Overview
IIROC is now part of CIRO, so IIROC outsourcing should be understood through the current CIRO framework. The value of the page is to help readers understand the legacy label and then point them to current CIRO rules and notices for outsourcing and service arrangements.
The core principle is accountability. Dealer members may use third parties for certain functions, but regulatory responsibilities, supervision, records, client protection, confidentiality, and access cannot disappear because work is outsourced.
Rather than prescribing identical controls for every relationship, the regulation emphasizes a risk-based approach, requiring organizations to apply governance, oversight, controls, monitoring, and due diligence according to the criticality and risk of each relationship.
This implementation guide explains what the regulation requires, how those requirements translate into operational controls and evidence, and how Halbarad helps organizations operationalize compliance through assessments, continuous monitoring, governance workflows, and supply chain risk intelligence.