Gatekeeper Reporting Obligation

1. Background

Gatekeeper obligations under UMIR apply to a Participant or Access Person and their respective directors, officers and employees. This Guidance Note outlines those obligations, identifies the specific UMIR provisions to which the gatekeeper reporting obligation applies (the identified UMIR provisions), and establishes a formal reporting procedure to support compliance. Under UMIR 10.16, each Participant or Access Person is expected to act on “red flags” which may be indicative of possible improper behaviour and to report activity which may be a violation of the identified UMIR provisions to their respective supervisor or compliance department. In turn, the supervisor or compliance department is expected to make a written record of the information received, to investigate the alleged activity and record the relevant findings. Where appropriate, the Participant or Access Person must report the relevant findings to CIRO (a “Report”).

2. Questions and Answers

2.1 How should a Report be made?

To support the filing of a Report, CIRO provides a secure web-based portal accessible through the “CIRO Services” button located at the bottom of the CIRO website, or directly at CIRO Services. Once on the CIRO services website, Participants may navigate to the Gatekeeper section via the menu on the left hand side of the page. For assistance on how to log in, navigate and manage user access, a User Guide is available on the CIRO services website that provides detailed information and instructions. To obtain login credentials, or for general portal-related support, contact the help team at [email protected]. For inquiries specifically related to Gatekeeper Reporting, additional support is available by contacting [email protected].

Once the form has been submitted to CIRO, the sender will receive confirmation of CIRO’s receipt of the Report. The Participant should maintain a copy of the receipt confirmation. The information submitted is not maintained in a database or server connected to the CIRO public website and therefore cannot be accessed by any person external to CIRO, including the person who submitted the Report. CIRO may contact the compliance department of the Participant or Access Person following receipt of the Report to request additional clarification or information.

2.2 What information must be contained in the Report?

At a minimum, the Report should contain:

• the identification of the specific UMIR provision(s) which may have been violated;
• the specific dates on which the violative activity took place (or may have taken place);
• the identification of the security or securities involved;
• if applicable, the identification of specific orders or trades including:
  • the time of the order entry or trade execution,
  • the marketplace on which the orders were entered or executed, and
  • volume and price of the orders or trades;
• names of all employees involved in the handling or entry of the orders;
• if applicable, the identification of the client on whose behalf the order or trade was entered or executed;
• how and when the behaviour was detected;
• all investigative and other actions taken by the Participant or Access Person in response to the initial detection;
• all actions taken or proposed to be taken by the Participant or Access Person in response to the findings of the investigation; and
• the name, title and contact information of the person filing the Report.

2.3 When is a Report due?

Subsection (4) of UMIR 10.16 states that the Report must be “not later than the 15th day of the month following the month in which the findings are made.” CIRO encourages Reports to be submitted as soon as possible and in any event not later than the 15th day of the month following the month in which the Participant or Access Person completes the findings of its investigation. For example, if a Participant or Access Person detects potential misconduct on January 28, the Participant or Access Person is under an obligation to “diligently” pursue an investigation to complete any findings without unnecessary delay. If the Participant or Access Person diligently investigates the behaviour and concludes on February 20 that a violation of one of the Rules listed in Rule 10.16 has occurred, the Report should be submitted to CIRO as soon as possible and, in any event, no later than March 15 of that year.

In addition, regular reporting is required for wash trades that have not been cancelled. All wash trades that have not been cancelled, including wash trades that were generated by automated program trading systems, must be reported to CIRO under UMIR 10.16, which can be done on a monthly basis or more frequently if desired.”1

2.4 Does the reporting obligation extend to activity in principal, non-client and client accounts?

Rule 10.16(1) explicitly states that a Participant is expected to act on “red flag” activity “in a principal, non-client or client account of the Participant.” This would include the trading activities of a Direct Electronic Access client, an Investment Dealer or Foreign Dealer Equivalent in a Routing Arrangement, or an order execution service client.2 If after diligent investigation, potential violative behaviour may have occurred in any of these types of accounts, a Report must be filed with CIRO.

2.5 Does a Participant or Access Person have to report every violation of UMIR that is detected?

As detailed in UMIR 10.16, a Participant must file a Report with CIRO if the Participant finds that one of the following Rules has, or may have, been violated:

• Subsection (1) of Rule 2.1 respecting specific unacceptable activities;
• Rule 2.2 respecting manipulative and deceptive activities;
• Rule 2.3 respecting improper orders and trades;
• Subsection (1) of Rule 3.3 respecting a reasonable expectation to settle prior to the entry of an order for a short sale;
• Rule 4.1 respecting frontrunning;
• Part C of Corporation Rule 3100 – Best Execution of Client Orders respecting best execution of client orders;
• Rule 5.3 respecting client priority; and
• Rule 6.4 respecting trades to be on a marketplace.
• Any Requirement3 that has been designated by the Market Regulator for the purposes of this subsection.

An Access Person must file a Report with CIRO if the Access Person finds that one of the following Rules has, or may have, been violated:

• Subsection (2) of Rule 2.1 respecting specific unacceptable activities;
• Rule 2.2 respecting manipulative and deceptive activities; and
• Rule 2.3 respecting improper orders or trades.
• Subsection (1) of Rule 3.3 respecting a reasonable expectation to settle prior to the entry of an order for a short sale;
• Any Requirement that has been designated by the Market Regulator for the purposes of this subsection

CIRO may designate additional Rules in respect of which a Report must be filed in the event a violation has been detected by a Participant or Access Person.

Additionally, as under UMIR 10.17 and 10.18, a Participant must also report:

• if an investment dealer or third party authorized under UMIR 7.1 to perform risk management or supervisory functions either:
  • has had their written agreement terminated, or
  • fails to promptly fix a deficiency identified by the Participant.
• if the Participant has either:
  • terminated a client’s direct electronic access or an investment dealer’s or foreign dealer equivalent’s access through a routing arrangement, or
  • knows or suspects that the client, investment dealer, or foreign dealer equivalent has breached a material provision of either the Participant’s access standards or the applicable written agreement.

2.6 Is there an obligation to file a Report where a Participant or Access Person has concluded that there “may have been a violation” and not only that there “was a violation”?

CIRO expects each Participant and Access Person to diligently investigate all possible violations of any of the identified UMIR provisions. Upon completion, if the Participant or Access Person concludes that either a UMIR rule has been violated, or may have been violated, the Participant or Access Person must file a Report with CIRO.

A Gatekeeper Report should contain as much of the information listed in Answer 2 above as is practical. For example, if a voluntary filing has been made on an “interim basis” prior to the conclusion of the investigation or if the investigation has been inconclusive, CIRO recognizes that the information may not be complete. If the investigation conducted by a Participant or Access Person is properly diligent but is nevertheless not definitive, CIRO does not expect a Participant or Access Person to exhaust its resources in pursuing a definitive answer. In these circumstances, CIRO would encourage a Participant or Access Person to make a Report, so that CIRO may have to opportunity to utilize its resources to investigate further. A Participant or Access Person has an obligation to retain all records related to its review, investigation and findings for a period of seven years regardless of whether a Report was submitted to CIRO or the findings indicated that there had been no breach of UMIR.

2.7 Is a Report required if a Participant or Access Person has detected that a violation has occurred only once?

CIRO expects a Participant or Access Person to diligently investigate a possible violation of any of the identified UMIR provisions. If the investigation by the Participant or Access Person concludes that a violation of one of the identified UMIR provisions has occurred, CIRO expects the Participant or Access Person to file a Report with CIRO, even if the investigation concludes that the violation has occurred only once. It is not appropriate for a Participant or Access Person to wait to conclude that there is or may be a pattern of violative behaviour before making a Report.

2.8 What “feedback” may a Participant or Access Person expect from CIRO once the Participant or Access Person has made a Report of a violation or possible violation?

CIRO cannot comment publicly on any ongoing investigation that it is undertaking or considering undertaking. As such, a Participant or Access Person should not expect to be “updated” on the status of CIRO’s investigation of a Report. However, CIRO understands that general information regarding Reports and CIRO investigations assist Participants and Access Persons in their compliance efforts. As such, CIRO may include statistics and other information that could be helpful to Participants and Access Persons in its various publications. This may contain details regarding how many Gatekeeper Reports result in further action by CIRO including follow up, formal investigation, enforcement action or referral to a securities regulatory authority or other self-regulatory organization. In addition, CIRO may include information regarding interesting or novel situations, on a “no names” basis. A Participant’s Gatekeeper Reports may be reviewed by CIRO within the scope of a trade conduct compliance examination, where CIRO may be able to provide the Participant with general information regarding how their reporting efforts compare with other Participants in the same peer group.

3. UMIR Rules this Guidance Note relates to:

• UMIR 1.1
• UMIR 2.1
• UMIR 2.2
• UMIR 2.3
• UMIR 3.3
• UMIR 4.1
• UMIR 5.3
• UMIR 6.4
• UMIR 7.1
• UMIR 10.16

4. Previous Guidance Note

This Guidance Note replaces:

• Market Integrity Notice 2006-007 – Gatekeeper Reporting Obligation (February 24, 2006).

5. Related Documents

This Guidance Note is related to the following Guidance Notes:

• Guidance Note GN-URPART7-26-0004 - Guidance Respecting Third-Party Electronic Access to Marketplaces (March 24, 2026)
• Guidance Note GN-URPART7-26-0008 - Guidance On Trading Supervision Obligations (March 27, 2026)

• 1Guidance Note GN-URPART7-26-0008 - Guidance On Trading Supervision Obligations (March 27, 2026)
• 2CIRO Guidance Note GN-URPART7-26-0004 Guidance Respecting Third-Party Electronic Access to Marketplaces (March 24, 2026)
• 3UMIR 1.1 defines “Requirements” to mean, collectively: (a) UMIR; (b) the Policies; (c) the Trading Rules; (d) the Marketplace Rules; (e) any direction, order or decision of the Market Regulator or a Market Integrity Official; and (f) securities legislation, as amended, supplemented and in effect from time to time.