Free cheat sheet
RSE Suitability Checklist Cheat Sheet
The Retail Securities Exam (RSE) under the CIRO Proficiency Model places heavy weight on suitability, KYC obligations, and account-opening procedures. This sheet covers a KYC trigger event checklist, NI 31-103 requirements by section, the CIRO account-opening and Rule 3402 suitability framework, concentration analysis, risk tolerance vs risk capacity, and pre-trade disclosure requirements. Rule citations are verified as of 2026-09-29 against the CIRO Investment Dealer and Partially Consolidated (IDPC) Rules; check ciro.ca for later amendments.
1. KYC Trigger Events (16-Point Checklist)
Under NI 31-103 §13.2(4) and CIRO Rule 3209(3), a registrant must update KYC information within a reasonable time after learning of a significant change. The following events require a KYC refresh. Memorize all 16.
- Significant change in household income (increase or decrease)
- Change in number of dependants (birth, adoption, death, dependent leaving household)
- Change in investment objectives (shift from growth to income, or income to growth)
- Change in risk tolerance stated by the client
- Change in risk capacity (ability to absorb losses changes independently of stated tolerance)
- Marriage or entry into a common-law partnership
- Separation or divorce
- Approaching retirement or actual retirement date
- Receipt of a significant inheritance or windfall
- Diagnosis of a serious illness affecting financial capacity or time horizon
- Change in employment status (job loss, promotion, self-employment)
- Business sale or purchase materially affecting net worth
- Change in investment time horizon (e.g., client reveals a shorter need for funds)
- Death of a spouse or primary beneficiary
- Change in tax status or residency (moving to a different province or country)
- Registrant has reason to believe the client's circumstances have changed materially
Note: the obligation to update KYC is ongoing, not limited to a fixed review schedule. A registrant who becomes aware of a trigger event must act on it even if the client does not initiate the conversation. KYC information must also be reviewed at least every 36 months, or every 12 months for managed and discretionary accounts (IDPC Rule 3209(4); NI 31-103 §13.2(4.1)).
2. NI 31-103 §13.2 - Mandatory KYC Content
The registrant must take reasonable steps to collect the following information before making a suitability determination. Section 13.2(2) also requires establishing whether the client is an insider of a reporting issuer, and the client's creditworthiness if the firm finances the purchase.
| KYC element | Details |
|---|---|
| Identity | Full legal name, date of birth, address - verified per PCMLTFA rules |
| Investment objectives | Growth, income, preservation of capital, or combination; with percentage weightings |
| Time horizon | Short (<3 years), medium (3-10 years), long (>10 years) |
| Risk tolerance | Client's willingness to accept risk; often captured as low/medium/high or on a numeric scale |
| Risk capacity | Client's financial ability to absorb losses; determined by income, assets, liabilities, obligations |
| Annual income | Total gross household income from all sources |
| Net worth | Total assets minus total liabilities; often split into liquid and non-liquid |
| Investment knowledge | Self-assessed: none, limited, fair, good; relevant to product complexity suitability |
| Other accounts and holdings | Accounts at other institutions to assess total portfolio concentration (account-as-a-whole) |
3. IDPC Rule 2554 - Outside Business Activity (OBA) Disclosure
An Approved Person must inform their Dealer Member of any outside activity and get its prior approval before engaging in it (IDPC Rule 2554). The dealer reviews the activity and either approves, prohibits, or imposes conditions on it, then reports it to CIRO under NI 33-109.
What must be disclosed: Any business activity outside the scope of the registrant's duties for the registered dealer, including directorships, officer roles, other employment, consulting engagements, and any activity that could create a conflict of interest or involve securities.
Three-party disclosure structure:
- Registered individual discloses the OBA to their employer (the registered dealer)
- The registered dealer must be satisfied the OBA does not create a conflict of interest that cannot be managed
- Where required, the OBA is disclosed to the client if it creates a material conflict of interest
Exam gotcha: The registrant discloses to the employer first, not to the regulator. The regulator is not the first point of disclosure. Failing to disclose an OBA to the employer is itself a compliance violation.
4. IDPC Rule 3115 - Personal Financial Dealings Prohibitions
Rule 3115 prohibits employees and Approved Persons of a Dealer Member from engaging, directly or indirectly, in personal financial dealings with clients.
Prohibited dealings include:
- Borrowing money or securities from a client (except from a lending financial institution in its normal course of business, or from a Related Person under the Income Tax Act with the dealer's prior written approval)
- Lending money or securities to a client (except to a Related Person under the Income Tax Act, with the dealer's prior written approval)
- Settling a complaint with a client, or paying for client account losses out of personal funds, without the dealer's prior written consent
- Accepting any consideration from anyone other than the dealer for activities conducted on behalf of a client (minor, infrequent non-monetary gifts excepted)
Power of attorney: Acting as a client's power of attorney, trustee or executor, or otherwise controlling a client's financial affairs, is a prohibited personal financial dealing unless the client is a Related Person and the dealer approves the arrangement in writing beforehand. Discretionary and managed accounts run under their account agreements are excepted.
5. CIRO Account-Opening Approval Flowchart (Rules 3214, 3247, 3251)
Step-by-step account approval process under the IDPC Rules:
- Collect KYC information - all NI 31-103 §13.2 data points gathered before any recommendations made
- Determine account type - cash account, margin account, options account, short-selling account. Each type requires progressively higher approval thresholds
- Assess client suitability for the account type - options trading requires demonstrated investment knowledge and risk tolerance; margin requires sufficient net worth
- Designated Supervisor review and approval - required for every new account, cash accounts included, no later than one business day after the initial trade (Rule 3214); derivatives accounts need the designated Supervisor's approval recorded in writing before the first derivatives trade (Rule 3251)
- Specific risk disclosure documents delivered - margin account agreement delivered and signed before the margin account is opened (Rule 3247); derivatives risk disclosure statement delivered and acknowledged before the first derivatives order (Rule 3254)
- Client acknowledges receipt of disclosures - signed acknowledgement filed in the account record
- Account activated - trading permitted only within the approved account type and suitability profile
Elevated approval requirements:
- Margin accounts: designated Supervisor approval required; minimum net worth thresholds per firm policy
- Options Level 1 (covered calls, protective puts; option levels are firm-defined): lower knowledge bar but still requires designated Supervisor sign-off
- Options Level 2 (spreads): requires demonstrated options knowledge
- Options Level 3 (naked shorts): highest approval bar; designated Supervisor plus potential compliance sign-off
- Short selling: must comply with the UMIR short-sale rules
6. CIRO Rule 3402 - Account-as-a-Whole Suitability Framework
Rule 3402 requires that suitability be assessed at the account level (account-as-a-whole), not just at the individual trade level. A single trade may be appropriate in isolation but inappropriate in the context of the client's total holdings.
Triggers for a Rule 3402 account-as-a-whole review:
- At account opening
- Before any trade recommendation
- When a KYC trigger event occurs
- When the registrant becomes the account's registered representative (through transfer or internal reassignment)
- When securities are transferred or deposited into the account, or a change in a held security could make the account unsuitable
- When KYC information is reviewed under Rule 3209(4) (at least every 36 months, or 12 for managed and discretionary accounts)
What a Rule 3402 analysis considers: Concentration by asset class, sector, geography, and single issuer; alignment of holdings with stated investment objectives; overall risk level vs the client's risk profile; liquidity of the portfolio relative to the client's time horizon; cost of the portfolio relative to the client's situation.
7. Concentration Thresholds and Risk Tolerance vs Risk Capacity
Illustrative concentration thresholds (firm policy; CIRO rules set no percentage):
- Single-issuer concentration above 10% of portfolio warrants documentation and client discussion
- Single-issuer concentration above 20% of portfolio is considered acute concentration requiring explicit justification in the account file and heightened supervisory review
- Sector concentration above 30-40% warrants review under most dealer policies (check current dealer manual - thresholds are firm-specific)
Risk tolerance vs risk capacity - the lower governs:
Risk tolerance = the client's willingness to accept volatility and potential loss; subjective and self-reported.
Risk capacity = the client's objective financial ability to absorb a loss without impairing financial goals or living standards; derived from income, net worth, liabilities, time horizon.
When tolerance and capacity differ: the risk profile is the more conservative of the two (CIRO bulletin 26-0200, September 10, 2026). A client who says they can accept high risk (high tolerance) but has low capacity (approaching retirement, limited savings, large liabilities) must be treated as a low-risk client for suitability purposes. Do not coach KYC answers or raise a profile to fit a product.
Exam gotcha: this is tested in scenario form. A client near retirement with a mortgage says they want aggressive growth. The correct action is to probe capacity, explain the mismatch, and document. The registrant should not simply accept the stated tolerance.
8. Pre-Trade Disclosure for Accounts Using Borrowed Funds
IDPC Rule 3217 requires a leverage risk disclosure statement, with the client's positive acknowledgement, when a retail account is opened, before recommending the use of borrowed money, or when the dealer first learns the client intends to borrow to invest. Points to cover with the client:
- Borrowing to invest is risky: the client can lose more than the amount invested if the securities decline in value
- The interest cost on borrowed funds is incurred regardless of portfolio performance
- The dealer can sell securities in the account to cover a margin deficiency, as set out in the margin account agreement
- Using borrowed funds magnifies both gains and losses in proportion to the debt-to-equity ratio
- The client signs the margin account agreement before the margin account is opened (Rule 3247)
Minimum margin requirements (CIRO): 50% margin on most listed Canadian equities priced at $2.00 or more. Higher margin (60% to 100%) for shares priced below $2.00 (IDPC Rule 5310). Concentrated single-issuer positions may face higher house margin requirements. Note: "margin" here refers to the client's equity in the account as a percentage of the total market value of marginable securities.
Test Yourself: 5 RSE Suitability Questions
Q1. Under IDPC Rule 2554, who is the first party a registrant must disclose an outside business activity to?
Show answer
The registered dealer (employer). The registrant discloses to the firm before engaging in the OBA. The firm then reviews and decides whether to approve, prohibit, or impose conditions. The dealer then reports the activity to CIRO under NI 33-109, and discloses it to clients if it creates a material conflict of interest.
Q2. A client's portfolio has 25% concentrated in a single mining company. What is required?
Show answer
At 25%, the position exceeds a typical 20% firm-policy threshold (CIRO rules set no percentage). Under such a policy the registrant must document explicit justification in the account file and the account requires heightened supervisory review. The registrant should discuss the concentration risk with the client and ensure the KYC file supports this level of concentration.
Q3. A client states a high risk tolerance on their KYC form but is 63 years old, will retire in 2 years, has $200,000 in savings, and a $180,000 mortgage. What effective risk level governs recommendations?
Show answer
Low risk. The client's risk capacity is low: short time horizon, large debt relative to savings, imminent retirement income need. Risk tolerance and capacity are in conflict; the lower (capacity = low) governs. The registrant must document the mismatch and recommend accordingly.
Q4. Under CIRO Rule 3402, when must an account-as-a-whole suitability review be conducted?
Show answer
Before any trade, recommendation or other investment action (Rule 3402(1)), and after any of these events (Rule 3402(2)): securities transferred or deposited into the account; a new rep is designated for the account; a change in the client's KYC information or in a held security that could make the account unsuitable; a KYC review under Rule 3209(4).
Q5. Which account type requires the designated Supervisor's written approval and delivery of a derivatives risk disclosure statement before the first trade?
Show answer
A derivatives (options) account under IDPC Rules 3251 and 3254. The derivatives risk disclosure statement must be delivered and acknowledged before the first derivatives order, and the designated Supervisor's approval must be recorded in writing. Every new account, margin accounts included, also needs designated Supervisor approval (Rule 3214), and a margin account needs a signed margin account agreement (Rule 3247).
Related Cheat Sheets
KYC + KYP Checklist
Mandatory KYC fields, KYP at firm and rep levels, product due diligence
Supervisor Branch Procedures
CIRO Rule 3900, trade review thresholds, complaint handling, AML
CIRO Rule Citations
Every CIRO, UMIR, NI rule number with plain-English summaries
CIRE Formula Cheat Sheet
Quantitative formulas for the CIRE exam
Last updated: 2026-09-29. NI 31-103 section references confirmed against the current OSC consolidation. CIRO rule references (2554, 3115, 3209, 3214, 3217, 3247, 3251, 3254, 3402, 5310) are to the CIRO Investment Dealer and Partially Consolidated (IDPC) Rules. Verify current CIRO rules at ciro.ca for any post-publication amendments.