Karsten Wenzlaff, Advisor
August 26th, 2025
Regulation | December 15, 2025

AI generated image
On December 11, 2025, the Canadian Securities Administrators (CSA) and the Canadian Investment Regulatory Organization (CIRO) released new guidance for finfluencers, investment firms, and issuers on how securities laws apply to online investing activity (Download CSA and CIRO Staff Notice 31-369 13 page PDF). Social media now plays a real role in how Canadians make investment decisions, and regulators expect existing securities law to apply when online influence impacts behaviour. The guidance clarifies when creators must register, how disclosure must work in short-form content, what counts as advice or trading activity, and where firms and issuers remain responsible when they work with finfluencers. Keep reading to learn about the practical implications, including some use case examples covered in the report.
Regulators are responding to what they see in the market today. Social media is no longer a side channel for financial education. It is where many investors first encounter investment ideas, products, and promotions, often without realizing when education turns into influence.
As NCFA previously reported, based on the CSA's 2024 Investor Index, 53% of Canadian investors now use social media as a source of investment information. Among younger investors aged 18 to 24, reliance on social platforms is even higher. Those investors face materially higher risk.
The OSC also tests causation, not just correlation. In a controlled experiment involving 1,465 Canadians managing a simulated $10,000 portfolio, 38% of participants exposed to finfluencer style promotional posts purchased the promoted asset, compared with 8% in the control group. Exposure alone drives different investment choices, even without personalized advice.
Canadian securities regulators examined 87 finfluencers and 9 issuers and repeatedly found undisclosed compensation, promotional framing that functions as recommendations, and content drifting into advising or trading activity without registration.
The CSA and CIRO aren't introducing new rules. They are making it clear how existing securities law already applies when online content influences investment decisions. There's a clear message that Finfluencers should take seriously:
Labels and intent matter less than impact. What counts is how a reasonable investor experiences the content, not how the creator describes it.
Finfluencers need to register when they provide investment advice or help facilitate securities trading for a business purpose, unless a specific exemption applies.
A business purpose doesn't require a formal firm, a full-time role, or a registered brand. Regulators look at how the activity actually operates. Repetition, promotion, compensation, solicitation, and continuity over time all matter. Paid courses, subscription communities, affiliate arrangements, and recurring sponsored content often meet this threshold.
The guidance is explicit that finfluencers cannot avoid registration by saying their content is not advice. Disclaimers do not change how regulators assess the activity.
Investment advice includes opinions about the merits of investing in a specific business or security, as well as recommendations to buy or sell. The guidance notes that even promotional language or emojis that imply opportunity can be interpreted as recommendations.
Trading activity is defined broadly. It includes not only executing trades, but any act done in furtherance of a trade. The guidance specifically points to copycat trading enablement, such as linking followers who pay a subscription fee to replicate trades in a self-directed account. These lines are crossed more often than many creators realize.
Some finfluencers rely on the general advice exemption when providing broad and non-personalized commentary, however the regulator's guidance makes clear that this exemption is narrow and conditional.
If a finfluencer relies on it, they must clearly disclose any financial or other interest in the securities discussed. Financial or other interest is interpreted broadly and includes indirect incentives, compensation arrangements, and related party interests.
The exemption does not apply to trading activity. This distinction becomes critical when education is paired with transaction pathways.
Disclosure needs to be clear, prominent, and specific enough for an audience to understand the security involved, the incentive, who paid it, and who received it.
The guidance is direct about what fails. Statements like “I may have a financial interest” are not enough. Disclosure also fails when it is buried at the end of a video, hidden behind extra clicks, or written in a way viewers are unlikely to notice.
A simple acid test applies. If a viewer has to look for the disclosure, it likely does not meet expectations.
The example scenarios below highlight when creators drift into regulated activity without intending to. These aren't rare cases but common growth paths.
In one example, a creator starts with general investing education. That activity stays outside registration. When the creator adds buy and sell signals in a paid course, the activity becomes advising. When the creator begins answering personalized questions through comments and direct messages, charges fees, and scales tailored advice, registration becomes necessary or the activity needs to stop.
In a second example, a crypto-focused creator promotes a token without compensation. When that creator later joins an airdrop program tied to promotional tasks, the activity becomes compensated promotion. Disclosure obligations arise immediately and need to stay current. Linking to trading platforms and receiving payments from followers or platforms can also push the activity into trading facilitation.
In a third example, a creator promotes issuer securities for payment but hides the sponsorship because disclosure reduces engagement. Disclosure is buried behind “show more” links. Regulators treat this as a breach and move to enforcement. Not knowing the rules does not change the outcome.
Registered firms that work with finfluencers are expected to govern those relationships. That includes due diligence, written agreements, training, ongoing monitoring, and corrective action when content becomes misleading or non-compliant.
Order-execution-only dealers face added sensitivity. Because they cannot provide advice, regulators caution against indirectly enabling recommendations or registerable activity through referral arrangements, hosted content, outbound links, or copycat trading features.
For fintech platforms, this brings compliance into product design. Referral flows, creator landing pages, and trading enablement features all carry regulatory weight.
When issuers work with finfluencers, social media content counts as public disclosure. Issuers remain responsible for statements made on their behalf.
Regulators expect issuers to ensure content stays factual, balanced, consistent with filed disclosure, and clear about paid relationships. Issuers need to provide guidance and controls rather than leaving disclosure discipline to third parties.
Promotional shortcuts can surface later during diligence and capital raising.
Securities law applies regardless of whether content is created by a human, a digital avatar, or an AI system. Anyone deploying AI to generate investment related content remains responsible for that content as if they created it themselves.
For platforms experimenting with automated education or AI powered engagement, note that technology does not reduce accountability.
Finfluencer activity now sits firmly inside the regulatory perimeter. Data shows that influence impacts behaviour, and behaviour drives investment decisions. This new guidance gives founders, platforms, creators and issuers clarity. Teams that design content, monetization, referral flows, and product features with these expectations in mind can move faster with fewer surprises.
Teams that treat finfluencer activity as casual marketing often discover where the line sits only after they cross it. That is the practical message regulators are sending, and it is one the market needs to take seriously now.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Compliance | December 11, 2025

AI generated image
On December 10 2025 the CSA and CIRO released new findings from their second national review of Client Focused Reforms based on 105 firms. The update arrives in a year marked by a CSA record year of 1,011 investor alerts and outreach that reached more than 4.5 million Canadians.
With the imminent arrival of Canada's commercialization of open banking, and the country's work on faster payments and new digital asset rules, fintechs now face a more demanding compliance environment, and firms must focus on fixing gaps to prepare for what comes next.
Client Focused Reforms arrived in two stages across 2021. Conflicts of interest rules took effect in June 2021 and enhanced rules for know your client, know your product and suitability took effect at the end of 2021.
Regulators did a first sweep in 2022 to confirm whether firms built the foundation. They looked at updated forms, processes and governance. The first sweep focused on whether firms completed the initial implementation work required by the reforms rather than on how well those changes worked in daily practice.
The second sweep tests practical use. Firms have lived with these rules for more than three years. Regulators expected complete records, strong reasoning and evidence of care in client decisions.
Regulators found that some digital onboarding flows move too quickly for the level of detail the rules require.
They saw cases where firms collected risk tolerance but did not collect risk capacity.
They found broad financial ranges that did not support detailed decisions.
They found missing updates when clients changed jobs, retired or faced major life events.
They also saw records that did not show meaningful conversations with clients.
👉 Regulators want firms to gather clear and complete financial information and to treat risk tolerance and risk capacity as separate concepts. They expect client data to guide decisions, not follow them. They expect fintechs to show that a digital experience still produces real understanding.
Fintechs often use a select list of products, model portfolios or automated recommendations. Regulators looked closely at these choices and found cases where product review notes were thin or unclear.
They found approvals without evidence of analysis.
They found firms relying on affiliates even though each firm must complete its own review.
👉 Regulators want product evaluations that show how a firm reviewed the structure, features, risks and costs of a product before deciding to offer it to clients. This work guides what a firm chooses to place on its platform and how it ensures the product suits the clients who may use it. They want clear records that show why a product fits the platform and how the firm reached that decision. They expect firms to understand their products in a practical way and to document that understanding with simple and direct notes.
Suitability is where digital advice models face the most pressure. Regulators found decisions marked as suitable with little or no explanation.
They found missing concentration checks and liquidity checks.
They found limited cost comparison even when firms offered lower cost fund series.
They saw suitability records that did not update after product changes or after changes to the representative responsible for the account.
👉Regulators want suitability work that explains how the firm connected the client’s information to the recommendation. They want firms to consider exposure levels, liquidity needs, cost differences and alternatives. They want reasoning that shows why a recommendation or a model portfolio fits the client.
Fintechs can improve compliance by treating data, product analysis and suitability logic as design elements. Design and process can impact onboarding flows that gather clear information without slowing clients down.
Fintechs strengthen compliance when they update client profiles after major life events and use product files that link directly to real due diligence notes.
Clear concentration and liquidity checks inside the recommendation engine supports more reliable decisions.
Cost comparison helps firms show why a recommendation fits the client.
Investor education tools help clients understand their choices with more confidence.
Thoughtful use of AI can improve accuracy and consistency when firms understand which processes benefit most from automation.
Strong design choices make it easier to show good judgment and better care for clients.
The new CFR review arrives as Canada prepares for major changes in the financial system. Open banking will introduce structured data sharing and clearer expectations for permission and accuracy. Payments modernization will accelerate how money moves, supported by Canada’s payments innovation push toward faster rails. Digital asset rules will mature as Canada moves forward with the first draft of the national stablecoin framework.
These developments point in the same direction. Regulators expect firms to show strong reasoning, accurate information and clear documentation of decisions. Fintechs that build these strengths now will be able to handle the coming changes with confidence instead of surprise.
Good CFR practices support competitiveness and growth. Partners and investors look for firms that manage risk with care and clarity. Clients choose platforms they trust.
The CSA year in review reports 54 permanent bans imposed during the reporting period and 24 enforcement actions tied to crypto assets. This is why strong governance matters at a time when financial infrastructure is evolving.
Fintechs that build accurate data, consistent processes and quality supervision strengthen their position and gain credibility across the market.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |