IIROC-Regulated Investment Firms Must Now Report Incidents

The Investment Industry Regulatory Organization of Canada (IIROC) has amended its Dealer Member Rules to require mandatory reporting by dealer members (Dealers) in the event of a cybersecurity incident. The amendments are accompanied by guidance on the new requirements.

IIROC expects dealers to issue an initial report within three days of discovery of an incident, and to submit a detailed incident investigation report within 30 days of the incident.

In light of IIROC's mission to protect investors, strengthen market integrity and support healthy Canadian capital markets, the IIROC reporting requirements are broader than the mandatory reporting requirements under the federal Privacy Information Protection and Electronic Documents Act (PIPEDA) and provincial requirements under Alberta's Personal Information Protection Act, which also apply to Dealers.