KYC and Suitability Under CIRO Rules: A Plain-English Guide

KYC (Know Your Client) and suitability are among the biggest topics on the CIRE. Element 3 (Scope of client relationship) carries about 17 of the 110 questions, and KYC information collection also appears in Element 2 (11 questions). Only Element 7 (securities and managed products, 21) is heavier.

This guide covers what KYC actually requires, what suitability means under CIRO rules, where the two interact, and the rules that changed in recent years (Client Focused Reforms, trusted contacts and temporary holds).

What KYC actually is

Know Your Client is the obligation to gather and document specific information about a client before opening an account or making a recommendation. It's defined in CIRO IDPC Rule 3202 (and NI 31-103 s.13.2).

Mandatory content (from Rule 3202):

Identity: full name, date of birth, address, ID document
Insider status: whether the client is an insider of a reporting issuer
Investment objectives: capital preservation, income, growth, speculation
Investment knowledge: basic, fair, good, excellent (or equivalent firm-specific scale)
Risk profile: both risk tolerance (willingness) and risk capacity (ability)
Time horizon
Income and net worth (with source-of-wealth questions)
Other accounts the client holds
Personal circumstances: dependants, employment, marital status

It's not optional. The firm must collect enough information to meet its suitability obligations under Rule 3400. (If the client refuses, you document the refusal and may not be able to make recommendations until the gap is filled.)

Risk tolerance vs. risk capacity

The CIRE tests this distinction relentlessly.

Risk tolerance is the client's willingness to accept losses. Behavioral. Subjective.
Risk capacity is the client's ability to absorb losses without derailing financial goals. Mathematical. Objective.

A 30-year-old earning $200,000 with $50,000 saved has high risk capacity (long horizon, surplus income). They might still have low risk tolerance because they panic during drawdowns. The risk profile should reflect the more conservative of the two. CIRO repeated this in Bulletin 26-0200 (September 10, 2026), which also says to assess and document tolerance and capacity separately.

A retired client living on portfolio income has low risk capacity even if they say they're willing to take risk. Recommendation must respect the lower number.

Some firms also assess risk need: the level of return required to meet stated objectives. If risk need exceeds capacity, the conversation isn't "let's increase the allocation to equities." It's "let's revisit objectives."

The suitability obligation

Suitability is also defined in Rule 3402. The advisor has to:

Have a reasonable basis to believe each recommendation is suitable based on the client's KYC
Put the client's interest first: this is the Client Focused Reforms standard, effective Dec 31, 2021
Keep documentation of the suitability assessment

Suitability assessments must be done:

Before opening the account (account appropriateness, Rule 3211)
Before each recommendation or investment action
When securities are deposited or transferred in, or a new representative takes over the account
After a change in the client's information that could make the account unsuitable
After a change in a security in the account that could make it unsuitable
When KYC is reviewed: at least every 12 months for managed and discretionary accounts, and every 36 months otherwise

A common CIRE trap: candidates think suitability is only required at recommendation. It's actually triggered by multiple events, including some passive ones (the scheduled KYC review).

KYP: Know Your Product

Separate but related obligation under NI 31-103 13.2.1. KYP requires:

At the firm level: the firm vets every product on its shelf. Approved-product list.
At the individual rep level: the rep understands every product they recommend.

You can't recommend a product just because it's on the firm's shelf. You also can't recommend a product the firm hasn't approved. Both legs of the obligation are independent.

CFRs: Client Focused Reforms

Most CFR amendments took effect December 31, 2021; the conflict-of-interest rules came first, on June 30, 2021. They changed three things:

Conflicts of interest must now be addressed in the client's best interest, with disclosure of remaining conflicts in language the client can understand. (NI 31-103 13.4)
KYC content expanded to require risk profile, investment knowledge, and personal circumstances at the level of detail above. The old "low/medium/high risk tolerance" wasn't enough.
Suitability language strengthened from "suitable" to "puts the client's interest first."

CFRs show up on the exam as both standalone questions and as the framework underneath suitability questions.

Vulnerable clients (trusted contacts and temporary holds)

These rules are in NI 31-103 (s.13.2.01 and s.13.19) and CIRO's IDPC Rules (3202(4) and 3222). Joint CSA/CIRO Staff Notice 31-368 (December 10, 2025) is a different document: it reports on firms' KYC, KYP and suitability practices.

The rules define a vulnerable client as one "who might have an illness, impairment, disability or aging-process limitation that places the client at risk of financial exploitation."

The rules require:

Trusted Contact Persons (TCPs): when collecting KYC information, the firm must take reasonable steps to get the name and contact details of a trusted contact person, and the client's written consent to contact them about suspected financial exploitation, concerns about mental capacity, the client's legal representative, or the client's contact information. The TCP cannot authorize transactions.
Temporary holds: a firm may place a temporary hold only if it reasonably believes a vulnerable client is being financially exploited, or that the client lacks the mental capacity to make financial decisions. It must document its reasons, notify the client as soon as possible, and within 30 days (and every 30 days after) either revoke the hold or tell the client why it continues.
Documentation requirements: every TCP designation, every temporary hold, every concern about vulnerability must be documented contemporaneously.

The CIRE syllabus names trusted contact persons; the Retail Securities Exam syllabus adds the conditions for temporary holds. Know the boundaries: TCPs can't trade, and holds need notice and a review at least every 30 days.

Material changes: when KYC must be refreshed

KYC is not static. It must be refreshed when:

The client tells you something has changed (job loss, divorce, inheritance, retirement)
A scheduled review reveals changes (at least every 36 months, or every 12 months for managed and discretionary accounts)
A significant deposit or withdrawal that doesn't fit the documented profile
Major life events the firm becomes aware of through other channels

The CIRE expects you to know that the client doesn't have to tell you for the obligation to trigger: if you become aware through any reasonable means, you act.

Common CIRE traps on this material

Confusing KYC with KYP. KYC is about the client; KYP is about the product. They have separate rules and separate documentation.
Thinking suitability only triggers at recommendation. It triggers at multiple events including annual review of managed accounts.
Assuming risk tolerance and capacity are interchangeable. They aren't. Recommendation respects the lower of the two.
Missing the CFR "client's interest first" language. Older textbook content used "suitable": current rule requires more.
Forgetting that TCPs can't transact. TCPs are an emergency-contact role only.
Confusing temporary holds with regulatory holds. Temporary holds under IDPC Rule 3222 and NI 31-103 s.13.19 are firm-initiated. Regulatory holds (e.g., from CIRO) are different.

How this gets tested

Expect about 17 E3 questions (Scope of client relationship) on your CIRE sitting. KYC information collection also sits in E2 (Prospective client relationships, 11 questions), so a large share of the exam turns on this material.

Expect both recall and scenarios. The syllabus has Remember outcomes (for example, the retail client information to be collected) and Understand outcomes that lend themselves to scenarios: "Your client tells you X: what's your obligation?"

How to study this

Read IDPC Rules 3202 and 3402 and NI 31-103 Part 13. Both free.
Read CIRO Bulletin 26-0200 (September 2026) on risk capacity, risk tolerance and risk profile, and skim Joint CSA/CIRO Staff Notice 31-368 (38 pages) for how regulators review KYC and suitability files.
Drill 60–80 practice questions on E2 and E3. Registrant Prep's E3 practice set is the obvious place.
Flashcard the boundaries: TCPs can / can't, temporary hold conditions, CFR effective dates, the six KYC information categories in Rule 3202.

Test where you stand. Take the free CIRE diagnostic: element-by-element score in 25 minutes.