On November 14, 2019, the Investment Industry Regulatory
Organization of Canada ("IIROC") amended
its Dealer Member Rules (the "Rules") to
require mandatory reporting by dealer members
("Dealers") that suffer a cybersecurity
incident or breach (the "Amendments").
The Amendments are the latest initiative undertaken by IIROC in its
ongoing focus on proactively addressing the cybersecurity risk
exposure of its Dealers. For this reason, IIROC plans to share the
information reported with the Dealer community on an anonymized
basis to allow Dealers to understand the nature of risks they face
and how they can protect themselves and their clients.
IIROC's mandatory reporting requirements are similar to the
requirements of the Office of the Superintendent of Financial
Institutions ("OSFI") which were
introduced earlier this year, and which apply to some Dealers.
