A single rulebook for exchange tech is here - guess who regulators are eyeing next
Canada's securities regulators are streamlining technology rules for exchanges and clearing houses - and hinting advisors and fund firms could be next.
On October 1, 2026, the Canadian Securities Administrators (CSA) published a notice proposing National Instrument 26-101 Information Technology System Integrity, along with a companion policy. Right now, the rules governing exchanges, alternative trading systems, clearing agencies, trade repositories, matching service utilities and information processors are scattered across a patchwork of different instruments. The new rule would gather them all under one roof.
The CSA is quick to say this isn't a shake-up - just a tidy-up. Still, a handful of changes would apply across the board. Boards of directors would need to be actively involved in, and clearly informed about, their organization's technology risk controls. Firms would have to spell out how they're protecting data integrity and security. And trade repositories and matching service utilities, which currently don't have to alert regulators quickly when something breaks, would join exchanges, clearing agencies and information processors in that duty.
A few other updates simply lock in practices that are already common sense. Clearing agencies and trade repositories would need a plan for getting critical systems back online within two hours of a disruption - a bar clearing agencies are already required to meet under international standards, now written directly into Canadian rules for trade repositories too. Matching service utilities would need a yearly check-up from a qualified party, and everyone covered would have 60 days to hand regulators the results of their independent system reviews.
Here's the thing for advisors and fund managers: none of this touches day-to-day compliance - yet. As of July 2026, Ontario alone counted 24 of these infrastructure entities (five exchanges, ten alternative trading systems, four clearing agencies, one matching service utility and four trade repositories), and the Ontario Securities Commission expects the switchover to cost them very little, with no direct costs expected for investors or other market participants.
But keep an eye on what's coming. Tucked into the CSA's consultation questions is a pointed one: should the next phase pull registrant firms and investment fund issuers into this framework directly? The CSA is also asking whether firms should face tighter rules on outsourcing technology - including artificial intelligence - to outside vendors. Nothing's decided, but it's a clear signal of where the regulator's focus is headed.
Comments are open for 120 days, until January 29, 2027. One holdout: British Columbia's securities commission is sitting this round out, with staff saying they expect to weigh in once the province's election wraps up.
The full text of the CSA Notice and Request for Comment - Proposed National Instrument 26-101 Information Technology System Integrity is available at https://www.osc.ca/en/securities-law/instruments-rules-policies/2/26-101/csa-notice-and-request-comment-proposed-national-instrument-26-101-information-technology-system.
