CCC — CSI Canadian Compliance Course Exam Blueprint

Last revised: June 29, 2026

Practical CCC exam blueprint for CSI Canadian Compliance Course candidates covering supervision, account rules, suitability, conflicts, complaints, AML, and final review.

How to Use This Exam Blueprint

Use this checklist as an independent study map for the Canadian Securities Institute CSI Canadian Compliance Course (CCC), exam code CCC. It is designed for final review and gap-finding, not as an official weighting guide.

Work through it in three passes:

Coverage pass: Mark each topic as green, yellow, or red.
Scenario pass: For each yellow/red area, explain what a compliance officer, supervisor, or registrant should do in a realistic client or firm situation.
Evidence pass: Name the document, record, approval, disclosure, or escalation trail that would prove the firm handled the issue properly.

Readiness mark	What it means	What to do next
Green	You can explain the rule, apply it to a scenario, and identify the required documentation or escalation.	Move to mixed practice.
Yellow	You recognize the topic but hesitate on judgment calls, exceptions, or documentation.	Re-read the related CCC material and drill scenarios.
Red	You are guessing, relying on memory fragments, or confusing similar obligations.	Rebuild the topic from definitions, roles, process, and examples.

CCC topic-area readiness table

Readiness area	What you should be able to do	Scenario cues to watch for	Ready when you can…
Canadian securities compliance framework	Identify the purpose of securities regulation, self-regulatory oversight, firm policies, and internal controls.	Regulatory review, deficiency letter, policy breach, client protection issue.	Explain who acts, why the rule exists, and what evidence the firm must keep.
Compliance roles and supervision	Distinguish responsibilities of senior management, compliance, supervisors, branch management, registered individuals, and operations staff.	“Who is responsible?”, “Who approves?”, “Who escalates?”	Assign responsibility without assuming compliance alone owns every control.
Registration and proficiency controls	Recognize registration, supervision, permitted activities, proficiency, and activity restrictions as compliance controls.	New representative, role change, outside activity, unapproved product activity.	Identify when an individual may not act until approval, registration, or supervision conditions are satisfied.
Policies, procedures, and governance	Understand how policies translate regulatory expectations into daily controls.	Missing procedure, inconsistent branch practice, weak supervision, exception reports.	Connect a policy gap to a practical risk and corrective action.
Account opening and client identification	Apply KYC, identity verification, account approval, beneficial ownership, third-party, and documentation concepts.	New account, incomplete form, corporate client, power of attorney, vulnerable client concern.	Name the missing client fact and the consequence of proceeding without it.
Know your client and suitability	Link client facts to recommendations, trades, strategies, leverage, concentration, and account type.	High-risk product, elderly client, income need, limited investment knowledge, unsolicited trade.	Decide whether to update KYC, recommend, decline, document, or escalate.
Know your product and product due diligence	Assess product features, risks, costs, liquidity, complexity, target market, and approval requirements.	New issue, complex note, illiquid security, alternative product, leveraged product.	Explain why “the client asked for it” does not replace product due diligence.
Conflicts of interest	Identify, avoid, control, disclose, and escalate conflicts involving compensation, referrals, outside activities, personal dealings, allocation, and proprietary products.	Referral fee, gift, side business, borrowing from client, allocation dispute.	State why disclosure alone may not be enough for a material conflict.
Trading and market conduct	Recognize fair dealing, client priority, order handling, supervision, insider information, market manipulation, and trade reporting concerns.	Front-running, late allocation, wash trade, restricted list, unusual trading pattern.	Identify the conduct risk and the immediate supervisory response.
Communications and marketing	Review advertising, client communications, social media, performance claims, research-related communications, and disclosure language.	Misleading claim, unapproved post, hypothetical return, testimonial, promissory wording.	Separate balanced, approved communication from exaggerated or unsupported communication.
Complaints and dispute handling	Distinguish service issues from reportable complaints, preserve records, avoid personal settlements, and escalate properly.	Written complaint, verbal allegation, compensation demand, regulatory inquiry.	Build the complaint file: allegation, timeline, response, supervision, and resolution evidence.
AML/ATF, sanctions, and suspicious activity	Apply client identification, beneficial ownership, third-party determination, politically exposed person concepts, sanctions screening, reporting, and no-tipping-off principles.	Unusual deposits, reluctant client, third-party funds, inconsistent occupation, urgent transfers.	Explain what makes the activity suspicious and what the firm should document or escalate.
Privacy, confidentiality, and records	Protect client information while understanding permitted sharing, retention, access, cyber risk, and books-and-records expectations.	Email error, lost device, client data request, regulator request, record deletion.	Choose between privacy, confidentiality, regulatory access, and record-retention duties.
Branch and trade supervision	Understand pre-trade, post-trade, exception-based, branch review, escalation, and evidence-of-review processes.	Exception report, high concentration, unsuitable pattern, dormant account suddenly active.	Interpret the supervisory red flag and state the required follow-up.
Enforcement, reviews, and remediation	Understand deficiency management, internal reviews, regulatory exams, discipline, undertakings, and corrective action.	Repeat deficiency, failed audit, missing records, ignored escalation.	Propose remediation that fixes both the individual event and the control weakness.

Can you do this? Core CCC skills checklist

Regulatory framework and compliance function

Explain why securities compliance focuses on investor protection, market integrity, fair dealing, and confidence in capital markets.
Distinguish legislation, rules, policies, guidance, firm procedures, and supervisory expectations.
Identify when a matter belongs to business supervision, compliance review, legal review, operations, senior management, or regulatory reporting.
Explain the difference between a regulatory requirement and a firm policy that may be stricter than the minimum requirement.
Recognize that good compliance requires both process and evidence: approval, review notes, exception handling, and retained records.
Describe how a weak control can create risk even when no client loss has yet occurred.

Registration, roles, and supervision

Identify activities that generally require appropriate registration, approval, or supervision.
Distinguish registered individuals, supervisors, branch managers, compliance officers, senior management, and operations staff by function.
Recognize when a representative’s activity is outside approved duties.
Identify red flags in outside business activities, referral arrangements, personal financial dealings, and private investments.
Explain why supervision must be risk-based, documented, and followed up.
Identify when a supervisor should escalate instead of simply coaching informally.
Recognize the compliance risk in rubber-stamped approvals, missing review evidence, or repeated exceptions.

Account opening, KYC, and client documentation

List the client facts needed to support account opening, recommendations, and ongoing suitability review.
Distinguish identity verification, KYC collection, beneficial ownership review, third-party determination, and account approval.
Identify missing or inconsistent KYC information.
Explain why incomplete KYC weakens suitability, supervision, complaint defense, and AML controls.
Recognize special issues for corporate, trust, estate, joint, managed, discretionary, margin, options, and other higher-risk account types when covered in your CCC materials.
Identify when updated KYC is required because client circumstances, objectives, risk profile, time horizon, or account activity changed.
Explain the compliance response when a client refuses to provide required information.
Distinguish account holder authority, trading authorization, power of attorney, and beneficial ownership.

KYP, product approval, and suitability

Explain the difference between knowing the client and knowing the product.
Identify product features that matter for compliance: risk, complexity, cost, liquidity, leverage, tax features, early redemption limits, guarantees, issuer risk, and target investor.
Recognize when a product requires enhanced due diligence or additional supervisory approval.
Apply suitability to both recommendations and relevant account events.
Explain why a trade can be unsuitable even if the client is eligible to buy the product.
Recognize concentration risk, leverage risk, liquidity mismatch, time-horizon mismatch, and risk-tolerance mismatch.
Distinguish an unsolicited client order from a recommendation, while still recognizing supervisory and documentation duties.
Explain what should be documented when a client wants to proceed against advice.
Identify when disclosure, risk acknowledgment, or client consent does not cure an unsuitable recommendation.

Conflicts, ethics, and conduct

Identify actual, potential, and perceived conflicts of interest.
Distinguish conflict avoidance, control, disclosure, supervision, and prohibition.
Recognize compensation conflicts, referral incentives, sales contests, proprietary products, gifts, entertainment, personal relationships, and outside activities.
Explain why conflicts should be addressed before harm occurs.
Identify problematic personal financial dealings with clients, including borrowing, lending, guarantees, shared investments, or acting as executor/trustee where not permitted or not approved.
Recognize confidentiality issues when a representative discusses one client’s activity with another.
Apply ethical judgment where a technically possible action is still unfair, misleading, or poorly supervised.

Trading, order handling, and market conduct

Identify trade supervision red flags: unusual volume, high turnover, short-term trading, concentration, off-book communications, or trades inconsistent with KYC.
Distinguish client priority, fair allocation, order handling, and trade correction concepts.
Recognize market manipulation, deceptive trading, wash trades, matched orders, spoofing-style behaviour, and other conduct that distorts market integrity.
Identify insider trading and tipping concerns involving material non-public information.
Explain restricted list, watch list, information barrier, and escalation concepts at a practical level.
Recognize supervision issues in discretionary trading, unauthorized trading, and time-and-price discretion.
Explain why after-the-fact documentation is weak evidence when approval should have occurred first.

Communications, marketing, disclosure, and reporting

Identify misleading, exaggerated, promissory, unbalanced, or unsupported statements.
Distinguish educational material, advertising, sales communication, research-style commentary, and individualized recommendations.
Recognize when communication requires review or approval under firm procedures.
Identify issues in social media, texting, personal email, seminars, webinars, and third-party marketing.
Explain why performance claims must be supportable, balanced, and not cherry-picked.
Recognize required disclosures related to fees, charges, conflicts, risks, account relationships, and referral arrangements as covered in your course materials.
Identify the compliance risk of using outdated forms, stale disclosure, or inconsistent client-facing explanations.

Complaints, investigations, and enforcement

Distinguish a routine service request from a complaint alleging misconduct, loss, misrepresentation, unauthorized trading, unsuitable advice, or poor supervision.
Identify what belongs in a complaint file: allegation, dates, accounts, trades, people involved, evidence reviewed, response, escalation, and resolution.
Explain why representatives should not personally settle complaints or discourage escalation.
Recognize when a matter may require regulatory reporting, internal investigation, client response, or remediation.
Identify patterns: repeated small complaints, repeated exceptions, branch-level concentration, or recurring documentation failures.
Explain the difference between correcting a client issue and remediating the control weakness that allowed it.

AML/ATF, sanctions, privacy, and records

Identify suspicious transaction red flags without relying only on dollar amounts.
Recognize third-party involvement, beneficial ownership opacity, unusual source of funds, rapid movement of funds, and client reluctance as risk indicators.
Explain no-tipping-off concerns in suspicious activity handling.
Distinguish AML obligations from privacy obligations; both can apply at the same time.
Identify when client information may be shared internally, with service providers, with regulators, or with law enforcement under applicable procedures.
Recognize recordkeeping failures: missing approval, missing rationale, altered records, off-channel communication, and unsupported supervisory sign-off.
Explain why cybersecurity, access controls, and data retention are compliance issues, not only technology issues.

Scenario and decision-point checks

Use these prompts to test whether you can apply the CCC material instead of only recalling terms.

Scenario cue	First compliance question	Better answer pattern
Client wants a high-risk product inconsistent with stated risk tolerance.	Is KYC current, and is the product suitable for this client?	Update facts if needed, assess KYP and suitability, document discussion, decline to recommend if unsuitable, escalate if required.
Representative says, “The client insisted, so supervision is not needed.”	Does client instruction remove all compliance duties?	No. Identify whether it was solicited or unsolicited, document, review for red flags, and follow firm escalation procedures.
New client refuses to explain source of funds.	Is this an onboarding, AML, or suitability issue?	It may be all three. Pause or restrict activity as required, escalate, and document the unresolved risk.
Advisor posts performance claims on personal social media.	Is this approved, balanced, and retained?	Treat as business communication if related to securities activity; review for approval, support, disclosure, and recordkeeping.
Branch has repeated late KYC updates.	Is the problem individual or systemic?	Look for root cause: training, supervision, systems, incentives, branch culture, or weak exception follow-up.
Client complaint alleges unsuitable leverage.	What evidence matters?	KYC at the time, recommendation rationale, risk disclosure, account approvals, trade history, leverage documentation, supervision notes.
Representative receives a referral fee from an outside professional.	Is there an approved arrangement and disclosure?	Check permissibility, written arrangement, conflict handling, client disclosure, compensation records, and supervision.
Employee learns confidential issuer information before a trade.	Is there material non-public information risk?	Escalate, restrict trading if required, preserve confidentiality, and document information-barrier steps.
Client requests trade correction after market movement.	Was there an error, misunderstanding, or attempt to shift market loss?	Review order records, timestamps, instructions, suitability, approval, and firm correction procedures.
Senior salesperson pressures supervisor to approve an exception.	Is independence of supervision compromised?	Apply documented criteria, escalate pressure concerns, and avoid approval without evidence.
Elderly client suddenly authorizes a new third party.	Are capacity, undue influence, trusted contact, fraud, or vulnerability concerns present?	Verify authority, review red flags, follow firm procedures, document, and escalate when appropriate.
Product issuer offers an incentive for sales volume.	Does compensation create a material conflict?	Assess conflict, client interest, disclosure, sales supervision, product suitability, and whether the incentive should be avoided or controlled.

Suitability and supervision decision path

    flowchart TD
	    A[Client request, recommendation, or account event] --> B{KYC current and complete?}
	    B -- No --> C[Update client facts and document]
	    B -- Yes --> D{Product or strategy understood?}
	    C --> D
	    D -- No --> E[Complete product due diligence or do not recommend]
	    D -- Yes --> F{Conflict identified?}
	    F -- Yes --> G[Avoid, control, disclose, and escalate as required]
	    F -- No --> H{Suitable and supportable?}
	    G --> H
	    H -- No --> I[Do not recommend; document rationale and escalation]
	    H -- Yes --> J[Proceed only with required approvals, disclosure, and records]
	    I --> K[Supervisory review and follow-up]
	    J --> K

Calculation, ratio, and evidence checks

The CCC is usually more judgment-heavy than calculation-heavy, but compliance scenarios often include numbers. You should be able to interpret simple figures without inventing thresholds that are not provided in your course materials.

\[ \text{Concentration percentage} = \frac{\text{Value of position, issuer, sector, or product type}}{\text{Total account or portfolio value}} \times 100 \]\[ \text{Fee impact in dollars} = \text{Account value or transaction amount} \times \text{Applicable fee rate} \]\[ \text{Percentage change} = \frac{\text{New value} - \text{Original value}}{\text{Original value}} \times 100 \]

Check	Why it matters	Common trap
Concentration percentage	Shows exposure to one issuer, sector, product type, currency, or strategy.	Treating concentration as acceptable only because the client signed a form.
Leverage exposure	Shows amplified gain/loss potential and repayment risk.	Focusing only on expected return and ignoring downside or cash-flow strain.
Fee impact	Converts percentage fees into client-understandable dollars.	Disclosing the rate but not recognizing total cost significance.
Turnover or frequent trading pattern	May indicate churning, unsuitable activity, or poor supervision.	Reviewing each trade alone and missing the pattern.
Loss compared with objective or risk tolerance	Helps assess suitability and complaint evidence.	Assuming losses prove misconduct, or assuming disclosure proves suitability.
Exception frequency	Shows whether a branch, advisor, product, or client segment needs enhanced supervision.	Treating repeated exceptions as isolated events.

Compliance artifact checklist

For each artifact, be ready to answer: What is it for? Who reviews it? What deficiency would matter? What happens if it is missing or inaccurate?

Artifact or record	Purpose	Exam-style deficiency cue
New account documentation	Establish account type, ownership, authority, approvals, and required client facts.	Account opened before required information or approval was complete.
KYC profile and updates	Support suitability, supervision, risk assessment, and client communication.	Stale risk tolerance, vague objectives, missing financial facts, inconsistent time horizon.
Product due diligence file	Shows the firm understood product features, risk, costs, liquidity, and target market.	Product sold widely without documented approval or risk review.
Suitability notes	Evidence the recommendation matched client facts and product features.	Notes are generic, after-the-fact, or inconsistent with KYC.
Trade ticket/order record	Documents instructions, timing, account, security, quantity, price terms, and representative involvement.	Dispute over whether trade was authorized or solicited.
Exception report	Flags unusual activity for supervisory review.	Exceptions closed with no rationale or repeated without escalation.
Branch review or audit file	Evidence of periodic supervision and corrective action.	Same deficiency appears in multiple reviews.
Complaint file	Preserves allegation, investigation, evidence, response, and resolution.	Representative handled complaint privately or failed to escalate.
Marketing approval record	Shows communication was reviewed, balanced, supportable, and retained.	Unapproved social media post or exaggerated performance claim.
Conflict disclosure and approval	Records identified conflicts and how they were avoided, controlled, or disclosed.	Disclosure exists but conflict remains harmful or unmanaged.
Referral arrangement file	Shows approval, compensation, disclosure, and supervision of referral activity.	Undisclosed fee or unapproved outside arrangement.
AML documentation	Supports identification, beneficial ownership, third-party review, risk rating, and escalation.	Client activity inconsistent with profile and no follow-up documented.
Training and registration records	Evidence individuals are qualified, approved, and supervised for their activities.	Representative performs activity before approval or outside permitted role.
Restricted or watch list evidence	Helps control MNPI and trading restrictions.	Employee trades despite information barrier concern.
Privacy or incident record	Documents data breach, unauthorized access, error, or disclosure issue.	Client information sent to wrong recipient with no escalation.

Common weak areas and traps

Weak area	Why candidates miss it	How to fix it
Treating compliance as memorized rule names	CCC scenarios often test judgment, not labels.	For every rule, ask: client risk, firm risk, documentation, escalation.
Confusing KYC, KYP, and suitability	They are connected but not interchangeable.	Practice explaining all three in one recommendation scenario.
Assuming disclosure solves every conflict	Some conflicts must be avoided or controlled, not merely disclosed.	Ask whether the client can still be treated fairly after disclosure.
Ignoring firm policy	Firms may impose stricter controls than minimum regulatory expectations.	In scenarios, include both regulatory and firm-procedure responses.
Overlooking documentation	Correct conduct without evidence may still be a compliance failure.	Always identify the record that proves the review occurred.
Treating unsolicited orders as risk-free	Unsolicited does not erase red flags, KYC concerns, or supervision.	Decide what must still be reviewed and documented.
Missing patterns	One trade may look acceptable; the pattern may not.	Review account history, exception trends, complaints, and concentration.
Mixing privacy and AML duties	Privacy protects information; AML may require review, escalation, or reporting.	Identify which duty applies and whether both apply.
Focusing only on client loss	Compliance obligations can be breached even without a realized loss.	Look for process failures, conflicts, misleading communication, or weak supervision.
Memorizing terms without roles	Exams may ask who should act.	Map each issue to representative, supervisor, compliance, operations, management, or regulator-facing process.
Ignoring vulnerable-client cues	Capacity, influence, sudden changes, and third-party pressure can change the compliance response.	Add vulnerability, authority, and documentation checks to client-change scenarios.
Underestimating communications risk	Informal messages can be business records and misleading statements.	Apply approval, retention, balance, and substantiation tests.

High-yield “can you explain the difference?” prompts

If you cannot clearly distinguish these pairs, review before doing more practice questions.

Pair	You should be able to distinguish…
KYC vs KYP	Client facts vs product facts. Suitability needs both.
Suitability vs eligibility	A client may be allowed to buy a product but still be poorly matched to it.
Disclosure vs conflict control	Disclosure informs; control or avoidance changes the conflict risk.
Service issue vs complaint	Routine administration vs allegation of misconduct, loss, unsuitable advice, or unfair treatment.
Supervision vs compliance	Day-to-day business review vs independent monitoring, policy, testing, and escalation functions.
Client instruction vs recommendation	Who initiated the trade and what advice was given, while recognizing duties may remain.
Recordkeeping vs approval	Keeping a record is not the same as obtaining required review before action.
Privacy vs confidentiality vs regulatory access	Protect information, restrict improper sharing, but recognize lawful/regulatory access pathways.
Error correction vs client compensation	Fixing an operational mistake is different from settling a complaint or compensating for alleged misconduct.
Individual breach vs systemic deficiency	One person’s mistake vs a control weakness requiring broader remediation.

Final-week checklist

Knowledge consolidation

I can describe the purpose of each major compliance control in one or two sentences.
I can identify who should act first in common scenarios.
I can explain the difference between KYC, KYP, suitability, conflicts, disclosure, supervision, and documentation.
I can apply compliance judgment without relying on exact exam weights or memorized chapter order.
I have reviewed current Canadian Securities Institute CCC materials for terminology and any recent course-specific updates.

Scenario practice

I have practiced mixed scenarios involving multiple issues, such as KYC plus AML plus suitability.
I can spot when a question is testing documentation rather than the underlying rule.
I can identify the best next step when several actions seem plausible.
I can explain why an answer is wrong, not just why the correct answer is right.
I have reviewed weak scenarios until I can state the rule, action, and evidence.

Exam-day readiness

I know the official exam instructions and administrative requirements from the Canadian Securities Institute.
I can manage time without rushing scenario stems.
I will read for role, timing, client facts, product facts, approval status, and documentation.
I will not assume facts that are not in the question.
I will choose the answer that best protects clients, follows procedure, documents the decision, and escalates when needed.

Practical next step

After you can check most green boxes, move into mixed CCC practice questions. For every missed question, write a three-part correction: rule or concept, scenario trigger, and required compliance action or record. This turns the checklist into exam-ready judgment rather than passive recognition.

Study Plan

Scenario Guide