Requirements to Notify CIRO under the Electronic Trading Rule Amendments

1. Background

The Amendments broaden the previous supervisory requirements for trading. They specifically require firms to establish and maintain risk management and supervisory controls, policies and procedures related to marketplace access and the use of an automated order system (Risk Management Controls)2.

Under Rule 7.1(7), a Participant may, on a reasonable basis:

1. authorize an investment dealer to set or adjust a specific risk management or supervisory control, policy or procedure on its behalf; or
2. use the services of a third party that provides risk management and supervisory controls, policies and procedures.

The Participant must also enter into a written agreement with the investment dealer or third party3.

If a Participant enters into either arrangement set out in Rule 7.1(7), it must promptly notify CIRO of:

• the name of the investment dealer or third party, as applicable; and
• their contact information.

This contact information enables CIRO to communicate directly with the investment dealer or third party if additional details are needed regarding an order or a trade.

2. Questions and Answers

The following are specific questions respecting the notification requirements in the Amendments and CIRO’s response to each question.

1. How do we notify CIRO?

Send an email to [email protected].

2. What information is required in the email?

If you are using a third party to provide Risk Management Controls, your email must contain:

• a statement that your firm is using a third party to provide Risk Management Controls;
• the name of the company; and
• a phone number or email address to allow CIRO to contact the company or, if appropriate, the Participant.

If you are authorizing an investment dealer to set or adjust a Risk Management Control on your behalf, your email must contain:

• a statement that your firm has authorized an investment dealer to set certain Risk Management Controls for itself;
• the name of the investment dealer; and
• a phone number or email address to allow CIRO to contact the investment dealer.

3. We use multiple technology vendors. Do we provide notification on all vendors?

You must provide information only on the company or companies that supply you with Risk Management Controls used to comply with the requirements in the Amendments. For example, if one company provides your Risk Management Controls and another handles order routing services without Risk Management Controls, your notification should include information only about the company supplying the Risk Management Controls. If multiple companies provide you with Risk Management Controls, you must include information for all of those companies.

4. We have authorized more than one investment dealer to set certain risk management controls. Do we send more than one email?

You must provide information for each investment dealer whom you have authorized to set certain Risk Management Controls. You may include information for multiple investment dealers in one email, or you can send a separate email for each investment dealer.

5. I use a vendor for risk management controls but I have not authorized an investment dealer to set those controls. Am I still required to notify CIRO?

Yes. A notification requirement is triggered by either arrangement coming into place. These are separate notification requirements.

6. I am using risk management tools from a well-known vendor who provides this service to many firms. Am I still required to provide contact information?

Yes

7. We are using the risk management tools supplied by our affiliate company. Is this considered a third party and do we need to provide notice?

Yes, this is considered a third party and notification is required.

3. Applicable Rules

UMIR Rules this Guidance Note relates to:

• UMIR 7.1

4. Previous Guidance Note(s)

This Guidance Note replaces:

• Guidance Note 13-0066 - Requirements to Notify IIROC under the Electronic Trading Rule Amendments (February 28, 2013).

5. Related Documents

This Guidance Note is related to the following Guidance Notes:

• Guidance Note GN-URPART7-25-0002 - Guidance Respecting Electronic Trading (August 19, 2025)

• 2Effective March 1, 2013, Rule 7.1(6) provides:
  Notwithstanding any other provision of this Rule, a Participant or an Access Person shall adopt, document and maintain a system of risk management and supervisory controls, policies and procedures reasonably designed, in accordance with prudent business practices, to ensure the management of the financial, regulatory and other risks associated with:
  1. access to one or more marketplaces; and
  2. if applicable, the use by the Participant, any client of the Participant or the Access Person of an automated order system.
• 3Effective March 1, 2013, Rule 7.1(8) provides: 
  An authorization over the setting or adjusting of a specific risk management or supervisory control, policy or procedure or retaining the services of a third party under subsection (7) must be in a written agreement with the investment dealer or third party that;
  1. precludes the investment dealer or third party from providing any other person control over any aspect of the specific risk management or supervisory control, policy or procedure;
  2. unless the authorization is to an investment dealer that is a Participant, precludes the authorization to the investment dealer over the setting or adjusting of a specific risk management or supervisory control, policy or procedure respecting an account in which the investment dealer or a related entity of the investment dealer holds a direct or indirect interest other than an interest in the commission charged on a transaction or reasonable fee for the administration of the account; and
  3. precludes the use of a third party unless the third party is independent of each client of the Participant other than affiliates of the Participant.