of general application on compliance and supervision activities is set out in Notice 12-0379 - The Role of Compliance and Supervision
- Guidance on notifying IIROC of any significant changes to a Dealer’s business model is set out in Notice 10-0060 – Reporting of Changes to Business Models
This Guidance Note is effective immediately.
This Guidance Notes relates to:
- IIROC DMR 38.1 [IIROC Rule 3904]
- IIROC DMR 2500.II.A.2 [IIROC Rule subsection 3214(3)]
Previous Guidance Note
For more information, please contact the Business Conduct Compliance relationship manager assigned to your firm.
- 1. To assist readers, we reference applicable IIROC Rules provisions (see Notice 19-0144 – IIROC Dealer Member Plain Language Rule Book Implementation). Since the plain language rule book is not yet effective, we shaded these references in grey. The shading will be removed when the plain language rule book is effective.
- 2. IIROC Dealer Member Rule 38.1
- 3. We intend to publish in the future updated guidance directed at all Dealers concerning reporting changes to business models, the introduction of new business lines and processes, and the use of automation more broadly.