National Instrument 21-101 Marketplace Operation

AMENDMENTS TO NATIONAL INSTRUMENT 21-101 MARKETPLACE OPERATION

1. National Instrument 21-101 Marketplace Operation is amended by this Instrument.

2. Section 3.2 is amended

(a) in subsection (2) by replacing "seven" with "15",

(b) in paragraph (3)(a) by replacing "month" with "calendar quarter", and

(c) by adding the following subsection:

(6) For the purposes of subsection (5), if information in a marketplace's Form 21-101F1 or Form 21-101F2, as applicable, has not changed since the marketplace filed its most recent Form 21-101F1 or Form 21-101F2 under subsection (5), the marketplace may incorporate that information by reference into its updated and consolidated Form 21-101F1 or Form 21-101F2..

3. Subsection 4.2(1) is amended by deleting "the requirements outlined in".

4. Part 4 is amended by adding the following section:

4.3 Filing of Interim Financial Reports

A recognized exchange and a recognized quotation and trade reporting system must file interim financial reports for each interim period, within 60 days after the end of the interim period, prepared in accordance with paragraphs 4.1(1)(a) and (b)..

5. Subparagraph 12.1(a)(i) is replaced with the following:

(i) adequate internal controls over those systems, and.

6. Subparagraph 12.1(a)(ii) is amended by adding "cyber resilience," after "information security,".

7. Subparagraph 12.1(b)(ii) is amended by:

(a) adding "processing capability" after "determine the",

(b) deleting "ability",

(c) adding "perform" after "those systems to",

(d) deleting "process transactions", and

(e) deleting "and" after "efficient manner,".

8. Paragraph 12.1(c) is amended by:

(a) deleting "material",

(b) replacing "breach" wherever it occurs with "incident",

(c) adding "that is material" before "and provide timely", and

(d) adding ", and" at the end of the paragraph.

9. Section 12.1 is amended by adding the following paragraph:

(d) keep a record of any systems failure, malfunction, delay or security incident and identify whether or not it is material..

10. Section 12.1.1 is replaced with the following:

12.1.1 Auxiliary Systems -- For each system that shares network resources with one or more of the systems, operated by or on behalf of the marketplace, that supports order entry, order routing, execution, trade reporting, trade comparison, data feeds, market surveillance and trade clearing, that, if breached, would pose a security threat to one or more of the previously mentioned systems, a marketplace must

(a) develop and maintain adequate information security controls that relate to the security threats posed to any system that supports order entry, order routing, execution, trade reporting, trade comparison, data feeds, market surveillance and trade clearing,

(b) promptly notify the regulator, or in Québec, the securities regulatory authority and, if applicable, its regulation services provider, of any security incident that is material and provide timely updates on the status of the incident, the resumption of service, where applicable, and the results of the marketplace's internal review of the security incident, and

(c) keep a record of any security incident and identify whether or not it is material..

11. Part 12 is amended by adding the following section:

12.1.2 Vulnerability Assessments -- On a reasonably frequent basis and, in any event, at least annually, a marketplace must engage one or more qualified parties to perform appropriate assessments and testing to identify security vulnerabilities and measure the effectiveness of information security controls that assess the marketplace's compliance with paragraphs 12.1(a) and 12.1.1(a)..

12. Subsection 12.2(1) is replaced with the following:

(1) On a reasonably frequent basis and, in any event, at least annually, a marketplace must engage one or more qualified external auditors to conduct an independent systems review and prepare a report in accordance with established audit standards and best industry practices that assesses the marketplace's compliance with

(a) paragraph 12.1(a),

(b) section 12.1.1, and

(c) section 12.4..

13. Paragraph 12.2(2)(b) is replaced with the following:

(b) the regulator or, in Québec, the securities regulatory authority, by the earlier of

(i) the 30th day after providing the report to its board of directors or the audit committee, and

(ii) the 60th day after the report's completion..

14. In the following provisions "and" is replaced with "or":

(a) Paragraph 12.3(1)(a), and

(b) Paragraph 12.3(2)(a).

15. Paragraph 12.3(3.1)(a) is amended by replacing "(2)(a)" with "(2)(b)".

16. Subsection 12.4(3) is amended by replacing "marketplace" with "recognized exchange or quotation and trade reporting system".

17. Paragraph 14.5(a) is amended

(a) in subparagraph (i) by replacing "an adequate system of internal controls" with "adequate internal controls", and

(b) in subparagraph (ii) by adding "cyber resilience," after "information security,".

18. Subparagraph 14.5(b)(ii) is amended by:

(a) adding "processing capability" after "determine the",

(b) deleting "ability",

(c) adding "perform" after "those systems to", and

(d) deleting "process information".

19. Paragraph 14.5(c) is replaced with the following:

(c) on a reasonably frequent basis and, in any event, at least annually, engage one or more qualified external auditors to conduct an independent systems review and prepare a report in accordance with established audit standards and best industry practices that assesses the information processor's compliance with paragraph (a) and section 14.6,.

20. Subparagraph 14.5(d)(ii) is replaced with the following:

(ii) the regulator or, in Québec, the securities regulatory authority, by the earlier of the 30th day after providing the report to its board of directors or the audit committee and the 60th day after the report's completion,.

21. Paragraph 14.5(e) is replaced with the following:

(e) promptly notify the following of any systems failure, malfunction, delay or security incident that is material and provide timely updates on the status of the failure, malfunction, delay or security incident, the resumption of service, and the results of the information processor's internal review of the failure, malfunction, delay or security incident:

(i) the regulator or, in Québec, the securities regulatory authority;

(ii) any regulation services provider, recognized exchange or recognized quotation and trade reporting system monitoring trading of the securities about which information is provided to the information processor, and.

22. Section 14.5 is amended by adding the following paragraph:

(f) keep a record of any systems failure, malfunction, delay or security incident and identify whether or not it is material..

23. Part 14 is amended by adding the following section:

14.5.1 Vulnerability Assessments

On a reasonably frequent basis and, in any event, at least annually, an information processor must engage one or more qualified parties to perform appropriate assessments and testing to identify security vulnerabilities and measure the effectiveness of information security controls that assess the information processor's compliance with paragraph 14.5(a)..

24. Form 21-101F1 is amended by replacing the portion of the Form after the heading "EXHIBITS" and before the heading "Exhibit A -- Corporate Governance" with the following:

File all Exhibits with the Filing. For each Exhibit, include the name of the exchange or quotation and trade reporting system, the date of filing of the Exhibit and the date as of which the information is accurate (if different from the date of the filing). If any Exhibit required is inapplicable, a statement to that effect must be included instead of the Exhibit.

Except as provided below, if the filer, recognized exchange or recognized quotation and trade reporting system files an amendment to the information provided in its Filing and the information relates to an Exhibit filed with the Filing or a subsequent amendment, the filer, recognized exchange or recognized quotation and trade reporting system, must, in order to comply with subsection 3.2(1), (2) or (3) of National Instrument 21-101 Marketplace Operation, provide a description of the change and the actual or expected date of the implementation of the change, and file a complete and updated Exhibit. The filer must provide a blacklined version showing changes from the previous filing.

If the filer, recognized exchange or recognized quotation and trade reporting system has otherwise filed the information required by the previous paragraph pursuant to section 5.5 of National Instrument 21-101 Marketplace Operation, it is not required to file the information again as an amendment to an Exhibit. However, if supplementary material relating to a filed rule is contained in an Exhibit, an amendment to the Exhibit must also be filed..

25. Exhibit B of Form 21-101F1 is replaced with the following:

Exhibit B -- Ownership

In the case of an exchange or quotation and trade reporting system that is a corporation, other than an exchange or quotation and trade reporting system that is a reporting issuer, provide a list of the beneficial holders of 10 percent or more of any class of securities of the exchange or quotation and trade reporting system. For each listed security holder, provide the following:

1. Name.

2. Principal business or occupation and title, if any.

3. Ownership interest, including the total number of securities held, the percentage of the exchange or quotation and trade reporting system's issued and outstanding securities held, and the class or type of security held.

4. Whether the security holder has control (as interpreted in subsection 1.3(2) of National Instrument 21-101 Marketplace Operation).

In the case of an exchange or quotation and trade reporting system that is a partnership, sole proprietorship or other type of organization, provide a list of the registered or beneficial holders of the partnership interests or other ownership interests in the exchange or quotation and trade reporting system. For each person or company listed, provide the following:

1. Name.

2. Principal business or occupation and title, if any.

3. Nature of the ownership interest, including a description of the type of partnership interest or other ownership interest.

4. Whether the person or company has control (as interpreted in subsection 1.3(2) of National Instrument 21-101 Marketplace Operation)..

26. Section 1 of Exhibit C of Form 21-101F1 is amended by

(a) repealing Item 4, and

(b) repealing Item 5.

27. Exhibit D of Form 21-101F1 is amended by

(a) repealing Item 2 of section 2,

(b) repealing Item 5 of section 2, and

(c) repealing Item 6 of section 2.

28. Exhibit E of Form 21-101F1 is amended by

(a) deleting ", including a description of any co-location arrangements" in Item 2 after "services",

(b) repealing Item 7, and

(c) repealing Item 8.

29. Exhibit G of Form 21-101F1 is amended by

(a) replacing "high level" with "high-level" in Item 1 under "General",

(b) replacing "the Instrument" with "National Instrument 21-101 Marketplace Operation" in Item 2 under "General" and in Item 3 under "Systems", and

(c) replacing "are" with "is" in Item 2 under "IT Risk Assessment".

30. Form 21-101F2 is amended by replacing the portion of the Form after the heading "EXHIBITS" and before the heading "Exhibit A -- Corporate Governance" with the following:

File all Exhibits with the Initial Operation Report. For each Exhibit, include the name of the ATS, the date of filing of the Exhibit and the date as of which the information is accurate (if different from the date of the filing). If any Exhibit required is inapplicable, a statement to that effect must be included instead of the Exhibit.

If the ATS files an amendment to the information provided in its Initial Operation Report and the information relates to an Exhibit filed with the Initial Operation Report or a subsequent amendment, the ATS must, in order to comply with subsection 3.2(1), (2) or (3) of National Instrument 21-101 Marketplace Operation, provide a description of the change and the actual or expected date of the implementation of the change, and file a complete and updated Exhibit. The ATS must provide a blacklined version showing changes from the previous filing..

31. Exhibit B of Form 21-101F2 is replaced with the following:

Exhibit B -- Ownership

In the case of an ATS that is a corporation, other than an ATS that is a reporting issuer, provide a list of the beneficial holders of 10 percent or more of any class of securities of the ATS. For each listed security holder, provide the following:

1. Name.

2. Principal business or occupation and title, if any.

3. Ownership interest, including the total number of securities held, the percentage of the ATS's issued and outstanding securities held, and the class or type of security held.

4. Whether the security holder has control (as interpreted in subsection 1.3(2) of National Instrument 21-101 Marketplace Operation).

In the case of an ATS that is a partnership, sole proprietorship or other type of organization, provide a list of the registered or beneficial holders of the partnership interests or other ownership interests in the ATS. For each person or company listed, provide the following:

1. Name.

2. Principal business or occupation and title, if any.

3. Nature of the ownership interest, including a description of the type of partnership interest or other ownership interest.

4. Whether the person or company has control (as interpreted in subsection 1.3(2) of National Instrument 21-101 Marketplace Operation)..

32. Section 1 of Exhibit C of Form 21-101F2 is amended by

(a) repealing Item 4, and

(b) repealing Item 5.

33. Exhibit D of Form 21-101F2 is amended by

(a) repealing Item 2 of section 2, and

(b) repealing Item 5 of section 2.

34. Exhibit E of Form 21-101F2 is amended by

(a) deleting ", including a description of any co-location arrangements" in Item 2,

(b) repealing Item 7, and

(c) repealing Item 8.

35. Exhibit G of Form 21-101F2 is amended by

(a) replacing "high level" with "high-level" in Item 1 under "General",

(b) replacing "the Instrument" with "National Instrument 21-101 Marketplace Operation" in Item 2 under "General" and in Item 3 under "Systems", and

(c) replacing "are" with "is" in Item 2 under "IT Risk Assessment".

36. Part A of Form 21-101F3 is amended by

(a) repealing Item B in section 3,

(b) repealing Item C in section 3,

(c) repealing section 4,

(d) repealing section 5,

(e) repealing section 6, and

(f) repealing section 7.

37. Section 1 of Part B of Form 21-101F3 is amended by

(a) repealing Item 1 and Chart 1,

(b) repealing Item 2 and Chart 2,

(c) repealing Item 3 and Chart 3,

(d) repealing Item 4 and Chart 4,

(e) repealing Item 5 and Chart 5, and

(f) repealing Item 6 and Chart 6.

38. Section 2 of Part B of Form 21-101F3 is amended by

(a) repealing Item 3, and

(b) repealing Chart 9.

39. Form 21-101F5 is amended by replacing the portion of the Form after the heading "Exhibits" and before the heading "Exhibit A -- Corporate Governance" with the following:

File all Exhibits with the Initial Form. For each Exhibit, include the name of the information processor, the date of filing of the Exhibit and the date as of which the information is accurate (if different from the date of the filing). If any Exhibit required is inapplicable, a statement to that effect must be included instead of the Exhibit.

If the information processor files an amendment to the information provided in its Initial Form, and the information relates to an Exhibit filed with the Initial Form or a subsequent amendment, the information processor must, in order to comply with sections 14.1 and 14.2 of National Instrument 21-101 Marketplace Operation, provide a description of the change and the actual or expected date of the implementation of the change, and file a complete and updated Exhibit. The information processor must provide a blacklined version showing changes from the previous filing..

40. Section 1 of Exhibit C of Form 21-101F5 is amended by

(a) replacing "directors," with "officers," after "list of the partners,",

(b) repealing Item 4, and

(c) repealing Item 5.

41. Section 1 of Exhibit G of Form 21-101F5 is amended by replacing "National Instruments 21-101 and 23-101" with "National Instrument 21-101 Marketplace Operation and National Instrument 23-101 Trading Rules".

42. In the following provisions of Form 21-101F5, "National Instrument 21-101" is replaced with "National Instrument 21-101Marketplace Operation":

(a) Section 2 of Exhibit J,

(b) Section 1 of Exhibit K, and

(c) Exhibit M wherever the expression occurs.

43.

(1) The Instrument comes into force on September 14, 2020.

(2) In Saskatchewan, despite subsection (1), if this Instrument is filed with the Registrar of Regulations after September 14, 2020, this Instrument comes into force on the day on which it is filed with the Registrar of Regulations.