November 5, 2026
The OSC’s Registration, Inspections and Examinations (RIE) Division 2026 Annual Report is worth reading for more than its useful list of deficiencies. Taken together, its findings show a division whose oversight now reaches beyond just registrants, and whose expectations increasingly turn on how firms manage third parties, deploy AI, and document their decisions. OSC Staff Notice 33-762, published October 7, 2026, covers the fiscal year ended March 31, 2026.
Read side by side with last year's OSC Staff Notice 33-759 (published July 24, 2025), the 2026 report shows three shifts that may overshadow any single finding:
Registrant conduct focus has pivoted from individual applicants to firms.
Third-party and outsourcing oversight has become a thread that ties some findings together.
RIE now reports examination results for regulated entities, and its first business-conduct examinations of derivatives dealers, alongside registrants.
This article sets out what is new, how the report has changed, and what we think legal and compliance teams should do with it.
At a glance: 2026 vs 2025
The 2025 report's centre of gravity was conflicts of interest and exempt market misuse. The 2026 report's is portfolio manager discipline, technology governance, and derivatives.
The 2026 report grows from three parts last year to five parts this year: it adds reporting on regulated entities and SROs, the first examinations of derivatives dealers under NI 93-101, and a full Part 5 on registrant misconduct.
The registrant population under OSC compliance oversight barely moved, now at 1,178 firms and 11,772 individuals. Because that population is stable, the headline numbers in the conduct section, with regulatory actions falling from 91 in fiscal 2025 to 39 in fiscal 2026, require context. The report attributes this change to the April 1, 2025 delegation to CIRO of firm registration in the investment dealer and mutual fund dealer categories, and of individual registration in the mutual fund dealer category, which sharply reduced the number of individual applicant files on the OSC's desk.
Accordingly, every category of regulatory action fell: terms and conditions dropped from 48 to 20, denials of registration from 23 to 10, suspensions from 7 to 3, warning letters from 8 to 6, and referrals to Enforcement from 5 to 0.
What is genuinely new in the 2026 Report
AI governance gaps. Early observations include firms using AI with no documented AI policies, little oversight of third-party AI tools, and marketing claims about AI that firms could not substantiate.
AI as a reportable business change. The report's examples of business changes that call for a Form 33-109F5 filing include material changes to operational business processes (including AI adoption), AI use that may directly affect registerable services, and automated KYC collection with an initial suitability assessment. Some of these changes may prompt a more extensive review as well as terms and conditions.
PM portfolio discipline. There are new items on leverage without documented suitability, alternative investments with thin KYP and concentration monitoring, fees that do not match disclosure, and IPS asset allocation breaches without documented rationale.
Structure and substance. The report provides guidance on sales of firm registrations (where new owners plan to change the business, staff will ask for a fresh F6, F4s and an in-person meeting) and on special warrants and other convertible securities distributed through NI 45-110 funding portals (in substance a prospectus distribution of the underlying securities, which generally requires an investment dealer and makes the issuer a reporting issuer).
Business titles on Form 33-109F4. Registration categories used as titles, officer titles that do not match, and associate advising representatives using "Portfolio Manager" without qualification were identified.
Regulated entities. The report describes RIE's first examinations of regulated entities: trade repository governance; third-party risk and outsourcing at two recognized clearing agencies (jointly with the OSC's Trading and Markets Division and the AMF); and newly commenced examinations of marketplaces, an information processor, and DRO ratings of Canadian CMBS (the DRO examination was still ongoing at fiscal year-end).
First NI 93-101 examinations. RIE examined the largest OTC derivatives dealers on fair dealing, conflicts, complaints, compliance, and record-keeping, applying the Companion Policy's context-sensitive approach for eligible derivatives parties.
Repeat findings
Some items return with long histories. When a finding recurs across several reports and a decade of guidance, staff are unlikely to treat it as a minor deficiency.
Whistleblower-restricting clauses in employment and severance agreements cite guidance dating from 2017 and 2018.
Insurance coverage gaps cite reports back to 2014.
PM understaffing was discussed in 2016 and 2023, and this year’s report adds a vivid example: a client-to-advising representative ratio above 600 to 1, where clients were not met at least annually to update KYC and reassess suitability. NAV error controls repeat almost word for word from 2025.
Derivatives data reporting deficiencies (inaccurate, late, or missing creation data, and over-reliance on a trade repository's field specifications and reporting vendors) have been flagged since Multilateral CSA Staff Notice 91-306 in June 2019, and the report says they continue.
What dropped out
The 2025 report's long sections on conflicts inventories, OM exemption investment limits, EMDs holding client cash, excess working capital and subordinated loans, books and records delays, and compensation to unregistered parties do not reappear as standalone items. Two of these topics have not gone away, however: excess working capital and late audited financial statements are now one of the Registrant Conduct Team's two referral channels, and EMDs distributing under the OM exemption are the subject of new examinations whose findings are due in fiscal 2026/27. In our view, the topic choice reflects topic rotation, not resolution.
Reading between the lines
The report's individual findings are useful, but its patterns are more so, with five significant ones:
1. Third-party oversight is a connective tissue
The same third-party-related weaknesses appear across business lines that rarely read each other's guidance. CTPs leaned on affiliates for KYP. Derivatives dealers trusted a trade repository's field specifications and their reporting vendors. Firms used third-party AI tools with little oversight. PMs accepted leverage recommendations from unregistered third parties. An EMD representative allowed an issuer's principal to collect KYC and assess suitability, obligations that are non-delegable. Clearing agencies were examined specifically on outsourcing, and the CSA cybersecurity sweep (CSA Staff Notice 33-322, July 2026) tested due diligence on third-party service providers.
With one OSC division examining registrants, derivatives dealers, market infrastructure, and CIRO members, expect lessons learned in one sector to be tested in another. A firm-wide vendor and affiliate oversight framework, overseen by compliance and not only procurement, may be the most efficient single response to this report.
2. Treat AI deployment as a regulatory event, not an IT project
The report highlighted AI adoption among other changes that can require a Form 33-109F5 filing to show a change in a registrant’s business. Combined with the observation that AI marketing claims could not be substantiated, and the national marketing sweep in Staff Notice 33-761, the AI-related exposure is threefold: an unfiled change, an unsupervised tool, and a misleading communication. Compliance and legal staff should insist on a pre-deployment gate that asks whether the AI use case materially changes the firm's operational business processes or touches KYC, suitability, advice, or client communications, and if so, whether a notice filing is needed. NI 33-109, s. 3.1(1.1) sets 15- and 30-day deadlines after a change, but filing before launch is the safer course. When in doubt, the report itself says to consult advisers; a short, early call with staff may be cheaper than a deficiency.
3. If it is not documented, expect staff to question it
Reading the PM-related items together (leverage, alternatives, fees, IPS deviations, staffing) shows that OSC Staff focus on whether there is a record that a decision was made. Temporary IPS deviations are recognized; undocumented ones raise supervision and recordkeeping concerns. Similarly, leverage can be suitable, but staff expect a documented suitability determination to support it. In each case, procedures and controls may have failed. Not every PM finding is about paperwork, though: fees that do not match disclosure, reliance on unregistered third parties’ leverage recommendations, and over-concentration in alternatives are substantive failures. Firms should build the documentation and rationale capture into the portfolio system (exception flags that require a reason code and approver) rather than relying on file notes after the fact.
4. The fall in actions is not a softening
The 57% drop in regulatory actions largely reflects the delegation of registration functions to CIRO. What remains is more concentrated on firms than on individuals. The Registrant Conduct Team now draws on two channels: significant or repeat examination deficiencies, and filing failures such as capital deficiencies and late audited statements. A number of the 2025 high-risk examinations also led to referrals to the Registrant Conduct Team. It may conduct formal interviews and request documents, including emails, and it negotiates terms and conditions that may require remediation overseen by an independent consultant or restrict non-compliant business activity, including onboarding new clients. Response readiness (who is interviewed, what is produced, who controls privilege) belongs in every firm’s examination playbook, not just the enforcement playbook.
5. Integrity screening reaches beyond securities conduct
Three individual case studies involve registration applicants from bank branch roles who were implicated in manipulating interest rates or paperwork, none involving securities trades, and in each case the sponsoring firm withdrew the application. Staff relied on the integrity requirement in s. 27(2) of the Act and Re Istanbul (2008), 31 OSCB 3799. The Nafarrate and Lian decisions highlight a different approach: rehabilitation, candour, and time can restore eligibility under strict supervision. Hiring firms should probe the reasons for any termination for cause, check references beyond HR confirmations, and ensure the F4 is complete. The Newsome suspension for an undisclosed consumer proposal shows that the disclosure failure, not the underlying event, can draw the sanction.
Recommended action items for CCOs and counsel
We will be emphasizing the following responses, including some topics not discussed above.
Inventory every AI use case and map each to operational processes, KYC, suitability, advice or client communications; decide for each whether a Form 33-109F5 is required, and document the decision.
Substantiate or remove every public statement about AI capabilities.
Stand up a single third-party and affiliate oversight register covering AI tools, reporting vendors, sub-advisers and affiliates performing KYP, with named compliance owners.
Review employment, severance and confidentiality templates for whistleblower-restricting language (s. 121.6 of the Act), fix templates prospectively and notify affected current and former employees.
Re-test insurance coverage against projected year-end AUM and confirm double aggregate or full reinstatement wording.
Audit Form 33-109F4 Schedule G, item 3(e) (Item 10) business titles against email signatures, websites and LinkedIn profiles.
Before any first-time acquisition of 10% or more of a registered firm's voting securities (or, under section 11.9, substantially all of its assets), file the section 11.9 notice at least 30 days ahead or the section 11.10 notice as soon as possible, and budget time for a fresh F6, F4s and an in-person meeting with staff.
Confirm the CCO, who now certifies the Risk Assessment Questionnaire, has the data and documented sign-off process to support that certification in the next RAQ cycle (the 2026 RAQ was issued in May 2026).
Watch for the promised follow-ups (AI findings, bank-affiliated dealer sales practices, EMD OM findings) and schedule a gap assessment within 30 days of each.
For PMs: build IPS deviation, leverage, and concentration exceptions into the portfolio system with mandatory rationale and approver fields; reconcile coded fees to client disclosures and give clients 60 days’ written notice of any fee change.
Confirm readiness for the CRM3 total cost reporting amendments, in effect since January 1, 2026; the first annual reports are due in 2027 for the year ending December 31, 2026.
If relying on OSC Coordinated Blanket Order 31-935 (in force June 25, 2026) for institutional accredited investors or overflow accounts, ensure you meet its conditions, including the one-time notice to the principal regulator before relying on it.
For PMs planning a fully paid securities lending program: file Form 33-109F5 before offering it, and document suitability and conflicts.
Test cybersecurity policies, training, risk assessment, third-party provider due diligence, and incident response against CSA Staff Notice 33-322.
————————————————————————————————————
Next Steps with North Star Group
North Star Group supports EMDs, PMs, IFMs, and other securities registrants across the full lifecycle of their business, from incorporation, registration, and governance through capital raising, regulatory transactions, and disclosure, with legal and compliance support that reflects how the business actually operates today. Whether you need ad hoc legal or compliance guidance, ongoing outsourced legal or compliance capacity, or hands-on support navigating a securities, AML, or compliance matter, our team helps you move your business forward with clarity and confidence.
Reach out to us today at info@northstarcompliance.com.
————————————————————————————————————
About the Author
Martha Rafuse (B.A. Western, LL.B. Osgoode, LL.M. London School of Economics) is a Partner at North Star Legal, bringing more than two decades of securities regulatory experience across the financial industry, private legal practice, and government. Before joining North Star, Martha led large compliance teams for both Canadian and U.S. firms, including RBC Phillips, Hager & North Investment Counsel Inc., RBC Dominion Securities Inc. (Retail), and RBC Royal Mutual Funds. Her earlier experience in big law firm private securities practice led to her experience with the Ontario Securities Commission, where she developed novel legal solutions and led significant policy initiatives involving NI 31-103. Read Martha’s full bio
North Star Group | 140 Yonge Street, Suite 200, Toronto, Ontario M5C 1X6 | info@northstarcompliance.com | 416-915-4219
This article is provided for general informational purposes only and does not constitute legal advice.