Guidance on Trading Supervision Obligations

1. Guidance on Trading Supervision Obligations

This Guidance Note clarifies CIRO’s expectations on the application of UMIR 7.1 and Policy 7.1. We remind Participants that failure to develop, implement and maintain written policies and procedures in accordance with UMIR 7.1 and Policy 7.1 may result in disciplinary action against the firm, its management, employees, and board of directors.

As part of each examination by Trading Conduct Compliance, CIRO will review the policies and procedures developed by the Participant to determine if they are reasonably designed to:

• ensure compliance with applicable Requirements
• prevent and detect violations of the Requirements.

CIRO will determine the reasonability of the policies and procedures by considering the size and nature of the business, and the experience and training of the employees of the Participant. However, an examination by Trading Conduct Compliance does not represent CIRO’s approval of the Participant’s policies, procedures or supervision system.

On an ongoing basis, the Participant’s board of directors must ensure that the principal risks for non-compliance with the Requirements have been identified, and ensure the firm has implemented appropriate supervision and compliance procedures and systems to manage those risks. The Participant’s management is responsible for ensuring that the supervision system is appropriately designed and effectively carried out.

Each Participant must ensure that its supervisory functions and compliance department are adequately funded, staffed and empowered to fulfill its responsibilities. Inadequate funding of the compliance department or supervisory functions may be a factor in any disciplinary action.

Part 1 of Policy 7.1 requires a Participant “to develop and implement a clearly defined set of policies and procedures that are reasonably designed to prevent and detect violations of Requirements”. Participants are reminded that the term “Requirements”, as defined in UMIR 1.1, includes more than just UMIR and its Policies. Specifically, “Requirements” includes:

• UMIR and its Policies
• National Instrument 23-101 (Trading Rules)
• rules, policies and other similar instruments adopted by a marketplace (Marketplace Rules)
• any direction, order or decision of the Market Regulator or a Market Integrity Official (Decisions)
• securities legislation.

Policy 7.1 sets out requirements for both supervisors and compliance departments and requires that a supervision system include both supervision policies and procedures and compliance policies and procedures. Policy 7.1 uses a number of terms regarding supervision systems that are not specifically defined in UMIR or the Policy. The following are CIRO’s administrative interpretations for these various terms:

• “supervision system” and “supervisory system” encompass the activities of both the supervision procedures and the compliance procedures
• “supervise”, “supervision”, “supervisor”, and “supervisory” refer to the responsibilities of the head of trading2 and “each person who has authority or supervision over or responsibility to the Participant for an employee of the Participant” with respect to the trading activities of the Participant as described in UMIR 7.1(4). A Participant may have more than one head of trading and any number of persons who have authority over the trading activity of employees
• “supervision procedures” are the policies and procedures to be followed by supervisors that are aimed at preventing violations from occurring
• “compliance department” and “monitoring” refer to the responsibilities of the persons responsible for the compliance activities of the Participant
• “compliance procedures” are the policies and procedures to be followed by the compliance department that are aimed at detecting whether violations have occurred
• “management” means those persons who are in supervisory roles, including those responsible for compliance department supervision.

2. Elements of a Supervision System

A supervision system must include both compliance procedures designed to detect violations and supervision procedures designed to prevent violations. The ten elements of a supervision system listed in Part 2 of Policy 7.1 are primarily conceptual and must be reflected in the overall structure of a Participant’s policies and procedures. A Participant cannot simply list each of these elements in its policies and procedures or affirm that each is being done. In its examinations, CIRO assesses whether these elements have been appropriately considered and addressed. Generally, relying solely on automated or hard-coded processes without ongoing oversight is inadequate. Participants should establish and follow a reasonable schedule to review and test these processes to ensure they continue to function effectively and meet both regulatory and operational requirements. The following provides specific guidance on each element.

2.1 Element 1 - Identification of Relevant Requirements

A Participant’s policies and procedures must address all the Requirements that apply to its business and trading. We remind Participants that the Requirements include not only UMIR but also the Trading Rules, Marketplace Rules, Decisions and securities legislation.

CIRO issues guidance to clarify rule requirements and to suggest acceptable methods for complying with specific CIRO requirements. Unless otherwise required by the rules, Participants may use alternative methods, provided that those methods demonstrably achieve the overall objective of Rule 7.1 and Policy 7.1.

2.2 Element 2 - Documentation of the Supervision System

A Participant’s written policies and procedures for both supervision and compliance must be sufficiently detailed to enable a reasonably knowledgeable person to understand both when the policy or procedure applies and how to follow it. Participants must clearly describe testing methodologies so that a reasonably knowledgeable person could complete the test.

We expect the policies and procedures to:

• include a step-by-step description of the testing methodologies, including any definitions needed to understand the logic of the procedures
• outline the principal elements of the testing methodology, including frequency, sample size, and sources of information to be used
• identify any exception reports, trading data and other documents to be reviewed as well as any systems or tools that are used.

These policies and procedures must specifically address all Requirements that apply to the Participant’s type of business or trading. We do not expect a Participant to maintain policies and procedures for Requirements that do not apply to its business activities. Using a copy or a slightly augmented version of Policy 7.1 would not satisfy the requirement to develop, implement and maintain compliance or supervisory procedures. Participants must tailor their procedures to address higher-risk areas and ensure they are appropriate for the size, structure, and nature of their business and trading activity. A Participant must update its policies and procedures when its activities change to address any new risks of non-compliance introduced by those changes.

2.3 Element 3 - Training and Proficiency

Supervisors must have policies and procedures that are reasonably designed to ensure employees are educated and trained on:

• the applicable Requirements
• the Participant’s procedures
• the electronic systems used by the Participant

such that the employee can competently complete the tasks that apply to his or her role.

In addition, supervisors must ensure that employees receive ongoing education and training to address:

• changes in Requirements, procedures or systems
• any problems found by compliance monitoring.

The presence of multiple or inconsistent procedures may indicate inadequate employee training or insufficient oversight of the supervision system. Each Participant must document records and content of all education and training provided to employees.

2.4 Element 4 - Delegation of Supervisory and Compliance Personnel

Firms may delegate compliance or supervisory tasks to other staff of the Participant as long as it does not create a conflict of interest. For example, it would be inappropriate for a supervisor to review the activities of a proprietary account where the supervisor has a direct or indirect interest in the performance of that proprietary account. However, it may be appropriate to delegate tasks such as identifying and reporting extended failed trades to an operations group where the relevant data is more accessible.

Supervisors and compliance staff retain the responsibility for their respective obligations, even where the tasks have been delegated to others.

2.5 Element 5 - Tailor Procedures to Fit the Participant’s Business

Policy 7.1 applies to all trading conducted by a Participant. This Policy is not limited to head office or institutional trading. A Participant’s supervision procedures must encompass all employees involved in the trading process and may include investment advisors and operations staff, as well as other staff that may be delegated tasks under Element 4. Compliance monitoring must consider all lines of business and locations.

2.6 Element 6 – Procedures for Dealing with Violations

Policies and procedures must include a process for handling potential violations of the Requirements including:

• taking steps to correct identified problems
• ensuring appropriate internal escalation of issues, where appropriate.

The compliance department must report problems to trading supervisors or their delegates. Monitoring trading activity alone is not sufficient to satisfy the requirements of Policy 7.1. A Participant must also take appropriate steps to correct any problems that it has detected.

Supervisors are responsible for ensuring that adequate steps are taken to address any problems identified. If supervisors fail to adequately address identified problems, the compliance departments must escalate the matter to higher levels of management, and if necessary, to the board of directors. All corrective actions and escalation must be documented and maintained in an easily retrievable format.

Recurring issues identified through compliance testing over time may indicate that supervisors have not taken adequate steps to:

• supervise activities
• correct problems that have been detected, or
• provide adequate training and education.

Persistent issues over an extended period may also indicate a failure by the compliance department to escalate the deficiencies to the appropriate management level.

2.7 Element 7 - Reviewing Supervision Systems

A Participant must ensure that its supervision system, including both supervision and compliance policies and procedures, remains effective and relevant by reviewing it at least annually.

Management is responsible for updating the supervision system to reflect new Requirements, procedures, systems, business lines, offices and employees. Management must also ensure that compliance testing remains effective.

As outlined in UMIR 7.1(10)(b), where a Participant delegates specific supervisory controls, policies, or procedures to an investment dealer or third party, the Participant remains responsible for ensuring their adequacy. Participants must conduct regular reviews, at least annually, to confirm that the delegated functions are being performed effectively and remain appropriate for meeting the firm’s regulatory obligations.

2.8 Element 8 - Documenting Results of Compliance Reviews

Compliance reviews determine a Participant’s level of compliance generally and identify any areas where compliance with the Requirements requires improvement. CIRO expects compliance reviews to indicate:

• if there is a compliance problem
• whether the problem is increasing or decreasing over time
• whether any previously identified issues have been adequately addressed.

For these reasons, tracking trends and patterns over several compliance reviews can be very useful.

2.9 Element 9 – Retaining Results of Reviews

CIRO requires Participants to summarize and retain the results of the supervision system review under Element 7 (including the compliance reviews under Element 8) in an easily retrievable format. Compliance review results must be verifiable. During a Trading Conduct Compliance examination, CIRO will evaluate the firm’s documentation of the required testing and may request the underlying sources for review.

2.10 Element 10 - Reports to Board of Directors3

Participants must provide their board of directors with a summary of the results of the supervision system review, under Element 7 (including the compliance review under Element 8), at least annually. However, the Participant must immediately report any significant issue regarding the supervision system to the board of directors.

As part of its examination of the Participant, CIRO will request copies of the relevant sections of the board meeting minutes of the Board meeting where the reviews were discussed, together with copies of the material provided to the board of directors. This documentation must include details of any corrective actions recommended and/or taken by the board of directors.

3. Questions and Answers

3.1 What is the difference between the roles of supervision and compliance?

CIRO recognizes that Participants may have different corporate structures based on the setup and business of the firm. The purpose in designating different roles for supervision and compliance in Element 4 of Part 2 in Policy 7.1 is to reinforce the following principles:

• Compliance with the Requirements is a firm-wide responsibility; it is not limited to an isolated department, but an integral part of the business. The existence of a compliance department does not relieve anyone else of the obligation to act on or escalate compliance issues. All employees – regardless of registration or approval status – should understand the standards of conduct for their role.
• The compliance department’s role is to identify, advise, communicate, monitor and report on the Participant’s compliance with the Requirements. Beyond identifying issues, the compliance department must take appropriate steps to ensure that supervisors and/or management take corrective measures. If corrective actions are not taken, the compliance officer4 must escalate the issue according to the firm’s policies and procedures. A Participant’s escalation procedures must be included in its policies and procedures pursuant to Elements 6 and 10 of Part 2 of Policy 7.1.5 Compliance officers must document and maintain the steps they take, and supervisors and/or management must record their corrective actions in a format that is auditable under Element 9 of Part 2 of Policy 7.1.
• The role of supervision is the ongoing supervision of a business function or area. A supervisor has the authority to implement changes on the operation of a business function or area. Supervisors have authority over, and are accountable for, the business that they supervise.
• Compliance roles may identify issues and then refer these issues to the supervisor. Supervisory roles have authority to resolve issues once they are identified. CIRO looks at the following when determining whether an individual is in a supervisory or compliance role:
  • policies and procedures
  • the practice within the firm
  • the individual’s responsibilities, authority and functions; not simply his or her title.

In certain instances, there may be some overlap between compliance and supervision roles. To avoid confusion, Participants should create job descriptions and defined reporting lines. This ensures that compliance officers understand when they may be expected to act in a supervisory capacity, or vice versa.

While duties can be delegated and individuals may have dual functions in certain circumstances, such delegation must avoid actual or perceived conflicts of interest. For example, it would not be appropriate to delegate a compliance function to an employee who reports to a trading supervisor, if doing so compromises the independence needed for effective compliance oversight.

3.2 When will compliance officers be subject to enforcement action by CIRO?6

In a disciplinary hearing, an individual’s conduct will be measured against the standard of a reasonably proficient and diligent individual in that position. This is an objective standard that looks at what the individual ought to have known or done. The individual may present evidence that he or she exercised due diligence to prevent the harm that occurred.

A compliance officer may be subject to enforcement action if she or he:

• violates the Requirements or aids and abets another in such violations
• fails to supervise when she or he has been delegated or has assumed supervisory authority for particular business activities
• fails to identify rule violations, or, if after identifying a violation, fails to sufficiently escalate and follow-up the issue with management as would be expected of a reasonably proficient and diligent compliance officer. What is considered to be sufficient escalation and follow-up will often be fact-specific.

If CIRO is satisfied that the compliance officer has met these regulatory expectations, he or she will not be subject to an enforcement action.

3.3 What policies and procedures are required under Part 3 of Policy 7.1 regarding a risk-based supervision system that identifies and prioritizes areas of greatest regulatory risk?

Participants are expected to establish and maintain a supervision system grounded in a risk-based approach. This system should be structured to identify and prioritize areas that pose the greatest risk of non-compliance with UMIR provisions. While the methodology for conducting and documenting a risk assessment may vary by firm, the rationale must be transparent and support a tiered approach to supervision. Higher-risk areas should be clearly identified along with their related UMIR provisions, and the policies and procedures should demonstrate that these areas are subject to more frequent or enhanced oversight. Medium and lower-risk areas should likewise be identified along with their related UMIR provisions, and the policies and procedures should be appropriate to the assessed risk.

3.4 What policies and procedures are required under Part 10 of Policy 7.1 regarding Audit Trail Requirements?

Under the Requirements, the audit trail of an order should represent the complete life of the order, including a record of all client instructions.7 While not an exhaustive list, the following are examples of information that may be required in the audit trail of an order under Part 10 of Policy 7.1:

• recording of the order type,8 which may contain client instructions regarding the method of execution on the marketplace
• if a stop loss order, the trigger price, and once triggered, whether it will become a market or limit order (if limit order, include limit price)
• if a post only order (including whether it was rejected or cancelled by the marketplace)
• if a long-life order
• if it is entered as a Must Be Filled order
• if it is entered as a market-on-close or limit-on-close order, and if so, the limit price
• if it is a pegged order, and if so, the type of pegged order
• if it is a Net Asset Value order9
• duration of order
  • whether it is a fill or kill order
  • whether it is an immediate or cancel order
  • whether it is a day order
  • whether it is a good-till-cancel (GTC) or good-till-date (GTD) order or good-till-time (GTT) – the limit price and good-till date (if GTD order) or good-till time (if GTT order) should be included
• if it is a dark order, and if so, the type of dark order (e.g. dark midpoint order)
• if it is entered as any other type of order available on a marketplace.

Participants may need to include additional designations as required under Marketplace Rules, which are part of the Requirements. For example, where a Participant purchases securities on behalf of an issuer under a normal course issuer bid (NCIB), the order must include the “NCIB” marker where applicable.

Regarding the short-marking exempt designation required by UMIR 6.2, we remind Participants to review whether an account qualifies for this designation in accordance with CIRO Bulletin GN-URPart6-25-0002.10 Participants must record the results of this review as part of the documentation required under Policy 7.1.

If a Participant enters an order on a marketplace without the appropriate order designation(s) as required under UMIR 6.2, and the order has been executed in whole or in part, the Participant must submit a regulatory marker correction report (RMCS Report) to CIRO.11 Participants should submit these reports immediately upon becoming aware that an order has been “mismarked” on its entry on any marketplace, regardless of how the Participant identified the error.12

A Participant must retain evidence of its review under Part 10 of Policy 7.1 for a period of five years pursuant to Element 9 of Part 2 of Policy 7.1.

3.5 Why is it important to retain order type information as part of the Audit Trail Requirements?

Participants should review whether certain order types are used as part of a manipulative or deceptive strategy. For example, order types similar to the post-only order may be used to “ping”13 or probe for dark liquidity, as part of a broader quote manipulation strategy . A complete audit trail of the order supports effective testing under other parts of UMIR 7.1.

3.6 What policies and procedures are required under Part 3 of Policy 7.1 regarding frontrunning?

Participants must have policies and procedures reasonably designed to ensure that their trading does not violate UMIR 4.1 and Policy 4.1. Where a Participant has knowledge of a client order that on entry, could reasonably be expected to affect the market price of that security, policies and procedures must include a process to review whether the Participant has:

• entered a principal or non-client order on the marketplace in that security or any related security
• solicited an order from any other person in that security or any related security
• informed any other person, other than in the necessary course of business, of the client order.

A Participant’s reviews may focus on the order and trade activity of proprietary and employee accounts trading ahead of client orders, especially client transactions that could reasonably be expected to impact the market. A representative sample of accounts should include:

• proprietary accounts
• non-client accounts that are held internally and outside of the Participant
• any related accounts.

Examples of copies of information that a Participant may need to retain pursuant to Part 2 of Policy 7.1 include:

• trade tickets or electronic audit trail
• account statements
• relevant market data
• exception reports or alerts
• recordings of communications between the client and the Participant and/or between traders at the Participant, etc.

If a Participant believes there may be a violation of UMIR 4.1 or Policy 4.1, the Participant must file a gatekeeper report within the applicable timeframe under UMIR 10.16.

3.7 What policies and procedures are required under Part 4 and Part 11 of Policy 7.1 regarding Client Priority and Order Handling?

Participants must have policies and procedures reasonably designed to ensure that their trading does not violate UMIR 2.1(2)(c), 5.3, 6.3 and 8.1. Policies and procedures should also include a step-by-step process to review for certain elements. The table below outlines these elements for the following situations:

Potential Problem Situations

Participants must also consider addressing potential problem situations when trading opportunities may be taken away from clients. Below are some examples of potential client priority concerns that a Participant may consider including in its policies and procedures:

• Retail brokers or their assistants withholding a client order to take a trading opportunity away from that client.
• Others in a brokerage office inadvertently withholding a client order, taking a trading opportunity away from that client.
• Agency traders withholding a client order to allow others to take a trading opportunity away from that client.
• Proprietary traders using knowledge of a client order to take a trading opportunity away from that client.
• Traders using their personal accounts to take a trading opportunity away from a client.

With respect to client priority, written policies and procedures pertaining to employee education and post-trade monitoring may consider including the following points:

• Education
  • Employees must know the applicable rules and understand their obligation for client priority.
  • Participants must ensure that all employees involved with the order handling process know that client orders must be entered into the market before non-client and proprietary orders, when they are received at the same time.
  • Train employees to handle particular trading situations that arise, such as client orders spread over the day and trading along with client orders.
• Post-Trade Monitoring Procedures
  • Document and follow-up on complaints from clients and Registered Representatives concerning potential violations of the Requirements.
  • Monitor traders’ personal accounts and those related to them, whether held at or outside of the Participant, to ensure no apparent violations of client priority have occurred.
  • Compare a sample of proprietary trades with client orders submitted at the same time.
  • Consider both client orders entered into order management systems and manually handled orders, such as those from institutional clients, when reviewing proprietary trades.
  • Ensure the sample size used for reviews of proprietary trades is representative of the Participant’s overall trading activity.
  • Examine potential problems found during these reviews to determine if an actual violation of UMIR has occurred. The Participant must retain documentation of these potential problems and examinations pursuant to Element 9 of Part 2 of Policy 7.1.
  • Take the necessary steps to correct problems when violations are found. Document corrective actions taken as required under Element 9 of Part 2 of Policy 7.1.

A Participant may conduct a manual review and/or rely on automated exception reports to review trading. The procedures should specify the criteria for manual reviews and the specifications and parameters of any automated exception reports. A risk-based approach should guide the selection of samples for review, taking into consideration the following:

• orders handled by employees of the Participant
• orders for clients who trade through different platforms at the Participant
• orders jitneyed in from another Participant
• orders received from a Dealer Member that is not a Participant.

Under Part 2 of Policy 7.1, a Participant may need to retain copies of information sources such as:

• trade tickets or electronic audit trail
• trading blotters (electronic or hard copy)
• relevant market data
• exception reports or other relevant reports.

3.8 What policies and procedures are required under Part 5 of Policy 7.1 regarding Manipulative and Deceptive Activities and Specific Unacceptable Activities?

Participants, as gatekeepers, must develop, implement and maintain policies and procedures that are reasonably designed to detect, prevent, investigate and report potential manipulative activity under UMIR 2.1, UMIR 2.2, Policy 2.2, Policy 7.1 and UMIR 10.16. A Participant’s policies and procedures must include steps to test for each of the following:

Artificial Price or Misleading Appearance of Trading Activity

Orders or trades that create an artificial price or misleading appearance of trading activity, such as potential high or low closing trades, ramping near the close, and artificial closing bids and offers are contrary to UMIR 2.2(2) and Policy 2.2.

An artificial price is one that is not justified by real demand or supply. In assessing whether a price is artificial, one key factor is whether the Participant or account involved in the order is motivated to establish an artificial price, which may include an attempt to affect the market value of a security.

Procedures should also consider whether the person entering an order is:

• an insider
• an associate of an insider
• part of an associate of a promotional group or other group with an interest in effecting an artificial price, either for banking and margin purposes, for purposes of effecting a distribution of the securities of the issuer or for any other improper purpose.

In the case of high or low closing of the final trade or bid and offer, there is an added complexity when marketplaces have differing hours of operation. As part of a Participant’s efforts to comply with UMIR 7.1, a Participant must determine the level and nature of testing which is appropriate based on the size and type of business conducted by the Participant. One of the relevant considerations in determining whether a price is artificial, is if the Participant, Access Person or account involved in the order has a motivation to establish an artificial price. For example, if the valuation of a particular portfolio is based on the closing sale or bid prices of a particular marketplace”, CIRO would expect that the compliance testing appropriate for that account would be to monitor sales or orders on the marketplace, since orders or trades, as applicable, on that marketplace may be susceptible to artificial pricing. Similarly, if margin requirements are based on the closing sale price on the marketplace that last trades a particular security, CIRO would expect that a Participant would have appropriate compliance testing of last sale prices on the “last marketplace”.

Wash Trades

A wash trade is a trade that involves no change in beneficial or economic ownership. Wash trades are prohibited under Part 1(b) of Policy 2.2.

Participants should regularly monitor for wash trades and consider instances where the same beneficial or economic owner has an interest in, or controls, more than one account or related account that may be held on the same or different platforms at the Participant.

A Participant must take reasonable measures to prevent wash trades from occurring. The Participant should document the methods used to prevent wash trades under Part 2 of Policy 7.1.

While a Participant may make use of marketplace tools, it is still responsible for monitoring and preventing wash trades. Under UMIR 2.2(1), a Participant shall not, directly or indirectly, engage in or participate in any manipulative or deceptive method, act, or practice – including wash trades, which by their nature involve no change in beneficial ownership and are considered a violation. If a wash trade occurs and cannot be cancelled, it must be reported to CIRO in accordance with UMIR 10.16 as a gatekeeper report. Reporting can be done monthly or more frequently if desired.15 Similar to all gatekeeper reports, the act of making a report does not remedy or eliminate the underlying potential violation.

Double Printing

Double printing refers to two trades printed on a marketplace when only one trade was required to execute the order. This activity is prohibited under UMIR 2.2(2)(a). Double printing creates artificial volume and results in inflated trading volume figures for both the firm and the marketplace.16

Orders or trades that abuse the minimum guaranteed fill facility of a person with Marketplace Trading Obligations17

It is contrary to UMIR 2.1(1)(b) to split a larger order into two or more orders on a particular trading day in order to intentionally impose an obligation on the person with a Marketplace Trading Obligation to:

• execute with one or more of the orders, or
• purchase at a higher price or sell at a lower price with one or more of the orders.

Trades that fail to settle

Participants must submit the proper notice to CIRO for trades that fail to settle within ten trading days following the settlement date pursuant to UMIR 7.10 (extended failed trade).

Under UMIR 2.1(1)(a), it is prohibited to enter into a transaction in order to rectify a failure in connection with a failed trade before the reporting deadline under UMIR 7.10, if the person knows or ought reasonably to know that the transaction will result in “re-aging” for the purpose of avoiding reporting obligations.

Where the extended failed trade is the result of:

• principal trading by the Participant, then the Participant must ensure that there is no additional shorting in that particular security without a pre-borrow under UMIR 3.4(1), subject to the exemption in UMIR 3.4(1)(b)
• client trading, then the Participant must ensure that the client will be unable to short without a pre-borrow on any listed security under UMIR 3.4(2) subject to the exemption in UMIR 3.4(2)(b).

Manipulative and Deceptive Activities

Trading strategies known as spoofing, layering, abusive liquidity detection, quote manipulation, and quote stuffing, are examples of activity that would be considered manipulative and deceptive under UMIR 2.2 and Policy 2.2.18 UMIR prohibits these strategies whether they are conducted manually or electronically.

i. Spoofing

Spoofing involves the entering of non-bona fide orders with no intention to be executed and is contrary to UMIR 2.2(2) and Part 2(f) of Policy 2.2. This includes entering non-bona fide orders to check market depth, to check for the presence of an iceberg order, to affect the Calculated Opening Price, or other improper purposes.

ii. Layering

Layering involves placing a bona fide order on one side of the market while simultaneously layering orders on the other side of the market without the intention to trade. The aim of the strategy is to bait other market participants into reacting and trading with the bona fide order at an artificial price. A variation of this strategy is referred to as intraday spoofing.19 Trading strategies such as layering and intraday spoofing are prohibited under UMIR 2.2(2), and Parts 2 and 3 of Policy 2.2.

iii. Abusive Liquidity Detection20

Abusive liquidity detection includes the use of fictitious orders to detect the existence of a buyer or seller with the intention of trading ahead of, rather than with, the buyer or seller, contrary to UMIR 2.2(1) and Policy 2.2.

iv. Quote Manipulation

Quote manipulation involves entering non-bona fide orders on visible markets in an attempt to change the national best bid or national best offer and affect the price calculation at which a trade will occur with a dark order. This results in a trade with the dark order at an improved price, following which orders are removed from the visible market. Quote manipulation is prohibited under UMIR 2.2(1), (2)(b) and Part 2(e) of Policy 2.2.

v. Quote Stuffing

Quote stuffing refers to entering excessive market data messages with the intent to ‘flood’ systems and create ‘information arbitrage’ opportunities, which is contrary to UMIR 2.2(1).

Supervisory functions or the compliance department may rely on automated alerts to detect potentially manipulative or deceptive activity. However, Participants should conduct further post-order or post-trade reviews to determine whether potential manipulative activity may have occurred. Access to historical market data may assist in reviewing whether triggered alerts constitute potential violations of the Requirements.

Participants should regularly review alert parameters to ensure they capture all appropriate activity. In addition, Participants should retain documentation of these reviews for at least five years as part of the requirements under Element 9 of Part 2 of Policy 7.1.

CIRO does not expect Participants to review every triggered alert. However, under Element 8 of Part 2 of Policy 7.1, Participants must document the criteria used to determine when a review is required, in the policies and procedures. If samples are used, the procedures must state how to select a sample, including the sample size. Sample sizes should cover all types of accounts across all lines of the business. Participants should use a risk-based approach when selecting samples and defining the activity to be reviewed. This risk-based approach should consider factors such as the size of the accounts, nature of trading, volume of activity, commissions generated and any pertinent information about account holders. Other considerations include:

• Sampling a higher percentage of orders that were entered directly by clients (e.g. either through direct electronic access or self-directed accounts). The Participant retains supervisory and compliance responsibility for all its orders, irrespective of the source or method of transmission to a marketplace.
• Enhanced supervision of trading for account(s) that have a history of questionable conduct.

The above list is not exhaustive and may not include all forms of potentially manipulative and deceptive activity. CIRO recognizes that trading strategies and forms of potential manipulative and deceptive activity will continue to evolve as market structure and technology change. As part of the annual supervisory system review under Element 7 of Part 2 of Policy 7.1, Participants should ensure that their policies and procedures remain effective and are reasonably designed to prevent and detect new types of manipulative or deceptive behaviour.

If a Participant believes there may be a violation of UMIR 2.1, UMIR 2.2 or Policy 2.2, the Participant must file a gatekeeper report within the applicable timeframe under UMIR 10.16.

3.9 What policies and procedures are required under Part 12 of Policy 7.1 with respect to: the trading of securities on a Grey or Watch List?

Participants should maintain a grey or watch list to have additional oversight over trading in specific targeted securities.

These securities often include issuers of whom the Participant may have inside information,21 referred to as Material Non-Public Information (MNPI). A firm’s corporate finance department may often be in receipt of MNPI. However, MNPI can arise from a variety of sources, and Participants without a corporate finance function are still expected to maintain policies and procedures that ensure the appropriate handling of MNPI and related trading activities.

Dealers are encouraged to recognize that employee trading activity in securities on Grey or Restricted Lists may represent a heightened risk. In addition to the handling of material non-public information (MNPI) and trading during a restricted period, there is also the potential for violations under UMIR 2.2 – Manipulative and Deceptive Activities.

While MNPI may eventually become public, the risk may not necessarily diminish at that point. Certain personnel may still have incentives to engage in trading that could give rise to a false or misleading appearance of market activity, including the use of artificial bid prices, ask prices, or sale prices, which continue to be prohibited under UMIR 2.2.

As part of a risk-based approach to supervision, Dealers should consider allocating resources to monitor trading activity during these periods—not only to once when UMIR 7.7 restrictions commence, but also to detect and prevent potential manipulative or deceptive practices under UMIR 2.2 at any stage where employees may be in possession of MNPI or the Dealer is involved in any type of prospectus distribution, restricted private placement, securities exchange take-over bid or issuer bid, amalgamation, arrangement, capital reorganization or similar transaction.

These considerations should be reflected in the design of supervisory and compliance frameworks governing Grey and Restricted List activity, as part of a multi-pronged oversight strategy that adapts to the elevated risks associated with sensitive information and trading behavior. Trading these securities by proprietary, employee or related accounts may not be subject to trading restrictions, but should be subject to scrutiny.

As part of complying with UMIR 7.1, a Participant should monitor the trading of proprietary and employee accounts, whether held internally or outside the firm.

Enhanced supervision may be appropriate for accounts:

• held by employees that are more likely to come into contact with sensitive information,
• over which employees have control and/or trading authority, or
• held by entities that may be related to employees.

Trading reviews may consider any or all of the following:

• unusual trading patterns
• timing of orders and trades, for example before a public announcement or before the commencement of a restricted period22
• first time purchase or sale of a security
• trade(s) that represent a significant percentage of a portfolio
• use of information sources such as records of communications by employees, or internal access logs that may reveal the identity of users that may have viewed sensitive documents.

Pre-approval of trading helps monitor activity before execution in employee accounts, whether held at the Participant or externally at another firm. Participants should retain evidence of trading pre-approval under Element 9 of Part 2 of Policy 7.1.

A Participant violates UMIR 2.3 if it enters an order on a marketplace that it knows or reasonably ought to know would result in a violation of the Requirements. If the Participant believes there may be a violation of UMIR 2.3, the Participant must file a gatekeeper report within the applicable timeframe under UMIR 10.16.

3.10 What policies and procedures are required under Part 12 of Policy 7.1 with respect to the review of trading in restricted securities?

UMIR 7.7(1) and (2) prohibit certain activity in a “restricted security”23 during the “restricted period.”24 While Participants may use the term “restricted” to describe various trading-related limitations applicable to their personnel, this guidance specifically addresses the requirements set out in Part 12 of UMIR 7.1 and UMIR 7.7, as they pertain to the definitions of “restricted security” and “restricted period” under UMIR 1.1. Participants must have policies and procedures to look for:

• orders for a restricted security during the restricted period from proprietary and employee accounts of the dealer-restricted person, or accounts over which the dealer- restricted person exercises direction or control, that are not permitted under an exemption in UMIR 7.7(4), (7) or (8)
• orders for a restricted security during the restricted period from a dealer-restricted person when acting for an issuer-restricted person, for the account of the issuer- restricted person or an account over which the issuer-restricted person exercises direction or control, that are not permitted under an exemption in UMIR 7.7(5)
• orders and/or trades in the restricted security during the restricted period entered or executed pursuant to an exemption under UMIR 7.7 but that may be manipulative or deceptive
• publication of information, opinions or recommendations on a restricted security during the restricted period that is not permitted under an exemption in UMIR 7.7(6).

If the Participant believes there may be a violation of UMIR 7.7, the Participant may report the potential violation to CIRO.

4. Applicable Rules

UMIR Rules this Guidance Note relates to:

• UMIR 1.1
• UMIR 2.1
• UMIR 2.2
• UMIR 2.3
• UMIR 3.4
• UMIR 4.1
• UMIR 5.3
• UMIR 6.1
• UMIR 6.2
• UMIR 6.3
• UMIR 7.1
• UMIR 7.7
• UMIR 7.10
• UMIR 8.1
• UMIR 10.16

5. Previous Guidance Note(s)

This Guidance repeals and replaces the following Guidance as shown:

• Market Integrity Notice 2003-025 Guidance – Guidelines on Trading Supervision Obligations (November 28, 2003)
• Market Integrity Notice 2006-023 Guidance - Joint Regulatory Notice - The Role Of Compliance And Supervision (November 30, 2006)
• Market Integrity Notice 2007-015 Guidance – Specific Questions related to Trading on Multiple Marketplaces (August 10, 2007)
• IIROC Guidance Note 17-0190 – Guidance – Guidance on Trading Supervision Obligations (September 28, 2017).

6. Related Documents

This Guidance note is related to the following Guidance Notes and Rules Bulletins:

• Guidance Note GN-URPART7-26-0007 – Guidance on Certain Manipulative and Deceptive Trading Practices (March 24, 2026)
• See GN-URPart6-26-0003 – Marker Corrections and the Use of the Regulatory Marker Correction System (February 23, 2026)
• Rules Bulletin 25-0200 – Amendments Respecting Net Asset Value Orders and Intentional Crosses (July 17, 2025)
• Guidance Note GN-URPart6-25-0002 – Updated Guidance on “Short Sale” and “Short-Marking Exempt” Order Designations (August 19, 2025).

• 2“Head of trading” refers to the individual responsible for supervising the trading activities of the Participant in a marketplace, appointed under UMIR 7.1(3).
• 3Board of Directors, or individuals acting in a similar capacity at the Participant
• 4References to “compliance officer” in this Notice include individuals designated as the Chief Compliance Officer under the Investment Dealer and Partially Consolidated (IDPC) Rules.
• 5See GN-1400-21-002 – The Role of Compliance and Supervision (October 14, 2021)
• 6See GN-1400-21-002 – The Role of Compliance and Supervision (October 14, 2021).
• 7Section 11.2 Audit Trail Requirements for Dealers and Inter-Dealer Bond Brokers of NI 23-101 Trading Rules provides the recording requirements for the receipt or origination of an order, including:
  11.2(1)(p) any client instructions or consents respecting the handling or trading of the order, if applicable.
• 8Section 11.2 Audit Trail Requirements for Dealers and Inter-Dealer Bond Brokers of NI 23-101 Trading Rules provides the recording requirements for the receipt or origination of an order, including:
  11.2(1)(i) whether the order is a market order, limit order or other type of order, and if the order is not a market order, the price at which the order is to trade. [emphasis added]
• 9See also UMIR 6.2(1)(b)(xvi), which provides that each order entered on a marketplace shall contain a designation acceptable to the Market Regulator for the marketplace on which the order is entered, if the order is of a type for which the Market Regulator may from time to time require a specific or particular designation.
• 10See GN–URPart6-25-0002 - Guidance on “Short Sale” and “Short-Marking Exempt” Order Designations (August 19, 2025). See also Guidance Note GN-URPART7-26-0007 – UMIR – Guidance Note – Guidance on Certain Manipulative and Deceptive Trading Practices (March 24, 2026).
• 11See GN-URPart6-26-0003 – Marker Corrections and the Use of the Regulatory Marker Correction System (February 23, 2026)
• 12See GN-URPart6-26-0003 – Marker Corrections and the Use of the Regulatory Marker Correction System (February 23, 2026)
• 13A “pinging” order is a tradeable order that can be used to search for and access all types of non-displayed liquidity, including dark pools and dark orders on displayed marketplaces. See Guidance Note GN-URPART7-26-0007 – UMIR – Guidance Note – Guidance on Certain Manipulative and Deceptive Trading Practices (March 24, 2026).
• 14See UMIR 1.1 definition of “better price”.
• 15See IIROC Letter dated 21 April 2014 to Investment Industry Association of Canada.
• 16See GN-URPart2-25-0002 – Guidance on Double Printing (November 5, 2025).
• 17See UMIR 2.1(1)(b)
• 18See Guidance Note GN-URPART7-26-0007 – UMIR – Guidance Note – Guidance on Certain Manipulative and Deceptive Trading Practices (March 24, 2026).
• 19Zhen (Steven) Pang and Oasis World Trading Inc. (14 December 2015), online.
• 20See also Re Zhang 2013 IIROC 35.
• 21Inside Information is defined in OSC Policy 33-601 to mean a material fact or material change with respect to a reporting issuer that has not been generally disclosed.
• 22A “restricted security” is defined in UMIR 1.1 to mean the offered security; or any connected security. See also UMIR 1.1 for definitions of “offered security” and “connected security”.
• 23See UMIR 1.1 definition of “restricted security”.
• 24See UMIR 1.1 definition of “restricted period”.