What does CIRO’s 2026 enforcement report mean for compliance teams?

Canadian Investment Regulatory Organization (CIRO) recently published its Enforcement Report for fiscal year 2026, offering compliance and surveillance leaders across Canada and the U.S. a detailed overview of where regulatory risk is concentrating. The overarching message is split between how individual case volume fell for a third straight year, while firm-level fines hit a three-year high. Four risk areas stood out across the case list, with implications for how regulated firms approach supervision and recordkeeping.

Off the record(s): Where off-channel communications fit in

Unlike the Financial Industry Regulatory Authority (FINRA) or the Financial Conduct Authority (FCA), CIRO’s Report does not single out off-channel communications as a standalone enforcement category, a notable omission given how prominently this issue has featured in enforcement reporting elsewhere. The underlying risk, however, is present without the label. Firms have been fined for off-channel communications, as well as for failing to prevent, detect, or investigate Approved Persons using e-signature platforms to sign client names. CIRO also called out matters where firms had conducted unreliable client account overviews which were sent from personal email accounts, and failed to properly supervise associates who had access to both business and personal accounts.

The pattern across these cases suggests that any communication channel operating outside firm-sanctioned oversight, whether an e-signature platform or a personal inbox, creates the same supervisory blind spot. This reinforces the case for comprehensive capture and surveillance across all channels, not only those explicitly named in regulatory guidance.

Documentation failures

The Report’s individual cases detail volume rather than severity. Most individual cases in 2026 involved paperwork and process failures rather than headline fraud, where pre-signed forms, improper account documentation, and similar procedural gaps were prominent issues. Pre-signed forms accounted for six separate cases, and proper execution of client account documents came up in roughly eleven more. Inadequate books and records also appeared at the firm level.

Fines for this category typically fell in the $10,000 to $20,000 range, modest compared to the multi-million-dollar cases referenced elsewhere in the Report. That contrast is instructive: this is not the category with the largest individual price tag, but it is the area where things most frequently go wrong – or perhaps are easiest to spot. Firms were sanctioned for this, plus costs and conditions for inadequate records, underscoring the recordkeeping obligations that sit at the center of firms’ compliance infrastructure. CIRO has framed its case selection around the effectiveness of supervision and internal controls, treating recordkeeping gaps as a supervisory issue rather than a simple filing error.

Conduct unbecoming: Non-financial misconduct enforcement climbs

Personal conduct violations nearly tripled year over year. Personal financial dealings cases rose to nine, up from three in 2025, while outside activities and standards of conduct each generated an additional case. A particularly significant example listed by CIRO saw a ten-year suspension, a $75,000 fine, and $50,000 in costs for personal financial dealings and conduct that “harmed the reputation of the securities industry”.

Notably, for a North American audience without a direct FCA-style “bullying and harassment” category outlined, CIRO’s enforcement focus here remains on financial dealings, outside business activity, and standards of conduct, rather than workplace culture misconduct specifically. This marks a real distinction from UK-style non-financial misconduct rules, and a gap that the regulator may look to monitor more closely in future reporting cycles rather than assuming it is already addressed.

Large fines, concentrated impact: AML, fraud, and gatekeeper failures

CIRO hearing panels imposed more than $15 million in sanctions in 2026, continuing to prioritize disgorgement as a means of removing any incentive for individuals or firms to remain non-compliant.

Gatekeeper failures tied to higher-risk OTC securities also drove significant sanctions. Many firms were fined hundreds of thousands in fines for instances such as, failing to question suspicious trading patterns in accounts later linked to an Securities and Exchange Commission (SEC) enforcement matter. CIRO’s Trading Review and Analysis team referred 86 market-related cases to the Canadian Securities Administrators (CSA in 2026, spanning manipulation, insider trading, and other securities-law violations.

Fewer cases, bigger firm fines: CIRO is doing more with less

Individual enforcement decisions have declined for three consecutive years, from 65 in 2024 to just 39 in 2026, all alongside a corresponding drop in permanent bars and suspensions. Firm-side sanctions have moved in the opposite direction, where total firm sanctions rose to $8.69 million in 2026, from $5.81 million in 2024. This has marked the highest total in the three years, despite only nine firm-level decisions.

Complaint volumes also surged, to 6,692 from 4,127 the prior year, though CIRO attributes most of the increase to a reporting-system change rather than a genuine rise in misconduct. The percentage of investigations referred to prosecution declined over the same period, from 38% in 2024 to 31% in 2026.

What it means for CIRO and regulated firms

CIRO has indicated that enforcement will continue to prioritize cases involving serious misconduct and the greatest potential harm to investors and markets, suggesting smaller, procedural cases may see continued de-prioritization.

Further to this, Ontario granted CIRO new powers to collect and preserve evidence, along with statutory immunity, effective across every Canadian province and territory as of June 2025.

A new Document Production Guide for enforcement submissions has also been published, as well as the Rule Consolidation Project, which will merge investment-dealer and mutual-fund-dealer rules into a single member-regulation rulebook.

CIRO’s Enforcement Report for 2026 provides 5 key takeaways for regulated firms:

1. Documentation workflows remain the highest-frequency risk. Client account documentation and pre-signed form errors were the most common individual violation type in 2026, a high-volume, low-severity risk that is comparably cheaper to remediate than the fines it can generate
2. Off-channel risk exists without a labeled rule. CIRO does not yet have off-channel communications listed as a distinct enforcement category in the way FINRA or the FCA do, but e-signature and personal-email failures point to the same underlying supervisory gap.
3. Personal financial dealings represent a rising-risk category. Cases in this area nearly tripled year-on-year, pointing to a need for firms to revisit policies on client borrowing, outside business activity, and personal accounts held jointly with clients.
4. Gatekeeper obligations are increasingly tested against OTC and higher-risk securities. Multiple 2026 cases centered on failures to question suspicious account activity tied to low-priced OTC securities, suggesting firms should revisit due diligence triggers for accounts showing atypical trading patterns.
5. Enforcement patterns matter as much as the number of cases. Fewer individual cases alongside record firm-level sanctions suggests CIRO is concentrating resources on firm-level supervisory failures.

Where Global Relay fits in

The patterns running through CIRO’s 2026 Report, such as recordkeeping gaps treated as supervisory failures, off-channel risk emerging without a named category, and gatekeeper obligations tested against higher-risk securities, point to a common theme: comprehensive capture and surveillance across every communication and trading channel are necessary, not just the ones explicitly named in regulatory guidance.

Global Relay provides a platform built to close exactly this kind of gap, it gives your firm a single, defensible record across email, e-signature platforms, trading activity, and beyond, before a documentation or supervision gap becomes a large financial penalty.