What CIRO Requires in Meeting Documentation (2026)

Building a documentation tool for Canadian financial advisors required understanding what CIRO actually expects from meeting notes. Not what the industry assumes, and not what compliance departments summarize in passing. I needed to know what the rules, the guidance notes, and the most recent examination findings actually say.

CIRO requires meeting documentation that demonstrates a reasonable basis for each suitability determination. Under IDPC Rule 3402(1), advisors must document how they considered five factors: client KYC information, product knowledge (KYP), account impact including concentration and liquidity, cost impact on returns, and reasonable alternatives. Joint CSA/CIRO Staff Notice 31-368 (December 2025) detailed specific examples of both deficient and adequate documentation after reviewing 105 firms across Canada as part of the Client Focused Reforms Phase 2 Implementation Sweep.

I'm not a compliance expert. I'm the developer behind Northern Catalyst's Meeting Notes Pro, and I had to understand these requirements to build it properly for the Canadian regulatory environment. What I found was more specific and less intimidating than I expected going in.

Why CIRO documentation requirements feel opaque

The perception that CIRO documentation requirements are unclear is not a failure of attention. It's a structural problem.

CIRO scatters its documentation expectations across at least eight separate publications: IDPC Rules 3200, 3300, 3400, 3800, and 3900, NI 31-103, Guidance Note GN-3400-21-004, and Staff Notice 31-368. There is no single page on ciro.ca titled "Meeting Documentation Requirements." Each publication is written for compliance officers and securities lawyers, not for the advisor sitting across from a client.

No content in the Canadian landscape bridges the gap from regulatory expectation to advisor daily practice. Law firms provide legally precise analysis directed at firms. Trade publications report examination findings. Vendors mention compliance in marketing copy. Nobody has translated what CIRO actually requires into practical, advisor-level guidance.

That missing translation layer is what this blog provides.

What Staff Notice 31-368 revealed

In December 2025, CIRO published Joint CSA/CIRO Staff Notice 31-368 after reviewing 105 registered firms across Canada as part of the Client Focused Reforms Phase 2 Implementation Sweep. The findings were specific. Not vague warnings about keeping good records. Specific documentation patterns that CIRO identified as deficient.

Four patterns stand out.

1. "Suitable" without basis. Some firms recorded only that an investment was "suitable" without showing the basis for that determination. Simply stating that securities are "approved" or placing them on an "approved list" without evidence of a reasonable review process was flagged as insufficient.

2. "No update" without evidence. The Notice was clear: "A note stating only 'no update' or 'no changes' in the client file or on the KYC form is insufficient without other evidence that a meaningful interaction took place with the client, to avoid solely performing a perfunctory review."

3. Checklists as shortcuts. Firms that relied on "superficial tools (e.g., checklists) without supporting documentation of how factors were considered and decisions made" did not meet the standard.

4. Ranges too broad to be meaningful. Net financial asset ranges so broad that a single investment could represent anywhere from 8% to 40% of the client's net financial assets were flagged as inadequate for meaningful suitability assessment.

CIRO has also signalled its direction. Its February 2026 Annual Compliance Report confirmed that BCC examinations going forward "will focus on assessing whether dealers have taken steps to rectify any deficiencies identified in the report." The Rule Consolidation Project, published for a 120-day comment period on February 12, 2026, will reshape KYC, KYP, and suitability documentation obligations once finalized. The regulatory landscape is not static, but the foundational standard is clear.

The five-factor suitability framework

Under IDPC Rule 3402(1) and NI 31-103 s. 13.3(1), before taking or recommending any investment action for a retail client, registrants must determine, and be able to demonstrate through documentation, that the action satisfies five specific factors:

The standard for all five: documentation must "demonstrate a reasonable basis for the suitability determination." Not perfection. Not legally bulletproof prose. A reasonable basis.

There is also a proportionality principle. Staff Notice 31-368 acknowledged that documentation completed through centralized or periodic processes "may not need to be repeated each time, provided that the analysis from that process is relied upon when making a recommendation." Firm-level KYP assessments, mandate-level suitability memos, and periodic portfolio reviews can reduce the per-recommendation documentation burden. Where suitability is less clear, more detailed individual records are necessary. The CIRO Compliance Guide's suitability chapter provides detailed examples and a practical memo format for documenting each factor.

Why CIRO requires risk tolerance and risk capacity documented separately

One of the most specific findings in Staff Notice 31-368 was that firms were blending risk tolerance and risk capacity in their KYC documentation with, in the regulator's words, "no clear logic." This matters because the two concepts serve different functions and produce different conclusions.

Risk tolerance is psychological. It describes how much portfolio fluctuation a client is willing to accept. A retired teacher who checks her portfolio daily and loses sleep over a 5% decline has low risk tolerance, regardless of her financial position.

Risk capacity is financial. It describes how much loss a client can absorb without materially affecting their lifestyle or goals. That same retired teacher, if she has a fully indexed pension and no debt, may have substantial risk capacity despite her low tolerance for volatility.

When these two assessments are combined into a single field or a blended score, the documentation fails to show how the advisor weighed the tension between them. A client with high capacity but low tolerance might reasonably be placed in a moderate portfolio, but the reasoning only holds if the notes show both inputs and explain the judgment.

Staff Notice 31-368 flagged firms where KYC files showed a single "risk profile" rating with no evidence of how tolerance and capacity were assessed individually. The fix is straightforward: document each factor with enough specificity that someone reviewing the file can see the two inputs and understand how the advisor reconciled them.

This is one area where the gap between current practice and what CIRO expects is genuinely small for most advisors. If you are already having conversations about both how your client feels about risk and what their financial situation can support, the documentation gap is about recording those as two distinct observations rather than collapsing them into one.

What the gap actually looks like

Staff Notice 31-368 didn't just identify what's deficient. It also described what adequate documentation looks like. When both appear side by side, the distance between them becomes specific and assessable.

What enforcement actually shows

CIRO hearing panels have sanctioned both advisors and firms over what was, or was not, in the client file. Three matters decided between 2024 and 2026 show the shape of it across both dealer channels. One caution on how to read them: most of the documentation matters in this window were settlements, which record facts the respondent agreed to rather than findings made on contested evidence. That distinction is noted for each case below.

Supervision of note-taking: Re National Bank Financial, 2026 CIRO 09. In March 2026 a CIRO hearing panel accepted a settlement in which National Bank Financial Inc. (NBF) admitted it had failed to adequately supervise the trading activity of registered representative Matthew Ewing on note-taking and suitability between April 2021 and August 2022. The agreed facts record that the April 2021 trade volume report listed 5,887 trades, that NBF asked Ewing for the notes behind twelve of them, and that those twelve notes were inadequate. The parties agreed, and the panel adopted as an aggravating factor, that "the inadequacy of the notes reviewed ... should have raised further red flags." A closer review after CIRO opened an investigation found no notes for 49% of the June 2021 trades reviewed and 17% of the July trades reviewed. NBF was fined $1,000,000 with costs of $50,000. Ewing was found liable separately in July 2025 for conduct below professional standards under IDPC Rule 1400 and for personal financial dealings, and was sanctioned in January 2026 with a ten-year suspension, a $75,000 fine and $50,000 in costs; allegations that he falsified portfolio overview documents and traded without authorization were dismissed. Ewing faced no stand-alone note-keeping charge. The missing notes did evidentiary work: without them, the firm could not confirm that client instructions sat behind the trades, and the panel recorded that his conduct left NBF's supervision "ineffective."

Note content: Re Short, 2025 CIRO 40. Jeremy Liam Short, a dealing representative with Investors Group Financial Services Inc. in Winnipeg, admitted, and the hearing panel confirmed, that he had created notes on the dealer's system on 13 occasions "containing false or misleading information about whether clients had personally signed" account forms. That conduct sat alongside electronically signing 356 account forms for 135 clients and making false statements to the dealer during its investigation. The panel confirmed a two-year prohibition, a $20,000 fine and $5,000 in costs. This was a settlement, so the facts were agreed rather than adjudicated. What it establishes is narrow and useful: the content of a note is regulated conduct in its own right, and the dealer's system is where that content is tested.

Recorded client information: Re Vaarsi, 2024 CIRO 02. Stephanie Vaarsi, a Sun Life dealing representative with more than 30 years in the industry, altered 26 Know Your Client forms for 22 clients between May 2016 and November 2018 without having clients initial the changes. The fields she changed were risk tolerance, investment objectives, annual income and net worth, which are the same fields the December 2025 Joint CSA/CIRO Staff Notice 31-368 returns to. The panel described the misconduct as "widespread and indicative of a pattern of misconduct" and accepted a $22,500 fine with $2,500 in costs. Again a settlement. Two details are worth holding onto: no affected client complained about the recorded information, and the panel found no evidence of client loss. The sanction followed anyway, because altering the record without the client's initials destroys the audit trail that lets a dealer investigate a complaint at all.

The same records work in the other direction

Re White (2024 CIRO 67) is often cited in this context, and it cuts differently. Michael Patrick White, then a registered representative at the Ottawa branch of Echelon Wealth Partners Inc., faced allegations that he failed to use due diligence to ensure his recommendations were suitable for three clients. The hearing panel found against him on two and dismissed the allegations concerning the third. The February 2025 penalty decision (2025 CIRO 04) imposed a $5,000 fine and $3,000 in disgorgement. No record-keeping contravention was charged or found.

The contested allegations turned on credibility, because the advisor and his former clients gave very different accounts of what had been discussed and agreed. The panel treated White's contemporaneous notes as a credible record of those conversations. It rejected the allegation that the handwritten notes had been altered after the fact, on the basis that the dealer had archived them and he no longer had access to change them (Re White, 2024 CIRO 67, paras. 97 and 125).

Documentation runs both ways. It is what an examiner tests when a file is reviewed, and it is what an advisor has when a client's memory of a conversation differs from their own. The archival point is worth carrying into any decision about note-taking tools: a note the advisor can still edit is a note someone can dispute.

What the enforcement record does not yet say

A search of the CanLII CIRO collection on 4 August 2026, covering all 171 hearing panel decisions from January 2024 to May 2026, found none that addresses AI-generated meeting summaries or third-party note-taking tools, either as an aggravating factor or as an exculpating one. The regulatory infrastructure has moved ahead of the enforcement record. CIRO's 2026 Annual Compliance Report names AI use as an examination priority, and Staff Notice 31-368 looks for evidence that the advisor engaged with the specific client rather than reproducing template language.

For an advisor deciding whether to use an AI tool, the question the file has to answer is unchanged. Whatever produced the note, the record still has to show what was discussed, what was recommended, and why that recommendation was reasonable for that client.

How long advisors must keep meeting records

CIRO requires a minimum seven-year retention period for client records under IDPC Rule 3800. The MFDA equivalent under Rule 5.6 imposes the same standard. NI 31-103 s. 11.6 reinforces this at the securities law level. The clock starts from the date the record is created, not from the date the client relationship ends.

Seven years means that meeting notes taken today could be requested during a CIRO examination in 2033. If a complaint or enforcement matter arises, those notes become evidence. The Re White case showed what happens when archived notes are available: they can resolve credibility disputes in the advisor's favour. The inverse is also true. If the notes do not exist or cannot be produced, the advisor has no documentary record to support their position.

This is why the format and storage system matters as much as the content. Notes need to be in a system that preserves them reliably over seven years with some form of audit trail or timestamp. Handwritten notes stored in a filing cabinet meet the minimum standard, but they are vulnerable to damage, loss, and questions about when they were written. Digital systems with timestamps and version control address these vulnerabilities.

The connection worth seeing

When I built Meeting Notes Pro, this was the core discovery. The five factors CIRO requires documented are the same factors a thorough advisor already considers during a good client meeting.

KYC is understanding the client's full situation. KYP is knowing what you're recommending. Account impact is considering how this fits the broader picture. Cost impact is being transparent about what clients pay. Reasonable alternatives is considering other options before settling on a recommendation.

The documentation standard asks advisors to capture what's already happening in their thorough client conversations. For the advisor who is already having comprehensive conversations and making thoughtful recommendations, the gap is mostly about recording the reasoning, not changing the practice.

Where AI tools fit in meeting documentation compliance

The five-factor framework creates a documentation standard that is specific enough to evaluate but broad enough that the format is left to the advisor and their firm. CIRO does not prescribe how documentation is produced, only what it must demonstrate.

This is where AI-assisted meeting documentation enters the picture. Tools designed for financial advisor meetings can capture the substance of a conversation and structure it around the documentation elements CIRO requires: what KYC information was discussed, what products were considered, how suitability was assessed, what costs were addressed, and what alternatives were evaluated. The advisor still exercises the professional judgment. The tool handles the recording and structuring.

The regulatory question is whether AI tools can be used for this purpose at all. CIRO's 2026 Compliance Report confirmed that AI in dealer operations will be examined, but within existing operational controls frameworks, not under new AI-specific rules. The full compliance analysis of whether CIRO allows AI meeting notes covers the regulatory landscape in detail.

For advisors evaluating specific tools, the compliance considerations differ depending on whether client data leaves the advisor's device and where it is processed. The analyses of ChatGPT and Claude from a Canadian compliance perspective cover these distinctions.

The underlying point is simpler than the technology discussion suggests. The documentation standard exists. Contemporaneous notes carry evidentiary weight. The five factors are specific. Whether an advisor captures them by hand, through a CRM, or with the assistance of an AI tool, the standard remains the same.

Where do your notes stand?

Pull up your last three meeting notes. Not the best ones. The most recent three.

If three or four of those are covered in the notes, the gap between current practice and what CIRO considers examination-ready is likely a matter of specificity and consistency. Not a fundamental change in practice.

If you want a structured way to evaluate your documentation against the five-factor standard, the Documentation Standards Kit sets out what a Canadian client meeting record needs to contain, with the regulatory basis for each block. It is written to be read against whatever template you already use: where your existing record already carries the required content, the block is satisfied. The Compliance Conversation Kit covers how to start the conversation about documentation standards at your firm.

Frequently asked questions

What does CIRO look for in meeting documentation?

CIRO expects documentation that demonstrates a reasonable basis for each suitability determination, addressing five factors: client KYC information, KYP assessment, account impact, cost impact, and consideration of reasonable alternatives. These requirements are codified under the Client Focused Reforms in IDPC Rule 3402(1) and NI 31-103 s. 13.3(1).

Does CIRO require notes for every client meeting?

CIRO's rules are principles-based and directed at dealer firms, not individual advisors. There is no explicit rule mandating notes for every meeting. However, the obligation to demonstrate compliance through documentation creates a practical expectation that significant client interactions are documented. Case precedent (Re White, 2024 CIRO 67) established that contemporaneous meeting notes carry persuasive evidentiary weight.

How long must advisors keep meeting documentation records?

CIRO requires a minimum seven-year retention period under IDPC Rule 3800. The MFDA equivalent (Rule 5.6) imposes the same standard, as does NI 31-103 s. 11.6. Records must be stored in a manner that allows them to be produced upon request during a CIRO examination. Systems with audit trails or timestamps strengthen the evidentiary value of the records.

How quickly do meeting notes need to be completed?

CIRO does not prescribe a specific documentation timeline. No "same day" or "24-hour" rule exists. Case law establishes that notes taken during or immediately after meetings, stored in systems with audit trails, carry the most evidentiary weight. This is best practice drawn from enforcement precedent, not a binding timeframe.

What is the difference between a CIRO examination and an audit?

CIRO conducts "examinations," not "audits." An audit verifies financial statements; a CIRO examination assesses regulatory compliance. Three streams exist: Business Conduct Compliance (BCC), Financial and Operations Compliance (FinOps), and Trading Conduct Compliance (TCC). BCC examinations are most relevant to advisor documentation.

Key regulatory references

The standard is navigable

The five-factor framework is specific. The deficiency examples are concrete. The proportionality principle acknowledges that context matters. And the practices required for good documentation map closely to the practices of good client service.

The question that remains is personal. Not whether the standard is clear. It is. But whether your documentation currently captures the professional judgment you're already exercising when you sit across from a client and do the work you were trained to do.

That conversation with your compliance officer is worth having. Not from avoidance. From understanding.