CSA Staff Notice 31-358 Guidance on Registration Requirements for Chief Compliance Officers

CSA Staff Notice 31-358
Guidance on Registration Requirements for Chief Compliance Officers and Request for Comments July 2, 2020 Introduction As part of our ongoing commitment to reduce regulatory burden, staff of the Canadian Securities Administrators (CSA) (staff or we) are providing this notice (the Notice) to set out guidance regarding the registration requirements for chief compliance officers (CCOs) under Regulation 31-103 respecting Registration Requirements, Exemptions and Ongoing Registrant Obligations (Regulation 31-103) for certain CCO models. Executive Summary In this Notice, staff provide guidance on the following CCO models:

1. an individual applying to be the CCO for more than one firm (the shared CCO model);
2. a firm applying to have multiple CCOs, each responsible for one or more business lines
   and/or different registration categories within the firm (the multiple CCO model); and
3. an individual applying to be the CCO of a non-traditional or specialized firm, such as a
   fintech firm, where industry-specific experience may be considered as relevant experience for the purposes of assessing the individual’s proficiency (the specialized CCO model). Registrants are invited to provide comments on how each of these models addresses their needs and how they may use these models in their operations. Any such comments, as well as anything firms tell us about their experience with adopting the above models, will assist us in assessing whether additional policy initiatives should be considered in the future. Substance and Purpose Our aim is to allow registrants to implement their CCO responsibilities in a manner that better aligns with their operational needs and business models. In particular, we expect that:

• the use of a shared CCO in appropriate circumstances may benefit smaller firms, because
  it may be easier or more cost effective to maintain an effective compliance system;
• larger firms may benefit from implementing a multiple CCO model, where they have
  distinct business lines or registration categories; and
• firms with less traditional or more specialized businesses will benefit from guidance
  concerning the assessment of a CCO’s proficiency for individuals with industry-specific experiences that may be relevant for that firm.

All applications for registration or exemptive relief will be reviewed by staff on a case-by-case basis. We invite registrants to reach out to CSA registration staff if they:

• would like to discuss how any of these models might be relevant to them,
• wish to combine two or more of the models above with respect to one firm, or
• identify other related models, as similar considerations may apply.
  The CSA consulted with staff of the Investment Industry Regulatory Organization of Canada (IIROC) and the Mutual Fund Dealers Association of Canada (MFDA) (together referred to as the self-regulatory organizations or the SROs) to develop this Notice. For members of the SROs, CSA and SRO staff will consult with one another on issues relevant to the member and the member’s application to achieve a coordinated approach. CCO Responsibilities and Requirements Every registered firm is responsible for having a system of controls and supervision that enables it to comply with securities law and manage the risks associated with its business. In order to maintain an effective compliance system, a firm must designate as the CCO an individual who meets the proficiency, experience and other requirements set out in Regulation 31-103, and is an officer, partner or sole proprietor of the registered firm(s). This Notice should be read in conjunction with section 5.2 of the Policy Statement to Regulation 31-103 respecting Registration Requirements, Exemptions and Ongoing Registrant Obligations (Policy Statement 31-103), which provides guidance regarding both the shared CCO model and multiple CCO model. Staff are open to considering applications for both models. This Notice provides information on the factors we will consider when reviewing any such application. Shared CCO Model Under this model, an individual can act as the CCO for more than one firm. Currently, some affiliated firms have been approved to use a shared CCO model. We are open to the possibility of unaffiliated firms using a shared CCO model as well. Many registered firms are large enough to need a full-time CCO in order to operate an effective compliance system. However, for some smaller firms, a shared CCO may suffice. The shared CCO model may also allow firms with only one individual to separate the role and function of the CCO from that of the UDP and sole director. In reviewing an application by a firm to designate as CCO an individual who holds that position with another firm, staff will consider the following factors:
• Proficiency: The shared CCO must be able to demonstrate they have the proficiency to
  act as CCO for each firm’s business. Typically, before an individual could be approved as a CCO in a shared model, the individual would have to have had prior experience as a CCO. Staff will take into account the CCO’s effectiveness, as evidenced by, among

other things, the outcomes of compliance reviews of firms where the individual was registered as CCO.

• Conflicts of Interest: The shared CCO, and the firms sponsoring such applicant, must
  be able to identify, and appropriately respond to, the existing or potential conflicts of interest resulting from the shared CCO model.
• Confidentiality: The shared CCO, and the firms sponsoring such applicant, must be able
  to demonstrate that they will be able to continue to meet their obligations to protect the confidential information of clients.
• Capacity: The shared CCO must be able to demonstrate their capacity to act as a CCO
  for more than one registered firm. Staff will consider, for example, the individual’s commitments at all registered firms as well as other commitments (such as their outside business activities) as part of this analysis.
• Effective Compliance System: Firms that make use of a shared CCO must continue to
  comply with their obligation under section 11.1 of Regulation 31-103 to maintain an effective compliance system. Staff may ask a variety of questions of the CCO and/or the sponsoring firms as part of the registration process. Examples of these questions are contained in Appendix A of this Notice. Firms applying to register a shared CCO should consider providing the responses to these questions at the same time they file the application. In addition, in the same way that staff currently recommend terms and conditions to novel business structures, and depending on the facts of a specific shared CCO model, we may recommend that tailored terms and conditions be applied to the registration of the CCO and/or one or more of the CCO’s sponsoring firms. Where a shared CCO has been approved but subsequently staff have concerns that the compliance system at a firm with a shared CCO is inadequate or that the shared CCO may no longer be suitable for registration, we may recommend actions that impact all of the firms that sponsor the shared CCO. This model does not contemplate a registered firm outsourcing its CCO’s responsibilities to a third-party service provider. An individual acting as CCO of a registered firm must still be an officer,1 partner or sole proprietor of the registered firm, and a firm may choose to structure its affairs such that the CCO is either an employee or independent contractor of the firm. A registered firm is prohibited by section 4.1 of Regulation 31-103 from permitting an individual to act as a dealing, advising or associate advising representative at that firm if the individual acts as a partner, officer or director of another registered firm. Although firms proposing a shared CCO model could seek exemptive relief from this requirement,2 the firms must explain how they would be able to adequately address the factors set out in this Notice if the proposed shared CCO 1 Note that we may request evidence from the firm that the officer has been duly appointed. 2 The exemptive relief application would be a separate application which would be reviewed in conjunction with the application to register the shared CCO.

was also registered as a dealing, advising or associate advising representative for one or both registered firms. An individual acting as CCO for more than one firm must have the ability to establish and maintain policies and procedures for the firm, and to monitor and assess compliance by the firm and individuals acting on its behalf as required in section 5.2 of Regulation 31-103. At the firm’s discretion, the CCO may also have the ability to take action to resolve compliance issues. CCOs considering participating in a shared CCO model should do their own due diligence before proceeding with such a model. For instance, they should assess:

• their capacity to act as CCO for more than one firm, both currently and as the firms’
  businesses grow and expand;
• how each firms’ support and governance structure will ensure that the CCO can comply
  with the requirements in Regulation 31-103; and
• the legal implications of acting as an officer for each sponsoring firm under securities,
  corporate and other law.
  Multiple CCO Model
  Under this model, and with the necessary exemptive relief to permit it, a firm can designate multiple CCOs with each CCO responsible for one or more registration categories and/or business lines within the firm.3 For example, a firm that is registered as an investment fund manager, portfolio manager and exempt market dealer may apply to have three CCOs, one for each of the firm’s three registration categories. Note that Policy Statement 31-103 provides additional general guidance. Any firm may apply for exemptive relief in order to operate with a multiple CCO model, and as
  part of the application, they must be able to demonstrate that this model is appropriate for their
  compliance system. To obtain the necessary relief, a firm must demonstrate that each CCO has their own separate responsibilities and that no CCO delegates or transfers to another CCO their responsibilities under section 5.2 of Regulation 31-103. Therefore, it is important that there be sufficiently clear lines between the firm’s activities to allow for this model. Some CSA jurisdictions have previously granted exemptive relief to allow certain firms to have multiple CCOs in similar contexts, such as multiple CCOs for different operating divisions within a large firm. Firms may wish to review such previous decisions to guide their applications for exemptive relief under this model. In considering whether the necessary relief should be granted, staff may ask a variety of questions, a non-exhaustive list of which is included at Appendix B of this Notice. 3 Section 11.3 of Regulation 31-103 requires the firm to designate “an individual” to act as the firm’s CCO. Therefore, a firm needs to apply for exemptive relief from this section in order to designate more than one individual as a CCO.

Specialized CCO Model
Under this model, where an individual applies to be the CCO of a non-traditional or specialized firm, staff may consider the individual’s business experience when assessing proficiency and experience requirements.4 The experience demonstrated by the individual being considered for the CCO position should be relevant for both the category of registration and the business of the firm sponsoring the individual. Other business experience may be considered relevant for the purposes of assessing whether the individual meets the experience requirements set out for a CCO in Regulation 31- 103 when a firm applying for registration demonstrates that it is engaged in a non-traditional or specialized business. Relevant business experience may include the following:

• experience developing products or services where the firm exclusively operates an online
  platform for innovative products or services;
• experience from a related investment field, such as experience with underwriting or credit
  adjudication while working at a financial institution or investment bank, where the firm operates an online lending business. As experience and business models can vary greatly among firms and individuals, CSA staff will assess other business experience based on the particular circumstances of the proposed CCO and the firm. For certain categories of registration, there is a requirement that the individual being considered for the CCO position must demonstrate that they provided professional services to and/or worked at a registered firm as set out in the proficiency requirements in Part 3 of Regulation 31-103. If the applicant does not have that work experience, they will need to apply for exemptive relief from these experience requirements. Any firm that believes it requires exemptive relief for its CCO or is unsure is encouraged to discuss its specific situation with CSA registration staff. An individual may be considered proficient to be the CCO under the specialized CCO model but may not be considered proficient to be the CCO of a registered firm with a different business model. In these cases, CSA staff may recommend terms and conditions on the CCO’s registration to this effect. Next Steps Staff believe this Notice will enhance competitiveness for registrants and better serve investors by making it easier for registrants to fulfill their CCO responsibilities in a manner that aligns 4 Part 3 of Regulation 31-103 sets out the minimum amount of specific experience CCOs of all categories of registered firms must have in order to be considered proficient to take on this role.

with their operational needs and business models while continuing to meet their obligations under Regulation 31-103. Registrants should reach out to the CSA registration staff with any questions they may have about CCO models and how they may apply to their business models. We welcome comments as we work with registrants to operationalize the three models addressed in this Notice. Staff are interested in receiving feedback on registrants’ use of the three models. We ask that all comments be provided by e-mail to 31-358@acvm-csa.ca on or before September 30, 2020. We cannot keep submissions confidential because securities legislation in certain provinces requires publication of the written comments received. All comments received will be posted on the websites of each of the Alberta Securities Commission at www.albertasecurities.com, the Autorité des marchés financiers at www.lautorite.qc.ca and the Ontario Securities Commission at www.osc.gov.on.ca. Therefore, you should not include personal information directly in comments to be published. It is important that you state on whose behalf you are making the submission. Questions Please refer your questions and comments on this Notice to the following:
Sylvie Demers
Coordonnatrice à l’inscription
Direction de la certification et de l’inscription Autorité des marchés financiers 418 525-0337, poste 2765 sylvie.demers@lautorite.qc.ca Isaac Filate Senior Legal Counsel, Capital Markets Regulation British Columbia Securities Commission 604 899-6573 ifilate@bcsc.bc.ca Charmaine Coutinho Legal Counsel, Market Regulation Alberta Securities Commission 403 592-4898 Charmaine.Coutinho@asc.ca Liz Kutarna Deputy Director, Capital Markets Securities Division Financial and Consumer Affairs Authority of Saskatchewan 306 787-5871 liz.kutarna@gov.sk.ca

Sarah Hill
Legal Counsel
Manitoba Securities Commission
204 945-0605 sarah.hill@gov.mb.ca
Adam Braun
Legal Counsel, Compliance and Registrant Regulation Ontario Securities Commission 416 593-2348 abraun@osc.gov.on.ca Clayton Mitchell Senior Securities Officer Financial and Consumer Services Commission (New Brunswick) 506 658-5476 clayton.mitchell@fcnb.ca Brian Murphy Manager, Registration Nova Scotia Securities Commission 902 424-4592 Brian.Murphy@novascotia.ca Steven Dowling Acting Director Government of Prince Edward Island, Superintendent of Securities 902 368-4551 sddowling@gov.pe.ca Renée Dyer Superintendent of Securities Office of the Superintendent of Securities, Service NL 709 729-4909 ReneeDyer@gov.nl.ca Jeff Mason Superintendent of Securities Department of Justice, Government of Nunavut 867 975-6591 jmason@gov.nu.ca

Jeremy Walsh
Policy Officer, Legal Registries
Office of the Superintendent of Securities, Northwest Territories 867 767-9260 ext. 82205 Jeremy_Walsh@gov.nt.ca Rhonda Horte Securities Officer, Deputy Superintendent of Securities Office of the Yukon Superintendent of Securities 867 667-5466 Rhonda.Horte@gov.yk.ca

Appendix A
Sample questions for shared CCO applications
Proficiency

• Please describe the education, training and experience of the CCO and how it is relevant
  for each of the registered firms’ specific businesses.
  Conflicts of Interest

• Do any conflicts of interest result from this model? If so, how do the firms and the CCO
  propose to respond to them?

• Please describe how the sponsoring firms have taken the necessary steps to ensure the
  success of the model, such as having an agreement in place to address conflicts of interest that may arise. Confidentiality

• Please confirm that there are adequate controls in place to protect confidential personal
  information of clients that the CCO may receive at each firm. What are these controls and how are they adequate? Capacity

• Does the CCO have adequate time to work for multiple registered firms simultaneously?

• Please describe how each firm has determined that it does not require a dedicated CCO to
  have an effective compliance system. Have the firms and shared CCO considered such factors as the firm’s scale, complexity and compliance history? How will they monitor this going forward?

• How will the shared CCO prioritize their time if a situation arises that requires that they
  devote more time than anticipated to one or both firms?
  Effective Compliance System

• How will strong communication and relationships be established between the CCO and
  the registered firms, such that the CCO is empowered to establish and maintain policies and procedures for assessing compliance, to monitor and assess compliance, to report non-compliance to the UDP and to meet with the firms’ board of directors (or equivalent) at any time they deem necessary? Is the CCO’s compensation model at each firm aligned with this?

• How will the CCO have sufficient access to the registered firms’ books, records and
  information to assess and, if necessary, improve the firm’s compliance policies and procedures?

• How will the CCO customize policy and procedure manuals, checklists and/or forms to
  implement compliance at the registered firms to reflect each firm’s business model, practices, strategies and compliance risks?

Appendix B
Sample questions for multiple CCO applications

• Please provide a description of the business lines that require their own CCO and how
  their operations are independent from one another.
• Please explain how each division operates functionally as a stand-alone entity, with its
  own compliance group and/or autonomy.
• Please explain how each CCO will have direct access to the UDP and the board of
  directors.
• Please describe how each of the CCOs meets the proficiency requirement to act in the
  role.
• Please describe how each CCO will meet their obligation to provide an annual report to
  the firm’s board of directors as required by subsection 5.2(d) of Regulation 31-103.
• Will the multiple CCOs have regular meetings with one another to discuss overall
  governance of the firm, key initiatives and regulatory matters that may impact each line of business?