Changes to Companion Policy 21-101CP Marketplace Operation
Changes to Companion Policy 21-101CP Marketplace Operation
CHANGES TO
COMPANION POLICY 21-101CP MARKETPLACE OPERATION
1. The changes to Companion Policy 21-101CP are set out in this Schedule.
2. Section 1.1 is changed by replacing "Instruments," with "Instrument and N1 23-101," immediately before "which were adopted at a time when".
3. Subsection 2.1(1) is changed
(a) by replacing "Paragraphs (c) and (d)" with "Subparagraphs (a)(iii) and (a)(iv)" immediately before "of the definition of "marketplace"", and
(b) by replacing "of" with "for" immediately after "that internalizes its orders".
4. Subsection 2.1(8) is changed by replacing "paragraph (c)" with "subparagraph (a)(iii)" immediately after "to be operating a marketplace under".
5. Subsection 3.3(1) is changed by adding "Canadian" immediately after "exempted from this requirement by the".
6. Section 6.1 is changed by replacing subsection (4) with the following:
(4) Under subsection 3.2(1) of the Instrument, a marketplace is required to file an amendment to the information provided in Form 21-101F1 or Form 21-101F2, as applicable, at least 45 days prior to implementing a significant change. The Canadian securities regulatory authorities consider a significant change to be a change that could significantly impact a marketplace, its systems, its market structure, its marketplace participants or their systems, investors, issuers or the Canadian capital markets
A change would be considered to significantly impact the marketplace if it is likely to give rise to potential conflicts of interest, to limit access to the services of a marketplace, introduce changes to the structure of the marketplace or result in costs, such as implementation costs, to marketplace participants, investors or, if applicable, the regulation services provider.
The following types of changes are considered to be significant changes as they would always have a significant impact:
(a) changes in the structure of the marketplace, including procedures governing how orders are entered, displayed (if applicable), executed, how they interact, are cleared and settled;
(b) new or changes to order types, and
(c) changes in the fees and the fee model of the marketplace.
The following may be considered by the Canadian securities regulatory authorities as significant changes, depending on whether they have a significant impact:
(d) new or changes to the services provided by the marketplace, including the hours of operation;
(e) new or changes to the means of access to the market or facility and its services;
(f) new or changes to types of securities traded on the marketplace;
(g) new or changes to types of securities listed on exchanges or quoted on quotation and trade reporting systems;
(h) new or changes to types of marketplace participants;
(i) changes to the systems and technology used by the marketplace that support order entry, order routing, execution, trade reporting, trade comparison, data feeds, co-location and, if applicable, market surveillance and trade clearing, including those affecting capacity;
(j) changes to the corporate governance of the marketplace, including changes to the composition requirements for the board of directors or any board committees and changes to the mandates of the board of directors or any board committees;
(k) changes in control over marketplaces;
(l) changes in affiliates that provide services to or on behalf of the marketplace;
(m) new or changes in outsourcing arrangements for key marketplace services or systems; and
(n) new or changes in custody arrangements..
7. Section 6.1 is changed by replacing subsection (5) with the following:
(5) Changes to information in Form 21-101F1 or Form 21-101F2 that
(a) do not have a significant impact on the marketplace, its market structure, marketplace participants, investors, issuers or the Canadian capital markets, or
(b) are housekeeping or administrative changes such as
(i) changes in the routine processes, policies, practices, or administration of the marketplace,
(ii) changes due to standardization of terminology,
(iii) corrections of spelling or typographical errors,
(iv) necessary changes to conform to applicable regulatory or other legal requirements,
(v) minor system or technology changes that would not significantly impact the system or its capacity, and
(vi) changes to the list of marketplace participants and the list of all persons or entities denied or limited access to the marketplace,
would be filed in accordance with the requirements outlined in subsection 3.2(3) of the Instrument..
8. Subsection 6.1(6) is changed
(a) by replacing "The" with "As indicated in subsection (4) above, the" at the beginning of the subsection,
(b) by removing "generally" immediately after "Canadian securities regulatory authorities", and
(c) by replacing "fee structure" wherever it occurs with "fee model".
9. Section 6.1 is changed by adding the following subsections:
(8.1) In order to ensure records regarding the information in a marketplace's Form 21-101F1 or Form 21-101F2 are kept up to date, subsection 3.2(4) of the Instrument requires the chief executive officer of a marketplace to certify, within 30 days after the end of each calendar year, that the information contained in the marketplace's Form 21-101F1 or Form 21-101F2 as applicable, is true, correct and complete and the marketplace is operating as described in the applicable form. This certification is required at the same time as the updated and consolidated Form 21-101F1 or Form 21-101F2, as applicable, is required to be filed pursuant to subsection 3.2(5) of the Instrument. The certification under subsection 3.2(4) is also separate and apart from the form of certification in Form 21-101F1 and Form 21-101F2.
(8.2) The Canadian securities regulatory authorities expect that the certifications provided pursuant to subsection 3.2(4) of the Instrument will be preserved by the marketplace as part of its books and records obligation under Part 11 of the Instrument..
10. Subsection 6.1(9) is changed by adding "calendar" before "quarter" wherever it occurs.
11. Section 7.7 is changed by adding the following subsections:
(0.1) The Canadian securities regulatory authorities are of the view that it is in the public interest for capital markets research to be conducted. Since marketplace participants' order and trade information may be needed to conduct this research, subsection 5.10(1.1) of the Instrument allows a marketplace to release a marketplace participant's order or trade information without obtaining its written consent, provided this information is used solely for capital markets research and only if certain terms and conditions are met. Subsection 5.10(1.1) is not intended to impose any obligation on a marketplace to disclose information if requested by a researcher and the marketplace may choose to maintain its marketplace participants' order and trade information in confidence. However, if the marketplace decides to disclose this information, it must ensure that certain terms and conditions are met to ensure that the marketplace participant's information is not misused.
(0.2) In order for a marketplace to disclose a marketplace participant's order or trade information, subparagraphs 5.10(1.1)(a)-(b) of the Instrument require a marketplace to reasonably believe that the information will be used by the recipient solely for the purposes of capital markets research and to reasonably believe that if information identifying, directly or indirectly, a marketplace participant, or a client of the marketplace participant is released, the information is necessary for the research and that the purpose of the research is not intended to identify the marketplace participant or client or to identify a trading strategy, transactions, or market positions of the marketplace participant or client. The Canadian securities regulatory authorities expect that a marketplace will make sufficient inquiries of the recipient of the information in order for the marketplace to sustain a reasonable belief that the information will be used by the recipient only for capital markets research. Where the information to be released to the recipient could identify a marketplace participant or a client of a marketplace participant, the Canadian securities regulatory authorities also expect the marketplace to make sufficient inquiries of the recipient in order for the marketplace to sustain a reasonable belief that the information identifying, directly or indirectly, a marketplace participant or its client is required for purposes of the research and that the purpose of the research is not to identify a particular marketplace participant or a client of the marketplace participant or to identify a trading strategy, transactions, or market positions of a particular marketplace participant or a client of the marketplace participant.
(0.3) In considering releasing order or trade information, the Canadian securities regulatory authorities expect a marketplace to exercise caution regarding information that could disclose the identity of a marketplace participant or client of the marketplace participant. In particular, a marketplace may only release information in any order entry field that would identify the marketplace participant or client, using a broker number, trader ID, or DEA client identifier, if it reasonably believes that this information is required for the research.
(0.4) Subparagraph 5.10(1.1)(c) of the Instrument requires a marketplace that intends to provide its marketplace participants' order and trade information to a researcher to enter into a written agreement with each person or company that will receive such information. Subparagraph 5.10(1.1)(c)(i) of the Instrument requires the agreement to provide that the person or company agrees to use the order and trade information only for capital markets research purposes. In the view of the Canadian securities regulatory authorities, commercialization of the information by the recipient, for example by using the information for the purposes of trading, advising others to trade or for reverse engineering a trading strategy, would not constitute use of the information for capital markets research purposes.
(0.5) Subparagraph 5.10(1.1)(c)(i) of the Instrument provides that the agreement must also prohibit the recipient from sharing the marketplace participants' order and trade data with any other person or company, such as a research assistant, without the marketplace's consent. The marketplace will be responsible for determining what steps are necessary to ensure the other person or company receiving the marketplace participants' data is not misusing this data. For example, the marketplace may enter into a similar agreement with each individual or company that has access to the data.
(0.6) To protect the identity of particular marketplace participants or their customers, subparagraph 5.10(1.1)(c)(i) of the Instrument requires the agreement to provide that recipients will not publish or disseminate data or information that discloses, directly or indirectly, a trading strategy, transactions, or market positions of a marketplace participant or its clients. Also, to protect the confidentiality of the data, the agreement must require that the order and trade information is securely stored at all times and that the data is kept for no longer than a reasonable period of time following the completion of the research and publication process.
(0.7) The agreement must also require that the marketplace be notified of any breach or possible breach of the confidentiality of the information. Marketplaces are required to notify the appropriate securities regulatory authorities of the breach or possible breach and have the right to take all reasonable steps necessary to prevent or address a breach or possible breach of the agreement or of the confidentiality of the information provided. In the view of the Canadian securities regulatory authorities, reasonable steps in the event of an actual or apparent breach of the agreement or of the confidentiality of the information may include the marketplace seeking an injunction preventing any unauthorized use or disclosure of the information by a recipient.
(0.8) Subparagraph 5.10(1.1)(c)(ii) of the Instrument provides for a limited carve-out from the restraints on the use and disclosure of the information by a recipient for purposes of allowing those conducting peer reviews of the research to have access to the data to verify the research prior to the publication of the results of the research. In particular, clause 5.10(1.1)(c)(ii)(C) requires a marketplace to enter into a written agreement with a person or company receiving order or trade information from the marketplace that provides that the person or company may disclose information used in connection with research submitted to a publication so long as the person or company obtains a written agreement from the publisher and anyone involved in the verification of the research that provides for certain restrictions on the use and disclosure of the information by the publisher or the other person or company. A marketplace may consider requiring a person or company that proposes to disclose order or trade information pursuant to subparagraph 5.10(1.1)(c)(ii) to acknowledge that it has obtained the agreement required by clause 5.10(1.1)(c)(ii)(C) at the time that it notifies the marketplace prior to disclosing the information for verification purposes, as required by clause 5.10(1.1)(c)(ii)(B)..
12. Subsection 7.7(1) is changed by replacing "shall" with "must".
13. Companion Policy 21-101CP is changed by adding the following section:
7.10 Access Arrangements with a Service Provider -- If a third party service provider provides a means of access to a marketplace, section 5.13 of the Instrument requires the marketplace to ensure the third party service provider complies with the written standards for access the marketplace has established pursuant to paragraph 5.1(2)(a) of the Instrument when providing access services. A marketplace must establish written standards for granting access to each of its services under paragraph 5.1(2)(a) and the Canadian securities regulatory authorities are of the view that it is the responsibility of the marketplace to ensure that these written standards are complied with when access to its platform is provided by a third party..
14. Section 9.1 is changed by replacing subsection (2) with the following:
(2) In complying with sections 7.1 and 7.2 of the Instrument, any information provided by a marketplace to an information processor or information vendor must include identification of the marketplace and should contain all relevant information including details as to volume, symbol, price and time of the order or trade..
15. Section 9.1 is changed by adding the following subsection:
(2.1) Subsections 7.1(3) and 7.2(2) prohibit a marketplace from making available order and trade information to any person or company before it makes the information available to the information processor or, if there is no information processor, to an information vendor. The Canadian securities regulatory authorities acknowledge that there may be differences between the time at which a marketplace participant that takes in market data directly from a marketplace receives the order and trade information and the time at which a marketplace participant that takes in market data from the information processor receives the information. However, in complying with subsections 7.1(3) and 7.2(2) of the Instrument, the Canadian securities regulatory authorities expect that marketplaces will release order and trade information simultaneously to both the information processor and to persons or companies that may receive order and trade information directly from the marketplace..
16. Section 14.1 is changed by adding "whether operating in-house or outsourced." immediately after "section 12.1 of the Instrument".
17. Subsection 14.1(1) is changed
(a) by adding "® 5 Management Guidelines," immediately after "COBIT", and
(b) by adding ", © 2012 ISACA, IT Infrastructure Library (ITIL) -- Service Delivery best practices, ISO/IEC27002:2005 -- Information technology -- Code of practice for information security management." Immediately after "IT Governance Institute".
18. Section 14.1 is changed by adding the following subsection:
(2.1) Paragraph 12.1(c) of the Instrument refers to a material security breach. A material security breach or systems intrusion is any unauthorized entry into any of the systems that support the functions listed in section 12.1 of the Instrument or any system that shares network resources with one or more of these systems. Virtually any security breach would be considered material and thus reportable to the regulator. The onus would be on the marketplace to document the reasons for any security breach it did not consider material. Marketplaces should also have documented criteria to guide the decision on when to publicly disclose a security breach. The criteria for public disclosure of a security breach should include, but not be limited to, any instance in which client data could be compromised. Public disclosure should include information on the types and number of participants affected..
19. Section 14.1 is changed by replacing subsection (3) with the following:
(3) Subsection 12.2(1) of the Instrument requires a marketplace to engage a qualified party to conduct an annual independent assessment to ensure that the marketplace is in compliance with paragraph 12.1(a), section 12.1.1 and section 12.4 of the Instrument. The focus of the assessment of any systems that share network resources with trading-related systems required under subsection 12.2(1)(b) would be to address potential threats from a security breach that could negatively impact a trading-related system. A qualified party is a person or company or a group of persons or companies with relevant experience in both information technology and in the evaluation of related internal controls in a complex information technology environment, such as external auditors or third party information system consultants. Before engaging a qualified party, a marketplace should discuss its choice with the regulator or, in Québec, the securities regulatory authority..
20. Section 14.1 is changed by adding the following subsection:
(3.1) The Canadian securities regulatory authorities also note the critical importance of an appropriate system of cyber-security controls over the systems described in section 12.1 of the Instrument. We further note that, as a matter of best practices, marketplaces may also conduct a vulnerability assessment of these controls in addition to the independent systems review required by subsection 12.2(1) of the Instrument. To the extent that a marketplace carries out, or engages an independent party to carry out on its behalf, a vulnerability assessment and prepares a report of that assessment as part of the development and maintenance of the controls required by section 12.1 of the Instrument, we expect a marketplace to provide that report to the regulator or, in Québec, the securities regulatory authority in addition to the report required to be provided by subsection 12.2(2) of the Instrument..
21. Subsection 14.2(1) is changed by adding the following paragraph:
The Canadian securities regulatory authorities consider a material change to a marketplace's technology requirements to include a change that would require a person or company interfacing with or accessing the marketplace to incur a significant amount of systems-related development work or costs in order to accommodate the change or to fully interact with the marketplace as a result of the change. Such material changes could include changes to technology requirements that would significantly impact a marketplace participant's trading activities, such as the introduction of an order type, or significant changes to a regulatory feed that a regulation services provider takes in from the marketplace..
22. Section 14.2 is changed by adding the following subsections:
(2.1) Paragraph 12.3(3)(c) of the Instrument prohibits a marketplace from beginning operations before the chief information officer of the marketplace, or an individual performing a similar function, has certified in writing that all information technology systems used by the marketplace have been tested according to prudent business practices and are operating as designed. This certification may be based on information provided to the chief information officer from marketplace staff knowledgeable about the information technology systems of the marketplace and the testing that was conducted.
(2.2) In order to help ensure that appropriate testing procedures for material changes to technology requirements are being followed by the marketplace, subsection 12.3(3.1) of the Instrument requires the chief information officer of the marketplace, or an individual performing a similar function, to certify to the regulator or securities regulatory authority, as applicable, that a material change has been tested according to prudent business practices and is operating as designed. This certification may be based on information provided to the chief information officer from marketplace staff knowledgeable about the information technology systems of the marketplace and the testing that was conducted..
23. Companion Policy 21-101CP is changed by adding the section:
14.2.1 Uniform Test Symbols
(1) Section 12.3.1 of the Instrument requires a marketplace to use uniform test symbols for the purpose of performing testing in its production environment. In the view of the Canadian securities regulatory authorities, the use of uniform test symbols is in furtherance to a marketplace's obligations at section 5.7 of the Instrument to take all reasonable steps to ensure that its operations do not interfere with fair and orderly markets.
(2) The use of uniform test symbols is intended to facilitate the testing of functionality in a marketplace's production environment; it is not intended to enable stress testing by marketplace participants. The Canadian securities regulatory authorities are of the view that a marketplace may suspend access to a test symbol where its use in a particular circumstance reasonably represents undue risk to the operation or performance of the marketplace's production environment. The Canadian securities regulatory authorities also note that misuse of the test symbols by marketplace participants could amount to a breach of the fair and orderly markets provisions of National Instrument 23-103 Electronic Trading and Direct Electronic Access to Marketplaces..
24. Companion Policy 21-101CP is changed by replacing section 14.3 with the following:
14.3 Business Continuity Planning
(1) Section 12.4 of the Instrument requires that marketplaces develop and maintain reasonable business continuity plans, including disaster recovery plans. Business continuity planning should encompass all policies and procedures to ensure uninterrupted provision of key services regardless of the cause of potential disruption. In fulfilling the requirement to develop and maintain reasonable business continuity plans, the Canadian securities regulatory authorities expect that marketplaces are to remain current with best practices for business continuity planning and to adopt them to the extent that they address their critical business needs.
(2) Paragraph 12.4(1)(b) of the Instrument also requires a marketplace to test its business continuity plans, including disaster recovery plans, according to prudent business practices on a reasonably frequent basis and, in any event, at least annually.
(3) Section 12.4 of the Instrument also establishes requirements for marketplaces meeting a minimum threshold of total dollar value of trading volume, recognized exchanges or quotation and trade reporting systems that directly monitor the conduct of their members, and regulation services providers that have entered into a written agreement with a marketplace to conduct market surveillance to establish, implement, and maintain policies and procedures reasonably designed to ensure that critical systems can resume operation within certain time limits following the declaration of a disaster. In fulfilling the requirement to establish, implement and maintain the policies and procedures prescribed by section 12.4, the Canadian securities regulatory authorities expect that these policies and procedures will form part of the entity's business continuity and disaster recovery plans and that the entities subject to the requirements at subsections 12.4(2) to (4) of the Instrument will be guided by their own business continuity plans in terms of what constitutes a disaster for purposes of the requirements..
25. Companion Policy 21-101CP is changed by adding the following section:
14.4 Industry-Wide Business Continuity Tests -- Section 12.4.1 of the Instrument requires a marketplace, recognized clearing agency, information processor, and participant dealer to participate in all industry-wide business continuity tests, as determined by a regulation services provider, regulator, or in Québec, the securities regulatory authority. The Canadian securities regulatory authorities expect that marketplaces will make their production environments available for purposes of all industry-wide business continuity tests..
26. Section 15.1 is changed
(a) by deleting "that" immediately after "Subsection 13.1(1) of the Instrument requires",
(b) by replacing "shall" with "to" immediately after "trades executed through a marketplace", and
(c) by removing "either" immediately after "registered as a dealer under securities legislation".
27. Companion Policy 21-101CP is changed by adding the following section:
15.2 Access to Clearing Agency of Choice -- As a general proposition, marketplace participants should have a choice as to the clearing agency that they would like to use for the clearing and settlement of their trades, provided that such clearing agency is appropriately regulated in Canada. Subsection 13.2(1) of the Instrument thus requires a marketplace to report a trade in a security to a clearing agency designated by a marketplace participant.
The Canadian securities regulatory authorities are of the view that where a clearing agency performs only clearing services (and not settlement or depository services) for equity or other cash-product marketplaces in Canada, it would need to have access to the existing securities settlement and depository infrastructure on non-discriminatory and reasonable commercial terms.
Subsection 13.2(2) of the Instrument provides that subsection 13.2(1) does not apply to trades in standardized derivatives or exchange-traded securities that are options..
28. Subsection 16.2 is changed by inserting "In Québec, a person or company may carry on the activity of an information processor only if it is recognized by the securities regulatory authority." after "to act as an information processor.".
29. Section 16.3 is changed in the heading of the section by replacing "to" with "in".
30. Companion Policy 21-101CP is changed by adding the following section:
16.3.1 Filing of Financial Statements -- Subsection 14.4(6) of the Instrument requires an information processor to file annual audited financial statements within 90 days after the end of its financial year. However, where an information processor is operated as a division or unit of a person or company, which may be a marketplace, clearing agency, issuer or any other person or company, the person or company must file an income statement, a statement of cash flow and any other information necessary to demonstrate the financial condition of the information processor. In this case, the income statement, statement of cash flow and other necessary financial information pertaining to the operation of the information processor may be unaudited..
31. These changes become effective on October 1, 2015.