Issue 1August 4, 20267 min read
The record outlasts the arrangement
Quebec representative oversight moved to CIRO on 4 July and took the historical files with it. Plus the three retention clocks, in one table.
Hello,
This is the first issue of the Compliance & AI Dispatch. Every two weeks, I break down what's changing in CIRO, PIPEDA, and Quebec Law 25, and what it means for how you run and document client work. Each issue follows a similar pattern: a short regulatory radar, one deeper look at something you can act on, and a note from the workshop. About five minutes of reading.
Regulatory radar
Four items from June and July, then the three documents that set the baseline underneath them.
Oversight of mutual fund dealer representatives in Quebec moved to CIRO on 4 July, under Quebec's Law 16. Responsibility for scholarship plan dealer representatives moved to the Autorité des marchés financiers on the same date. The deep dive below takes this one further.
CIRO published proposed amendments for comment on 9 July that would let any client-facing Approved Person enter an incorporated advisor arrangement, retain the current employee and agent options, and repeal the directed commission arrangement that mutual fund dealer advisors use today, and that is not available in Alberta. Nothing is in force. If the CSA approves the amendments, implementing them will require changes to securities legislation. The comment period runs 120 days, to 6 November 2026.
CIRO: proposed rule amendments on advisor compensation(external site, opens in a new tab)
On the privacy side, Quebec's Commission d'accès à l'information tabled its 2026 five-year report on 11 June with 74 recommendations, 38 of them on personal information, covering algorithmic inferences, privacy impact assessments, and anonymization. These are recommendations to the legislature, not obligations, so nothing changes in a Quebec-facing practice today. They are the clearest available signal on where Law 25 goes next. The report is in French only.
CAI: publication of the 2026 five-year report(external site, opens in a new tab)
Federally, the Privacy Commissioner accepted WestJet's commitments on 14 July following the 2025 breach that reached more than five million current and former customers and employees. The entry point was social engineering that bypassed multi-factor authentication on an employee account with administrative privileges, and the investigation stays open until the Commissioner is satisfied the commitments are met. The next date to watch is 7 August, when WestJet's summary of its external security assessment is due to the Commissioner.
OPC: news release, 14 July 2026(external site, opens in a new tab)
Three documents set the baseline. CIRO's Compliance Report for 2026, published 17 February 2026, puts AI inside the examination conversation: examiners will now ask about AI use and review the operational controls around it. The full write-up is at northerncatalyst.ca/blog/does-ciro-allow-ai-meeting-notes/. The Client Focused Reforms Phase 2 sweep (CSA Staff Notice 31-368, December 2025) reviewed 105 firms and found widespread documentation deficiencies across know-your-client, know-your-product, suitability, and policies and procedures. CSA Staff Notice 11-348 remains the standing reference on how Canadian securities law applies when firms use AI systems, setting out how existing obligations apply rather than prohibiting use, with explainability and governance at the centre.
Your records outlast the arrangements they were written under
On 4 July, under Quebec's Law 16, oversight of mutual fund dealer representatives in Quebec moved to CIRO. Complaint handling, case assessments, investigations, and disciplinary decisions about representative conduct transferred, and so did files about conduct that occurred before that date.
The last part is the one that matters here. A meeting record written three years ago, under one oversight body, can now be assessed by a different one. No advisor chose that and none could have planned for it.
Most of this list is not in Quebec. It is the deep dive anyway, because it is the clearest recent example of something true everywhere: a record is written once and read later, by whoever is doing the reading then.
The list of things that can change between the writing and the reading is longer than it looks. The oversight body, as here. The compliance officer, who moves on. The dealer, when an advisor changes firms or a firm is acquired. The advisor, at succession or on a leave. The client's memory. In every one of those cases the record is the only part of the meeting still available, and it has to work for a reader who was not there and who cannot ask the person who wrote it.
That is the standard, and it is why "would a reviewer understand this" is a better test than "would my compliance officer understand this." Your compliance officer has context. A reader five years out has the file.
Two practical consequences for a Quebec-registered advisor right now.
If you hold a mutual fund registration and the financial planner title, you now answer to two bodies for two parts of one practice. Representative conduct sits with CIRO, continuing education included. The financial planner title sits with the Chambre de l'assurance, the body formed by merging the Chambre de la sécurité financière and the Chambre de l'assurance de dommages. One client meeting can touch both roles, and one record has to hold up under both readings.
And the historical file is in scope. Records made before 4 July transferred with the function. Do not go back and rewrite anything. Do read a few of the older ones, so you know what they contain before someone else does.
For everyone else the exercise is the same one I keep coming back to. Open a meeting record from two or three years ago, one you have not looked at since. Read it the way a stranger would. If it holds without you in the room to explain it, the system that produced it is doing its job. If it does not, that is worth knowing now, while the fix is a change to a template rather than an answer to a question someone has already asked you.
The three retention clocks
Three retention regimes can reach the same meeting record, and each clock starts on a different date.
| Regime | Retention | Clock starts |
|---|---|---|
| CIRO books and records | 7 years | Date the record is created |
| Quebec confidentiality incident register | 5 years | Date the incident file closes |
| AMF information security incident register | 5 years | Date of the closing report |
Where more than one regime reaches a record, the longest applicable clock decides how long it stays. CIRO's clock runs from the date the record is created, not from account closure: years one and two readily accessible, years three to seven retrievable within a reasonable time. The Quebec register follows the client, so one Quebec-resident client brings that file into scope wherever the firm sits.
Reference material, not legal advice; a firm's obligations turn on its own registrations.
From the workshop
The Documentation Standards Kit went live on 21 July. It sets out what a Canadian client meeting record needs to contain, in one place.
The Meeting Documentation Agent is built and in use. It runs inside the advisor's own Microsoft 365 tenant and is completely contained within that working space. This is a strong data story a confidentiality-restricted market can rely on. The instructions ship in two editions for the same reason. A meeting-note format that has already survived a compliance review should not be replaced by anything else, so one edition carries your own templates instead of my defaults.
There are more agents in the workshop. Each has to pass the test the meeting one passed: a job the advisor already does, inside tools the firm already approved, with a person reading the output before it is closed off in a file. Many ideas fail that, which is why the list stays short.
The Documentation Standards Kit, the standard behind the agents.
Warm regards, Sandy Northern Catalyst