IIROC Introduces Mandatory Cyber Breach Reporting (January 28, 2020)

The Investment Industry Regulatory Organization of Canada (IIROC) has extended its vigilance over the cybersecurity posture of its Dealer Members by introducing mandatory cyber breach reporting.

On November 14, 2019, IIROC released Rules Notice 19-0194¹ in which it advised that the Canadian Securities Administrators (CSA) had approved changes to IIROC’s Dealer Member Rules and Rule Book. The Notice “requires Dealers to report to IIROC any cybersecurity incidents within three days of discovery of the cybersecurity incident” and "requires Dealers to provide IIROC with an incident investigation report within 30 days of discovery of the cybersecurity incident."

The amendments took effect immediately upon release of the Notice.  A companion Rules Notice Guidance Notice released the same day² provides further details on the amendments, offers guidance as to the circumstances in which reporting will be necessary, and sets out the expected content of reports to be