Background

The Amendments expand the existing supervisory requirements for trading to specifically include the establishment and maintenance of risk management and supervisory controls, policies and procedures related to access to one or more marketplaces and/or the use of an automated order system (“Risk Management Controls”).2

The Amendments provide in Rule 7.1(7) that a Participant may, on a reasonable basis:

1. authorize an investment dealer to perform on its behalf the setting or adjusting of a specific risk management or supervisory control, policy or procedure; or
2. use the services of a third party that provides risk management and supervisory controls, policies and procedures.

The Participant must also enter into a written agreement with the investment dealer or third party.3

A Participant that enters into either of the arrangements set out in Rule 7.1(7) must forthwith notify IIROC of:

• the name of the investment dealer or third party, as applicable; and
• the contact information for the investment dealer or third party.

This contact information enables IIROC to deal with an investment dealer or third party in the event that IIROC wants additional information with respect to the entry of an order or execution of a trade.

Questions and Answers

The following are specific questions respecting the notification requirements in the Amendments and IIROC’s response to each question.

1. How do we notify IIROC?
   Send an email containing the information to [email protected] using IIROC’s secure email system, EMX.4
2. What information is required in the email?
   
   If you are using a third party to provide Risk Management Controls, your email must contain:
   • a statement that your firm is using a third party to provide risk management controls;
   • the name of the company; and
   • a phone number or email address to allow IIROC to contact the company or, if appropriate, the Participant.
     
     If you are authorizing an investment dealer to perform on its behalf the setting or adjusting of a Risk Management Control, your email must contain:
   • a statement that your firm has authorized an investment dealer to set certain risk management controls for itself;
   • the name of the investment dealer; and
   • a phone number or email address to allow IIROC to contact the investment dealer.
3. We use multiple technology vendors. Do we provide notification on all vendors?
   
   You must provide information only on the company or companies that provide you with Risk Management Controls used to comply with the requirements in the Amendments. For example, if you use one company to supply your Risk Management Controls, and a separate company to provide you with order routing services that do not include Risk Management Controls, your notification must contain information only about the company that supplies you with Risk Management Controls. If you use more than one company to supply you with Risk Management Controls, you must provide information on all such companies.
4. We have authorized more than one investment dealer to set certain risk management controls. Do we send more than one email?
   
   You must provide information about each investment dealer to whom you have authorized certain Risk Management Controls. You can send information about more than one investment dealer in one email, or you can send a separate email for each investment dealer.
5. I use a vendor for risk management controls but I have not authorized an investment dealer to set those controls. Am I still required to notify IIROC?
   
   Yes. A notification requirement is triggered by either arrangement coming into place. These are separate notification requirements.
6. I am using risk management tools from a well-known vendor who provides this service to many firms. Am I still required to provide contact information?
   
   Yes.
7. IIROC is giving firms until May 31, 2013 to complete testing and fully implement the automated controls set out in the Amendments. We are in the process of testing our automated controls. Can we wait until May 31 to provide notice of our third party risk management controls provider?
   
   No. The requirement to notify IIROC of your third party provider becomes effective on March 1, 2013. This date is not impacted by any testing that may be ongoing.
8. We are using the risk management tools supplied by our affiliate company. Is this considered a third party and do we need to provide notice?
   
   Yes.

• 2Effective March 1, 2013, Rule 7.1(6) provides:
  Notwithstanding any other provision of this Rule, a Participant or an Access Person shall adopt, document and maintain a system of risk management and supervisory controls, policies and procedures reasonably designed, in accordance with prudent business practices, to ensure the management of the financial, regulatory and other risks associated with:
  (a) access to one or more marketplaces; and
  (b) if applicable, the use by the Participant, any client of the Participant or the Access Person of an automated order system.
• 3Effective March 1, 2013, Rule 7.1(8) provides:
  An authorization over the setting or adjusting of a specific risk management or supervisory control, policy or procedure or retaining the services of a third party under subsection (7) must be in a written agreement with the investment dealer or third party that;
  (a) precludes the investment dealer or third party from providing any other person control over any aspect of the specific risk management or supervisory control, policy or procedure;
  (b) unless the authorization is to an investment dealer that is a Participant, precludes the authorization to the investment dealer over the setting or adjusting of a specific risk management or supervisory control, policy or procedure respecting an account in which the investment dealer or a related entity of the investment dealer holds a direct or indirect interest other than an interest in the commission charged on a transaction or reasonable fee for the administration of the account; and
  (c) precludes the use of a third party unless the third party is independent of each client of the Participant other than affiliates of the Participant.
• 4For information about EMX, refer to IIROC Notice 13-0045 - Rules Notice - Technical - UMIR - Requirements for Secure Electronic Regulatory Communication (February 7, 2013).