Karsten Wenzlaff, Advisor
August 26th, 2025
Karsten Wenzlaff is a Crowdfunding and Fintech Expert from Germany. He is Secretary-General of Digit[...]
CSA Proposes NI 26-101 for Market Technology Integrity
October 1, 2026 | NCFA Market Activity | Capital Markets And Market Infrastructure, Cybersecurity And Fraud, Risk Compliance And Regtech, Regulation And Policy
Market Infrastructure, Technology Resilience And Future AI Rules
On October 1, 2026, the Canadian Securities Administrators proposed NI 26-101 Information Technology System Integrity, a national framework for technology systems used by marketplaces, clearing agencies, trade repositories, information processors and matching service utilities. The proposal would bring existing IT requirements into one instrument and make the rules more consistent across Canada's core capital market infrastructure. Comments close January 29, 2027.
The proposed rule is only the first phase. The CSA is also asking whether a second phase should add more explicit requirements for cybersecurity, cloud services, outsourced technology and artificial intelligence, and whether technology integrity rules should eventually reach a wider group of securities market participants.
NI 26-101 Consolidates Core Market Technology Rules
Canadian trading, clearing, reporting and market data systems already operate under technology requirements spread across several securities rules. NI 26-101 would consolidate those obligations into one national instrument and use more consistent language across the organizations that run critical market infrastructure.
See: AI Agents Probe Library and Archives Canada
The organizations in scope perform different jobs, but all depend on technology that can handle trading volume, stay available and recover when systems fail.
- Marketplaces operate exchanges and alternative trading systems such as the TSX and other regulated trading venues
- Clearing agencies support post trade clearing and settlement infrastructure
- Trade repositories collect derivatives transaction data for regulators, including designated repositories such as DTCC Data Repository
- Information processors consolidate and distribute market data, such as the TMX Information Processor
- Matching service utilities electronically match institutional trades before settlement
Canada is also adding new trading infrastructure. CIX Trading recently launched Canada's first new equity ATS in more than a decade, adding another venue to the systems brokers use for order routing, execution and market data. New entrants can increase competition, but every additional connection also raises the value of reliable infrastructure and clear operating standards.
The CSA describes Phase 1 primarily as consolidation and harmonization. It doesn't turn every technology risk discussed in the consultation into a new rule, and it should not be read as a new AI or cybersecurity regime.
Phase 2 Could Add Cyber, Cloud And AI Requirements
The Phase 2 consultation questions go further. The CSA is asking whether market infrastructure firms should face clearer cybersecurity requirements. That could include ongoing system monitoring, security testing, regular checks for weaknesses and exercises to see how well firms can recover from a cyber incident. Regulators are also asking whether outside experts should test these systems and whether serious findings should be reported.
The questions build on work the CSA is already doing elsewhere. A recent review of cybersecurity controls at registered firms looked at policies, risk assessments, oversight of outside technology providers and incident response. NI 26-101 starts with market infrastructure, but the consultation asks whether similar requirements should eventually reach other securities firms.
The CSA is also looking at cloud services and other outsourced technology. It wants feedback on where data is stored, how much firms rely on the same large providers, how risks are managed when suppliers depend on other suppliers, and how firms should oversee outside AI providers.
See: AI Agents Expose Weak Links in Financial Authorization
Artificial intelligence is not directly regulated by the proposed NI 26-101. For Phase 2, the CSA is asking whether firms should have specific AI risk controls, minimum oversight, clearer records of how AI is used and reporting when AI supports a critical system or service. Quantum computing, blockchain and tokenization are also listed as technologies that may need clearer treatment.
The future scope could extend beyond exchanges and clearing infrastructure. The CSA is asking whether registrant firms, investment fund issuers, benchmark administrators, regulation services providers and self regulatory authorities should also come under a wider technology integrity framework.
Compliance Costs Could Affect New Entrants
Stronger testing, cyber controls and oversight of outside technology providers would add costs for regulated firms. Large exchanges and clearing organizations already support extensive technology programs, while smaller venues and new infrastructure providers have fewer resources to absorb recurring testing, assurance and compliance work.
The cost of proving compliance is already rising across financial regulation. The CSA is asking whether future requirements should vary with an organization's role and importance to the market rather than apply the same standard to every participant.
That choice could affect how easily smaller firms compete while still meeting higher expectations for system reliability and security.
Talking Point
NI 26-101 would bring Canada's market technology rules into one framework. Phase 2 could extend that framework to cyber, cloud and AI controls. The key issue is whether regulators can strengthen resilience without making it too costly to build and operate new capital market infrastructure.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
|---|---|---|
 |  |  |
Leave a Reply