Skip to main content
Registrant Prep
Try the mock examDownload PDF
Registrant Prep

CIRE Cheat Sheet

Updated May 2026 · registrantprep.ca

Free cheat sheet

RSE Suitability Checklist Cheat Sheet

The Retail Securities Exam (RSE) under the CIRO Proficiency Model places heavy weight on suitability, KYC obligations, and account-opening procedures. This sheet covers a KYC trigger event checklist, NI 31-103 requirements by section, the CIRO account-opening and Rule 3402 suitability framework, concentration analysis, risk tolerance vs risk capacity, and pre-trade disclosure requirements. Rule citations are verified as of 2026-09-29 against the CIRO Investment Dealer and Partially Consolidated (IDPC) Rules; check ciro.ca for later amendments.

1. KYC Trigger Events (16-Point Checklist)

Under NI 31-103 §13.2(4) and CIRO Rule 3209(3), a registrant must update KYC information within a reasonable time after learning of a significant change. The following events require a KYC refresh. Memorize all 16.

  1. Significant change in household income (increase or decrease)
  2. Change in number of dependants (birth, adoption, death, dependent leaving household)
  3. Change in investment objectives (shift from growth to income, or income to growth)
  4. Change in risk tolerance stated by the client
  5. Change in risk capacity (ability to absorb losses changes independently of stated tolerance)
  6. Marriage or entry into a common-law partnership
  7. Separation or divorce
  8. Approaching retirement or actual retirement date
  9. Receipt of a significant inheritance or windfall
  10. Diagnosis of a serious illness affecting financial capacity or time horizon
  11. Change in employment status (job loss, promotion, self-employment)
  12. Business sale or purchase materially affecting net worth
  13. Change in investment time horizon (e.g., client reveals a shorter need for funds)
  14. Death of a spouse or primary beneficiary
  15. Change in tax status or residency (moving to a different province or country)
  16. Registrant has reason to believe the client's circumstances have changed materially

Note: the obligation to update KYC is ongoing, not limited to a fixed review schedule. A registrant who becomes aware of a trigger event must act on it even if the client does not initiate the conversation. KYC information must also be reviewed at least every 36 months, or every 12 months for managed and discretionary accounts (IDPC Rule 3209(4); NI 31-103 §13.2(4.1)).

2. NI 31-103 §13.2 - Mandatory KYC Content

The registrant must take reasonable steps to collect the following information before making a suitability determination. Section 13.2(2) also requires establishing whether the client is an insider of a reporting issuer, and the client's creditworthiness if the firm finances the purchase.

KYC elementDetails
IdentityFull legal name, date of birth, address - verified per PCMLTFA rules
Investment objectivesGrowth, income, preservation of capital, or combination; with percentage weightings
Time horizonShort (<3 years), medium (3-10 years), long (>10 years)
Risk toleranceClient's willingness to accept risk; often captured as low/medium/high or on a numeric scale
Risk capacityClient's financial ability to absorb losses; determined by income, assets, liabilities, obligations
Annual incomeTotal gross household income from all sources
Net worthTotal assets minus total liabilities; often split into liquid and non-liquid
Investment knowledgeSelf-assessed: none, limited, fair, good; relevant to product complexity suitability
Other accounts and holdingsAccounts at other institutions to assess total portfolio concentration (account-as-a-whole)

3. IDPC Rule 2554 - Outside Business Activity (OBA) Disclosure

An Approved Person must inform their Dealer Member of any outside activity and get its prior approval before engaging in it (IDPC Rule 2554). The dealer reviews the activity and either approves, prohibits, or imposes conditions on it, then reports it to CIRO under NI 33-109.

What must be disclosed: Any business activity outside the scope of the registrant's duties for the registered dealer, including directorships, officer roles, other employment, consulting engagements, and any activity that could create a conflict of interest or involve securities.

Three-party disclosure structure:

  1. Registered individual discloses the OBA to their employer (the registered dealer)
  2. The registered dealer must be satisfied the OBA does not create a conflict of interest that cannot be managed
  3. Where required, the OBA is disclosed to the client if it creates a material conflict of interest

Exam gotcha: The registrant discloses to the employer first, not to the regulator. The regulator is not the first point of disclosure. Failing to disclose an OBA to the employer is itself a compliance violation.

4. IDPC Rule 3115 - Personal Financial Dealings Prohibitions

Rule 3115 prohibits employees and Approved Persons of a Dealer Member from engaging, directly or indirectly, in personal financial dealings with clients.

Prohibited dealings include:

  1. Borrowing money or securities from a client (except from a lending financial institution in its normal course of business, or from a Related Person under the Income Tax Act with the dealer's prior written approval)
  2. Lending money or securities to a client (except to a Related Person under the Income Tax Act, with the dealer's prior written approval)
  3. Settling a complaint with a client, or paying for client account losses out of personal funds, without the dealer's prior written consent
  4. Accepting any consideration from anyone other than the dealer for activities conducted on behalf of a client (minor, infrequent non-monetary gifts excepted)

Power of attorney: Acting as a client's power of attorney, trustee or executor, or otherwise controlling a client's financial affairs, is a prohibited personal financial dealing unless the client is a Related Person and the dealer approves the arrangement in writing beforehand. Discretionary and managed accounts run under their account agreements are excepted.

5. CIRO Account-Opening Approval Flowchart (Rules 3214, 3247, 3251)

Step-by-step account approval process under the IDPC Rules:

  1. Collect KYC information - all NI 31-103 §13.2 data points gathered before any recommendations made
  2. Determine account type - cash account, margin account, options account, short-selling account. Each type requires progressively higher approval thresholds
  3. Assess client suitability for the account type - options trading requires demonstrated investment knowledge and risk tolerance; margin requires sufficient net worth
  4. Designated Supervisor review and approval - required for every new account, cash accounts included, no later than one business day after the initial trade (Rule 3214); derivatives accounts need the designated Supervisor's approval recorded in writing before the first derivatives trade (Rule 3251)
  5. Specific risk disclosure documents delivered - margin account agreement delivered and signed before the margin account is opened (Rule 3247); derivatives risk disclosure statement delivered and acknowledged before the first derivatives order (Rule 3254)
  6. Client acknowledges receipt of disclosures - signed acknowledgement filed in the account record
  7. Account activated - trading permitted only within the approved account type and suitability profile

Elevated approval requirements:

  • Margin accounts: designated Supervisor approval required; minimum net worth thresholds per firm policy
  • Options Level 1 (covered calls, protective puts; option levels are firm-defined): lower knowledge bar but still requires designated Supervisor sign-off
  • Options Level 2 (spreads): requires demonstrated options knowledge
  • Options Level 3 (naked shorts): highest approval bar; designated Supervisor plus potential compliance sign-off
  • Short selling: must comply with the UMIR short-sale rules

6. CIRO Rule 3402 - Account-as-a-Whole Suitability Framework

Rule 3402 requires that suitability be assessed at the account level (account-as-a-whole), not just at the individual trade level. A single trade may be appropriate in isolation but inappropriate in the context of the client's total holdings.

Triggers for a Rule 3402 account-as-a-whole review:

  1. At account opening
  2. Before any trade recommendation
  3. When a KYC trigger event occurs
  4. When the registrant becomes the account's registered representative (through transfer or internal reassignment)
  5. When securities are transferred or deposited into the account, or a change in a held security could make the account unsuitable
  6. When KYC information is reviewed under Rule 3209(4) (at least every 36 months, or 12 for managed and discretionary accounts)

What a Rule 3402 analysis considers: Concentration by asset class, sector, geography, and single issuer; alignment of holdings with stated investment objectives; overall risk level vs the client's risk profile; liquidity of the portfolio relative to the client's time horizon; cost of the portfolio relative to the client's situation.

7. Concentration Thresholds and Risk Tolerance vs Risk Capacity

Illustrative concentration thresholds (firm policy; CIRO rules set no percentage):

  • Single-issuer concentration above 10% of portfolio warrants documentation and client discussion
  • Single-issuer concentration above 20% of portfolio is considered acute concentration requiring explicit justification in the account file and heightened supervisory review
  • Sector concentration above 30-40% warrants review under most dealer policies (check current dealer manual - thresholds are firm-specific)

Risk tolerance vs risk capacity - the lower governs:

Risk tolerance = the client's willingness to accept volatility and potential loss; subjective and self-reported.

Risk capacity = the client's objective financial ability to absorb a loss without impairing financial goals or living standards; derived from income, net worth, liabilities, time horizon.

When tolerance and capacity differ: the risk profile is the more conservative of the two (CIRO bulletin 26-0200, September 10, 2026). A client who says they can accept high risk (high tolerance) but has low capacity (approaching retirement, limited savings, large liabilities) must be treated as a low-risk client for suitability purposes. Do not coach KYC answers or raise a profile to fit a product.

Exam gotcha: this is tested in scenario form. A client near retirement with a mortgage says they want aggressive growth. The correct action is to probe capacity, explain the mismatch, and document. The registrant should not simply accept the stated tolerance.

8. Pre-Trade Disclosure for Accounts Using Borrowed Funds

IDPC Rule 3217 requires a leverage risk disclosure statement, with the client's positive acknowledgement, when a retail account is opened, before recommending the use of borrowed money, or when the dealer first learns the client intends to borrow to invest. Points to cover with the client:

  1. Borrowing to invest is risky: the client can lose more than the amount invested if the securities decline in value
  2. The interest cost on borrowed funds is incurred regardless of portfolio performance
  3. The dealer can sell securities in the account to cover a margin deficiency, as set out in the margin account agreement
  4. Using borrowed funds magnifies both gains and losses in proportion to the debt-to-equity ratio
  5. The client signs the margin account agreement before the margin account is opened (Rule 3247)

Minimum margin requirements (CIRO): 50% margin on most listed Canadian equities priced at $2.00 or more. Higher margin (60% to 100%) for shares priced below $2.00 (IDPC Rule 5310). Concentrated single-issuer positions may face higher house margin requirements. Note: "margin" here refers to the client's equity in the account as a percentage of the total market value of marginable securities.

Test Yourself: 5 RSE Suitability Questions

Q1. Under IDPC Rule 2554, who is the first party a registrant must disclose an outside business activity to?

Show answer

The registered dealer (employer). The registrant discloses to the firm before engaging in the OBA. The firm then reviews and decides whether to approve, prohibit, or impose conditions. The dealer then reports the activity to CIRO under NI 33-109, and discloses it to clients if it creates a material conflict of interest.

Q2. A client's portfolio has 25% concentrated in a single mining company. What is required?

Show answer

At 25%, the position exceeds a typical 20% firm-policy threshold (CIRO rules set no percentage). Under such a policy the registrant must document explicit justification in the account file and the account requires heightened supervisory review. The registrant should discuss the concentration risk with the client and ensure the KYC file supports this level of concentration.

Q3. A client states a high risk tolerance on their KYC form but is 63 years old, will retire in 2 years, has $200,000 in savings, and a $180,000 mortgage. What effective risk level governs recommendations?

Show answer

Low risk. The client's risk capacity is low: short time horizon, large debt relative to savings, imminent retirement income need. Risk tolerance and capacity are in conflict; the lower (capacity = low) governs. The registrant must document the mismatch and recommend accordingly.

Q4. Under CIRO Rule 3402, when must an account-as-a-whole suitability review be conducted?

Show answer

Before any trade, recommendation or other investment action (Rule 3402(1)), and after any of these events (Rule 3402(2)): securities transferred or deposited into the account; a new rep is designated for the account; a change in the client's KYC information or in a held security that could make the account unsuitable; a KYC review under Rule 3209(4).

Q5. Which account type requires the designated Supervisor's written approval and delivery of a derivatives risk disclosure statement before the first trade?

Show answer

A derivatives (options) account under IDPC Rules 3251 and 3254. The derivatives risk disclosure statement must be delivered and acknowledged before the first derivatives order, and the designated Supervisor's approval must be recorded in writing. Every new account, margin accounts included, also needs designated Supervisor approval (Rule 3214), and a margin account needs a signed margin account agreement (Rule 3247).

Related Cheat Sheets

Last updated: 2026-09-29. NI 31-103 section references confirmed against the current OSC consolidation. CIRO rule references (2554, 3115, 3209, 3214, 3217, 3247, 3251, 3254, 3402, 5310) are to the CIRO Investment Dealer and Partially Consolidated (IDPC) Rules. Verify current CIRO rules at ciro.ca for any post-publication amendments.