CSA Notice and Request for Comment : Proposed National Instrument 26-101 Information Technology System Integrity

Proposed rule and related materials

The CSA is seeking comment on proposed National Instrument 26-101 Information Technology System Integrity, proposed Companion Policy 26-101 Information Technology System Integrity and related to the integrity of market infrastructure entities’ information technology (IT) systems.  The proposed rule would establish a single, harmonized framework for the information technology (IT) requirements for marketplaces, clearing agencies, trade repositories, information processors and matching service utilities. It would consolidate current IT-related requirements and use more consistent language and requirements across these entities.

Consultation questions

The CSA is also seeking stakeholder input through consultation questions to inform a second phase of the project, including how best to align the framework with international standards and address issues relating to emerging technologies. Please see the questions below.

Closing Consultation Date: January 29, 2027

Submit your feedback

A copy of the Consultation Paper can be found on the website of the following jurisdictions:

Alberta, British Columbia, Manitoba, New Brunswick, Nova Scotia, Ontario, Québec, Saskatchewan

Questions about this proposal? Please refer to any of the following:

Alberta Securities Commission
Julio Arboleda Ramirez
Senior Legal Counsel
Email: julio.arboledaramirez@asc.ca

Autorité des marchés financiers
Julie Boyer
Senior Policy Advisor
Email: julie.boyer@lautorite.qc.ca

British Columbia Securities Commission
Catherine Tearoe
Senior Legal Counsel
Email: ctearoe@bcsc.bc.ca

Financial and Consumer Affairs Authority of Saskatchewan
Curtis Brezinski
Acting Director, Capital Markets, Securities Division
Email: curtis.brezinski@gov.sk.ca

Financial and Consumer Services Commission of New Brunswick
Nick Doyle
Legal Counsel
Email: nick.doyle@fcnb.ca

The Manitoba Securities Commission
Angela Duong
Deputy Director, Compliance and Oversight
Email: angela.duong@gov.mb.ca

Nova Scotia Securities Commission
Doug Harris
General Counsel, Director of Market Regulation and Policy and Secretary
Email: doug.harris@novascotia.ca

Ontario Securities Commission
Stacey Barker
Senior Accountant, Trading & Markets
Email: sbarker@osc.ca

Stephanie Wakefield
Senior Legal Counsel, Trading & Markets
Email: swakefield@osc.ca

Technical questions about submitting your comments? Click here to contact the CSA Secretariat. Or alternatively please reach out to info@acvm-csa.ca.

CSA Notice and Request for Comment - Proposed National Instrument 26-101 Information Technology System Integrity

Step 1 of 2

Phone

This field is for validation purposes and should be left unchanged.

Name(Required)

First name Last name

Email(Required)

Consent

Please do not publish my name on the websites of CSA members

Place of residence(Required)

State / Province / Region Country

Are you commenting on behalf of an organization?(Required)

Yes

Organization Name(Required)

Address of the organization(Required)

Street Address Address Line 2 City State / Province / Region ZIP / Postal Code Country

Phone number of the organization

Are you replacing a previous submission?(Required)

Yes

Thank you for your confirmation.

Proposed rule and related materials

The CSA is seeking comment on proposed National Instrument 26-101 Information Technology System Integrity, proposed Companion Policy 26-101 Information Technology System Integrity and related to the integrity of market infrastructure entities’ information technology (IT) systems.  The proposed rule would establish a single, harmonized framework for the information technology (IT) requirements for marketplaces, clearing agencies, trade repositories, information processors and matching service utilities. It would consolidate current IT-related requirements and use more consistent language and requirements across these entities.

Please provide comments on the Proposed Materials.

Consultation questions

Harmonization of current requirements

Should we impose different requirements for different types of entities, or have a single set of requirements that applies to all entities? Please explain.

Should distinct requirements be imposed according to the entity’s relative importance or function within the market? Please explain.

Scope of entities

Should Phase 2 include registered entities such as registrant firms and investment fund issuers? Please explain.

Should other types of entities be included in Phase 2 to better align with international standards and facilitate harmonized regulatory treatment across entities? For example:

a) Should Phase 2 include market structure entities other than MIEs, such as benchmark administrators? Please explain. b) Should regulation services providers or self-regulatory authorities be brought into Phase 2? Please explain.

What factors should be considered in determining whether an entity should be included in Phase 2?

Outsourcing and third-party risks management

Should the outsourcing provisions be extended beyond specified MIEs and apply to all MIEs? Please explain.

Should the outsourcing provisions include more specific obligations for managing risks related to outsourced technologies, such as AI? This could include governance, due diligence, certification, or reporting on the robustness and reliability of an outsourced technology.

In your view, which aspects of outsourcing (increasingly referred to as “third-party risk management”) should be strengthened? Please explain.

In particular, we invite feedback on the following: a) How should risks associated with the use of third-party AI vendors be managed? b) Should there be requirements for independent certifications or attestations regarding the reliability and security of third-party technology solutions? c) How should supply chain risks, including those arising from fourth- and fifth-party service providers, be addressed within the regulatory framework?

Data governance

In your view, how should we address any issues regarding the use of cloud services (e.g. data storage location and concentration risk) by MIEs?

Cybersecurity

Should Phase 2 introduce specific requirements for risk-based cybersecurity controls, including the continuous monitoring and testing of these controls by MIEs (such as penetration testing and vulnerability assessments, and scenario-based cyber resilience exercises), in line with international standards (e.g., ISO/IEC 27001: 2022 standards, NIST Cybersecurity Framework)?

a) What types and frequency of cybersecurity testing should be mandated to ensure ongoing resilience against evolving and emerging threats, including those enabled by new technologies? b) Should there be specific requirements for independent third-party testing or attestation in connection with cybersecurity, and for reporting material findings to regulators?

Emerging technologies

Should emerging technological developments – such as AI, quantum computing, blockchain and distributed ledger technology (DLT) (e.g. tokenization) be addressed more explicitly? What risks do you see or foresee that could and should be addressed by securities regulation?

Given the increasing use of AI systems in capital markets, should Phase 2 include specific requirements regarding AI risk management consistent with the guidance in CSA Staff Notice and Consultation 11-348 Applicability of Canadian Securities Laws and the Use of Artificial Intelligence Systems in Capital Markets?

a) Should there be minimum standards for AI system oversight and transparency regarding AI-driven decision-making? b) Should there be requirements for documenting and reporting to regulators on AI system uses in connection with a critical system or critical service?

Other

What other issues should we consider in Phase 2? Please explain.

Upload your letter:

Do not submit any password protected document.

Accepted file types: pdf, Max. file size: 128 MB.

Contact information