OSC Argosy decisions: KYC risk tolerance and a suspended UDP
Two Ontario Securities Commission decisions on Argosy Securities: a representative suspended after misstating clients' risk tolerance, the firm's top executive suspended, and what compliance teams should check.
By Alberto RosasCo-founder & CEO, DiditUpdated 
In short
The OSC Argosy decision is really two documents from a Director of the Ontario Securities Commission (OSC), both dated 8 September 2026. One gives the reasons for a suspension ordered on 13 July 2026: an Argosy Securities representative had admitted misstating two retirees' risk tolerance on their Know Your Client (KYC) forms.[1] The other suspends the firm's top executive and keeps the firm registered under new terms.[2]
- Compliance staff caught the problem and escalated it. The Director found the executive they told failed to act effectively.[2]
- No fine was ordered. The outcomes are suspensions, one reinstatement and new terms on the firm.[2]
- No request for review was listed at the Capital Markets Tribunal on 6 October 2026.[9]
In Canadian securities law, Know Your Client means more than checking who a person is. A dealer must also record the client's finances, goals, knowledge and risk profile, and then test every recommendation against that record.[4] If the record is wrong, the test passes products it should stop.
That is what the OSC's staff found at Argosy Securities Inc., an Ontario investment dealer and a member of the Canadian Investment Regulatory Organization (CIRO).[1]
What the OSC decided about Argosy Securities
The first document gives the reasons for suspending a dealing representative registered with Argosy since 30 July 2009. OSC staff told him on 9 January 2026 that they recommended suspension. He waived his right to be heard on 13 July 2026, and the Director suspended him the same day under section 28 of Ontario's Securities Act.[1]
The reasons set out staff's findings. In October 2021 Argosy introduced a policy that treated exempt market products (securities sold without a prospectus) as high risk and required compliance to approve each trade first. In July 2022, the reasons say, Argosy's compliance team questioned him about his assessment of the risk tolerance of two retirees, and he "admitted to deliberately misrepresenting the risk tolerance in their KYC forms".[1]
A month later he recommended two $100,000 investments in the same exempt market product to a retired couple with a combined income of less than $30,000 a year. Compliance rejected the trades as unsuitable because they would have exceeded the firm's concentration limits. Staff also found unauthorized trading in August 2022 and abusive emails to compliance officers who objected.[1]
The Director concluded that he "lacks the requisite proficiency and integrity and is, therefore, unsuitable for continued registration."[1]
The second decision deals with the firm, its chief executive, and a chief compliance officer (CCO) who held that post from November 2020 to February 2024 and applied to be reinstated. The chief executive was also the firm's Ultimate Designated Person (UDP), the registered individual who must supervise and promote compliance, and its acting CCO since February 2024.[2]
| Registrant | Outcome | The Director's stated basis |
|---|---|---|
| The dealing representative | Suspended on 13 July 2026 | Lacks the requisite proficiency and integrity[1] |
| The chief executive and UDP | Suspended as UDP of Argosy, and as UDP and dealing representative of Keybase Financial Group Inc. | Lacks the requisite integrity and proficiency; integrity attaches to the person, whatever the category of registration[2] |
| The CCO seeking reinstatement | Reinstatement as CCO of Argosy approved | Errors of judgment, but not indifference to compliance; no lack of integrity found[2] |
| Argosy Securities Inc. | Stays registered, with additional terms | The record is serious, but the evidence does not establish a firm-wide lack of honesty, competence or compliance capability[2] |
The Director separated what compliance staff did from what happened to their warnings. The principal failure, the Director wrote, occurred when the chief executive "overrode, minimized or mischaracterized those concerns and determined that they did not warrant disciplinary action or regulatory reporting."[2]
What the Director found worked
The compliance function
- Identified breaches of the exempt product policy
- Withheld approval and rejected unsuitable trades
- Contacted clients where necessary
- Escalated the risk-profile issue to the UDP
Decision, paragraphs 102 and 116
What the Director found failed
The response at the top
- Requests to intervene ignored or answered late
- Pre-approval breaches called a "minor breach"
- A $66,000 FINTRAC penalty not disclosed as NI 33-109 requires
- An email urging a call before staff "commit a paper trail"
Decision, paragraphs 116, 118 and 121
Findings of the OSC Director in the decision of 8 September 2026.[2]
The firm contested much of this. Argosy submitted that flagged trades were rejected "with no loss suffered by those clients", and the chief executive submitted that his 30 September 2024 email only aimed to cut routine messages. The Director found the email concerning, saying an instruction that could discourage written records of compliance matters was inconsistent with his duties, and noted that no allegations of fraud, misappropriation or self-dealing were made against him.[2]
The rules behind it: KYC, risk profile and who answers for them
Three layers of rules meet here. The Securities Act decides who may stay registered.[3] National Instrument 31-103 (NI 31-103) sets the KYC and suitability duties and the duties of the UDP and CCO.[4] CIRO's rules repeat those duties for its dealer members and say who carries them.[5]
Rule 3209(1)CIRO Investment Dealer and Partially Consolidated Rules
"Compliance with the Corporation requirements relating to know-your-client is primarily the responsibility of the Registered Representative, Portfolio Manager or Associate Portfolio Manager assigned to the client account."
Source: CIRO, Investment Dealer and Partially Consolidated Rules, 27 April 2026[5]
Rule 3209(2) adds: "The responsibility in subsection 3209(1) must not be delegated to any other person." Rule 3406 says the same for suitability.[5] These are today's rule numbers. The conduct dates from 2021 to 2023, and the Director found that under each set of rules in force over that period, KYC and suitability compliance "was, and continues to be, the primary responsibility of the registered representative assigned to the account."[1]
| Rule | What it requires | Role in the case |
|---|---|---|
| NI 31-103, s. 13.2(2) | Establish the client's identity, and collect personal and financial circumstances, needs and objectives, knowledge, risk profile and time horizon[4] | The misstated field was part of the risk profile |
| NI 31-103, s. 13.3(1) | Suitability, including the concentration of securities in the account, with the client's interest first[4] | Trades rejected for concentration |
| CIRO Rules 3202, 3209, 3402, 3406 | The same duties for dealer members; the representative is primarily responsible and cannot delegate[5] | Current numbering of the duties the representative was found to have breached |
| NI 31-103, s. 5.1 and 5.2 | The UDP supervises and promotes compliance; the CCO monitors and reports non-compliance to the UDP[4] | Non-compliance found against the executive |
| Securities Act, s. 27(2), 28, 31 | Proficiency, solvency and integrity; suspension at any time; a right to be heard first[3] | The power the Director used |
Note
Risk tolerance is only half of a risk profile. In Joint Staff Notice 31-368 of 10 December 2025, the Canadian Securities Administrators (CSA) and CIRO separate risk tolerance (willingness to accept risk) from risk capacity (ability to endure financial loss) and say the overall profile "should reflect the lower of the two."[6]
Who the Argosy decisions affect
The decisions bind only the four registrants. Their reasoning speaks to every dealer under the same rules.
| Who | Why it matters | What to take from it |
|---|---|---|
| Registered representatives | KYC and suitability are personal and cannot be delegated[5] | A form adjusted to fit a product is an integrity issue, not a paperwork one[1] |
| UDPs and chief executives | Section 5.1 duties to supervise and promote compliance[4] | Ignoring or delaying a compliance escalation can end a registration[2] |
| CCOs and compliance staff | Section 5.2 duty to monitor and report[4] | Documented escalation protected both the CCO and the firm[2] |
| Boards of owner-led dealers | The firm was kept, on condition of independence from its chief executive[2] | Expect governance terms, not only fines |
The new terms are specific. Argosy must ensure that the suspended executive does not perform, influence or interfere with the work of the UDP or CCO, including hiring, supervising, dismissing or paying compliance staff. The firm's UDP or most senior decision maker must be independent of him. The board must keep at least four members, and every new director must be independent too. Immediate family members and former employees do not count as independent.[2]
Timeline: from the policy to the decisions
- October 2021PolicyArgosy requires pre-approval of exempt market trades.
- July 2022AdmissionThe representative admits misstating two retirees' risk tolerance.
- 9 January 2026RecommendationOSC staff notify the registrants of their recommendations.
- 13 July 2026SuspensionThe representative waives his hearing and is suspended.
- 8 September 2026DecisionsReasons issued; the UDP is suspended; new terms for the firm.
Dates from the two Director's decisions.[1][2]
The Director also weighed a $66,000 penalty that the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) imposed on the firm on 12 September 2024 for three compliance programme violations, which the firm did not disclose to the OSC as National Instrument 33-109 requires, and staff's finding of inaccuracies in 8 monthly attestations to the OSC and CIRO.[2][7]
What compliance teams should do now
A practical list, drawn from what the Director examined:
- Record risk tolerance and risk capacity as two separate answers on every KYC form.[6]
- Set the overall risk profile to the lower of the two, and document any exception.[6]
- Have the client confirm the accuracy of the KYC information.[5]
- Compare each form change with the trade that followed it, by representative.
- Review KYC information at least every 36 months, and every 12 months for managed and discretionary accounts.[5]
- Put every escalation to the UDP in writing, with a date and a requested action.[4]
- Check each attestation or regulatory filing against the compliance log before signing.[2]
- Ask whether a penalty from another regulator must be reported to your securities regulator.[2]
1Compliance finds a KYC or suitability problem
Reject the trade, contact the client, write it down.
2The CCO reports to the UDP
Section 5.2 of NI 31-103: as soon as possible when there is a risk of harm or a pattern.
The UDP acts on the report
Investigate and discipline
Timely, proportionate, documented.
Take it to the board
Keep the written record; section 5.2(d) has the CCO report to the board each year.
3Reflect it in regulatory reporting
Attestations and required reports match the log.
An escalation path built on sections 5.1 and 5.2 of NI 31-103.[4] The board step is a suggestion, not a quoted rule.
What is still open, as of 6 October 2026
Both decisions are in effect. Under section 8 of the Securities Act, a directly affected person may ask the Capital Markets Tribunal for a hearing and review within thirty days after the notice of the decision is mailed, and the Tribunal may extend that time. A decision under review still takes effect at once unless the Tribunal grants a stay.[3]
Watch out
The review window had not clearly closed on 6 October 2026. The OSC's own page counts 30 days from the date of the decision, which for 8 September runs to 8 October 2026.[8] The Tribunal's public search listed no 2026 proceeding about either decision on 6 October 2026, but a request made in time may not appear yet.[9]
The decision does not name a new UDP, and it does not state any change to the executive's positions as chief executive, director or shareholder.[2] We found no follow-up release from the OSC or CIRO after 8 September 2026, only trade press coverage.[10]
How Didit helps with the identity side of KYC
First, the scope. Didit does not assess risk tolerance, risk capacity or suitability, and it does not supervise representatives or sign attestations. Those duties stay with the registrant and its people. What Didit covers is the first line of the same rule, establishing the client's identity, through identity verification.[4]
- Document capture, near-field communication (NFC) chip reading, liveness and face match for 14,000+ document types in 220+ countries and territories. A full KYC check costs $0.33; see pricing.
- Anti-money laundering (AML) screening against 1,300+ sanctions, politically exposed person (PEP) and watchlists at $0.20 per check, with ongoing monitoring at $0.07 per person per year.
- Business verification with linked identity checks for owners and officers, for corporate clients where the rule asks who holds more than 25% of the votes.[4]
- Evidence of every check, manual review and four-eyes approval, and retention you set from 1 month to 10 years.
Didit provides
- Identity checks by document, chip and face
- Sanctions, PEP and watchlist screening
- The evidence of each check
Stays with you
- The risk profile and the suitability determination
- Supervision, discipline and escalation
- Attestations, regulatory reports and the liability
Get the identity step of KYC on record
Verify who the client is and keep the evidence, so your team can spend its time on the judgment calls.
Key takeaways
- A representative who admitted misstating two retirees' risk tolerance was suspended on 13 July 2026; the reasons are dated 8 September 2026.[1]
- Under CIRO Rule 3209, as under the rules before it, KYC is the representative's own responsibility and cannot be delegated.[1][5]
- The firm's compliance staff escalated; the UDP who failed to act effectively lost his registrations.[2]
- Argosy stays registered only on terms that keep the suspended executive away from compliance.[2]
- No fine was ordered, and no review request was listed on 6 October 2026.[2][9]
Frequently asked questions
What did the OSC decide about Argosy Securities?
Two documents are dated 8 September 2026. One gives the Director's reasons for suspending an Argosy dealing representative on 13 July 2026.[1] The other suspends the registrations of the firm's chief executive and Ultimate Designated Person, approves the reinstatement of its chief compliance officer and adds terms to the firm's registration.[2]
Why was the Argosy representative suspended?
The Director found he lacked the proficiency and integrity required for registration. The evidence included his admission that he deliberately misrepresented the risk profile of vulnerable clients on their KYC forms, and unauthorized trading.[1]
Can a representative delegate KYC to the compliance team?
No. CIRO Rule 3209 makes KYC compliance primarily the responsibility of the representative assigned to the account and says it must not be delegated to any other person. Rule 3406 says the same for suitability.[5]
What is the difference between risk tolerance and risk capacity?
Risk tolerance is the client's willingness to accept risk. Risk capacity is the client's ability to endure a financial loss. Joint CSA/CIRO Staff Notice 31-368 says both should be assessed separately and the overall risk profile should reflect the lower of the two.[6]
Was Argosy Securities fined?
Not in these decisions. The outcomes are suspensions, one approved reinstatement and additional terms.[2] Separately, FINTRAC imposed a $66,000 administrative monetary penalty on the firm on 12 September 2024 for three compliance programme violations, announced on 13 February 2025.[7]
Why did the firm keep its registration?
The Director found that compliance staff had identified, documented and escalated the concerns. The firm remains suitable for registration provided the suspended chief executive no longer controls or influences its compliance and risk management.[2]
Can the Argosy decisions be reviewed?
Yes. Section 8 of Ontario's Securities Act lets a directly affected person request a hearing and review by the Capital Markets Tribunal within thirty days after the notice of the decision is mailed, a date the decisions do not state.[3] The Tribunal's public search listed no 2026 proceeding about either decision on 6 October 2026.[9]
Does identity verification software cover investment KYC?
Only part of it. NI 31-103 requires a registrant to establish the client's identity and also to collect the information behind a suitability determination, including the risk profile.[4] Didit verifies identity and screens against sanctions and watchlists. It does not assess risk tolerance or suitability.
Sources
- Reasons for Decision with respect to Radoslaw "Radek" Chrabalowski (Opportunity to be Heard under Section 31 of the Act), Ontario Securities Commission, Director, 8 September 2026.
- Decision of the Director with respect to Dax Sukhraj, Ilia Katerli, and Argosy Securities Inc., Ontario Securities Commission, 8 September 2026.
- Securities Act, R.S.O. 1990, c. S.5, Government of Ontario, e-Laws, sections 8, 27, 28 and 31.
- National Instrument 31-103 Registration Requirements, Exemptions and Ongoing Registrant Obligations, Ontario Securities Commission, unofficial consolidation current to 13 September 2023, sections 5.1, 5.2, 11.1, 13.2 and 13.3.
- Investment Dealer and Partially Consolidated Rules, Canadian Investment Regulatory Organization, 27 April 2026, Rules 3202, 3209, 3402 and 3406.
- Joint CSA/CIRO Staff Notice 31-368 Client Focused Reforms, Canadian Securities Administrators and CIRO, 10 December 2025.
- FINTRAC imposes an administrative monetary penalty on Argosy Securities Inc., FINTRAC, 13 February 2025.
- Opportunity to be heard and Director's decisions, Ontario Securities Commission, opened 6 October 2026.
- Proceedings search, Capital Markets Tribunal, searched 6 October 2026.
- OSC suspends Argosy Securities advisor over KYC misrepresentation, unauthorized trading, Wealth Professional, 15 September 2026 (trade press).
The Argosy decisions show that a KYC form is evidence, and that an escalation nobody acts on is evidence too. Keep the judgment where the rules put it, and make the factual steps easy to prove. For the identity step, see how Didit identity verification works.
Make client identity the easy part
Run identity checks and screening in one workflow and keep the record your reviewers ask for.
Related articles
- Companies House identity verification: Insolvency Service convictions
- Privacy coin regulation after FinCEN drops its mixing rule
- FinCEN verifiable digital credentials: mDLs under the CIP Rule
- Revolut data breach: the reported fake government request
- CIMA AML Rule: Cayman's audit filing duty explained
- e-Devlet for businesses: identity verification in Turkey