- within Corporate/Commercial Law topic(s)
- with Senior Company Executives, HR and Finance and Tax Executives
- with readers working within the Basic Industries, Technology and Media & Information industries
When the Ontario Securities Commission (OSC) completes a compliance review, registrants must demonstrate not only adherence to securities law but also the strength of their internal controls. At the end of the review, the OSC issues a compliance report outlining deficiencies and areas where corrective measures are required.
Understanding the OSC Compliance Report and What It Means
An OSC compliance report is the regulator's formal assessment of a firm's compliance with National Instrument 31-103 – Registration Requirements, Exemptions, and Ongoing Registrant Obligations. The report typically highlights one or more of the following categories:
- Minor Deficiencies: Require remediation but don't raise urgent regulatory concerns.
- Significant Deficiencies: Reflect compliance failures that may affect investor protection, market integrity, or financial solvency.
- Repeat Deficiencies: Previously identified issues that were not sufficiently addressed, signaling a pattern of non-compliance.
In most cases, registrants must submit a written response outlining remedial measures to significant deficiencies within roughly 30 days. Where the deficiencies are severe or raise immediate regulatory concerns, registrants may not be given the opportunity to remediate, and may instead be referred directly to the Registrant Conduct Team, which can consider imposing terms and conditions, suspending, or revoking registration.
How to Effectively Respond to an OSC Compliance Report
1. Conduct a Thorough Internal Review First
Before preparing a response, firms should analyze the OSC's findings carefully to understand their root causes. This includes:
- Reviewing each deficiency to identify whether it stems from policy gaps, insufficient training, or weak supervisory processes.
- Collecting documentation to support corrective actions and demonstrate compliance.
A well-grounded internal review helps firms respond accurately and credibly, demonstrating a serious commitment to compliance.
2. Prepare a Clear and Well-Structured Written Response
For significant deficiencies, registrants are usually required to use a standardized response format provided by OSC Staff. This typically involves listing each deficiency alongside the firm's remedial actions and supporting evidence. Strong responses should include:
- Detailed Corrective Measures for each issue identified.
- Timelines for Completion of remediation steps.
- Evidence of Implementation, such as revised procedures, training logs, internal audit reports, or evidence of enhanced supervision or controls.
An effective response should also be:
- Organized and Professional: Following the OSC's requested format closely.
- Evidence-Based: Supporting statements with tangible proof. This could include revised procedures, compliance checklists, or training session materials.
- Proactive: Highlighting measures already completed where possible. Frame the response as part of a broader effort to enhance the compliance program.
For example, if KYC procedures are found lacking, a strong response might include:
- A revised KYC and suitability review process aligned with the firm's business model.
- Firm-wide training materials reinforcing updated regulatory expectations.
- Documentation for enhanced monitoring or testing.
3. Address Repeat Deficiencies Head-On
If the compliance report identifies repeat deficiencies, OSC will expect a more robust response. Firms should:
- Explain why previous efforts fell short and describe enhanced solutions.
- Provide data or tangible proof of improved compliance practices.
- Consider engaging an external compliance consultant to validate reforms.
Failing to adequately respond to repeat issues significantly increases the risk of escalation to Registrant Conduct, which may result in registration restrictions or enforcement actions.
4. Maintain Open Dialogue with the OSC
Early, transparent communication with the regulator can reduce risk. If additional time is needed to implement corrective measures, registrants should raise this proactively. Seeking clarification where needed can demonstrate a genuine commitment to compliance.
If a firm disagrees with the OSC's conclusions, it should clearly outline its position, supported by factual evidence and regulatory analysis. Legal counsel can help craft strategic responses that protect the firm's position while maintaining a cooperative tone.
Avoiding Escalation to Registrant Conduct or Enforcement
If issues are not adequately addressed, the OSC may refer the matter to the Registrant Conduct Team, which can lead to:
- Terms and conditions such as enhanced supervision, external compliance monitoring, or capital requirements.
- Suspension or revocation of registration, preventing the firm or individual from continuing operations.
- Referral to OSC Enforcement, potentially resulting in monetary penalties or market bans.
Demonstrating timely and meaningful remediation is the best way to avoid escalation. If necessary, negotiating proactive solutions with OSC Staff can sometimes lead to a more favorable outcome.
The Risks of Inadequate Responses
Failure to respond effectively to an OSC compliance report can have serious business and reputational consequences, including:
- Restrictions on a firm's ability to conduct business.
- Damage to client trust and investor confidence.
- Regulatory reporting implications across jurisdictions.
By contrast, a well-prepared response shows regulators, clients, and stakeholders that the firm takes its obligations seriously.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
