OSC 2026 Registration and Compliance Report: Key Findings for PMs, IFMs and EMDs

On October 7, 2026, the Ontario Securities Commission (OSC) published Staff Notice 33-762, Registration, Inspections and Examinations Division – 2026 Annual Report, covering the fiscal year ended March 31, 2026.

The report provides an overview of registration activities, compliance examination findings, regulatory initiatives and areas of ongoing concern involving registered firms and individuals.

For Portfolio Managers (PMs), Investment Fund Managers (IFMs) and Exempt Market Dealers (EMDs), the report is particularly useful because it identifies both recurring compliance deficiencies and emerging areas of regulatory scrutiny.

Several themes stand out, including management fee practices, suitability assessments involving leverage and alternative investments, adequate staffing and supervision, artificial intelligence (AI), and whistleblower protections.

The findings provide a useful opportunity for firms to assess whether their compliance programs continue to reflect their actual business activities and regulatory obligations.

1. Management Fees: Disclosure and Actual Charges Must Align

The OSC continues to identify deficiencies involving the management fees charged by Portfolio Managers.

In particular, compliance examinations identified instances where fees charged to clients did not correspond with the fee schedules disclosed in client documentation.

For PMs, fee calculations can become more complex where firms have multiple fee schedules, negotiated arrangements, household billing, minimum fees or different rates applied to particular assets.

The regulatory concern is not limited to whether fees have been disclosed. Firms must also have appropriate controls to ensure that fees are calculated and charged in accordance with the applicable client agreements.

PMs should consider whether:

• Investment Management Agreements and fee schedules accurately reflect current billing practices;

• negotiated fees and exceptions are appropriately documented;

• fee calculations are independently reviewed or periodically tested;

• fees charged by custodians or other service providers on the firm's behalf are subject to appropriate oversight;

• clients receive the required advance written notice of fee changes; and

• billing errors are identified, investigated and corrected.

The OSC specifically reminds firms of the requirement to provide clients with at least 60 days' written notice before changes to applicable account charges.

The compliance system implication: Fee testing should form part of a PM's ongoing compliance monitoring with sample testing, rather than relying solely on automated billing systems.

2. Leverage and Alternative Investments: Suitability Requires Supporting Documentation

The OSC continues to identify concerns involving leverage and concentrations in alternative investments within managed client accounts.

For discretionary PMs, the suitability obligation applies at the portfolio level and requires an assessment of whether investment decisions remain appropriate having regard to the client's circumstances and investment mandate.

The use of leverage or alternative investments may be appropriate for certain clients. However, firms must be able to demonstrate how the associated risks were considered and why the resulting portfolio remains suitable.

PMs should assess whether their documentation adequately supports:

• the client's investment objectives, risk tolerance and risk capacity;

• the suitability of leverage, including the client's ability to absorb potential losses;

• concentration in individual issuers, sectors or investment strategies;

• liquidity needs and the characteristics of alternative investments;

• the overall risk profile of the managed portfolio; and

• ongoing monitoring and reassessment of suitability.

This is particularly relevant where investment strategies involve private securities, derivatives, borrowing or less liquid assets.

A client agreeing to an investment strategy or signing an acknowledgement does not replace the firm's independent obligation to determine suitability.

The compliance system implication: Firms should be able to connect their KYC information, Investment Policy Statements, portfolio construction decisions and ongoing monitoring to a documented suitability process.

3. Staffing and Supervision: Is the Firm Adequately Resourced?

One notable finding relates to the adequacy of registered advising personnel relative to a firm's client base and business activities.

The OSC identified instances where Portfolio Managers did not maintain sufficient advising representatives or associate advising representatives to appropriately service their clients.

In one example, a firm had more than 600 clients per advising representative, raising concerns about whether clients could receive sufficient ongoing attention, including regular KYC updates, portfolio monitoring and suitability reassessments.

There is no universal client-to-adviser ratio that determines whether a firm is adequately staffed. The appropriate number of registered individuals depends on the firm's business model, client relationships, investment strategies and operational arrangements.

However, firms should periodically assess whether their resources remain appropriate as assets under management, client numbers and business activities change.

Considerations include:

• the number and complexity of client relationships;

• the frequency and nature of client communications;

• responsibility for KYC updates and suitability reviews;

• portfolio monitoring and investment decision-making;

• the adequacy of supervisory resources; and

• the effectiveness of administrative and operational support.

For smaller firms, this is particularly relevant where registered individuals have multiple responsibilities, including portfolio management, client servicing, business development and compliance.

The compliance system implication: Growth in clients or assets under management should be accompanied by a reassessment of staffing, supervision and operational capacity.

4. Artificial Intelligence: Governance and Oversight Are Becoming Regulatory Priorities

Artificial intelligence is an emerging area of regulatory attention.

The OSC conducted a survey of registrants regarding their use of AI in November 2025 and commenced further examinations of selected firms in January 2026.

Preliminary findings identified concerns involving:

• inadequate or undocumented policies and procedures governing AI use;

• limited oversight of third-party AI tools; and

• statements in marketing materials concerning AI capabilities or use that could not be substantiated.

For PMs, IFMs and EMDs, AI may be used across a range of business functions, including research, portfolio analytics, marketing, administrative processes and compliance support.

The use of AI does not remove existing obligations relating to supervision, confidentiality, books and records, client protection or misleading communications.

Firms should consider whether they have:

• identified and reviewed or approved the AI tools currently used by employees and service providers;

• established appropriate policies governing permitted and prohibited uses;

• assessed confidentiality, privacy and information-security risks;

• implemented appropriate oversight and required human review of AI-generated outputs;

• considered the risks associated with third-party AI providers; and

• reviewed marketing claims concerning the firm's use of AI.

Even firms that have not formally adopted AI may wish to clarify whether employees are permitted to use publicly available tools in carrying out their responsibilities.

The compliance system implication: AI governance should be proportionate to the firm's operations and risks, but firms should not assume that informal employee use falls outside their compliance responsibilities.

5. Whistleblower Protections: Review Employment and Confidentiality Agreements

The OSC continues to identify concerns with contractual provisions that may discourage or restrict individuals from reporting potential securities law violations.

These provisions may appear in employment agreements, severance arrangements, confidentiality agreements or other contractual documents.

The OSC has emphasized that firms must not impede individuals from reporting potential misconduct to securities regulators, self-regulatory organizations or law enforcement authorities.

For registered firms, this is a reminder that whistleblower protections should be considered alongside broader governance, supervisory and escalation procedures.

Firms should consider reviewing:

• employee confidentiality provisions;

• employment and separation agreements;

• internal complaint and escalation procedures;

• policies addressing regulatory cooperation; and

• employee communications concerning reporting obligations.

Confidentiality obligations should not be drafted or applied in a manner that improperly restricts an individual's ability to report potential securities law violations.

The compliance system implication: Compliance reviews should extend beyond the firm's Policy and Procedures Manual to include relevant employment and contractual documentation.

6. Cybersecurity and Third-Party Oversight Remain Important

Cybersecurity continues to feature prominently in regulatory oversight.

The OSC's annual report highlights the work undertaken through targeted regulatory initiatives, including reviews of cybersecurity controls and emerging technology risks.

This follows the July 2026 publication of CSA Staff Notice 33-322, Review of Registered Firms' Cybersecurity Practices and Additional Guidance, which provided further observations and guidance for registered firms.

For PMs, IFMs and EMDs, cybersecurity should form part of the broader compliance and risk-management framework.

A firm's controls should reflect the nature of its operations, the sensitivity of information it holds and its reliance on third-party service providers.

Areas for consideration include:

• maintaining an inventory of important systems, information assets and service providers;

• assessing cybersecurity risks and implementing proportionate controls;

• managing user access and authentication;

• conducting appropriate employee training;

• maintaining and testing incident-response procedures;

• assessing cybersecurity risks arising from outsourced functions; and

• documenting oversight and remediation activities.

For smaller registered firms, outsourcing technology services does not eliminate the need to understand and oversee the associated risks.

The compliance system implication: Firms should be able to demonstrate that cybersecurity procedures are current, understood and supported by ongoing risk assessment and oversight.

7. Client Reporting: Preparing for Total Cost Reporting

The report also highlights the implementation of Client Relationship Model Phase 3 (CRM3) total cost reporting requirements.

The relevant amendments came into effect on January 1, 2026, with the first annual reports reflecting the new requirements generally expected in 2027 for the calendar year ending December 31, 2026.

For PMs and EMDs, this creates an important operational consideration. Firms should consider whether:

• applicable costs and charges are appropriately captured;

• information required from third parties is available and reliable;

• reporting responsibilities are clearly assigned;

• existing systems and reporting processes can accommodate the new requirements; and

• procedures are in place to review reports for accuracy and completeness.

Where reporting functions are outsourced, firms should understand the role of each service provider and how compliance with applicable obligations will be supported.

The compliance system implication: Firms should not assume that their custodians or service providers have addressed every aspect of the requirements. Responsibility for applicable registrant obligations remains with the registered firm.

8. What Should Firms Review Now?

The OSC's 2026 report reinforces several established regulatory expectations while identifying emerging risks associated with technology and changing business practices.

For CCOs and UDPs, the findings provide a useful starting point for a focused assessment of existing compliance controls.

Firms may wish to consider the following:

• Fees: Confirm that client agreements, disclosed fee schedules and actual billing practices are consistent.

• KYC and suitability: Review the documentation supporting leverage, alternative investments and portfolio concentration decisions.

• Staffing: Assess whether registered advising personnel and supervisory resources remain appropriate for the firm's client base and activities.

• AI: Establish or update policies governing employee use, third-party tools, confidentiality and supervision.

• Whistleblower protections: Review employment and confidentiality provisions for inappropriate restrictions on regulatory reporting.

• Cybersecurity: Confirm that policies, risk assessments, incident-response procedures and third-party oversight remain current.

• Client reporting: Assess readiness for applicable CRM3 reporting requirements.

• Compliance monitoring: Ensure identified deficiencies are documented, addressed and incorporated into ongoing testing and supervision.

These reviews need not involve a complete redesign of the firm's compliance program. In many cases, a targeted assessment of existing policies, documentation and practices may identify opportunities for improvement.

The broader message is consistent with previous OSC guidance: a firm's compliance framework must be appropriately tailored to its business and supported by evidence that its policies and controls are being followed.

How SGD Compliance Can Help

SGD Compliance Consulting supports Portfolio Managers, Investment Fund Managers and Exempt Market Dealers with compliance reviews, regulatory examinations, policy and procedure updates, KYC/KYP and suitability frameworks, registration matters and ongoing compliance support.

A focused review against current regulatory findings can help identify gaps in existing documentation, controls and supervisory practices, and assist firms in addressing them through practical, proportionate improvements.

Source: OSC Staff Notice 33-762 – Registration, Inspections and Examinations Division, 2026 Annual Report (October 7, 2026)

This article is provided for general informational purposes only and does not constitute legal or regulatory advice.