CIRO 2026 Enforcement Report: Key Takeaways For Registrants

On July 22, 2026, the Canadian Investment Regulatory Organization (“CIRO”) released the 2026 edition of its annual Enforcement Report. The report indicates that, while CIRO is pursuing fewer enforcement cases overall, it is choosing to focus on those involving the most serious sources of investor harm and market risk — especially supervision failures, internal control weaknesses, firm conduct, and gatekeeper obligations, with disgorgement emerging as an increasingly important enforcement tool. CIRO is increasingly evaluating firms not simply by whether misconduct occurred, but by how effectively firms identified, escalated and responded to risk.

The key takeaways for registrants are below:

1. CIRO is Prioritizing Cases with the Greatest Harm

The report shows declining investigation and proceeding volumes, while sanctions have increased substantially. Registrants should not mistake declining enforcement volumes for reduced regulatory scrutiny: the data suggests CIRO is becoming increasingly selective, concentrating resources on what it considers “the most significant and serious cases” involving supervision failures, internal controls, and gatekeeper obligations.

The result may be fewer proceedings overall, but higher stakes for firms that become the subject of enforcement action.

When it comes to the “most significant and serious cases” in the past year:

• Supervision: Six cases are referenced involving supervision issues. These cases have generally involved issues where the firm failed to properly monitor excessive use of margin, enforce proper record-keeping procedures by advisors, and identify red flags arising from trading activity.
• Internal controls: Two cases are referenced involving internal control issues. These matters generally involved weaknesses in firms’ compliance infrastructure, policy implementation, escalation processes, and transaction-monitoring systems (e.g., issues with respect to obtaining client signatures or failing to investigate unusual redemption activity).
• Gatekeeper obligations: Two cases are referenced in which the primary concern was registrants failing to act as effective gatekeepers to protect the integrity of the capital markets by identifying and responding to potential market-manipulation risks (e.g., not conducting adequate due diligence when opening high-risk accounts, failing to perform proper client verification, continuing relationships after multiple red flags).
  
  From our experience representing other registrants, these two cases are part of a growing focus on the gatekeeper obligation and a push by CIRO Staff in favour of a broad interpretation of the obligation in enforcement proceedings.
  
  These two cases were resolved by way of settlement, and therefore the scope of the gatekeeper obligation was not at issue. However, the scope of the gatekeeper obligation is currently before the B.C. Securities Commission in two separate cases.
  
  The first is an appeal by CIRO Staff of a decision by a CIRO Panel dismissing the proceeding against the registrant, and the second is an appeal by the registrant of a decision by a CIRO Panel which found a gatekeeper breach had been made out. Our firm represents the registrants in both of these cases, and their outcome could have a significant impact on CIRO’s application of the gatekeeper standard in future enforcement proceedings.

2. CIRO is Increasing Its Focus on Firm Conduct

The sanctions imposed on firms in the past year have jumped significantly – from $3.12M to $8.69M. The report underscores that effective supervision remains one of the most important compliance controls. In many cases, the focus of CIRO's investigation is not merely what occurred, but whether the firm had systems reasonably designed to detect and prevent the misconduct.

Firms should continue testing branch supervision, escalation protocols, and exception-reporting systems before issues arise. Moreover, the enforcement cases signal a continuing shift away from reviewing written policies toward assessing whether compliance programs actually function in practice. Firms should expect regulators to examine how issues are escalated, investigated, and resolved, and whether compliance controls are operating effectively.

Registrants should view the report as a reminder to revisit governance frameworks, test supervisory controls, review escalation protocols, and ensure that compliance programs operate effectively in practice.

3. Disgorgement is Becoming a Key Remedy

CIRO created the Disgorgement Distribution Program, effective April 1, 2026, to facilitate the return of lost capital to directly harmed investors. Regulated entities facing a CIRO proceeding should keep in mind that penalties may now increasingly come with both a fine and a compensatory award (increasing overall potential exposure).

To view the original article click here

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.