Free CSI CCO Full-Length Practice Exam: 100 Questions

This free full-length CSI CCO practice exam includes 100 original Securities Prep questions across the exam domains.

The questions are original Securities Prep practice questions aligned to the exam outline. They are not official exam questions and are not copied from any exam sponsor.

Count note: this page uses the full-length practice count maintained in the Mastery exam catalog. Some exam sponsors publish total questions, scored questions, duration, or unscored/pretest-item rules differently; always confirm exam-day rules with the sponsor.

For concept review before or after this set, use the CSI CCO guide on SecuritiesMastery.com.

How to use this CSI CCO diagnostic

Use this full-length set to test chief-compliance judgment under time pressure. For each miss, identify whether the failure was governance, materiality, evidence, investigation, reporting, or practical application.

• Below 70%: return to compliance structure, dealer risks, and CCO skill requirements before repeating a full timed set.
• 70% to 79%: drill the topic where you chose a plausible business response instead of the defensible compliance response.
• 80% or higher: focus on second-best-answer traps, especially where escalation, reporting, or documentation could all appear reasonable.
• Repeated 75%+ timed attempts: shift from repeating familiar questions to unseen mixed sets and explanation review so you are using judgment rather than memorized patterns.

CSI CCO miss patterns that should change your next drill

Exam snapshot

Full-length exam mix

Practice questions

Questions 1-25

Question 1

Topic: Application of Skills

A dealer’s CCO reviews a branch control-testing snapshot and must decide the best follow-up.

Exhibit: File review snapshot

Which follow-up is best supported by the exhibit?

• A. Add mandatory checklists and supervisory sign-off for account changes.
• B. Complete an immediate full KYC refresh for all clients.
• C. Replace the complaint log and retrain service staff.
• D. Expand new-account suitability sampling across the branch.

Best answer: A

What this tests: Application of Skills

Explanation: The snapshot shows only an isolated new-account opening issue, but repeated weaknesses in documenting account maintenance events. The best response is to strengthen preventive documentation controls for changes to existing accounts, including client instruction evidence and supervisory approval.

Documentation controls should let the firm demonstrate that account records were opened correctly and later changed only with proper support. In this exhibit, the strongest pattern is not at account opening: identity and beneficial ownership evidence were present, and only one new account lacked a signed application at approval. The recurring problem is with maintenance activity after the account is open.

• Banking and address changes often lack evidence of the client’s instruction.
• Material KYC changes often lack a dated reason for the change and proof the client was contacted.
• Both areas also show weak supervisory evidence.

That pattern supports adding a standardized maintenance-change package or checklist, with required documents captured before the update is processed and clear supervisor sign-off. A broader KYC refresh or more suitability sampling would not directly fix the documented control failure shown here.

• New-account focus misreads the data because the repeated exceptions are in maintenance changes, not core opening documents.
• Complaint process confuses account documentation deficiencies with complaint handling, which the exhibit does not address.
• Full KYC refresh treats the issue as review frequency, when the real weakness is missing evidence for specific changes already made.

The repeated gaps relate to documenting and approving account maintenance changes, so a preventive checklist and sign-off control is the best response.

Question 2

Topic: CCO Skill Requirements

A Canadian investment dealer defines a key control point as a step where failure could allow a material compliance breach before a later review detects it. The CCO is updating monitoring for outgoing client-funds transfers.

Exhibit: Control-testing snapshot

Which follow-up is best supported by the exhibit?

• A. Build recurring monitoring around callback evidence before first third-party transfers.
• B. Expand testing of quarterly branch attestations across all locations.
• C. Make review of the daily exception report the primary monitoring focus.
• D. Replace control monitoring with branch-level transfer-volume trend reviews.

Best answer: A

What this tests: CCO Skill Requirements

Explanation: The callback step is the strongest key control point because it is preventive, sits before client funds are released, and already shows exceptions. Monitoring should be built around the control point that can prevent the highest-impact breach, not around broader or downstream indicators.

Key control points are identified by asking where a control sits in the process, what harm could occur if it fails, and whether there is evidence that it is not operating consistently. Here, the callback before a first transfer to a new third-party bank account is upstream and preventive: if it fails, unauthorized funds can leave the firm before a later review catches the problem. The exhibit also shows actual breakdowns, including released transfers.

• Preventive controls usually rank above detective controls for key-point monitoring.
• High client-harm potential increases priority.
• Repeated exceptions show the control should be incorporated into recurring monitoring.

A clean downstream exception report does not outweigh weakness in the earlier control that should have stopped the event.

• Downstream focus overweights a detective review that showed no unresolved exceptions and operates after the transfer process.
• Attestation focus emphasizes general process confirmation rather than the step that directly prevents unauthorized movement of client funds.
• Trend-only review tracks outcomes by branch but does not test whether the critical preventive control was performed.

It targets the failed preventive step that can stop unauthorized transfers before release, making it the clearest key control point.

Question 3

Topic: CCO Skill Requirements

A dealer’s CCO reviews the following memo after an analyst completes a report on a listed issuer. Compliance has identified no factual or legal issue with the draft, but business heads disagree on timing.

Exhibit: Compliance memo excerpt

• Research report: downgrade from Buy to Hold; draft finalized Tuesday 3:00 p.m.
• Head of Investment Banking: “Delay release until after Thursday’s pitch to avoid harming the issuer relationship.”
• Head of Research: “Release on the normal timetable once compliance review is complete.”
• Firm policy: “Research publication timing must not be influenced by actual or prospective investment banking revenue. Attempts to influence timing for commercial reasons must be escalated to Compliance.”

What is the most defensible next action for the CCO?

• A. Let executive management choose the timing because both positions are commercially reasonable.
• B. Publish immediately and bypass further compliance review to protect research independence.
• C. Complete compliance review, publish on the normal timetable, and escalate the pressure attempt.
• D. Approve a brief delay because the issuer is only a prospective banking client.

Best answer: C

What this tests: CCO Skill Requirements

Explanation: The memo gives the deciding rule: publication timing cannot be influenced by actual or prospective investment banking revenue, and attempts to do so must be escalated. Since no factual or legal issue exists, the defensible response is to complete normal compliance review, keep the usual release timing, and escalate the pressure.

This is an ethics and conflict-management issue, not a business-balancing exercise. The artifact states that the draft has no factual or legal problem, so there is no valid control reason to hold it back. It also states that research timing must stay independent of actual or prospective banking revenue and that commercial pressure must be escalated. The CCO should therefore preserve both controls: complete the ordinary compliance review and keep the report on its normal publication path, while documenting and escalating the investment banking request.

• Keep the standard pre-publication compliance review.
• Do not allow a revenue-based delay.
• Record and escalate the attempted influence.

The closest distractor is sending the matter to executive management, but independence requirements are not meant to be traded off against business preferences.

• Skip review fails because independence does not eliminate the need for the firm’s normal compliance review.
• Prospective client fails because the policy covers prospective as well as actual banking revenue.
• Management balancing fails because the memo frames this as a control requirement, not a discretionary business judgment call.

This follows the policy by preserving independent review and publication while escalating attempted commercial influence.

Question 4

Topic: Application of Skills

A compliance officer at a Canadian investment dealer is reviewing surveillance alerts linked to a confidential takeover. An investment banking associate was brought over the wall on Monday. Which development is the most serious red flag and should be escalated immediately as a potential criminal trading offence?

• A. The associate used a personal phone for routine business scheduling.
• B. The target’s shares traded on unusually high pre-announcement volume.
• C. The associate’s spouse bought target shares before the announcement after several calls.
• D. The associate filed the outside-account attestation several weeks late.

Best answer: C

What this tests: Application of Skills

Explanation: The strongest red flag is trading in a related person’s account shortly before the announcement after contact with someone who had confidential deal information. That fact pattern creates a concrete tipping or insider-trading concern and deserves immediate escalation over more general control issues.

In a potential criminal trading-offence review, compliance should prioritize the fact that most directly links material non-public information, a person who had access to it, and suspicious trading. A wall-crossed investment banking associate had confidential takeover information. If the associate’s spouse then traded the target before the announcement, and there were several calls between them, that is a specific and serious indicator of possible insider trading or tipping.

A risk-based response would normally include prompt escalation, preservation of trading and communication records, and an independent review of related accounts and timelines. General policy breaches and unexplained market activity still matter, but they are weaker signals when they do not connect a specific trader to confidential information.

The key takeaway is that linked access-plus-contact-plus-pre-announcement trading is more urgent than stand-alone control deficiencies.

• Personal phone use is a supervision and recordkeeping concern, but routine scheduling alone does not point directly to a trading offence.
• Late attestation shows a control weakness, not specific evidence that confidential information was misused.
• Unusual volume may justify further monitoring, but by itself it lacks the direct link to a person with deal knowledge and a related account.

Trading in a related account shortly before a public deal, combined with contact with a wall-crossed employee, is a direct insider trading or tipping red flag.

Question 5

Topic: Application of Skills

Operations receives a signed request from a 78-year-old client to transfer $85,000 from her cash account to a bank account in her nephew’s name. The account has no prior third-party transfers. During a callback to the phone number on file, the client says, “My adviser told me this has to go today,” and cannot clearly explain the purpose of the transfer. Firm policy requires escalation before any release when a funds movement shows client confusion, adviser pressure, or a new third-party destination. What is the best next step?

• A. Request a fresh client signature and treat it as a normal transfer.
• B. Process the transfer because the form is signed and the client answered the callback.
• C. Hold the transfer, document the red flags, and escalate to supervision/compliance.
• D. Seek the adviser’s written explanation, then release the funds.

Best answer: C

What this tests: Application of Skills

Explanation: This request should be escalated before any money leaves the firm because it presents several red flags at once: a new third-party destination, apparent adviser pressure, and a confused client response. The proper next step is to stop the release, record the concerns, and send the matter for supervisory and compliance review.

The core concept is red-flag escalation on outbound funds movements. This is not a routine paperwork issue: the destination is a third party, the transfer pattern is new, the adviser appears to be creating urgency, and the client cannot clearly explain the request during an independent callback. Those facts raise both control concerns and possible conduct concerns, so operations should not rely only on a signed form or on the adviser’s account of the situation.

• Stop the funds movement before release.
• Document the specific red flags and callback details.
• Escalate promptly under the firm’s supervisory and compliance process.
• Complete any further independent verification required before deciding whether to process or refuse the request.

The closest trap is trying to cure the issue with more paperwork or an adviser explanation, because the concern is whether the instruction is being improperly influenced.

• Processing based on a signed form and a completed callback skips the required escalation when the callback itself revealed confusion.
• Relying on the adviser to explain the transfer does not independently address a possible conduct concern involving that adviser.
• Getting a fresh signature treats the issue as a form defect, not a red-flag funds-movement concern.

Multiple red flags require an independent supervisory and compliance review before any funds are released.

Question 6

Topic: Application of Skills

A dealer receives a written complaint from a senior client alleging unsuitable purchases of high-risk exempt securities and a loss of $120,000. The client requests compensation and says they will go to an ombuds service or court if the matter is not resolved. The dealing representative wants to contact the client directly and offer a small personal payment to end the matter. Which action by compliance best aligns with sound Canadian complaint-handling and civil-litigation principles?

• A. Keep documentation to a minimum until counsel confirms a lawsuit.
• B. Let the representative negotiate directly if the client signs a release.
• C. Centralize the file, preserve evidence, investigate independently, and provide written complaint and ADR information.
• D. Suspend the review until the client chooses ombuds service or litigation.

Best answer: C

What this tests: Application of Skills

Explanation: A complaint that seeks compensation and threatens court or ombuds escalation should be handled as a formal complaint, not as an informal side deal. Compliance should preserve records, keep the review independent, and give the client clear written information about the firm’s process and available escalation or ADR paths.

When a complaint includes a compensation demand and a threat of court or ombuds escalation, the compliance priority is disciplined complaint management, not informal damage control. The firm should open a formal file, preserve all relevant records, separate the review from the representative whose conduct is questioned, and escalate internally to legal or insurance channels as appropriate. The client should receive the firm’s complaint process and available escalation or ADR information in writing. This supports fairness, avoids pressure on the client, and leaves the firm prepared if the matter later moves to an ombuds process, arbitration, or civil litigation.

• Preserve emails, notes, recordings, account records, and supervisory documents.
• Control communications so the client is not pushed into a private side settlement.
• Document the investigation and final response clearly.

The closest trap is waiting for the client to choose a forum; prudent firms investigate promptly either way.

• Private settlement is weak because the implicated representative should not control the response or pressure the client into a release.
• Wait for forum choice fails because the firm’s complaint review should continue even if ADR or litigation is mentioned.
• Minimal records fails because litigation risk increases, not decreases, the need for full evidence preservation and documentation.

This approach protects independence, preserves the record, and supports fair handling whether the matter proceeds internally, through ADR, or in court.

Question 7

Topic: Regulatory Investigations and Reporting

A provincial securities regulator sends a dealer a written request for emails, chat messages, and trade blotters relating to one institutional trader, and notes that staff may be contacted for interviews. The desk head wants employees to review and delete “duplicate” messages before production, and several traders have started drafting direct replies to the regulator. The matter has not been escalated beyond the desk. What is the single best action for the CCO now?

• A. Let the desk head screen and remove duplicate records before collection.
• B. Produce the requested records and keep the issue at desk level.
• C. Activate the investigation protocol with preservation, controlled communications, and escalation.
• D. Wait for interview notices before restricting staff contact.

Best answer: C

What this tests: Regulatory Investigations and Reporting

Explanation: The CCO should immediately activate the firm’s external-investigation response. Once a regulator has opened an inquiry, relevant records must be preserved, communications should be routed through designated contacts, and the matter should be escalated so the response is coordinated and defensible.

When an external investigation begins, the priority shifts from routine supervision to controlled incident management. Potentially relevant records must be preserved immediately across emails, chats, blotters, files, and any other business records so nothing is altered, deleted, or selectively gathered. Communications with the regulator should be centralized through compliance and legal so staff do not provide incomplete, inconsistent, or unauthorized responses. Prompt escalation to the CCO, legal counsel, and appropriate senior management also ensures oversight, documented decision-making, and a consistent collection process.

Allowing the desk to “clean up” records, delaying restrictions until interviews start, or treating the request as a simple document production exercise creates avoidable regulatory and litigation risk. The key takeaway is immediate preservation, message discipline, and formal escalation.

• Desk-led culling fails because business staff should not decide what is deleted or excluded once an investigation has started.
• Waiting for interviews fails because communication controls and preservation begin when the regulatory request arrives, not later.
• Desk-level handling fails because a regulatory inquiry requires escalation beyond the business unit and a coordinated firm response.

An external investigation requires immediate preservation, controlled communications, and documented escalation so evidence and the firm’s response remain defensible.

Question 8

Topic: Application of Skills

A supervisor at a Canadian dealer reviews a request to sell all securities in an 82-year-old client’s account and transfer the cash to a bank account owned by the client’s new caregiver. The instruction came by email from the caregiver, not the client. The client usually gives instructions by phone, recently appeared confused about account activity, and cannot be reached at the verified phone number on file. Under firm policy, unusual third-party asset movements and possible client vulnerability must be escalated before processing. What is the best next step?

• A. Request a notarized letter and process if the signature matches.
• B. Confirm the urgency with the caregiver and document the explanation.
• C. Hold the request and escalate for independent client verification.
• D. Sell the securities now and verify the cash transfer afterward.

Best answer: C

What this tests: Application of Skills

Explanation: The most serious red flag is the attempted movement of assets to a caregiver’s account when the instruction did not come from the client and the client cannot be independently reached. The proper response is to stop the transaction and escalate for independent verification and potential financial exploitation review.

The core issue is possible financial exploitation of a vulnerable client. A request to liquidate an entire account and send proceeds to a new third-party destination is already high risk; it becomes more serious when the instruction comes from the caregiver rather than the client and direct contact using verified information fails. The correct process is to prevent movement of assets, escalate internally under the firm’s vulnerable-client or asset-movement procedures, and seek independent confirmation of the client’s intent through previously verified channels. Extra paperwork from the caregiver does not solve the problem, because the concern is whether the instruction is genuinely the client’s. Selling first and investigating later exposes the client and the firm to avoidable harm.

• Notarized paperwork does not replace direct, independent verification when exploitation is suspected.
• Caregiver confirmation is insufficient because the concern is the caregiver’s involvement in the asset movement.
• Selling first is premature; the suspicious instruction should be stopped before any part of it is carried out.

A third-party destination, possible vulnerability, and failed direct contact require stopping the transaction and escalating before any assets move.

Question 9

Topic: Compliance Role and Structure

A Canadian investment dealer plans a reorganization. Under the draft structure, branch review staff would report to the regional sales head, and significant compliance findings would go to the board only after review by a sales committee. The CCO believes this could discourage escalation of issues, and no regulatory filing is triggered solely by the draft org chart. What is the best next step?

• A. Pilot the structure for one quarter and monitor surveillance results.
• B. Document the risk and escalate it to the CEO and board committee before rollout.
• C. Notify CIRO first instead of escalating the concern internally.
• D. Let the sales head decide what findings reach the board.

Best answer: B

What this tests: Compliance Role and Structure

Explanation: The issue is governance, not just staffing. If sales can control compliance staff or filter what reaches the board, the compliance function is weakened. The CCO should document that risk and escalate it internally to senior management and the board committee before the new structure takes effect.

A core element of an effective compliance function is independence from revenue-producing business lines and direct access to senior management and the board. In this scenario, the draft reporting lines create two weaknesses: branch review staff would be supervised by sales, and important compliance issues would be screened by a sales committee before reaching the board. That creates real and perceived pressure to delay, soften, or suppress escalation.

The proper next step is to document the conflict, explain how the structure could weaken compliance oversight, and escalate the concern through the CEO and the board’s audit or compliance committee before rollout. That gives the firm a chance to correct the design while preserving an audit trail. Monitoring later may still be useful, but it does not fix a governance model that is already compromised.

• Pilot first fails because testing a known conflict for a quarter allows a weakened structure to operate before correction.
• Sales filter fails because business-line management should not decide which compliance findings reach the board.
• Regulator first fails because the stem says no filing is triggered, so internal escalation should come before external contact.

This is the best next step because sales-controlled reporting lines can impair compliance independence and should be escalated before implementation.

Question 10

Topic: Canada Regulation and Dealer Risks

A Canadian investment dealer plans to launch an online service that automatically rebalances retail client portfolios within preset risk bands. The business head says existing suitability, trade-review, and complaint processes can be adapted, and operations can build the workflow within a month. However, no one has assessed whether the service involves discretionary management or fits the firm’s current registration and permitted business model. What is the single best compliance action?

• A. Update procedures and train staff on documenting client risk tolerance.
• B. Allow the build to proceed and rely on enhanced post-launch surveillance.
• C. Pause the launch and escalate for a regulatory-framework assessment of registration, permitted activities, and applicable securities-law obligations.
• D. Approve a limited pilot because existing suitability controls already exist.

Best answer: C

What this tests: Canada Regulation and Dealer Risks

Explanation: This is fundamentally a regulatory-framework issue, not just an operational one. Before the firm designs workflows, training, or surveillance, it must determine whether the proposed service is allowed under its registration and business model and what legal obligations apply.

The core concept is identifying the threshold question: is the firm permitted to conduct the proposed activity within its existing regulatory framework? Here, automatic rebalancing may change the nature of the service from ordinary supervised dealing to an activity that raises registration, permitted-business, and securities-law questions. That makes the first compliance step a formal regulatory assessment and escalation, not operational implementation.

In a principle-based environment, compliance must look past process readiness and test whether the business model itself fits the firm’s legal obligations. If that threshold is unresolved, building workflows, training staff, or running a pilot does not solve the main risk; it may deepen it by operationalizing an activity the firm has not confirmed it can lawfully offer. The key takeaway is to address the regulatory status of the activity before designing controls around it.

• Build first fails because stronger surveillance does not fix an unassessed registration or permitted-activity issue.
• Procedure update fails because better documentation addresses process quality, not whether the service fits the firm’s regulatory framework.
• Pilot approach fails because limiting the rollout does not remove the need to determine whether the activity is permitted at all.

The unresolved issue is whether the business itself is legally permitted under the firm’s regulatory status, which must be assessed before operational controls are built.

Question 11

Topic: Compliance Role and Structure

A Canadian dealer that has operated from one office with a small accredited-investor client base plans to open 12 retail branches and add an active trading desk. Management proposes keeping a one-person compliance department, having branch managers perform their own branch testing, and giving the board only an annual verbal compliance update. What is the best compliance recommendation?

• A. Launch first and expand compliance only if complaints or exceptions increase materially.
• B. Keep the current model if branch managers certify each quarter that local supervision was completed.
• C. Redesign the operating model now using a documented risk assessment, added compliance capacity, independent testing, and formal board reporting.
• D. Retain external counsel to update policies while leaving ongoing monitoring with business supervisors.

Best answer: C

What this tests: Compliance Role and Structure

Explanation: Compliance operating models should scale with the firm’s business mix, locations, and supervisory risk. Moving from one office to 12 retail branches plus a trading desk makes a one-person compliance team, self-testing by branch managers, and minimal board reporting too weak. A risk-based redesign before launch is the best recommendation.

Compliance operating models should be proportionate to the firm’s size, business lines, geographic spread, client type, trading activity, and conflict profile. A structure that worked for a single-office accredited-investor business is unlikely to remain appropriate once the firm adds 12 retail branches and an active trading desk. The proposal also weakens independence because branch managers would test their own supervision, and it weakens governance because the board would receive only an annual verbal update. The CCO should recommend a documented risk assessment and a scaled model that adds qualified compliance resources, independent monitoring or surveillance, clear escalation paths, and regular written reporting to senior management and the board. Detailed procedures alone do not fix under-resourcing or weak governance.

• Manager certifications help document first-line supervision, but they do not replace independent compliance testing.
• Waiting for problems is reactive and inconsistent with a risk-based approach to a major business expansion.
• External counsel support may improve policy drafting, but it does not create day-to-day monitoring, surveillance, or board reporting.

The firm’s larger footprint and added trading activity make the legacy one-person, self-testing model inadequate for its increased size and complexity.

Question 12

Topic: Application of Skills

A Canadian investment dealer is replacing its CRM. The project team proposes migrating only open-account files and leaving closed-account records on backup tapes after the old system is decommissioned. Restoring one file from tape would take several days, and users would not have searchable access. The firm’s recordkeeping standard requires required records to remain complete and readily retrievable throughout the retention period. What is the best next step for the CCO?

• A. Print only higher-risk legacy files before the shutdown.
• B. Require a documented migration plan and test legacy retrieval before decommissioning.
• C. Complete the migration first and remediate retrieval issues later.
• D. Approve decommissioning because the backup tapes preserve the data.

Best answer: B

What this tests: Application of Skills

Explanation: Recordkeeping is not just about preserving data; it also requires that required records remain usable and retrievable. Because the proposed approach would leave legacy files unsearchable and slow to restore, the CCO should require and test a compliant migration solution before the old system is shut down.

In a dealer compliance context, recordkeeping includes both retention and access. Required records must stay complete and reasonably available throughout the retention period so the firm can supervise activity, respond to issues, and produce records when needed. When systems change, the CCO should ensure the firm has a documented plan for which records are retained, where they will reside, how they will be indexed, and whether staff can retrieve them promptly in usable form. Backup tapes are mainly a recovery tool; they are not a strong primary recordkeeping solution if records are hard to search or slow to restore.

The key control is to confirm compliant legacy access before retiring the source system.

• Backup storage only fails because preserving data on tape does not ensure timely, searchable production of required records.
• Selective printing fails because recordkeeping cannot depend on guessing which files may later matter.
• Fix it later fails because the safeguard must be in place before legacy access is removed.

Required records must remain accessible and producible throughout retention, so legacy retrieval should be validated before shutdown.

Question 13

Topic: Application of Skills

A CCO is assessing whether a dealer’s files would withstand a client complaint investigation.

Exhibit: File review snapshot

Which interpretation is best supported?

• A. The gaps could prevent reconstruction and proof of supervision.
• B. Recordkeeping mainly protects suitability information, not supervision evidence.
• C. Verbal explanations can cure missing retained approval records.
• D. Complete order tickets make the file regulator-ready.

Best answer: A

What this tests: Application of Skills

Explanation: Regulatory recordkeeping exists to create an audit trail that allows the firm and a regulator to reconstruct events and assess compliance. Here, missing supervisory approval evidence and incomplete emails leave material gaps even though some client and trade records are complete.

The core purpose of regulatory recordkeeping is to preserve reliable evidence of what happened, who did it, and whether required supervision and compliance steps occurred. In this exhibit, the dealer has some strong records, such as the signed account form, KYC history, and order tickets, but it lacks evidence of supervisory approval and part of the communication record. That means the firm may not be able to demonstrate how the recommendation was reviewed or what was communicated to the client.

Regulatory books and records support:

• reconstruction of events
• evidence of supervision
• response to complaints, examinations, and investigations

A complete trade trail does not replace missing supervision and communication records.

• Treating order tickets as enough fails because execution records do not prove supervisory review or the full communication history.
• Focusing only on suitability misses that recordkeeping also has to evidence approvals and other compliance actions.
• Relying on verbal explanations fails because required records must be retained and producible, not recreated from memory.

Regulatory recordkeeping must let the firm and regulators reconstruct events and verify supervision, which these gaps undermine.

Question 14

Topic: CCO Skill Requirements

An investment dealer’s sales vice-president launched a seminar campaign for a high-yield product aimed at retirees before compliance approved the materials. Within two weeks, three senior clients complained that the seminars described the product as ‘safe income’ even though it carries market and liquidity risk. The firm’s policy requires pre-approval of retail communications and escalation of conduct issues that could harm clients or the firm’s reputation. The CEO tells the CCO to revise future slides but avoid a formal escalation. What is the CCO’s best action?

• A. Revise future slides and continue the campaign unless more complaints arise.
• B. Wait for evidence of client losses before escalating the matter.
• C. Leave the issue with sales management because no regulator has contacted the firm.
• D. Treat it as a material conduct issue requiring suspension, investigation, escalation, and remediation.

Best answer: D

What this tests: CCO Skill Requirements

Explanation: The best response is to treat the matter as a material conduct issue, not just a marketing edit. Compliance protects public trust by challenging business pressure, enforcing fair communications, and escalating risks that could harm clients and confidence in the dealer.

Ethics is the standard of fair dealing, public trust is the confidence clients and markets place in the firm, and the compliance function turns both into real controls, challenge, and escalation. Here, the problem is not only that a required approval step was bypassed. Senior clients may have been misled, the product was marketed to a potentially vulnerable audience, and senior management is trying to avoid formal escalation. A sound compliance response is to stop the campaign, review the unapproved materials and affected sales, escalate through the firm’s governance process, and drive client remediation and control improvements.

• Preserve evidence and assess client impact.
• Escalate under the firm’s policy and document management challenge.
• Strengthen pre-approval and training controls.

Simply fixing future slides would treat ethics as optional and would weaken public trust in the firm’s supervision.

• The option to revise future slides fails because existing clients may already have been misled and the policy requires escalation of conduct risk.
• The option to wait for proven losses fails because compliance acts on material misconduct risk before harm is fully quantified.
• The option to leave it with sales management fails because the breach arose in the business line and compliance must provide independent challenge.

Misleading senior clients and bypassing approval controls create an ethical and public-trust risk that compliance must address and escalate promptly.

Question 15

Topic: Application of Skills

A dealer’s CCO reviews the following monitoring note.

Artifact: Monitoring report excerpt

• Three dealing representatives emailed an issuer’s treasury financing to existing retail clients.
• The emails attached a term sheet and asked clients to return signed subscription agreements to the representatives’ dealer email addresses.
• One representative offered to help clients complete the forms.
• No file notes show a prospectus review, an exempt-distribution analysis, or documented client eligibility for any exemption.
• The branch manager recorded the activity as “issuer direct, not on dealer books.”

Based on the artifact, what is the best next compliance action?

• A. Suspend the activity pending documented prospectus or exemption and client-eligibility review.
• B. Record it as outside business activity and update disclosures.
• C. Approve the emails and continue after standard marketing review.
• D. Permit it because the issuer, not the dealer, settles trades.

Best answer: A

What this tests: Application of Skills

Explanation: The artifact shows active dealer involvement in an issuer financing, not a passive referral. Because there is no documented prospectus or exemption analysis and no evidence that clients qualify for an exemption, the safest and best compliance response is to stop the activity and review the legal basis before it continues.

When registered staff market an issuer financing to clients, send offering materials, and collect subscription agreements through dealer channels, compliance should treat that as possible participation in a distribution. The fact that the issuer settles directly does not remove prospectus-related risk for the firm. Here, the key control gap is the absence of documented analysis showing either that a prospectus is available or that a valid exemption is being relied on for each client.

A sound compliance response is to pause the activity and confirm:

• the dealer’s actual role in the financing
• the prospectus or exemption basis for the sale
• each client’s eligibility for any exemption relied on
• whether supervisory approval and due diligence were completed

Treating this only as a communications issue or an outside business matter would miss the core distribution risk.

• Issuer direct misreads the facts because dealer representatives are actively soliciting clients and handling subscription documents.
• Marketing review only is too narrow because email approval does not address the missing prospectus or exemption analysis.
• Outside business activity does not cure potential dealer participation in a distribution using dealer systems and client relationships.

Dealer staff are soliciting investors and handling subscription paperwork without documented prospectus or exemption analysis, so the activity should pause until the legal basis is confirmed.

Question 16

Topic: CCO Skill Requirements

A dealer’s account surveillance system produces about 4,000 monthly alerts, and analysts close 94% as non-issues after brief review. Two recent client complaints involving unsuitable concentration recommendations were substantiated, but neither account was captured by the surveillance scenarios. The written procedure requires an annual review of surveillance effectiveness, but no documented testing or clear control owner exists, and the CCO must report to the board risk committee this month. What is the best compliance action?

• A. Keep settings unchanged and add analysts to clear alerts faster.
• B. Restrict surveillance to larger accounts to cut alert volume.
• C. Run a documented risk-based tuning review, test against missed cases, add interim manual controls, and escalate the gap.
• D. Suspend surveillance and fast-track a replacement vendor.

Best answer: C

What this tests: CCO Skill Requirements

Explanation: This is a control-effectiveness problem, not just a staffing problem. The best response is a documented, risk-based review that tests the system against known misses, recalibrates it, adds interim coverage, and escalates the weakness through governance.

When a monitoring system creates heavy noise and still misses substantiated issues, compliance should treat that as a surveillance design and governance failure. The right approach is to perform a documented risk-based effectiveness review, using the missed complaint cases as evidence for root-cause analysis and scenario validation. Because the control has underperformed, the issue should be escalated, assigned clear ownership, and reported with a remediation plan. Interim manual reviews should cover higher-risk accounts or activity until revised scenarios are tested and implemented. This approach improves both detection quality and auditability. Simply processing alerts faster, narrowing coverage, or pausing the system leaves the firm exposed because the core problem is poor calibration and weak control governance.

• More reviewers improves throughput but does not explain why meaningful cases were missed or fix scenario calibration.
• Suspend and replace removes an active control before an alternative is proven and delays immediate remediation.
• Limit to larger accounts reduces noise by creating new blind spots instead of validating coverage against actual risk.

A documented tuning and validation review addresses both high false positives and missed issues while preserving coverage through interim controls and escalation.

Question 17

Topic: CCO Skill Requirements

A CCO at a Canadian investment dealer identifies repeated exceptions suggesting undisclosed discretionary trading in several senior client accounts. The regional business head disputes the seriousness and asks the CCO to keep the matter verbal to avoid “overreacting.” The CCO has enough verified facts to conclude the issue must be elevated to the UDP and the board’s compliance committee. Which communication approach is best?

• A. Wait for a full account review before escalating so the message is complete.
• B. Provide a concise written escalation with facts, risk, interim controls, management response, and decisions needed.
• C. Email all business heads for comments before informing the UDP and board committee.
• D. Raise it verbally first and document it only after business management agrees.

Best answer: B

What this tests: CCO Skill Requirements

Explanation: The best approach is a concise written escalation that is factual, risk-based, and clear about what action is needed. That format helps senior governance bodies act promptly, preserves the CCO’s independence, and creates a reliable record of the issue and response.

When a difficult compliance issue must be elevated, the CCO should communicate in a way that is timely, independent, and useful for decision-making. A concise written escalation to the identified governance bodies should separate verified facts from opinions, explain the client and regulatory risk, describe any interim controls already in place, note management’s response, and state what decision or support is required.

This approach aligns with durable Canadian compliance principles: risk-based oversight, proper escalation, and disciplined recordkeeping. It also reduces the chance that business pressure, delay, or informal discussion will soften the message or blur accountability. Once the key facts are reasonably established, the goal is not perfect completeness but prompt, well-supported escalation. Waiting for every detail is usually less defensible than escalating with clear facts and updating as needed.

• Verbal first weakens the audit trail and lets business pressure shape the issue before formal governance review.
• Wait for certainty delays action even though the stem says enough verified facts already exist to escalate.
• Broadcast widely spreads sensitive information unnecessarily and bypasses focused, accountable escalation to the right bodies.

A documented, fact-based, decision-oriented escalation supports timely governance action while preserving the CCO’s independence and recordkeeping discipline.

Question 18

Topic: Regulatory Investigations and Reporting

A CCO at a Canadian dealer reviews the following excerpt.

Artifact: Investigation summary excerpt

• Trigger: Trade surveillance flagged unusual third-party transfers in two client accounts.
• April 8: Compliance opened an internal review and asked the branch manager to collect emails and interview the dealing representative.
• April 10: A provincial securities regulator sent a written demand for records and instructed the firm not to alert staff until the initial production was secured.
• April 11: The branch manager interviewed the representative and advised that a regulator was reviewing the file.

What is the best supported next action?

• A. Keep it as an internal review until client loss is confirmed.
• B. Stop the firm’s review and wait for the regulator’s findings.
• C. Finish branch interviews before producing records to the regulator.
• D. Treat it as an external investigation led centrally by compliance/legal.

Best answer: D

What this tests: Regulatory Investigations and Reporting

Explanation: The regulator’s written demand changes the context from a firm-led internal review to an external investigation response. The firm should centralize handling, preserve evidence, and control further communications rather than letting first-line supervision continue routine interviews.

An internal investigation is initiated and directed by the firm to determine facts, assess breaches, and decide on remediation. An external investigation is led by a regulator or other authority, often with formal production demands and specific instructions. Here, the written demand and the instruction not to alert staff are clear signs that the matter must be managed as an external investigation response.

The firm may still need internal assessment and remediation, but it should now separate that work from the regulator response, preserve records, and restrict further branch-led outreach that could interfere with the external process. The closest distractor is continuing interviews before production, which ignores the explicit no-alert direction.

• Finish interviews first fails because it ignores the regulator’s instruction not to alert staff before the initial production.
• Internal until loss fails because an external investigation does not depend on proving client loss first.
• Wait for the regulator fails because the firm still has responsibility for controlled fact-gathering, preservation, and remediation.

A regulator demand and no-alert instruction mean the matter must be handled as an external investigation response, not routine branch-led internal fact-finding.

Question 19

Topic: Regulatory Investigations and Reporting

At a Canadian investment dealer, compliance is deciding whether a branch matter should remain a supervisory coaching issue or be escalated.

Exhibit: Escalation summary

Which follow-up is best supported by the exhibit?

• A. Open a formal internal investigation and preserve relevant records.
• B. Give documentation coaching and resample the branch next quarter.
• C. Limit the review to suitability because client losses are unproven.
• D. Have the branch manager interview the representative before escalation.

Best answer: A

What this tests: Regulatory Investigations and Reporting

Explanation: This should be treated as a formal internal investigation, not routine coaching. The facts suggest potential misconduct and compromised record integrity, so compliance should preserve evidence and use an independent, documented investigation process.

An ordinary issue review or coaching response is appropriate for isolated control lapses, unclear procedures, or skill gaps where there is no sign of misconduct or evidence risk. Here, the exhibit shows a repeated pattern across multiple accounts, clients disputing approval of both KYC changes and trades, and identical notes added only after compliance asked for the files. That combination raises concerns about unauthorized activity and possible record reconstruction.

A sound compliance response is to:

• open a formal, documented internal investigation
• preserve relevant books, records, and communications
• keep fact-finding independent of the subject and routine branch coaching

The key takeaway is that possible client harm plus potential evidence integrity issues moves the matter beyond ordinary supervision.

• Coaching only fails because the issue is not a simple documentation gap; the pattern and late-added notes suggest possible misconduct.
• Suitability only fails because proven client loss is not required before escalating a matter involving disputed instructions and record integrity concerns.
• Manager-led questioning fails because early fact-finding should protect independence and evidence, not rely on routine branch handling.

The pattern, disputed client authorization, and possible post-request record alteration indicate potential misconduct requiring formal investigation governance.

Question 20

Topic: CCO Skill Requirements

An investment dealer has started a limited pilot of a digital account-onboarding process using a third-party portal that has already passed vendor and security review. The business moved faster than compliance documentation, and current written procedures do not address portal access, evidence retention, exception handling, or branch manager review. No client harm has been identified. As CCO, what is the best next step?

• A. Suspend the pilot until the board approves a complete rewritten policy.
• B. Have branch managers apply existing procedures until internal audit finishes testing.
• C. Continue the pilot unchanged and capture issues at the next annual policy review.
• D. Perform a documented gap assessment, issue interim written controls, train staff, and promptly amend the procedures.

Best answer: D

What this tests: CCO Skill Requirements

Explanation: When business practices change faster than written procedures, compliance should not rely on informal workarounds or wait for a later review cycle. The best response is a documented gap assessment, interim written controls, targeted training, and a prompt procedure amendment so supervision remains effective during the transition.

This tests change management within the compliance function. When a new business process is already underway but written procedures lag behind, the priority is to identify the control gap and put a governed bridge in place. That means documenting the risks, defining interim supervisory requirements, clarifying recordkeeping and exception handling, training affected staff, and assigning responsibility to update the formal procedures promptly.

This approach preserves evidence of reasonable supervision and shows that management reacted in a controlled, risk-based way once the gap was identified. Waiting for the annual review leaves a known weakness unaddressed. Relying on branch managers to improvise creates inconsistent supervision. Stopping the activity immediately may be disproportionate where the process has already passed core review and the risk can be managed through interim controls.

• Annual review delay leaves a known procedural gap in place instead of addressing it promptly.
• Immediate freeze is premature here because the facts support a controlled interim response rather than a full shutdown.
• Branch manager workaround skips formal guidance, documentation, and consistent firm-wide supervision.

It closes the immediate control gap with documented interim measures while the formal procedures are updated.

Question 21

Topic: Compliance Role and Structure

A Canadian investment dealer is facing a surge in new account applications before quarter-end. The head of retail asks the CCO to suspend review of system alerts for seniors, third-party trading authority, and large incoming transfers for 10 business days so accounts can be opened faster. Internal testing shows these alerts have produced the dealer’s most significant recent suitability and fraud issues. Which response best aligns with sound compliance practice?

• A. Suspend the alerts but increase post-opening surveillance on the affected accounts.
• B. Approve the suspension because it is temporary and exceptions can be reviewed later.
• C. Keep the alerts, triage the highest-risk files, add temporary capacity, and document/escalate the override request.
• D. Let branch managers decide which alerts can be bypassed for their own clients.

Best answer: C

What this tests: Compliance Role and Structure

Explanation: When business pressure conflicts with a control that has already identified serious suitability and fraud issues, compliance should not disable the control for convenience. The better response is to keep the control in place, manage the backlog on a risk basis, and escalate any attempt to override it.

The core principle is that compliance must remain independent and proportionate to actual risk. Here, the requested override targets alerts tied to the dealer’s most significant recent issues, so suspending them would weaken a proven preventive control at exactly the time pressure is highest. A sound response is to preserve the control, prioritize the highest-risk accounts first, use temporary staffing or other operational support to address the backlog, and create a clear record of the request and compliance decision. If business leadership continues to press for the override, the matter should be escalated through appropriate management or governance channels. After-the-fact surveillance can support supervision, but it is not an adequate substitute for turning off an effective front-end safeguard.

• Temporary relief fails because a short suspension of a proven high-risk control still increases exposure during a peak-volume period.
• Business discretion fails because line management should not unilaterally weaken an independent compliance control.
• Back-end monitoring only fails because post-opening surveillance does not replace preventive review where recent serious issues have already been found.

A prudent compliance response preserves a proven high-risk control, applies risk-based triage, and escalates pressure to weaken that control.

Question 22

Topic: CCO Skill Requirements

A CCO at a Canadian investment dealer is reviewing a draft branch procedure for outgoing client fund transfers.

Exhibit: Draft policy excerpt

• Staff should be alert to unusual requests.
• If a request seems concerning, use judgment and take appropriate steps.
• Material issues should be escalated promptly to the appropriate supervisor.
• Notes should be added to the file where helpful.

Which deficiency is best supported by the excerpt?

• A. It is workable as written because front-line judgment can fill in the details case by case.
• B. It is too weak mainly because it does not require compliance to approve every outgoing transfer.
• C. It is too weak mainly because it does not set a single universal dollar threshold for escalation.
• D. It is too vague because it omits clear triggers, escalation ownership, and minimum documentation requirements.

Best answer: D

What this tests: CCO Skill Requirements

Explanation: The draft is not operational enough for front-line use. Terms such as “unusual,” “appropriate,” “promptly,” and “where helpful” are subjective unless the procedure also defines triggers, specifies who receives escalations, and states what documentation is mandatory.

A usable front-line procedure must translate broad compliance expectations into actions staff can apply consistently. In this excerpt, the key words are vague: staff are told to watch for “unusual” requests, take “appropriate” steps, escalate “material” issues “promptly,” and document the file only “where helpful.” That language does not tell employees what facts require escalation, who the decision-maker is, or what minimum record must exist to support supervision and later review.

A stronger procedure would typically state:

• examples of red flags or escalation triggers
• the specific supervisor or function to notify
• any hold, verification, or follow-up step required
• the minimum file notes or evidence to retain

Blanket pre-approval for every transfer or a single dollar threshold may be possible controls, but they do not address the core drafting defect shown in the excerpt: the policy is too vague to guide consistent front-line action.

• Blanket approval adds an across-the-board control that is not required to fix the drafting problem shown.
• Rely on judgment ignores the risk of inconsistent handling when staff are given only subjective terms.
• One dollar threshold treats amount as the only risk factor and still leaves escalation steps and documentation unclear.

The excerpt uses subjective terms without telling front-line staff what to identify, who to contact, or what must be recorded.

Question 23

Topic: Application of Skills

During a weekly supervision review, an investment dealer’s equity desk supervisor sees that one trader made 18 post-execution order-ticket amendments in two weeks, compared with a desk average of 1. Several amendments added notes describing client instructions that were absent from the original ticket. The trader says the market was busy at the open and the tickets were simply cleaned up later. Which action best aligns with prudent Canadian trading supervision?

• A. Accept the explanation and remind the trader to complete tickets earlier.
• B. Start a documented review against time-stamped source records, apply heightened supervision, and escalate unexplained discrepancies.
• C. Ban all post-execution amendments on the desk without further review.
• D. Wait for a client complaint before reviewing the affected orders.

Best answer: B

What this tests: Application of Skills

Explanation: A repeated pattern of post-execution amendments is a trading-supervision red flag because it can weaken the reliability of order records and obscure original client instructions. The strongest response is a targeted, documented review using objective evidence, with heightened supervision and escalation if concerns remain.

The core control issue is the integrity of the original order record. When one trader shows an outlier pattern of post-execution amendments, prudent supervision requires more than a verbal reminder: the firm should verify the amended tickets against time-stamped source evidence such as recorded calls, electronic messages, and original order-entry data, document the review, and consider temporary heightened supervision while the issue is assessed. If the review shows unexplained discrepancies, a broader control weakness, or possible misconduct, the matter should be escalated to compliance and management promptly. This is a risk-based and evidence-driven response. By contrast, relying on the trader’s explanation, waiting for a complaint, or imposing a blanket prohibition without understanding the facts does not address the specific supervisory risk properly.

• Verbal reassurance fails because an outlier pattern needs testing against books and records, not just a reminder.
• Blanket prohibition fails because some corrections may be legitimate; supervision should be proportionate and evidence-based.
• Complaint-driven review fails because trading supervision is meant to detect and address issues before client harm is reported.

A red-flag pattern of late amendments should be tested against original evidence and escalated if it cannot be satisfactorily explained.

Question 24

Topic: Application of Skills

During a monthly exception review, compliance finds 18 retail orders over two weeks marked as unsolicited, but client notes show recommendations were given. The entries were made by different assistants for six advisors in two branches, and both branch managers had already completed their supervisory sign-offs. The firm’s policy requires escalation when repeated exceptions cross branches or involve completed supervisory reviews. What is the best next step for the CCO?

• A. Report the matter to CIRO before verifying scope and cause.
• B. Remind assistants about coding and reassess next month.
• C. Open a targeted supervision review and add interim sign-off control.
• D. Correct the order codes and close it as an entry problem.

Best answer: C

What this tests: Application of Skills

Explanation: This is not just a ticket-coding problem. Because the same exception pattern appears across multiple assistants, advisors, and branches after supervisory sign-off, the CCO should treat it as a possible business-line supervision weakness and add an interim safeguard while the review is expanded.

The core distinction is whether the problem is isolated to order entry or reflects a supervisory breakdown. A single miscoded order by one person can often be handled as an order-entry correction. Here, the pattern spans multiple assistants, advisors, and branches, and branch managers already signed off on their reviews. That points to a broader business-line supervision issue, such as ineffective exception review, weak escalation, unclear procedures, or poor training.

A sound next step is to:

• preserve the tickets, notes, exception reports, and supervisory records
• expand the review to the affected branches, advisors, and supervisors
• add an interim control on unsolicited-order sign-off
• assess root cause and then decide on any further escalation

Simply correcting tickets or issuing a reminder would address the symptom, not the control failure.

• Isolated correction misses the repeated cross-branch pattern and the failed supervisory sign-off.
• Reminder first skips evidence preservation, scope assessment, and immediate risk containment.
• Immediate external reporting is premature before confirming the full facts, root cause, and whether a reportable breach exists.

The repeated, cross-branch exceptions after supervisory sign-off indicate a potential business-line supervision failure, so the issue should be escalated and contained broadly.

Question 25

Topic: CCO Skill Requirements

A dealer’s compliance team has found the same exceptions in approvals for third-party fund transfers for three consecutive quarterly reviews. Each report was sent to operations management, which replied that staff had been reminded, but the exception rate has not improved. The issue tracker still shows no accountable owner or target date. What is the best next step for the CCO?

• A. Send another staff reminder and keep ownership at branch level
• B. Expand the sample for one more quarter before escalating
• C. Close the issue after staff attest to the procedure
• D. Formally escalate the issue and require a tracked remediation plan

Best answer: D

What this tests: CCO Skill Requirements

Explanation: When monitoring repeatedly identifies the same control failure without improvement, the problem is no longer detection; it is failed remediation. The strongest response is to escalate through governance and require a documented plan with ownership, timelines, and follow-up validation.

The core concept is monitoring effectiveness. Compliance monitoring is not successful merely because it finds exceptions; it must also drive timely corrective action. Here, the same issue has appeared over three quarters, management has responded only with reminders, and there is still no named owner or target date. That pattern shows a breakdown in issue management and escalation.

A sound follow-up is to move the matter into formal governance and strengthen remediation discipline:

• require root-cause analysis
• assign an accountable business owner
• set deadlines and track progress
• perform follow-up testing before closure

More sampling or another reminder may add information, but neither addresses the fact that prior findings have not been remediated.

• Waiting for another quarter delays action even though the repeated pattern already shows a persistent unresolved control weakness.
• Another reminder repeats the same ineffective response from line management and does not improve accountability.
• Closing the issue on staff attestation is weak because remediation must be demonstrated and validated, not assumed.

Repeated unchanged findings show monitoring is detecting the problem but governance and remediation are failing, so formal escalation and documented corrective action are needed.

Questions 26-50

Question 26

Topic: CCO Skill Requirements

A dealer’s CCO reviews the following branch escalation entry.

Exhibit: Issue tracker snapshot

What interpretation is best supported by the exhibit?

• A. It is primarily a documentation lapse because the KYC update was delayed.
• B. It is primarily a training gap requiring another procedure review.
• C. It is primarily an ethical dilemma involving pressure and conflict.
• D. It is primarily a policy gap because approval steps are unclear.

Best answer: C

What this tests: CCO Skill Requirements

Explanation: The exhibit shows that the procedure already existed and the relevant staff had just been trained on it. The stronger signal is the manager’s pressure to change client information after the sale, combined with a personal and business conflict, which makes this primarily an ethical dilemma rather than a simple process gap.

This scenario points mainly to an ethical dilemma, not a missing procedure. The dealer already had a clear rule requiring independent approval before a trade that does not fit current KYC, and both individuals had recent training on that rule. Despite that, the branch manager directed the representative to alter the client’s risk tolerance after the sale and had a personal and business relationship with the client. Those facts indicate improper influence, compromised judgment, and a conflict of interest.

For a CCO, the primary lens is conduct risk and ethical decision-making: the issue should be treated as potential misconduct requiring independent review, evidence preservation, and escalation. Training or policy edits may still be considered later, but they are secondary because the facts show knowing circumvention of an existing control, not confusion about what the control requires. The closest distractor is the training explanation, but recent training is already documented.

• More training fails because the exhibit already shows recent procedure training for both individuals.
• Unclear policy fails because the written process already requires independent approval before an off-KYC trade.
• Documentation only fails because the concern is not simple delay; it is pressure to change KYC after the sale to fit the trade.

The process was documented and recently trained, so the key issue is deliberate pressure to alter KYC amid a personal conflict.

Question 27

Topic: Regulatory Investigations and Reporting

A provincial securities regulator sends a dealer a written request for emails, trade blotters, and supervisory notes about one registered representative, with a response due in five business days. Before the CCO sees it, the branch manager asks the representative and assistant to “pull anything relevant and send it over today.” What is the best next step for the CCO?

• A. Send the regulator the readily available records now and explain that missing items will follow later if found
• B. Centralize the response through compliance or legal, issue an immediate preservation notice, and control all regulator communications
• C. Allow the branch manager to gather documents first, then have compliance review what was sent
• D. Interview the representative immediately to decide whether the request is serious before collecting records

Best answer: B

What this tests: Regulatory Investigations and Reporting

Explanation: The strongest next step is to respond cooperatively in a controlled way. That means preserving potentially relevant records immediately and routing collection and communications through a central compliance or legal process so the firm’s response is complete, consistent, and defensible.

In an external investigation, the key distinction is between being cooperative and being uncontrolled. A cooperative response does not mean letting front-line staff send materials directly or sending a rushed partial package. The CCO should first establish control over the process: preserve records, stop ad hoc responses, define who will collect documents, and ensure one channel for regulator communications. This helps prevent loss of evidence, inconsistent explanations, incomplete production, and avoidable credibility issues.

A sound sequence is:

• issue a preservation hold for relevant records and devices
• instruct staff not to respond individually
• centralize collection, review, and submission through compliance or legal
• confirm scope or timing with the regulator if clarification is needed

The closest distractors appear cooperative, but they create fragmented or incomplete production rather than a disciplined response.

• Branch-led collection is too uncontrolled because documents may be selected inconsistently or sent before proper review.
• Partial production first seems responsive, but it risks an incomplete record and weakens confidence in the firm’s controls.
• Interview before preservation skips the key safeguard; evidence must be preserved before facts are informally tested.

This creates a cooperative but controlled response by preserving evidence first and preventing fragmented or incomplete submissions.

Question 28

Topic: Regulatory Investigations and Reporting

A Canadian investment dealer receives a formal request from a provincial securities regulator for emails, chat messages, order records, and supervision notes relating to one registered representative. The firm’s chat system auto-deletes after 90 days, and the branch manager wants to hold a team call so everyone can “get the facts straight” before compliance responds. As CCO, what is the best next step?

• A. Let the branch manager interview staff first, then preserve only the records that appear relevant.
• B. Issue a documented preservation hold, stop routine deletion, restrict discussions to need-to-know, and route regulator contact through compliance/legal.
• C. Ask operations to export current records, but wait to escalate until the firm knows whether misconduct occurred.
• D. Send the regulator an initial narrative response now and address retention settings once the request is narrowed.

Best answer: B

What this tests: Regulatory Investigations and Reporting

Explanation: Once an external investigation begins, the firm must immediately preserve potentially relevant evidence and control who communicates about the matter. Prompt escalation through compliance/legal helps keep the response coordinated, defensible, and regulator-ready.

The core concept is immediate evidence preservation and controlled response. Once a regulator has started an external investigation, the firm should not rely on ordinary retention settings or informal discussions led by the business unit. The CCO should trigger a documented preservation hold covering all potentially relevant records, suspend auto-deletion, limit internal discussions to those with a need to know, and centralize external communications through compliance/legal.

This protects the integrity of records, reduces the risk of altered or lost evidence, and helps avoid inconsistent employee accounts. It also ensures senior decision-makers and legal advisers are engaged early enough to manage legal, operational, and reputational risk. Fact-gathering can follow, but only after preservation and communication controls are in place. The closest distractors fail because they start interviews or responses before those safeguards exist.

• Interview first is flawed because staff discussions before a formal hold can create coaching concerns and selective preservation.
• Respond first is premature because relevant records could still be deleted while the firm is already under investigation.
• Export only is incomplete because a one-time export does not replace a broader hold or prompt escalation to the right control functions.

An immediate preservation hold, controlled communication, and prompt escalation reduce spoliation risk, inconsistent statements, and unmanaged regulatory exposure.

Question 29

Topic: Regulatory Investigations and Reporting

During a branch review, the CCO finds the following note in a branch manager’s files regarding a request from a provincial securities regulator.

Artifact: Investigation summary

April 8, 2026
Source: Telephone call from regulator investigator
Request: 'Send client KYC, trade tickets, and any advisor emails for client M.'
Handled by: Branch manager
Actions: Selected emails and account forms sent by secure email same day
Notes: No need to open legal matter; request seemed routine
Log status: Not added to central investigations log
Preservation: No documented instruction to retain additional records

Which deficiency is best supported by the artifact?

• A. The file should have been classified first as a client complaint.
• B. The regulator inquiry was not centrally escalated, logged, and preservation-controlled.
• C. The request could not be answered without a formal written summons.
• D. The client should have been notified before any records were provided.

Best answer: B

What this tests: Regulatory Investigations and Reporting

Explanation: The note shows an external regulatory inquiry handled informally by a branch manager, with no central log entry and no documented preservation step. That is the clearest control gap because external investigations require disciplined escalation, documentation, and response management.

The core issue is weak control over an external investigation request. The artifact shows the branch manager responded directly to a regulator, sent selected records the same day, did not place the matter in the central investigations log, and documented no preservation instruction. Those facts support a deficiency in escalation and documentation discipline, because the firm should control who responds, confirm and record the request scope, preserve relevant records, and maintain a clear response trail.

A sound process would typically:

• route the inquiry to compliance and, where appropriate, legal
• log the matter centrally and document the request details
• issue retention or preservation instructions for potentially relevant records
• document what was produced, by whom, and on what basis

The closest distractor is the idea that a summons was required, but the real problem here is not the absence of compulsory process; it is the absence of controlled handling.

• Client notice is unsupported; notifying a client can be inappropriate in an external inquiry and is not the main gap shown.
• Formal summons only goes too far; firms may respond to regulator requests without compulsory process if the response is properly escalated and documented.
• Complaint classification misreads the artifact; this is a regulator inquiry, not a client expression of dissatisfaction.

Producing records from a regulator call without centralized logging, documented scope control, and preservation steps shows a clear external-investigation handling failure.

Question 30

Topic: Regulatory Investigations and Reporting

A provincial securities regulator emails a dealer’s CCO at 10:15 a.m. requesting records and an explanation by 4:00 p.m. the same day.

Exhibit: Escalation log

• Requested items: trade tickets, trader emails/chats, and the desk supervisor’s explanation
• Preservation status: email hold not yet applied; desk chat platform auto-deletes at midnight
• Business-unit action: desk manager is drafting a direct reply to the regulator
• IT note: a legal hold can be applied within 30 minutes

What is the best immediate compliance action?

• A. Clarify the regulator’s theory of concern before taking any preservation steps.
• B. Let the desk manager send a preliminary explanation, then gather supporting records afterward.
• C. Wait for the overnight backup because the chat deletion risk does not arise until midnight.
• D. Apply a legal hold immediately, stop any direct desk response, and coordinate the reply through compliance.

Best answer: D

What this tests: Regulatory Investigations and Reporting

Explanation: The immediate priority is to preserve potentially relevant evidence and control the firm’s communications. Because chats may auto-delete and the desk manager is preparing a direct reply, compliance should impose a hold right away and manage the response centrally.

When an external authority requests records or explanations on short notice, the first compliance priority is to preserve all potentially relevant evidence and prevent uncontrolled statements. In the exhibit, email is not yet on hold, chats are subject to auto-deletion, and a business manager is about to reply directly. That creates both preservation risk and response-management risk.

• Place a hold on relevant mailboxes, chats, and trade records immediately.
• Instruct the business unit not to respond outside the coordinated process.
• Have compliance, and legal if involved, acknowledge the request and manage production or any clarification.

A preliminary business reply or delayed preservation can create gaps, inconsistencies, or lost evidence, which is exactly what compliance should avoid.

• Desk-first reply fails because business staff should not make an uncontrolled statement before compliance preserves and reviews the evidence.
• Wait for backup fails because a known deletion risk requires immediate preservation, not delayed collection.
• Clarify before preserving fails because scope questions can be addressed after records are secured; preservation should not wait.

The exhibit shows both evidence-preservation risk and uncontrolled-response risk, so compliance should immediately preserve records and centralize the regulator communication.

Question 31

Topic: Application of Skills

A CCO at a Canadian investment dealer reviews the following monthly desk-monitoring excerpt.

Exhibit: Monitoring report excerpt

Which deficiency is best supported by the exhibit?

• A. Equity supervision is not adequately reviewing best execution across trading venues.
• B. Both desks lack restricted-list controls for securities on the firm’s restricted list.
• C. Fixed-income supervision is not adequately reviewing fair pricing and support for client bond prices.
• D. Fixed-income supervision is missing wash-trade surveillance, the main risk shown for bond trading.

Best answer: C

What this tests: Application of Skills

Explanation: The exhibit points to a fixed-income control gap, not an equity one. Retail bond trading creates key risks around fair pricing, spreads or markups, and documented support for client prices, and the report shows repeated exceptions in exactly those areas.

Equity and fixed-income desks require different supervisory focus because the market structure and conduct risks differ. On the equity desk, the report already shows desk-specific surveillance for wash trades, layering, restricted-list issues, and best execution, with two alerts escalated and under investigation. That suggests the equity controls exist and are operating.

On the fixed-income desk, the current reviews are limited to restricted-list checks and P&L, yet the findings show repeated retail bond trades above the internal spread guideline and missing quote support for client pricing. In a quote-driven, often principal bond market, that is a direct signal that fair-pricing and pricing-documentation supervision is the control gap. The key takeaway is that bond-desk risks are often centred on client pricing evidence and spread review, not the same surveillance pattern used for equities.

• The option about equity best execution misreads the exhibit, which expressly says best-execution by venue is already reviewed.
• The option about wash-trade surveillance for fixed income ignores the stated bond-pricing exceptions and focuses on the wrong desk risk.
• The option claiming both desks lack restricted-list controls is contradicted by the report, which lists restricted-list checks for each desk.

The fixed-income findings show repeated pricing and documentation exceptions, which are core bond-desk supervision risks.

Question 32

Topic: CCO Skill Requirements

A Canadian investment dealer rolls out a new client cash-disbursement process after several attempted social-engineering frauds. The process requires: the representative records the request, operations completes an independent callback for any new banking instruction, a branch manager approves any third-party payment or disbursement over $50,000, and operations sends a confirmation notice to the client. The CCO has been asked to build monthly monitoring for this process. What is the best next step?

• A. Map the workflow and design tests for the callback, approval, and confirmation controls.
• B. Review only disbursements over $50,000 for the first six months.
• C. Obtain quarterly manager attestations before designing any exception tests.
• D. Wait for complaint trends before deciding which steps need monitoring.

Best answer: A

What this tests: CCO Skill Requirements

Explanation: The best next step is to identify the process steps where a compliance failure would matter most and build monitoring around those controls. In this workflow, the independent callback, required approval, and client confirmation are the key control points, so monitoring should test those steps directly.

Effective monitoring starts with the process, not with a broad sample or a later complaint review. The CCO should first map the end-to-end workflow, identify where the main compliance risks arise, and then anchor monitoring to the preventive and detective controls at those points. In this scenario, the key risks are fraudulent banking changes, unauthorized cash disbursements, and missed client notifications. That makes the independent callback, supervisory approval, and confirmation notice the key control points.

• Link each control point to its trigger.
• Define the evidence to review, such as call logs, approvals, and confirmations.
• Build exception reporting for missed, late, or undocumented controls.

A narrower transaction review, attestation-only approach, or waiting for complaints would be more reactive and would skip the control-design step.

• Large-value only is too narrow because it would miss third-party payments and new banking instructions below the stated threshold.
• Attestations first support accountability, but they do not identify or test whether the key controls actually operated.
• Waiting for complaints is reactive and delays monitoring instead of building it around known risk points in the process.

Monitoring should begin by identifying the highest-risk control points and testing whether those controls were performed and evidenced.

Question 33

Topic: Application of Skills

A CCO reviews supervision on a Canadian dealer’s institutional equity desk. Orders above preset price or size limits can be manually overridden by traders. A daily override report exists, but it is reviewed by the desk head, who also enters orders and makes some overrides. Other findings are one outdated procedure screenshot and one late training attestation. What is the best next step?

• A. Update the desk procedure first, then revisit the override control next quarter.
• B. Deliver refresher training to traders before changing the monitoring process.
• C. Require the desk head to certify monthly that all overrides were appropriate.
• D. Assign an independent supervisor to review override reports immediately and document follow-up.

Best answer: D

What this tests: Application of Skills

Explanation: The most important deficiency is the lack of independent review over manual overrides, not the outdated screenshot or late attestation. Because overrides bypass preset trading controls, the CCO should first install prompt, documented supervisory review by someone outside the activity.

The key control concept is supervisory independence. Manual overrides of price or size limits are higher-risk events because they bypass preventive order-entry controls. When the same desk head both participates in trading activity and reviews the override report, the firm has a self-review weakness and weaker evidence that exceptions are being challenged appropriately. The best next step is to implement immediate independent review of override activity, with documented follow-up and escalation where needed.

A sound response is to:

• move the review to an independent supervisor or compliance function;
• require timely evidence of review and challenge;
• then update procedures and training to reflect the revised control.

Documentation and training matter, but they should follow repair of the core control deficiency.

• Updating the desk procedure first fixes documentation, not the immediate self-review weakness in override monitoring.
• Monthly certification by the desk head preserves the same independence problem.
• Trader refresher training may help later, but it should not come before repairing the control design.

Independent review addresses the highest-risk deficiency because override activity is currently subject to self-review on the desk.

Question 34

Topic: Application of Skills

A dealer’s communications policy states that material distributed to the public or to a broad client/prospect group is advertising or sales literature and must be approved by Compliance before first use. Individual, tailored messages to one client are treated as correspondence and may be reviewed after use.

Exhibit: Communications review snapshot

Which follow-up is most appropriate?

• A. Withdraw the seminar invitation and preferred share flyer pending Compliance approval.
• B. Escalate only the ETF switch email for missing prior approval.
• C. Treat the preferred share flyer as correspondence and review it after use.
• D. Leave the seminar invitation in place because it is not product-specific.

Best answer: A

What this tests: Application of Skills

Explanation: The public seminar invitation and the preferred share flyer are not ordinary one-to-one correspondence. Under the stated policy, both are broadly distributed promotional materials and required Compliance approval before first use, so the immediate response is to pull them until approved.

The key issue is how the communication is classified. Advertising and sales literature are identified by public or broad distribution and promotional purpose, so they need pre-use Compliance approval. The seminar invitation is posted on a public website and uses firm branding, which makes it advertising even though it does not name a product. The preferred share flyer is standardized promotional material sent to many prospects, so it is sales literature and also required approval before first use.

The ETF switch email is different because it is tailored to one existing client. Under the stated policy, that is correspondence and may be supervised after use, although it still needs normal supervisory oversight. The quarterly market update already used an approved template. The closest trap is assuming only product-specific pieces need approval; public promotional material can require approval even without product detail.

• Tailored email misreads individualized correspondence as material that always needs prior approval; the stated policy allows post-use review for one-client messages.
• Product-only view fails because a public seminar invitation can still be advertising even without product details.
• Prospect flyer as correspondence ignores that standardized promotional material sent to many prospects is sales literature, not ordinary correspondence.

Both items are broadly distributed promotional materials, so the policy requires Compliance approval before first use.

Question 35

Topic: Application of Skills

A compliance analyst reviews a new account package for an individual margin account before activation.

Artifact: Registration file note

• KYC: annual income $48,000; liquid assets $22,000; net worth $90,000
• Knowledge: limited
• Objectives: income, long-term growth
• Risk tolerance: medium
• Options form: signed and approved for covered call writing only
• Representative note: client wants to begin writing uncovered short calls immediately

What is the best supported deficiency in the file?

• A. The documented approval is narrower than the trading the client intends.
• B. A branch note can resolve the difference between approval and trading intent.
• C. The file is adequate because a signed options form is already present.
• D. The proper fix is simply to recode the client as high risk.

Best answer: A

What this tests: Application of Skills

Explanation: The file shows a mismatch between documented account approval and the proposed trading activity. Approval for covered call writing does not extend to uncovered short call writing, and an internal note does not cure that gap.

The core issue is whether the account-opening record supports the activity the client plans to undertake. Here, the file documents limited knowledge, medium risk tolerance, and approval only for covered call writing, yet the representative note says the client wants to write uncovered short calls immediately. That intended strategy is different from, and riskier than, the activity the file authorizes. Compliance should treat this as inadequate account-opening documentation and require complete, accurate documentation and any necessary internal approval before that activity is permitted.

The key takeaway is that client intent does not expand account authority.

• Signed form present fails because the form on file authorizes a different, narrower options strategy.
• Branch note cure fails because informal notes cannot replace proper documented approval for the intended activity.
• Recode to high risk fails because KYC must reflect the client accurately, not be changed just to fit a desired trade.

The file authorizes only covered call writing, so it does not support the client’s intended uncovered short call activity.

Question 36

Topic: Application of Skills

A CCO at a Canadian investment dealer reviews this equity-surveillance note for a thinly traded issuer. Based on the artifact, what is the best next action?

Exhibit: Surveillance note

Issuer: Northlake Bio Inc. (thinly traded)
15:56-15:59: same dealing rep entered 3 client buy orders
Prices: 1.96, 2.00, 2.03
Volume: 6,000 shares = 61% of last-10-minute market volume
Prior last sale: 1.94
Desk chat at 15:55: "Need a close above 2.00 before tomorrow's collateral review."
Client notes: no urgency or investment rationale recorded

• A. Open a formal manipulation investigation and preserve trading evidence.
• B. Close the alert because no employee account traded.
• C. Send the matter for branch suitability review and coaching.
• D. Monitor for recurrence before starting a formal investigation.

Best answer: A

What this tests: Application of Skills

Explanation: This fact pattern points to possible market manipulation, not just poor documentation or suitability weakness. Concentrated end-of-day buying, rising prices, dominant late-session volume, and the chat about needing a specific close justify immediate escalation and evidence preservation.

A key criminal-trading-offence concept is manipulative or deceptive trading intended to create or support an artificial price. Here, the concern is stronger than ordinary aggressive buying: the issuer is thinly traded, the orders were placed in the final minutes, the price was pushed from 1.94 to 2.03, the orders made up most of the late-session volume, and an internal chat links the activity to achieving a closing level before a collateral review. That combination is consistent with possible “marking the close.”

A CCO should treat this as an immediate escalation matter, preserve orders and communications, and begin a formal review under the firm’s investigation procedures. The absence of an employee personal-account trade or proven client loss does not remove the manipulation concern. Waiting for another episode would risk losing evidence and understating a potentially serious offence.

• Suitability only misses the stronger indicator of trading intent shown by the chat and the end-of-day price-support pattern.
• No employee account fails because manipulative conduct can be carried out through client orders; personal-account use is not required.
• Wait for recurrence is too passive because the existing facts already support immediate escalation and record preservation.

The late-day price pattern and the rep’s chat support possible marking the close, so immediate escalation and evidence preservation are warranted.

Question 37

Topic: Compliance Role and Structure

At a mid-sized investment dealer, the CCO finds that significant supervision findings are discussed in quarterly management meetings, but minutes do not assign owners, due dates, or escalation triggers, and the board receives only a year-end narrative summary. Several issues have remained open for more than six months. What is the best next step to build a senior-level compliance framework that supports durable oversight?

• A. Have each business unit keep its own action log and report only issues it considers material.
• B. Increase testing immediately and defer governance changes until the next annual compliance review.
• C. Send all open issues directly to the board now and let business heads propose remediation afterward.
• D. Implement a documented issue-management framework with risk ratings, owners, deadlines, escalation triggers, and recurring reporting to senior management and the board.

Best answer: D

What this tests: Compliance Role and Structure

Explanation: The main weakness is not insufficient testing; it is weak governance around remediation. Durable oversight requires a formal process that assigns accountability, sets escalation rules, and provides regular reporting so senior management and the board can monitor issues consistently over time.

A senior-level compliance framework is durable when material issues move through a documented governance process rather than informal discussion. In this scenario, findings are aging because there is no clear ownership, no target dates, no escalation path, and no regular board-level visibility. The best next step is to formalize issue management so compliance can track remediation, challenge delays, and escalate significant or overdue items on a defined cadence.

• Risk-rate each issue.
• Assign a responsible business owner.
• Set due dates and escalation triggers.
• Report status and trends to senior management and the board.

More testing, ad hoc board escalation, or fragmented local logs may generate activity, but they do not create sustainable oversight.

• More testing first adds findings but does not fix the missing governance structure around ownership and escalation.
• Immediate board escalation is premature because management accountability and a formal remediation process should be established first.
• Local business-unit logs weaken enterprise-wide visibility and make escalation inconsistent.

It creates the accountability, escalation, and reporting structure needed for durable senior-level oversight of unresolved compliance issues.

Question 38

Topic: Application of Skills

A dealer is lead underwriter for a Canadian prospectus offering. The CCO reviews this excerpt from the deal file before institutional marketing begins.

Artifact: Due diligence memo excerpt

• April 8: Issuer CFO disclosed that a customer representing 28% of annual revenue may cancel its contract.
• April 8: Banking and external counsel requested supporting documents from the issuer.
• April 9: Research, sales and trading, and compliance were not added to the issue update list “until materiality is confirmed.”
• April 10: Institutional investor meetings are scheduled to start.

Based on the artifact, what is the best supported next action?

• A. Allow investor meetings to proceed while banking completes fact-gathering.
• B. Wait for issuer counsel to decide materiality before involving compliance.
• C. Limit compliance to final prospectus review after disclosure is settled.
• D. Initiate compliance escalation and assess watch/restricted list controls now.

Best answer: D

What this tests: Application of Skills

Explanation: The memo shows a possible material development surfaced during underwriting due diligence just before investor marketing, while compliance and other control functions were intentionally excluded. That creates an immediate compliance oversight obligation to escalate the issue and assess information-control measures before the deal proceeds.

Underwriting due diligence is not only a legal or banking exercise when it reveals a potential control or market-conduct risk. Here, the possible loss of a customer representing 28% of annual revenue could be material, investor meetings are imminent, and compliance was deliberately left off the update list until someone else confirmed materiality. That is the control gap.

The CCO should step in promptly to oversee the firm’s response, including:

• escalation of the issue within the dealer
• assessment of watch or restricted list status
• review of information barriers and wall-crossing controls
• confirmation that marketing does not continue without appropriate controls and documentation

External counsel can help assess disclosure, but the dealer still owns its supervisory and compliance obligations during the underwriting process.

• Counsel only confuses disclosure advice with the dealer’s own duty to control information flow and restricted activity.
• Proceed with meetings ignores that client outreach is about to begin while a potentially material issue remains unresolved.
• Final-only review is too late because compliance oversight is needed during due diligence, not only at filing or closing.

Possible material non-public information uncovered in underwriting due diligence requires immediate compliance escalation and control review before marketing continues.

Question 39

Topic: Compliance Role and Structure

The CCO of a Canadian investment dealer is reviewing a proposed governance memo before it is finalized.

Artifact: Governance memo excerpt

• The CCO reports administratively to the CFO.
• Business-line heads own remediation of compliance findings.
• Material compliance issues are discussed with the responsible business head and, if unresolved, are carried to the next quarterly executive committee meeting.
• The board receives an annual compliance summary prepared by the CFO.
• The memo gives the CCO no standing right to report directly to the board or its risk committee.

Which next action is best supported by the excerpt?

• A. Transfer ownership of remediation from business-line heads to compliance.
• B. Add a formal direct escalation path from the CCO to the board for material issues.
• C. Accept the framework because the board already receives an annual compliance summary.
• D. Move the CCO’s administrative reporting line from the CFO to the CEO.

Best answer: B

What this tests: Compliance Role and Structure

Explanation: The key gap is board access and escalation, not who handles day-to-day administration. A senior-level compliance framework should give the CCO a clear, timely way to bring material unresolved issues directly to the board or an appropriate board committee.

This scenario tests governance design within a senior compliance framework. The excerpt already assigns remediation to business-line management, which is generally appropriate, and an administrative reporting line to the CFO is not, by itself, the main defect. The real weakness is that material issues can only move through management channels and the board receives only an annual summary prepared by the CFO. That structure may delay escalation and can weaken the CCO’s independence on significant matters.

A sound framework should include direct, documented access for the CCO to the board or a relevant board committee, especially for material, unresolved, or systemic compliance issues. Annual board reporting is useful, but it does not replace timely escalation rights when a serious issue arises.

• Change the admin line is tempting, but the artifact does not show that the CFO reporting line is the core control failure.
• Shift remediation to compliance fails because first-line management should generally own corrective action, while compliance oversees and escalates.
• Rely on the annual summary ignores that significant issues need a timely path to board-level attention, not just periodic reporting.

The memo lacks a timely, documented route for the CCO to take significant unresolved compliance matters directly to the board or a board committee.

Question 40

Topic: CCO Skill Requirements

A Canadian investment dealer recently added active retail options trading. Its surveillance system now produces so many alerts that desk supervisors have started closing “duplicate” alerts before compliance sees them, and no closure rationale is retained. The CCO wants a durable fix that reduces noise without weakening oversight. Which action best aligns with sound monitoring-system design?

• A. Adopt compliance-approved risk-based triage, preserve closure rationale, and test suppressed alerts.
• B. Raise all alert thresholds until the backlog returns to target levels.
• C. Permit desk supervisors to close repetitive alerts and report totals monthly.
• D. Review alerts strictly in arrival order and defer recalibration to year-end.

Best answer: A

What this tests: CCO Skill Requirements

Explanation: The best response is to redesign the monitoring workflow on a risk basis rather than simply cutting volume or pushing decisions to the business. Compliance should govern suppression logic, require an audit trail for closed alerts, and test whether filtered alerts are masking misconduct.

Monitoring systems should be calibrated to the firm’s actual risk, not simply to staffing capacity. Here, the alert backlog shows the system needs a governed triage model: risk-based prioritization, compliance approval of suppression or closure logic, a retained rationale for each closed alert, and periodic testing of suppressed alerts to confirm that real misconduct is not being screened out. That approach balances efficiency with independence, creates an audit trail, and supports regulator-ready evidence of prudent supervision. A business-run monthly summary may look efficient, but it does not provide the same independent control or documentation discipline.

• Business-only closure is too weak because monthly totals do not replace independent compliance oversight or contemporaneous reasons for each closure.
• Blanket threshold increases may reduce volume, but they can create uncontrolled blind spots across higher-risk activity.
• First-in-first-out review preserves process order, not monitoring quality, and ignores the need to recalibrate surveillance to actual risk.

This creates a risk-based process with independent governance, documented decisions, and validation that suppression is not hiding real issues.

Question 41

Topic: CCO Skill Requirements

A dealer’s CCO reviews the following excerpt after a system conversion.

Exhibit: Monitoring report excerpt

• Review: third-party transfers over $25,000
• July source population meeting the rule: 186 transfers
• July transactions received by the monitoring tool: 41 transfers
• July exceptions generated: 0
• Analyst note: “No rule changes were made. A population-to-feed reconciliation has not yet been built.”

What is the best next action for Compliance?

• A. Raise the threshold above $25,000 to reduce distorted alert volumes.
• B. Validate the feed against the source population and rerun July monitoring.
• C. Record July as complete because the report already notes the conversion issue.
• D. Change the review to daily before investigating the missing transfers.

Best answer: B

What this tests: CCO Skill Requirements

Explanation: The artifact shows a clear completeness gap: 186 transfers met the rule in the source system, but only 41 reached the monitoring tool. Until Compliance validates that feed and reruns the review, the zero-exception output is not a reliable monitoring result.

A monitoring system is only dependable if the population entering it is complete and accurate. Here, the issue is not the exception count itself; it is that the monitoring tool received only 41 of 186 transfers that should have been subject to review, and the analyst confirms no population-to-feed reconciliation exists after the conversion. That means Compliance cannot conclude the control worked or that transfer risk fell.

A sound response is to:

• reconcile source transactions to the monitoring feed,
• identify why records were excluded,
• rerun the July review or apply a temporary manual review, and
• document the gap and any interim control.

The key takeaway is that low or zero alerts do not demonstrate effective monitoring when data completeness has not been established.

• Disclosure is not enough because noting the conversion issue does not make the July report complete or reliable.
• Changing thresholds attacks alert volume, but the artifact shows a missing-population problem, not an over-sensitive rule.
• Changing frequency may be reasonable in some contexts, but it does not address the immediate control failure that many transfers never reached the tool.

Without a population-to-feed reconciliation, Compliance cannot rely on the zero-exception result because the monitoring input may be incomplete.

Question 42

Topic: Canada Regulation and Dealer Risks

A national investment dealer plans to launch a new digital account-opening workflow in several provinces. The business head tells the CCO that no Canadian rule prescribes every workflow step, so the firm should rely on the vendor’s materials and launch immediately. Which action best aligns with the Canadian securities regulatory environment and principle-based regulation?

• A. Map provincial and CIRO requirements, then implement documented controls.
• B. Use the vendor template without a Canadian gap review.
• C. Let each branch create controls after launch.
• D. Wait for a specific rule before changing procedures.

Best answer: A

What this tests: Canada Regulation and Dealer Risks

Explanation: Canada’s securities framework is layered and principle-based. A dealer should assess the activity against applicable provincial securities law and CIRO expectations, document the risks, and put controls in place before launch rather than waiting for a rule that addresses every detail.

In Canada, investment dealers operate within a regulatory environment that includes provincial and territorial securities regulators, coordinated national policy work through the CSA, and dealer oversight by CIRO. Because the system is principle-based, the absence of a highly prescriptive rule does not remove the firm’s obligation to act prudently.

The best compliance response is to:

• identify the applicable provincial requirements and CIRO standards
• assess client, conduct, and operational risks
• set a consistent documented control framework before rollout
• monitor for any province-specific differences

Relying only on a vendor, waiting for a new rule, or leaving branches to design their own controls weakens head-office accountability and supervision.

• Wait for a rule fails because firms are expected to apply existing principles and controls even when no rule describes every workflow step.
• Vendor reliance fails because third-party materials do not replace the dealer’s own Canadian compliance assessment.
• Branch-by-branch design fails because head office remains responsible for consistent supervision and documented standards.

Canada’s layered, principle-based framework requires the dealer to assess applicable obligations and risks itself, then document controls before rollout.

Question 43

Topic: Application of Skills

At a Canadian dealer, the CCO reviews a newly opened complaint file.

Exhibit: Complaint intake log

Based on the exhibit, what is the best follow-up?

• A. Log it mainly as a supervision issue for quarterly trend reporting.
• B. Keep it in routine branch handling unless formal court papers arrive.
• C. Escalate it immediately as both a complaint and a potential civil claim.
• D. Send it directly to external dispute resolution instead of internal review.

Best answer: C

What this tests: Application of Skills

Explanation: This file goes beyond a routine complaint. The allegations raise suitability and KYC concerns, and the client’s demand for compensation backed by a lawyer threat signals potential civil litigation, so the matter should be escalated immediately.

A complaint presents litigation exposure when the facts suggest not only possible rule breaches but also a realistic prospect of a civil claim. Here, the client alleges an unauthorized KYC change and unsuitable concentration, identifies a material loss, and explicitly threatens legal action unless compensated. That combination means the firm should not leave the file in ordinary branch complaint handling.

The proper response is to treat it as both a regulatory complaint and a potential lawsuit, with prompt escalation and coordinated handling. Internal complaint review still matters, but legal-risk recognition must happen early so the firm can manage the response appropriately and preserve the record. The closest trap is treating the matter only as a supervision or trend item, which misses the immediate claim exposure.

• Wait for court papers fails because an express threat of legal action and a quantified loss already indicate potential civil exposure.
• Trend-reporting focus fails because quarterly supervision reporting does not address the immediate need to manage a possible claim.
• Direct external referral fails because internal escalation and review are still required; outside dispute processes do not replace them.

The alleged unauthorized KYC change, significant loss, and explicit threat of legal action create litigation exposure as well as regulatory risk.

Question 44

Topic: Regulatory Investigations and Reporting

At 4:30 p.m., a provincial securities regulator emails an investment dealer’s branch manager requesting trade blotters, client emails, and a written explanation of supervision over one registered representative by noon the next day. The branch manager says some communications are on approved mobile devices, and the desk supervisor proposes deleting duplicate messages before production to speed up the response. The firm’s process requires Compliance to coordinate external regulatory inquiries. What is the best compliance action?

• A. Wait for a formal order before preserving approved mobile-device messages.
• B. Issue a preservation hold for all relevant records, including mobile messages, and have Compliance coordinate the response.
• C. Allow the desk supervisor to delete duplicates before records are collected.
• D. Have the branch manager send available records first and fill gaps afterward.

Best answer: B

What this tests: Regulatory Investigations and Reporting

Explanation: When an external authority asks for records on short notice, the priority is immediate preservation and a controlled response. Compliance should stop any deletion or cleanup, capture all potentially relevant records, including mobile messages, and manage production under the firm’s regulatory-inquiry process.

When a regulator requests records or explanations, the firm should treat the matter as a potential investigation response as soon as the request is received, even if it arrives by email and under a tight deadline. The core compliance action is to preserve all potentially relevant evidence immediately, including records on approved mobile devices, and to centralize collection and communications through Compliance. That protects completeness, reduces the risk of inconsistent statements, and avoids accidental alteration of evidence. Deleting “duplicates” before collection is not a housekeeping step; it changes the record set and can undermine regulator confidence. If the scope or timing is unclear, Compliance can promptly seek clarification, but preservation should start at once. Fast production is important, but controlled preservation comes first.

• Ad hoc response fails because business-line staff should not make piecemeal productions outside the firm’s coordination process.
• Deleting duplicates fails because records must be preserved before any culling, cleanup, or alteration.
• Waiting for a formal order fails because preservation begins once the firm knows relevant records are being requested.

Once the request is known, the firm should preserve potentially relevant evidence immediately and control the response through Compliance.

Question 45

Topic: Application of Skills

A Canadian investment dealer is reviewing a proposed supervision model for its institutional equity desk. The CCO receives the following snapshot of daily trading controls.

Exhibit: Proposed desk surveillance design

Which is the most serious weakness in this design?

• A. Requiring CCO approval to override an automated restricted-list block
• B. Letting traders close their own off-market alerts without independent review
• C. Reporting desk trends monthly to senior management and the board
• D. Having the desk supervisor review wash/self-trade alerts the same day

Best answer: B

What this tests: Application of Skills

Explanation: The key weakness is the lack of independence in alert review. When the originating trader can close their own off-market price alert with no second review, the control can be bypassed and serious trading issues may never be escalated.

The core concept is independent, credible supervision of trading exceptions. A first-line trading supervisor can review alerts, but the person whose trading triggered the alert should not be permitted to clear it unilaterally. In this design, off-market price alerts are both high-volume and potentially higher-risk, yet closure depends on the trader’s own judgment and does not require a second review. That creates a clear self-review conflict and weakens the firm’s evidence if the activity is later questioned.

By contrast, same-day desk-supervisor review of wash or self-trade alerts is a normal first-line control, an automated restricted-list block with controlled override is generally strong, and monthly trend reporting to management and the board can be reasonable for aggregated oversight. The decisive issue is independence at the alert-clearance stage.

• Monthly reporting is an oversight feature; it is not as serious as a flawed exception-review control.
• Desk-supervisor review of wash or self-trade alerts is generally an appropriate first-line supervisory activity when reasons are documented.
• CCO override approval for a restricted-list block is an escalation control, not a surveillance weakness on these facts.

It allows self-review of the activity being surveilled, undermining independent supervision and reliable escalation.

Question 46

Topic: Canada Regulation and Dealer Risks

An investment dealer’s branch review plan gives every branch the same one-day review each year. Mid-year, the CCO learns that one branch has started recommending leveraged income strategies, accounts for 40% of the firm’s suitability exceptions, and still has two overdue corrective actions from its last review. Compliance hours are limited, and senior management asks that the schedule remain unchanged for fairness. What is the single best compliance response?

• A. Re-rank the branch as higher risk and expand its review now.
• B. Keep identical reviews for all branches to preserve consistency.
• C. Rely on the branch manager’s attestation until next year.
• D. Wait for a client complaint before changing the review plan.

Best answer: A

What this tests: Canada Regulation and Dealer Risks

Explanation: A risk-based approach means applying compliance resources where risk is highest, not giving every branch the same level of testing. The higher-risk business activity, large share of suitability exceptions, and overdue remediation all support increasing review scope or frequency for that branch now.

In practice, a risk-based compliance program uses current risk indicators to decide where monitoring should be deeper, sooner, or more frequent. Relevant indicators include product complexity, exception trends, rapid growth, client vulnerability, prior findings, and whether corrective actions were completed. Here, the branch’s leveraged income activity raises inherent risk, its concentration of suitability exceptions suggests elevated residual risk, and overdue corrective actions show that prior control weaknesses remain unresolved. The best response is to formally increase that branch’s risk rating, redirect limited compliance time to it, and document the reasons for the change. A consistent methodology does not require identical review intensity across all branches. The key takeaway is that fairness in a risk-based program comes from consistent risk assessment, not equal time spent everywhere.

• Equal treatment fails because risk-based oversight uses a consistent method, not identical testing for every branch.
• Wait for harm fails because known exception trends and unresolved findings already justify enhanced monitoring.
• Attestation only fails because management self-certification does not replace independent compliance testing when risk indicators are elevated.

A risk-based program shifts monitoring to areas showing higher current risk and weaker controls, with the rationale documented.

Question 47

Topic: CCO Skill Requirements

A CCO at a Canadian investment dealer receives the following internal note from a branch review. Based on the exhibit, what is the best next action?

Exhibit: Investigation summary

• 14 account switches generated unusually high commissions; most affected clients are over age 70.

• Branch manager note: “Do not contact clients until after quarter-end. L is our top producer and we are pitching for a new team.”

• Branch manager note: “I will decide later whether Compliance needs to be involved.”

• No documented suitability review, evidence hold, or client remediation plan.

• A. Wait for client complaints before opening a compliance file.

• B. Let the branch manager conclude the review after quarter-end.

• C. Escalate now, preserve evidence, and assign an independent review.

• D. Seek the representative’s explanation before deciding on escalation.

Best answer: C

What this tests: CCO Skill Requirements

Explanation: The exhibit shows an ethical conflict between client protection and business pressure. Because the branch manager is trying to delay action for revenue and recruiting reasons, the CCO should act independently, preserve records, and escalate immediately.

The core issue is independence in the face of conflicting ethical pressures. The branch manager is not making an objective supervisory decision; the notes tie delay to quarter-end revenue and a recruiting effort, while the affected clients are mainly seniors and there is no documented suitability review or evidence hold. That is both an ethics problem and a control failure. The CCO should not leave the matter with the same business line that has an incentive to minimize or delay it. The appropriate response is to escalate promptly, secure relevant evidence, and direct an independent compliance review so the facts can be assessed without production influence. Waiting for more revenue results, a client complaint, or the representative’s explanation would leave a conflicted supervisor in control and increase client, regulatory, and reputational risk.

• Letting the branch manager finish the review fails because the exhibit shows the manager is already conflicted by business considerations.
• Waiting for complaints fails because possible unsuitable activity involving older clients already warrants immediate compliance action.
• Seeking the representative’s explanation first fails because the urgent gap is independent escalation and evidence preservation, not more business-line discretion.

The manager’s notes show a clear business-line conflict, possible client harm, and missing controls, requiring immediate independent escalation and evidence preservation.

Question 48

Topic: Application of Skills

A CCO at an investment dealer learns that a representative approved only in Ontario plans to solicit three British Columbia residents who do not currently have accounts with the firm. The dealer itself is registered only in Ontario and Alberta. The branch manager says the representative can proceed because all calls and order entry will occur from Toronto and compliance can deal with registration later. What is the best next step?

• A. Submit an NRD change for the representative and permit activity once the filing is sent.
• B. Pause the outreach and confirm firm and individual British Columbia registration, or a valid exemption, before any solicitation or account opening.
• C. Allow the representative to contact the prospects, but hold any account opening until compliance reviews the file.
• D. Rely on the Toronto location of the activity and intensify supervision of the first trades.

Best answer: B

What this tests: Application of Skills

Explanation: This fact pattern raises a registration problem immediately because the proposed activity targets clients in a jurisdiction where the firm is not registered and the representative is not approved. The best next step is to stop the activity and confirm whether both firm-level and individual registration, or a valid exemption, are required before any outreach starts.

The core concept is jurisdictional registration analysis before client-facing activity occurs. Here, the representative plans to solicit British Columbia residents, but the firm is not registered there and the representative is approved only in Ontario. That means compliance should not let the activity begin and “fix it later.”

A sound process is:

• stop the proposed outreach
• assess whether the activity triggers registration in British Columbia for both the dealer and the individual
• determine whether any exemption clearly applies
• permit activity only after the registration issue is resolved

The fact that calls and order entry would occur from Toronto does not remove the jurisdictional issue. The closest distractor is letting contact occur first, but solicitation itself can be the problem.

• Contact first fails because the registration review must occur before solicitation, not after prospects are approached.
• NRD filing only fails because sending a filing is not the same as approval, and it does not address the firm’s own registration status.
• Toronto location fails because where the representative sits does not by itself solve the need to assess the client jurisdiction.

Soliciting British Columbia residents creates a jurisdictional registration issue that must be resolved for both the firm and the individual before activity begins.

Question 49

Topic: CCO Skill Requirements

A dealer introduced a new email-surveillance scenario for unapproved client communications. Three months later, the CCO reviews the dashboard below. Which follow-up is best supported when assessing whether the monitoring system is actually effective?

Exhibit: Monitoring dashboard

• A. Recalibrate alerts and test whether remediation is preventing repeats
• B. Scale back monitoring because confirmed breaches did not increase
• C. Keep the scenario unchanged and simply assign more investigators
• D. Treat higher alert volume as evidence the control is effective

Best answer: A

What this tests: CCO Skill Requirements

Explanation: Monitoring effectiveness is not measured by alert volume alone. Here, alerts surged, but confirmed breaches stayed flat, investigations took longer, and repeat breaches increased, so the best next step is to review alert calibration and whether corrective action is actually stopping recurrence.

An effective monitoring system should identify meaningful exceptions, support timely investigation, and contribute to reducing repeat problems. In this dashboard, alert volume rose sharply from 180 to 760, but escalations and confirmed breaches did not increase. At the same time, investigation closure slowed materially and repeat breaches after coaching increased. That pattern suggests the scenario may be poorly calibrated, generating more noise without better detection, and that prior remediation is not being validated effectively.

A sound assessment would focus on whether the control is producing useful results, not just more activity:

• review alert logic and thresholds for precision
• test whether prior corrective actions were implemented
• verify that repeat issues are being root-caused and rechecked

The closest distractor addresses workload, but capacity alone does not show the control is detecting the right issues or driving better outcomes.

• More alerts confuses monitoring activity with monitoring effectiveness; the meaningful outcomes did not improve.
• More staff only may help backlog, but it does not address weak alert quality or repeat misconduct.
• Scale back monitoring ignores the rise in repeat breaches, which signals an unresolved control problem.

The data shows much higher alert volume without more confirmed breaches, plus slower closure and more repeat issues, so both tuning and remediation effectiveness need review.

Question 50

Topic: Compliance Role and Structure

A Canadian investment dealer is launching a new institutional fixed-income desk. The firm’s compliance manual sets out general supervision standards, but there is no desk-specific risk assessment, no documented control owners, and no escalation thresholds for exceptions. The COO asks the CCO to start surveillance immediately using the retail branch review template and document the details later. What is the best next step for the CCO?

• A. Start surveillance with the retail review template and refine it after early exceptions.
• B. Obtain staff attestations to the existing manual before designing new desk controls.
• C. Ask the board to approve alert thresholds before management defines the desk framework.
• D. Build a desk-specific risk and control framework with owners, escalation triggers, and management reporting before launch.

Best answer: D

What this tests: Compliance Role and Structure

Explanation: The CCO should first establish a risk-based framework tailored to the new business line. That means identifying key risks, assigning ownership, and setting escalation and reporting rules before relying on surveillance outputs.

In a senior-level compliance framework, monitoring is not the starting point; it rests on a documented risk and control design. For a new institutional desk, the CCO should first identify the desk’s material supervision and conduct risks, assign responsibility between line management and compliance, and define how exceptions will be detected, escalated, and reported to senior management. That creates a clear basis for surveillance parameters and supports accountability, evidence, and regulator readiness.

Launching surveillance before that design work creates unclear ownership and weak control evidence. The nearest distractor is reusing an existing retail review template, but that skips the required desk-specific assessment and may miss business-line-specific risks.

• Reuse the retail template fails because a new desk needs controls designed for its own risk profile, not a generic retail program.
• Manual attestation first fails because staff sign-off does not replace documented control design, ownership, and escalation criteria.
• Board approval of thresholds first is out of sequence because management should design the framework before board-level oversight reporting begins.

A senior-level compliance framework should be risk-based, documented, and assigned to clear owners before monitoring begins.

Questions 51-75

Question 51

Topic: Canada Regulation and Dealer Risks

During a branch review, a dealer’s CCO finds that several representatives opened accounts without the firm’s “enhanced vulnerable-client checklist.” The checklist was created internally to support broader KYC and supervision duties, but the exact form is not required by securities legislation or CIRO rules. The branch manager asks whether compliance should immediately classify each file as a securities-law breach and prepare a regulatory report. What is the best next step?

• A. Map the gap to securities law, CIRO requirements, or firm controls, then assess the underlying duty before escalating.
• B. Close the issue because the checklist itself is not expressly prescribed.
• C. Prepare the regulatory report now because any policy breach is automatically a legal breach.
• D. Discipline the representatives first and review the files afterward.

Best answer: A

What this tests: Canada Regulation and Dealer Risks

Explanation: The best next step is to identify what type of requirement was actually missed. A failure to use an internal checklist may be only a control deficiency, or it may indicate a breach of broader KYC or supervision obligations, so classification must come before reporting or discipline.

The core concept is distinguishing the source of the obligation. In dealer compliance, not every breach of an internal form is automatically a breach of securities legislation, and not every internal control failure is irrelevant. Here, the checklist is a firm-designed control, so the CCO should first determine whether the affected files still met the underlying statutory and CIRO requirements for KYC, suitability support, and supervision. That review allows the firm to classify the issue properly: internal control weakness, self-regulatory deficiency, statutory breach, or some combination. Only after that analysis should the firm decide on remediation, internal escalation, possible discipline, and whether any external reporting is required. The closest mistake is assuming that an internal control has no compliance significance simply because the exact form is not prescribed.

• Automatic reporting fails because a policy breach is not automatically a securities-law breach.
• Ignore the form fails because an internal control breakdown may still reveal missed KYC or supervision duties.
• Discipline first fails because the firm should establish the facts and classify the obligation before imposing sanctions.

The CCO should first identify the source of the obligation so an internal control failure is not automatically treated as a legal or CIRO breach.

Question 52

Topic: Canada Regulation and Dealer Risks

A dealer’s CCO reviews the following escalation log excerpt.

Exhibit: Escalation log excerpt

Which interpretation is best supported by the exhibit?

• A. Both issues are mainly operational because each can be fixed through process changes.
• B. The coding issue is mainly operational-control, while the email requires legal-risk analysis.
• C. The coding issue is the stronger legal-risk item, while the email is mainly an approval-workflow problem.
• D. Both issues are mainly legal because each involves a deviation from firm policy.

Best answer: B

What this tests: Canada Regulation and Dealer Risks

Explanation: Legal-risk analysis asks whether conduct may breach securities law or create regulatory or civil exposure. Operational-control analysis asks whether a process, control, or data flow failed. Here, the complaint miscoding did not disrupt escalation or reporting, but the unsupported “principal protected” statement may create misleading-communication risk.

The core distinction is between exposure to a legal obligation and weakness in the control environment. A legal-risk analysis focuses on whether the firm’s conduct may have violated securities-law standards or created enforcement, investor-remediation, or litigation exposure. An operational-control analysis focuses on whether the firm’s systems, approvals, coding, supervision, or workflows were designed or executed effectively.

In the exhibit, the complaint item points mainly to control effectiveness: the dashboard category was wrong, but the files were still escalated the same day, acknowledged on time, and included in required reporting. By contrast, the structured note email contains a statement that conflicts with the term sheet and lacks compliance approval. That supports immediate legal-risk analysis for potentially misleading disclosure, with a separate control review of the approval process.

A process fix alone is not enough when the underlying communication itself may be legally problematic.

• Process-only view fails because the email’s content may itself create securities-law exposure, not just a workflow gap.
• Policy equals law is too broad; an internal control error can remain operational when required external handling still occurred.
• Wrong priority misreads the exhibit because the coding error did not interrupt complaint escalation or reporting, while the email conflicts with the term sheet.

The complaint item shows a control/data-quality weakness without missed regulatory handling, while the email raises possible misleading-disclosure exposure.

Question 53

Topic: Application of Skills

An 82-year-old retail client instructs her advisor on a recorded call to sell part of her bond fund, and the order entry is properly completed. She then emails a same-day request to wire the settlement proceeds to a newly added bank account not in her name, listed as “North Shore Home Renovations Ltd.” When the advisor calls back, the client seems unsure of the amount and says a neighbour told her the payment must be made immediately. Operations says the trade can settle normally tomorrow. What is the best compliance response?

• A. Cancel the trade and freeze the entire account until written instructions arrive.
• B. Let the trade settle and release the wire because the sell order was validly entered.
• C. Let the trade settle, but hold the wire and escalate for enhanced client-protection verification.
• D. Refer the matter only to AML staff and let the branch decide the wire.

Best answer: C

What this tests: Application of Skills

Explanation: The sale order can be processed in the ordinary course, but the requested movement of proceeds cannot be treated as routine. A newly added third-party destination, client uncertainty, and outside pressure are red flags that require enhanced verification and escalation under the firm’s client-protection process.

The key compliance distinction is between ordinary settlement of a properly entered trade and an unusual movement of client assets. Here, the sell order was entered properly, so routine settlement processing may continue. The problem is the requested wire: it is going to a newly added account not in the client’s name, and the advisor observed uncertainty and urgency tied to a neighbour’s pressure. Those facts raise possible financial exploitation or improper third-party transfer concerns.

The firm should pause the outgoing wire, escalate through its supervisory or compliance process, verify the instruction directly with the client in a way that reduces third-party influence, and document the review. A blanket account freeze or automatic trade cancellation is broader than the facts require, while treating the matter as ordinary settlement or AML-only misses the immediate client-protection issue.

• Routine settlement only fails because valid trade entry does not make an unusual third-party disbursement routine.
• Full account freeze goes too far when the immediate concern is the destination of proceeds, not all account activity.
• AML only is incomplete because the firm must address possible client exploitation and control the disbursement decision.

The trade itself can settle routinely, but the new third-party destination and pressure indicators make the disbursement a client-protection concern.

Question 54

Topic: Canada Regulation and Dealer Risks

A branch manager at a Canadian investment dealer goes on unexpected leave. For seven business days, new margin-account approvals and daily trade reviews for that branch were not assigned to another approved supervisor, although no client losses are known. What is the best next step for the CCO?

• A. Treat it primarily as operational risk and complete a workflow review before reassigning approvals.
• B. Treat it primarily as legal risk and seek external counsel before naming an interim supervisor.
• C. Treat it primarily as reputational risk and prepare client notifications before fixing the coverage gap.
• D. Treat it primarily as compliance risk and document interim supervisory coverage immediately.

Best answer: D

What this tests: Canada Regulation and Dealer Risks

Explanation: This issue most directly involves a failure to maintain required supervision, which is a compliance risk. The best next step is to restore and document proper supervisory coverage immediately, then assess impact and remediation.

Risk categorization should focus on the most direct source of harm or rule exposure. Here, the branch was left without assigned supervisory oversight for account approvals and trade reviews, so the primary issue is compliance risk arising from a supervision gap. Because the unmet obligation is current and ongoing, the CCO should first ensure an approved interim supervisor is formally assigned and the coverage is documented.

• Identify the specific supervisory function that was unattended.
• Restore documented supervisory coverage immediately.
• Then review affected activity, exceptions, and any needed escalation.

Operational, legal, and reputational consequences may follow, but they are secondary to the immediate compliance failure.

• Workflow review first mis-sequences the response because the supervision gap must be closed before a broader process review.
• External counsel first may be appropriate later, but it skips the immediate safeguard of restoring required supervision.
• Client notifications first are premature when no client harm is known and the control failure remains uncorrected.

The immediate problem is a breach of supervisory obligations, so the first step is to classify it as compliance risk and restore documented supervision.

Question 55

Topic: Canada Regulation and Dealer Risks

An investment dealer wants to launch a mobile app feature that sends retail clients security-specific “buy now” and “sell now” prompts generated by a third-party algorithm. The firm has no policy addressing whether the feature is research, advice, or a client communication, and no registration analysis has been completed for branch staff who would explain the prompts to clients. The business sponsor argues the feature can go live because no rule names this exact model. What is the best response by the CCO?

• A. Pause launch, document the regulatory analysis, assess obligations, and seek guidance if uncertainty remains.
• B. Treat the feature as marketing only, since the algorithm does not place orders.
• C. Let the business sponsor approve the model because no rule addresses it directly.
• D. Allow a controlled pilot, add disclosures, and review issues after launch.

Best answer: A

What this tests: Canada Regulation and Dealer Risks

Explanation: When the regulatory basis for a new activity is unclear, the CCO should not rely on silence in the rules or on disclosure alone. The best response is to stop the launch, perform a documented substance-based analysis, assess registration and conduct implications, and escalate for guidance if uncertainty remains.

In a principle-based Canadian regulatory environment, compliance should assess the substance of a new activity rather than assume it is permissible because no rule describes the exact technology or business model. Here, the feature sends security-specific prompts to retail clients, branch staff would explain those prompts, and the firm has no policy or registration analysis for that activity. Those facts create real uncertainty about whether the service could trigger obligations relating to advice, research, client communications, supervision, or registration.

The CCO should require a documented regulatory analysis before launch, map the activity to applicable conduct and supervisory obligations, and escalate unresolved issues through appropriate governance. If material uncertainty remains after internal review, obtaining legal advice and, where appropriate, regulatory guidance is the prudent step. A pilot or disclaimer-based approach is weaker because the firm should establish the regulatory basis first, then design controls around it.

• Pilot first fails because monitoring and disclosure do not solve an unresolved regulatory classification before client launch.
• Marketing only fails because regulatory treatment depends on substance and client impact, not on whether orders are auto-executed.
• Business sign-off fails because commercial urgency cannot replace compliance analysis, governance, and proper escalation.

A launch should not proceed until the firm has established and documented the regulatory basis and addressed unresolved uncertainty through proper escalation or guidance.

Question 56

Topic: Compliance Role and Structure

A Canadian investment dealer has found inconsistent handling of account-opening exceptions across branches. The Head of Retail asks the CCO to have Compliance approve all future exceptions “until things settle down.” The board has asked management for a stronger control framework, and no misconduct has yet been found. What is the best next step for the CCO?

• A. Ask internal audit to redesign the process before management changes roles.
• B. Propose documented business-owned approvals with compliance monitoring and escalation.
• C. Have Compliance approve every exception until branch practices improve.
• D. Leave approvals unchanged until quarterly trend data confirms the issue.

Best answer: B

What this tests: Compliance Role and Structure

Explanation: The best next step is to clarify and document governance so line management owns exception approvals and Compliance provides independent oversight. That approach strengthens controls without compromising the Compliance function’s second-line role.

In a formal compliance structure, business management is the first line and owns day-to-day supervisory decisions, including operational approvals within the firm’s policies. Compliance is the second line: it advises, monitors, tests, challenges, and escalates, but it should not routinely take over business supervision just to solve inconsistency.

Here, the control weakness is unclear or inconsistent first-line execution. The right response is to formalize accountability and oversight:

• assign approval responsibility to business supervisors
• document escalation criteria and reporting
• set Compliance monitoring and trend review
• report the strengthened framework to senior management and the board

Using Compliance as the approver would blur independence, while internal audit should assess the framework later as a third line function. Waiting for more data is too slow once a governance weakness is already identified.

• Compliance as approver weakens the governance model because the second line should oversee and challenge, not replace first-line supervision.
• Internal audit redesign uses the third line too early; management and Compliance should establish ownership and controls first.
• Wait for more evidence delays remediation even though inconsistent approvals and board concern already show a control issue.

This preserves first-line supervisory ownership while keeping Compliance independent as the second line.

Question 57

Topic: CCO Skill Requirements

A Canadian investment dealer introduced a new account-opening policy and monthly post-review monitoring for three higher-risk branches. For six months, compliance tested 100% of new accounts from those branches, issued exception reports, and obtained branch manager attestations that deficiencies were fixed. The monitoring package is detailed, but the same KYC and suitability gaps recur at about the same rate each month. What is the best next step for the CCO?

• A. Start formal discipline for all advisors named in repeat exceptions.
• B. Expand testing to more branches before altering the monitoring program.
• C. Review account-opening control points, find root causes, and redesign remediation metrics.
• D. Obtain new branch attestations and continue unchanged for another quarter.

Best answer: C

What this tests: CCO Skill Requirements

Explanation: This monitoring program appears active, but it is not changing outcomes. When the same gaps recur after repeated reviews and attestations, the CCO should assess whether controls are placed properly, owned by the business, and measured by reduced recurrence rather than by monitoring volume.

The core issue is monitoring effectiveness. A program can look thorough because it produces reports, exceptions, and attestations, yet still fail to reduce risk if it only detects problems after the fact and does not address the control breakdown causing them. Here, repeated KYC and suitability gaps suggest the preventive or supervisory controls in the account-opening workflow are weak, misplaced, or not truly owned.

• Map the workflow and identify the key preventive and supervisory control points.
• Determine why the same gaps recur despite prior remediation.
• Reset ownership, escalation, and closure testing.
• Measure success by lower recurrence, not by more reports.

More testing, repeated attestations, or discipline may follow later, but first the firm needs a control-point review that explains why risk is not falling.

• More coverage increases detection volume, but it does not explain why the same failures keep recurring.
• More attestations repeat an existing step that has already failed to change behaviour or process quality.
• Immediate discipline may be appropriate in some cases, but using it first can bypass root-cause analysis and miss design or supervision failures.

Recurring exceptions despite detailed monitoring indicate weak control effectiveness, so the next step is a control-point and root-cause review rather than more detection.

Question 58

Topic: Application of Skills

A carrying dealer plans to market a private placement under prospectus exemptions. Firm policy requires UDP and CFO approval before launch if a deal could leave less than $250,000 of excess capital. Finance estimates the dealer would have only $150,000 of excess capital if 20% of the issue remains unsold, and compliance finds subscription packages can be accepted before staff document each purchaser’s exemption and collect any required risk acknowledgement. What is the best next step for the CCO?

• A. Pause launch, escalate the capital issue, and verify each purchaser’s exemption before taking subscriptions.
• B. Obtain issuer counsel’s memo, keep it on file, and begin selling immediately.
• C. Launch now, monitor capital daily, and verify each purchaser’s exemption before settlement.
• D. Take subscriptions now, then seek capital approval after the first closing.

Best answer: A

What this tests: Application of Skills

Explanation: The CCO should stop the launch because two pre-launch safeguards are missing: required internal approval for the capital impact and documented exemption review before subscriptions are accepted. Both issues must be addressed before distribution activity starts.

This scenario combines capital governance with exempt distribution controls. Even if the dealer would remain above its minimum capital, the stem says the firm’s own policy requires UDP and CFO approval whenever excess capital could fall below $250,000, so that escalation must happen before launch. Separately, a dealer should not accept subscriptions in an exempt offering until it has documented the purchaser’s eligibility for the prospectus exemption and obtained any required acknowledgement. The best next step is therefore to pause the offering, escalate the capital issue under policy, and add a hard-stop control so subscriptions cannot be accepted without completed exemption evidence. Daily monitoring, relying only on issuer counsel, or seeking approval after closing all come too late.

• Verify later is too late because exemption eligibility should be documented before a subscription is accepted.
• Counsel memo only is insufficient because external legal support does not replace the dealer’s internal capital approval and supervisory controls.
• Approval after closing is out of sequence because the firm’s policy requires approval before launch, not after sales begin.

The dealer should not launch until it satisfies its internal capital approval trigger and blocks subscriptions unless the prospectus exemption is properly documented.

Question 59

Topic: Application of Skills

A Canadian investment dealer’s CCO reviews the weekly surveillance summary for the sales and trading desks. The desk head asks which item requires the most urgent escalation and investigation.

Exhibit: Desk surveillance summary

Which issue is the most serious compliance red flag?

• A. A voice-recording outage on two bond trades
• B. An outdated spread chart corrected the same day
• C. High order cancellations in volatile small-cap trading
• D. Post-trade reallocation of profitable client-block bond fills to employee-related accounts

Best answer: D

What this tests: Application of Skills

Explanation: The post-trade reallocation of profitable client-block bond fills to employee-related accounts is the clearest indicator of possible allocation abuse. Because there were no pre-trade instructions, the pattern suggests employees may have received favourable fills only after the outcome was known, which requires immediate escalation and record preservation.

In desk supervision, the most urgent red flags are patterns that suggest intentional misconduct, client harm, or conflicted employee benefit. Here, profitable fills from a client block were shifted after execution to employee-related accounts, and there was no pre-trade allocation record. That combination is inconsistent with proper allocation controls and raises concerns about cherry-picking, misuse of client opportunities, personal trading conflicts, and inaccurate books and records.

Immediate compliance follow-up would normally include:

• preserving order, allocation, and communication records
• stopping similar allocation changes pending review
• escalating to senior compliance and trading supervision
• assessing client impact, employee misconduct, and any reporting obligations

The other items show control or communications weaknesses, but the exhibit gives mitigating facts that do not support the same level of misconduct risk.

• The high cancellation rate is less compelling because the exhibit ties it to documented client repricing during a volatile open.
• The recording outage is a control issue, but it was logged and supported by independent email confirmations of trade terms.
• The outdated spread chart is a communications deficiency, yet prompt correction makes it less urgent than a pattern suggesting self-dealing.

Post-trade movement of profitable client-block fills to employee-related accounts without pre-trade instructions strongly suggests allocation abuse and a serious conflict of interest.

Question 60

Topic: Application of Skills

An investment dealer’s equity desk relies on a daily exception report to flag potential pre-arranged trading and unusual activity between client and proprietary accounts. During a routine review, compliance discovers that, after a mailbox change, the report went unread for six weeks because it was routed to a former supervisor. Firm policy requires independent review of material trading alerts, and no improper trading has yet been confirmed. What is the best next step?

• A. Ask the desk head to clear the backlog and report only serious items.
• B. Submit an immediate regulatory breach report before reviewing the affected trades.
• C. Initiate a documented containment and independent review of the missed alerts.
• D. Restore the routing and defer analysis to the next quarterly testing cycle.

Best answer: C

What this tests: Application of Skills

Explanation: The priority is to contain the trading-desk control failure and independently assess the missed alerts. Compliance should first stabilize the process, preserve the record, and review the affected period before deciding on further escalation or regulatory reporting.

The core concept is sequencing the compliance response to a supervisory control weakness. When a trading-desk surveillance or exception process fails, the first step is not to delegate the issue back to the desk, wait for a later review cycle, or report externally without facts. The best response is to contain the weakness and perform a documented independent review of the missed alerts.

• stop the control gap from continuing
• preserve the reports and related evidence
• review the affected period independently
• then decide whether internal escalation, remediation, discipline, or regulatory reporting is required

This approach protects the integrity of the review and supports a defensible escalation decision. The closest distractor is immediate reporting, but that is premature when the firm has confirmed a control failure but not yet whether reportable misconduct occurred.

• Having the desk head clear the backlog fails because line staff should not self-assess missed alerts that required independent review.
• Deferring analysis to the next quarterly cycle leaves potential trading issues unreviewed and does not promptly address the control gap.
• Reporting to the regulator immediately is premature when the firm has not yet determined whether the missed alerts reveal misconduct or another reportable event.

This contains the control failure, preserves evidence, and creates a reliable fact base for any later escalation or reporting.

Question 61

Topic: Compliance Role and Structure

A Canadian investment dealer is redesigning its senior-level compliance structure after internal audit found that compliance staff were performing daily supervisory approvals for the retail desk, while business heads decided which issues were serious enough to report upward. The board wants a structure that is durable and defensible. Which action best aligns with sound compliance governance?

• A. Move daily desk approvals and exception sign-offs to compliance.
• B. Require the CCO to report material issues only through the COO.
• C. Let business heads decide which findings are material enough to escalate.
• D. Keep daily supervision with business heads, and give the CCO direct escalation access to senior management and the board.

Best answer: D

What this tests: Compliance Role and Structure

Explanation: A sound senior compliance structure separates first-line supervision from independent compliance oversight. Business heads should own daily supervision, while the CCO monitors compliance risk and can escalate material issues directly to senior management and the board. That balance supports both accountability and independence.

The core governance principle is role clarity. At a Canadian dealer, line management owns the business and its day-to-day supervisory controls. The CCO and compliance function should act as an independent oversight function: advising on controls, monitoring adherence, challenging management, documenting issues, and escalating significant matters when needed. If compliance takes over daily approvals, the business can shift responsibility to compliance and the control model weakens. If the CCO can report only through another executive, or if business leaders decide what is material, escalation may be delayed or filtered. A durable senior-level structure therefore keeps supervision and remediation with the business, while ensuring the CCO has sufficient stature, independence, and direct access to senior management and the board. That is better than centralizing more operational approvals inside compliance.

• Daily approvals moving routine desk approvals to compliance blurs first-line management accountability.
• COO-only reporting weakens independence because the CCO should have a path to escalate material issues beyond management filters.
• Business-set materiality is inappropriate because the business should not control whether compliance concerns are escalated.

This preserves first-line accountability while giving the CCO the independence and access expected in senior compliance governance.

Question 62

Topic: Canada Regulation and Dealer Risks

A Canadian investment dealer uses a risk-based compliance model to allocate targeted reviews. The model gives primary weight to inherent business risk, exception rate, and repeat issues that remain overdue more than 60 days; raw exception counts are secondary because sample sizes differ.

Exhibit: Q2 compliance dashboard

The CCO can deploy one review team this quarter. Which follow-up is best supported by the model?

• A. Prioritize branch suitability for seniors.
• B. Prioritize retail options supervision.
• C. Prioritize fixed income trade review.
• D. Split the team evenly across all areas.

Best answer: A

What this tests: Canada Regulation and Dealer Risks

Explanation: Risk-based prioritization should focus on the area with the highest residual compliance risk, not the largest raw exception count. Branch suitability for seniors has high inherent risk, a 33% exception rate, and four repeat overdue issues, so it is the strongest candidate for immediate review.

A risk-based model helps compliance direct scarce resources to the area where business risk and control weakness are most serious. The stem tells you to focus on three factors: inherent risk, exception rate, and repeat overdue issues. Branch suitability for seniors is high risk, has 5 exceptions out of 15 tests, and shows 4 repeat overdue issues, indicating both current weakness and poor remediation.

Retail options is also high risk, but its exception rate is lower at 3/20 and it has only 1 repeat overdue issue. Fixed income has the largest raw number of exceptions, but the testing volume is much larger, so its exception rate is only 6/60 and there are no repeat overdue issues. Institutional onboarding is low risk and comparatively clean. The best interpretation is to escalate the seniors suitability area first.

• Raw-count error The fixed income choice ignores the stated condition that raw exception totals are secondary when testing volumes differ.
• Partial risk view The retail options choice notices high inherent risk but misses that the seniors area has worse results and more unresolved repeat issues.
• No prioritization The equal-split choice defeats the purpose of a risk-based model, which is to rank areas and concentrate resources.

This area combines high inherent risk, the highest exception rate, and the most repeat overdue issues, making it the top priority.

Question 63

Topic: Compliance Role and Structure

An investment dealer plans a retail campaign for a complex product before quarter-end. The CCO finds that advisor training is incomplete, the draft client script downplays liquidity risk, and the proposed client list includes many seniors with limited investment knowledge. The head of sales says the campaign should launch now and any concerns can be handled by branch managers later. Which action best aligns with the purpose of the compliance function within the firm?

• A. Approve the launch and review exceptions after the campaign begins.
• B. Require control and disclosure fixes before launch, document concerns, and escalate if unresolved.
• C. Defer to sales because compliance should not impede commercial decisions.
• D. Assume ownership of the campaign by choosing clients and rewriting sales targets.

Best answer: B

What this tests: Compliance Role and Structure

Explanation: The compliance function exists to provide independent oversight and advice so the firm can identify, manage, and escalate compliance risk before clients are harmed. Here, incomplete training, weak disclosure, and a vulnerable target audience create material risks, so the proper response is to require remediation, document the issue, and escalate if the business resists.

In a Canadian securities firm, compliance is not just an approval desk and it is not a substitute for line management. Its purpose is to provide independent, risk-based oversight, challenge business activity that creates regulatory or conduct risk, help the business build workable controls, and escalate material issues when they are not resolved. In this scenario, the proposed campaign raises clear client-protection concerns: weak disclosure, incomplete training, and a potentially vulnerable target group. A sound compliance response is to prevent launch until key controls are in place, keep a clear record of the analysis and decision trail, and escalate if revenue pressure overrides the risk assessment. That supports both client protection and a strong compliance culture. The closest distractor is taking over the campaign itself, which would blur accountability and weaken compliance independence.

• Post-launch cleanup is too weak because material risks should be addressed before the campaign starts.
• Running the business is misplaced because compliance should challenge and advise, not own sales decisions or first-line controls.
• Deferring to revenue pressure is inconsistent with independent oversight and weakens the firm’s compliance culture.

This reflects compliance’s purpose: provide independent, risk-based oversight, require appropriate controls, and escalate material unresolved risks.

Question 64

Topic: CCO Skill Requirements

A Canadian investment dealer’s compliance team completed every scheduled branch review and monthly exception report during the year, and board materials highlighted a 100% monitoring completion rate. However, the same unsuitable leveraged ETF recommendation issue was found in two branches in three consecutive quarters, related client complaints increased, and there were no documented corrective-action deadlines or follow-up testing results. What is the best interpretation of this monitoring program?

• A. It is effective because repeat findings confirm strong detection.
• B. It measures completion, not remediation of recurring high-risk issues.
• C. It should be replaced by annual internal audit testing.
• D. It mainly needs larger random samples across all branches.

Best answer: B

What this tests: CCO Skill Requirements

Explanation: The program looks thorough because all planned reviews were completed, but effective monitoring is judged by whether it reduces recurring risk. Repeated suitability issues, rising complaints, and no documented follow-up show the process is tracking activity rather than control effectiveness.

Effective compliance monitoring is not just about completing reviews on schedule. It should identify issues, assign remediation, set deadlines, escalate overdue items, and verify through follow-up testing that the weakness was actually corrected. In this scenario, the same suitability problem appears for three quarters and complaints are rising, which indicates the monitoring program is not changing behaviour or reducing risk.

A sound interpretation is that the program is activity-based rather than outcome-based. Useful monitoring metrics include not only review completion, but also repeat findings, ageing of action items, root-cause analysis, and evidence that corrective action was implemented and worked. Detection alone is not enough when the same problem keeps reappearing.

• Treating repeat findings as proof of effectiveness confuses issue detection with risk reduction; unresolved recurring issues show the control loop is weak.
• Calling for larger samples misses the stated problem: the issue was already found repeatedly, but remediation was not tracked or retested.
• Replacing compliance monitoring with annual internal audit testing is too infrequent and does not address the need for ongoing corrective-action follow-up.

Recurring findings and rising complaints show the program records activity without verifying that corrective action reduced risk.

Question 65

Topic: Application of Skills

A dealer’s morning exception report is below. Which follow-up is most appropriate for the CCO?

Exhibit: Movement and settlement exceptions

Which follow-up is most appropriate for the CCO?

• A. Wait for a complaint before intervening in the transfer.
• B. Escalate the certificate settlement delay as the main concern.
• C. Route the transfer through the standard disbursement queue without escalation.
• D. Independently verify the senior client’s instructions using existing contact details before releasing funds.

Best answer: D

What this tests: Application of Skills

Explanation: The exhibit shows one item with clear client-protection red flags: a senior client, a newly added bank account, urgency, and a relative dominating the discussion. That combination supports independent verification and escalation before funds are released, unlike ordinary settlement or account-maintenance delays.

The key distinction is between routine settlement processing and a funds-movement situation that raises client-protection concerns. A rejected certificate signature, a same-name journal that matches standing instructions, and a name-update delay are ordinary operational exceptions that should be handled through standard processing and documentation. Item 3 is different because it combines several red flags: a senior client, a request to move all proceeds, a newly added bank account, urgency, and a relative speaking for the client without authority on file. Those facts can indicate possible financial exploitation or that the instruction is not fully independent. The appropriate compliance response is to stop treating the request as routine, independently confirm the client’s intent using pre-existing contact information, document the concern, and escalate under the firm’s vulnerable-client or funds-movement procedures. A simple settlement delay is operationally important, but it is not the strongest protection concern here.

• Routine queue fails because new banking instructions plus third-party pressure are not ordinary disbursement facts.
• Settlement delay focus misreads the exhibit because the late settlement is an explained operational issue, not the clearest client-protection risk.
• Wait for complaint is inappropriate because firms should act on credible red flags before assets leave the account.

A new bank instruction, urgency, and a relative directing the call make this a potential client-protection issue requiring independent confirmation.

Question 66

Topic: Application of Skills

A retail client emails the dealer alleging that her representative bought leveraged ETFs without her authorization and that a KYC update form in her file does not contain her signature. She asks that the trades be reversed and says she may complain to CIRO. What is the best next step for the CCO?

• A. Treat it as a service complaint and negotiate a trade reversal.
• B. Classify it as a serious conduct complaint, preserve records, and begin an independent compliance investigation.
• C. Ask the representative for an explanation before classifying the complaint.
• D. Record it in the complaint log and review it at month-end.

Best answer: B

What this tests: Application of Skills

Explanation: This is not a routine service complaint. Allegations of unauthorized trading and a questionable client signature create elevated regulatory, civil, and reputational risk, so the firm should promptly preserve evidence and move the matter into an independent compliance review.

The key issue is complaint triage. A complaint about delays, communication, or minor administrative errors may be a service complaint, but alleged unauthorized trading and a disputed signature point to possible misconduct and books-and-records concerns. That creates higher risk for the firm: client harm, regulatory scrutiny, litigation exposure, and reputational damage.

The appropriate next step is to classify the matter as serious, preserve relevant records such as orders, notes, emails, and recordings, and have compliance investigate independently. The accused representative can be asked for information as part of that process, but not before the firm secures the record and takes control of the review. A refund, reversal, or other resolution may follow later if supported by the facts.

The closest distractor is seeking the representative’s explanation first, but that is premature and weakens the control response.

• Representative first delays proper triage and risks compromising the evidence trail.
• Service complaint is the wrong category because unauthorized trading and a disputed signature suggest misconduct.
• Month-end review is too slow for a matter with potential regulatory, civil, and reputational exposure.

Alleged unauthorized trading and a disputed client signature make this a serious conduct complaint that requires immediate escalation, record preservation, and independent review.

Question 67

Topic: Regulatory Investigations and Reporting

Review the internal investigation summary excerpt from a Canadian investment dealer.

Artifact: Investigation summary excerpt

• Trigger: Two retired clients complained that a representative recommended leveraged ETFs they did not understand.
• Steps taken: Compliance interviewed the representative and confirmed both orders were client-authorized.
• Not reviewed: KYC changes, suitability notes, call recordings, marketing emails, or other accounts serviced by the representative.
• Proposed outcome: Close the file because unauthorized trading was not found.

What is the best next action?

• A. Escalate immediately for discipline before further fact-finding.
• B. Limit follow-up to compensation discussions with the two complainants.
• C. Expand the review to assess suitability, scope, and control failures.
• D. Close the file because client authorization answers the complaints.

Best answer: C

What this tests: Regulatory Investigations and Reporting

Explanation: The file should not be closed after confirming only that the trades were authorized. An internal investigation is meant to establish the full facts, including suitability, scope, and any control weakness, so compliance should expand the review before deciding on remediation or escalation.

The purpose of an internal investigation within a compliance program is to establish what happened, how broad the issue may be, whether controls or supervision failed, and what remediation or escalation is required. In the excerpt, compliance verified only that the trades were authorized. That does not answer the actual complaint: whether leveraged ETFs were suitable for retired clients, whether risks were properly explained and documented, and whether similar recommendations affected other clients. A risk-based expansion of the review to KYC information, suitability records, communications, and other accounts is the strongest next step. Treating authorization as the end of the inquiry is too narrow.

• Close the file fails because authorization does not resolve a suitability or disclosure concern.
• Immediate discipline fails because the facts are not yet developed enough to support a fair disciplinary decision.
• Compensation only fails because client remediation may matter later, but it cannot replace determining scope and root cause.

The summary only tests authorization; a proper internal investigation must also determine suitability, extent, and any control breakdown before closure.

Question 68

Topic: Application of Skills

At a Canadian investment dealer, surveillance flags a possible spoofing pattern by one equity trader. Review the investigation summary excerpt.

09:18 Alert opened: repeated entered-and-cancelled buy orders,
      with opposite-side sell fills in the same account.
09:24 Desk supervisor emails 12 desk managers:
      "Possible criminal manipulation by Trader K - keep an eye out."
09:31 Supervisor interviews Trader K and mentions chat messages.
09:37 IT deactivates Trader K's chat access.
10:05 CCO notified.
10:20 No record shows chats, notes, or phone logs were preserved.

Which compliance deficiency is best supported?

• A. The response was adequate because trading access was stopped quickly.
• B. Evidence preservation and need-to-know confidentiality failed before escalation.
• C. Desk interviews should continue before involving the CCO.
• D. Broad internal circulation was appropriate to enhance surveillance.

Best answer: B

What this tests: Application of Skills

Explanation: When potential criminal trading concerns arise, the dealer should preserve relevant records, restrict information to a need-to-know group, and escalate promptly through the formal compliance channel. Here, the matter was widely circulated, the trader was alerted, and chat access changed before any documented preservation step and before the CCO was notified.

Possible criminal trading conduct requires disciplined escalation because the first response can affect both evidence integrity and confidentiality. The excerpt shows three control failures: a broad internal email naming the trader and suggesting criminal conduct, an early interview that could tip off the subject, and chat deactivation before any documented preservation of chats, notes, or phone logs. Those steps increase the risk of lost or contaminated evidence and weaken regulator-readiness. In this situation, the matter should move quickly into the firm’s formal escalation process so the CCO can coordinate preservation, access restrictions, and further inquiry on a strict need-to-know basis. Fast intervention can matter, but speed does not replace controlled evidence handling.

• Treating the response as adequate confuses disabling chat access with preserving the underlying records and limiting disclosure.
• Continuing desk interviews before CCO involvement reverses the proper escalation sequence for a potentially criminal matter.
• Saying broad circulation helps surveillance ignores the need-to-know principle and raises the risk of tipping off others or contaminating evidence.

The excerpt shows premature disclosure, subject contact, and chat deactivation without documented preservation before the CCO was engaged.

Question 69

Topic: CCO Skill Requirements

At a Canadian investment dealer, the CCO is reviewing the following governance note.

Exhibit: Governance review note

• Head of Retail approves product-switch exceptions.
• The CCO may request exception logs but does not receive them routinely.
• Regional managers’ bonuses are based 80% on sales growth and 20% on expense control.
• Weekly branch rankings highlight gross commission leaders.
• Employee concern-line reports go to Human Resources, which notifies the relevant business head before Compliance.

Which deficiency is best supported by the exhibit?

• A. The note demonstrates that the approved exceptions were unsuitable.
• B. Control oversight is weakened by sales-heavy incentives and a business-influenced escalation path.
• C. The main deficiency is the low weighting assigned to expense control.
• D. Ethical risk is limited because Human Resources receives staff concerns first.

Best answer: B

What this tests: CCO Skill Requirements

Explanation: The exhibit points to classic organizational drivers of ethical risk: strong pressure to produce revenue and weak independence in challenge and escalation. Sales-heavy compensation, business-side exception approval, and routing concerns through management before Compliance can all discourage early reporting and normalize boundary-pushing.

Ethical risk increases when a firm’s structure rewards commercial results more heavily than conduct and when escalation channels are not independent of the business. Here, regional managers are paid mainly on sales growth, top producers are publicly highlighted, and the Head of Retail approves exceptions. At the same time, the CCO does not receive exception data routinely, and employee concerns are routed through Human Resources to the business head before Compliance is notified.

These facts suggest two reinforcing problems:

• incentives that can pressure staff toward aggressive behaviour
• escalation and oversight channels that may be influenced by the business

That combination can suppress challenge, delay escalation, and weaken a speak-up culture. The narrow bonus-detail option misses the broader governance pattern shown by the note.

• The option treating Human Resources intake as risk-reducing ignores that the business head is told before Compliance, which can chill escalation.
• The option focusing on the 20% expense-control weighting is too narrow and misses the larger incentive and oversight conflict.
• The option claiming the exceptions were unsuitable goes beyond the artifact; it shows a control risk, not proven client harm.

Sales-dominant incentives, business approval of exceptions, and concern routing through management all reduce independent challenge and intensify ethical risk.

Question 70

Topic: Application of Skills

A retail client emails a branch manager saying her advisor moved her retirement account into speculative mining shares after she asked for conservative income investments. She writes that the trades were “not what I agreed to” and asks head office to review the matter. She does not use the word complaint and does not ask for compensation. Under the firm’s compliance program, what is the best interpretation?

• A. This is routine feedback because the client asked for review, not discipline.
• B. This is a client complaint and should enter the complaint-handling process.
• C. This is not a complaint unless the trades are first proven unsuitable.
• D. This is only a service issue until the client requests compensation.

Best answer: B

What this tests: Application of Skills

Explanation: A client complaint is an expression of dissatisfaction about a firm’s or advisor’s conduct, products, services, or account handling. Here, the client alleges the account was handled contrary to instructions and asks for head office review, so the matter should be classified and handled as a complaint.

The core concept is that a complaint is defined by the substance of the client’s communication, not by the label the client uses. A client does not need to say “complaint,” threaten legal action, or ask for compensation. In this scenario, the client clearly expresses dissatisfaction, identifies the conduct at issue, and seeks review by the firm.

Relevant indicators include:

• dissatisfaction with the advice or trading
• an allegation that the activity did not match instructions
• a request for the firm to review the matter

That is enough to trigger the firm’s complaint-handling process, including logging, escalation, and investigation under its procedures. Waiting for proof of unsuitability or for a compensation request would delay proper handling. The key takeaway is that complaint classification comes first; merit is assessed afterward.

• Compensation test fails because a complaint can exist even when the client asks only for review or correction.
• Proof required first fails because the firm classifies the matter as a complaint before finishing its investigation.
• Feedback only fails because an allegation about trading contrary to instructions is more than general feedback.

It is an expression of dissatisfaction about account handling and advice, so it should be treated as a complaint regardless of wording or compensation demand.

Question 71

Topic: Application of Skills

A dealer’s equity trading desk has shown a rise in manual trade corrections and after-the-fact order note changes over the past month. The desk head says the activity reflects a busy market and notes that no client complaints have been received. Which action best aligns with the purpose of trading desk supervision within the firm’s compliance program?

• A. Concentrate only on the desk’s revenue trends and profitability.
• B. Rely on the desk head’s verbal assurance that the activity is normal.
• C. Conduct a targeted exception review, document results, and escalate unresolved concerns.
• D. Wait for a client complaint before increasing supervisory review.

Best answer: C

What this tests: Application of Skills

Explanation: The best response is to use risk-based supervisory review when trading exceptions increase, even if no complaint has been made. Trading desk supervision is meant to identify misconduct, control failures, or market integrity risks early and ensure they are documented and escalated appropriately.

The core purpose of trading desk supervision is preventive and detective oversight of trading activity. When a desk shows unusual patterns such as more manual corrections or post-trade note changes, compliance should not wait for harm to become visible through complaints or losses. A prudent Canadian compliance program uses risk-based monitoring to assess whether the pattern reflects operational strain, poor controls, or potentially improper trading practices.

A sound supervisory response is to:

• review the exceptions independently
• document the analysis and outcome
• require corrective action where needed
• escalate issues that remain unresolved or appear serious

This approach supports market integrity, supervisory accountability, and regulator-readiness. Profitability and management assurances may inform context, but they do not replace independent supervision.

• Complaint-driven only is too reactive because supervision should detect issues before clients complain.
• Management assurance is insufficient because supervisory oversight requires independent review and evidence.
• Profit focus misses the compliance purpose, which is control effectiveness and trading-risk oversight, not revenue monitoring alone.

Trading desk supervision exists to detect and address trading risks through independent, risk-based monitoring, documented follow-up, and escalation when needed.

Question 72

Topic: Application of Skills

A Canadian investment dealer receives a demand letter from a client’s lawyer alleging unsuitable recommendations and stating that a civil claim is being prepared. The dealer’s normal practice deletes internal chat after 60 days, and branches keep some working notes locally. As CCO, which action best aligns with prudent compliance practice now?

• A. Issue a litigation hold and centrally preserve all potentially relevant records.
• B. Wait for formal service before suspending routine destruction and collection.
• C. Keep the complaint file and continue normal deletion of other records.
• D. Let branch staff decide which records are relevant to preserve.

Best answer: A

What this tests: Application of Skills

Explanation: Once litigation is reasonably anticipated, the key control is a documented litigation hold. The dealer should suspend routine destruction and centrally preserve potentially relevant records, including emails, chats, notes, recordings, KYC, orders, supervision evidence, and complaint materials.

The core concept is document preservation once litigation is reasonably anticipated. A lawyer’s demand letter alleging unsuitable recommendations creates real litigation exposure, so the CCO should move from ordinary complaint handling to controlled preservation. The strongest response is to suspend auto-deletion and routine destruction, preserve potentially relevant records broadly, and centralize instructions and access so the firm can show what was retained and by whom.

• Preserve client, trading, supervisory, complaint, email, chat, note, and recording records.
• Use a formal hold notice rather than informal branch-by-branch judgment.
• Maintain an audit trail for collection and custody.

This supports fair investigation, consistent legal response, and regulator-ready governance. Waiting for a statement of claim or preserving only a narrow file creates avoidable evidentiary risk.

• Complaint file only is too narrow because key evidence may sit in chats, notes, recordings, trading records, and supervisory files.
• Wait for service fails because preservation should begin when litigation is reasonably anticipated, not only after formal filing.
• Local relevance calls are weak control because business staff may miss documents, apply inconsistent judgment, or alter the evidentiary record.

Threatened litigation requires prompt preservation controls over all potentially relevant records, not selective or delayed retention.

Question 73

Topic: Compliance Role and Structure

At a fast-growing branch of an investment dealer, a regional sales manager tells supervisors to handle concerns about unapproved product flyers verbally so there is ’no paper trail’ that might slow sales. Compliance has already found two flyers that omit key product risks, but no client complaint has been received yet. The branch manager says the issue can be handled informally to avoid hurting morale. What is the single best response by the CCO to support a culture of compliance, client protection, and firm integrity?

• A. Send a general reminder on approved communications and review the branch at the next scheduled cycle.
• B. Ask the branch manager to coach staff privately and confirm later that sales practices improved.
• C. Wait to escalate until a client complaint or regulatory inquiry shows actual harm.
• D. Require immediate withdrawal of the flyers, document the issue, escalate the manager’s direction, and reinforce non-retaliatory reporting.

Best answer: D

What this tests: Compliance Role and Structure

Explanation: The best response is to stop the risky conduct, create a clear record, and escalate the attempt to avoid documentation. A culture of compliance supports client protection when staff are expected to speak up, issues are documented, and sales pressure does not override firm integrity.

A culture of compliance means business pressure does not override fair, transparent, and documented conduct. In this scenario, the risk is not only the misleading flyers; it is also the manager’s direction to avoid a paper trail, which weakens supervision, discourages escalation, and undermines accountability. The CCO should act promptly to remove the materials, document what occurred, escalate the conduct concern to appropriate senior management, and reinforce that employees must raise concerns without fear of retaliation. That approach protects clients before harm expands and shows that the firm values integrity over short-term sales results. A softer or delayed response would miss the root cultural problem.

• Private coaching is too weak because it leaves the suppression of reporting unaddressed and creates no reliable remediation record.
• General reminder only fails because misleading materials are already in use and the cultural issue involves management conduct, not just policy awareness.
• Waiting for harm treats compliance as reactive when client protection depends on early intervention and escalation.

A strong compliance culture requires prompt, documented escalation of conduct that suppresses reporting and exposes clients to misleading communications.

Question 74

Topic: Compliance Role and Structure

A Canadian investment dealer finds that branch-review findings and trade-surveillance alerts are being escalated slowly. Most monitoring staff report to regional sales managers, and analysts must obtain business-line sign-off before the CCO is notified of significant issues. The firm wants faster escalation without weakening monitoring quality. Which action best aligns with a durable compliance operating model?

• A. Keep monitoring under sales management but require quarterly meetings with compliance.
• B. Rotate front-line advisers into compliance monitoring roles to strengthen business alignment.
• C. Assign branch managers to approve all significant alerts before compliance review begins.
• D. Create an independent compliance reporting line with direct escalation to the CCO and documented risk-based triggers.

Best answer: D

What this tests: Compliance Role and Structure

Explanation: The best structure is one that lets compliance monitor and escalate material issues without waiting for approval from the business area being reviewed. Independent reporting lines plus documented risk-based triggers improve escalation speed, preserve objectivity, and make monitoring more consistent.

Departmental organization directly affects whether compliance can act quickly and independently. When monitoring staff sit inside the business line, escalation can be delayed by competing sales priorities, and analysts may feel pressure to soften findings. A stronger model places monitoring within an independent compliance function, gives the team direct access to the CCO, and uses documented risk-based criteria for when issues must be escalated.

This approach improves all three concerns in the scenario:

• faster escalation, because business-line approval is not a gatekeeper
• better independence, because reviewers are not reporting to the area under review
• stronger monitoring quality, because thresholds and documentation are applied consistently

Business input still matters, but it should inform remediation, not control whether compliance can escalate a significant issue.

• Quarterly meetings are too slow and do not solve the core independence problem created by sales-line reporting.
• Manager approval first weakens escalation by letting the supervised area control when compliance can act.
• Adviser rotations may add product knowledge, but they reduce independence and can undermine consistent monitoring discipline.

This improves independence, removes business-line gatekeeping, and supports faster, more consistent escalation of higher-risk issues.

Question 75

Topic: CCO Skill Requirements

A Canadian investment dealer has approved a revised policy for handling clients who may be vulnerable. The CCO is building the implementation plan for advisors, branch managers, and compliance staff. Which action best aligns with durable compliance implementation?

• A. Wait for the annual compliance review to confirm whether the policy worked.
• B. Require a one-time employee attestation that the policy was read.
• C. Assign control owners, provide role-based training, and retain evidence of adoption.
• D. Email the policy to all staff and rely on local managers to explain it.

Best answer: C

What this tests: CCO Skill Requirements

Explanation: A policy is not truly implemented just because it is approved or distributed. Durable implementation requires clear ownership, training tailored to each role, and evidence that staff adopted the new requirements in practice.

The core concept is that implementation planning must turn policy text into consistent behaviour across the firm. Clear ownership makes someone accountable for each control or process, role-based training helps advisors, supervisors, and compliance staff understand what they must do differently, and evidence of adoption shows the firm can demonstrate real implementation rather than mere circulation of a document. Useful evidence can include training logs, attestations, updated procedures, supervisor checklists, and early monitoring results. In a Canadian dealer compliance context, this supports prudent supervision, recordkeeping discipline, and regulator readiness. Simply sending a policy or waiting for a later review does not show that responsibilities were understood, embedded, and tested soon after rollout.

• Email only shows dissemination, but not clear accountability, understanding, or proof of behavioural change.
• One-time attestation is limited evidence and does not replace role-specific training or named ownership.
• Wait for annual review is too passive because early implementation should be supported and tested promptly.

Effective implementation needs accountable owners, tailored training, and records showing the policy was actually put into practice.

Questions 76-100

Question 76

Topic: Application of Skills

A dealer reviews the following registration file note for a newly transferred employee.

Exhibit: Registration file note

• Individual: Priya Nair
• Effective Monday: registered and CIRO-approved as a Registered Representative in Alberta
• Proposed additional duty: sign the Calgary branch’s daily supervision reports
• The firm treats signing those reports as a supervisory function
• Supervisory approval request: not filed
• Required supervisor proficiency course: exam scheduled next month
• Branch manager comment: “She can act as temporary supervisor until the course is done.”

What is the best supported next action?

• A. Keep her in Registered Representative duties only until supervisory approval and proficiency are complete.
• B. Track the missing course as a training item and let supervision begin now.
• C. Permit supervision if an approved supervisor reviews her signed reports afterward.
• D. Permit temporary supervision because her Registered Representative approval is already effective.

Best answer: A

What this tests: Application of Skills

Explanation: The file note shows that Priya is approved only as a Registered Representative. It also shows that the supervisory approval has not been filed and the required supervisory course is not yet complete. She should therefore be restricted to representative duties until the supervisory role’s approval and proficiency requirements are satisfied.

The core concept is that registration, approval, and proficiency are role-specific. Priya’s current status supports Registered Representative activities in Alberta, but the artifact clearly says the additional duty is supervisory and that the firm treats signing daily supervision reports as a supervisory function. The file also shows two gaps for that supervisory role: no supervisory approval request and no completed supervisory proficiency.

A sound compliance response is to:

• keep her out of supervisory duties
• ensure the proper supervisory approval process is completed
• wait until the required supervisory proficiency is completed before assigning supervision

Being approved for one individual role does not automatically authorize a higher or different function at the firm.

• Representative status only confuses baseline representative approval with a separate supervisory role.
• After-the-fact review does not fix the problem that an unapproved, unqualified person performed the supervisory function.
• Training log only treats the issue as administrative and ignores the separate approval gap.

Her current registration and approval cover representative activities only; supervisory functions require separate approval and the required proficiency.

Question 77

Topic: Application of Skills

A dealer’s CCO reviews the following closed complaint file involving an unauthorized-trading allegation. Based on the excerpt, what is the best next action?

Exhibit: Complaint log excerpt

• A. Conclude unauthorized trading occurred because no order tickets are listed.
• B. Reopen the file and add trade evidence, supervisory analysis, and closure rationale.
• C. Escalate the file externally because any complaint with compensation is reportable.
• D. Leave the file closed because the goodwill credit addressed the complaint.

Best answer: B

What this tests: Application of Skills

Explanation: Recordkeeping is the evidence trail for complaint handling. Because this file was closed with only a vague review note and no listed order tickets, call recordings, or documented supervisory reasoning, compliance should reopen it and complete the record before relying on the outcome.

Recordkeeping lets a dealer reconstruct the complaint, the trade review performed, the supervisory judgment made, and the basis for the client response. Here, the file shows the allegation, the representative’s denial, and a goodwill credit, but it does not identify the key records normally needed to assess an unauthorized-trading complaint, such as order tickets, call recordings, client instructions, or meaningful supervisory notes. A branch manager comment that the trades “appear okay” does not show what was reviewed or why that conclusion was reached. Without a complete file, compliance cannot properly assess supervision, support the complaint response, or respond confidently to a CIRO or securities regulator inquiry. The appropriate step is to reopen the file, attach the reviewed records, document the analysis, and then determine closure.

Compensation does not replace proper books and records.

• A goodwill credit may help resolve a dispute commercially, but it does not cure an incomplete complaint file.
• Missing order tickets in the log show weak documentation, not conclusive proof that the trades were unauthorized.
• External reporting cannot be inferred from the excerpt because no specific reporting trigger is stated.
• The representative’s statement alone is not enough to evidence an adequate supervisory review.

The file lacks the records and documented supervisory reasoning needed to support the complaint outcome and any later regulatory review.

Question 78

Topic: Compliance Role and Structure

A Canadian dealer is reviewing whether its compliance structure supports independent challenge.

Exhibit: Governance summary

Based on the exhibit, what is the best follow-up?

• A. Keep branch manager control because the CCO meets the board.
• B. Shift branch compliance reviews and bonuses to compliance leadership.
• C. Change the CCO’s administrative report from COO to CFO.
• D. Add branch manager approval before alert escalation to the CCO.

Best answer: B

What this tests: Compliance Role and Structure

Explanation: The exhibit shows the clearest conflict in branch managers approving the ratings and bonuses of the compliance officers who monitor them. That influence can weaken independent challenge, even though the CCO still has direct board access.

The core concept is compliance independence. A CCO can have an administrative reporting line to a senior executive if the compliance function still has direct access to the board and can escalate issues without interference. Here, the more serious weakness is that branch managers control the performance ratings and bonuses of the branch compliance officers assigned to oversee those same branches.

When the monitored business influences a compliance employee’s pay or career progression, the compliance function may be less willing to challenge conduct, escalate findings, or document issues firmly. A stronger structure is to place objective setting, performance assessment, and compensation decisions within an independent compliance chain while keeping effective access to branch information. The alert-escalation item in the exhibit supports, rather than weakens, compliance independence.

• Board access alone does not cure a branch-level conflict when monitored managers still control compliance pay and ratings.
• Different admin boss misses the main issue; moving the CCO from the COO to the CFO does not remove business-line influence over branch compliance staff.
• Extra branch approval would worsen independence by giving the monitored business another gate before a high-risk issue reaches the CCO.

The monitored business should not control the evaluations or pay of the compliance staff assigned to oversee it.

Question 79

Topic: Application of Skills

During daily surveillance at a Canadian investment dealer, compliance flags three retail corporate bond trades priced above both the firm’s internal exception threshold and an external pricing source. The fixed income desk supervisor says the bonds were illiquid and asks compliance to wait until month-end to review them with the trader. The dealer’s procedures require prompt investigation of material pricing exceptions. What is the best next step?

• A. Open a documented review now, preserve records, and obtain pricing support.
• B. Wait until month-end and review the trades with the desk supervisor.
• C. File a report with CIRO immediately, before validating the exceptions.
• D. Rewrite the fixed income pricing policy before examining these trades.

Best answer: A

What this tests: Application of Skills

Explanation: The best next step is a prompt, documented review of the flagged bond trades. In a fixed income pricing-exception case, compliance should preserve records and test the trader’s illiquidity rationale before deciding on escalation, remediation, or any regulatory reporting.

This tests the proper sequence for a trading-compliance review. When surveillance identifies material fixed income pricing exceptions, compliance should act promptly to preserve evidence and gather facts, including trade tickets, client instructions, trader and supervisor communications, pricing-source data, and the desk’s rationale for the execution level. A documented review allows the firm to determine whether the higher price was reasonably supported by market conditions such as illiquidity, or whether the trades point to a supervision, conduct, or fair-pricing concern.

A practical sequence is:

• confirm the exception;
• preserve records;
• obtain and assess pricing support;
• then decide on escalation, remediation, client impact review, and any required reporting.

Waiting until month-end weakens control execution, while reporting externally before validating the facts is premature unless an explicit immediate-notice requirement applies.

• Waiting for convenience fails because the firm’s procedures call for prompt review of material exceptions.
• Immediate regulatory reporting is premature before compliance confirms the facts and assesses the trading rationale.
• Policy revision first skips the urgent review of actual trades that may already present client or supervision risk.

Prompt evidence preservation and fact-finding should occur before deciding on any further escalation or reporting.

Question 80

Topic: Canada Regulation and Dealer Risks

A dealer’s CCO reviews the following weekly incident log. No court, police, or regulatory findings have been made yet.

Exhibit: Incident log

Which follow-up best reflects the role of criminal, civil, and common-law obligations in the firm’s compliance program?

• A. Close item 1 after reimbursement and treat items 2 and 3 as service issues.
• B. Wait for external findings before preserving evidence or assigning any legal classification.
• C. Preserve evidence and escalate item 1, while investigating items 2 and 3 for civil/common-law risk.
• D. Escalate only item 2, because items 1 and 3 are internal conduct issues.

Best answer: C

What this tests: Canada Regulation and Dealer Risks

Explanation: A compliance program must recognize legal exposure early and respond before any court or regulator makes a final finding. The fabricated transfer points to potential criminal conduct, while the misleading website statement and unauthorized disclosure still create civil and common-law risk that requires investigation, remediation, and documentation.

Criminal, civil, and common-law obligations help a compliance program triage incidents and decide the urgency and type of response. Compliance is not determining guilt or civil liability, but it must identify when facts suggest different legal risks. A fabricated client instruction used to move money to an employee’s own account raises potential criminal concerns, so evidence should be preserved and the matter escalated immediately. By contrast, a misleading product description and unauthorized disclosure of client information may not be criminal on these facts, but they can still create civil and common-law exposure through misrepresentation, negligence, or breach of confidence. Those matters still require investigation, client-harm assessment, remediation, supervisory review, and clear records. Reimbursement or the absence of an outside finding does not remove the firm’s compliance obligations.

• Waiting for outside findings fails because compliance must assess facts, preserve evidence, and escalate promptly based on internal detection.
• Treating only the website issue as external legal risk ignores the potential fraud and confidentiality exposures in the other two items.
• Closing the transfer matter after reimbursement fails because repayment does not erase possible criminal conduct or control weaknesses.

The facts suggest potential criminal misconduct in item 1 and civil or common-law exposure in items 2 and 3, so compliance should triage and act accordingly.

Question 81

Topic: Application of Skills

During a quarterly review, a CCO finds a complaint file for a client who alleged unauthorized trading and unsuitable use of margin. The file contains the client complaint and the dealer’s final response letter, but little else. Which additional documentation would best align the file with sound Canadian complaint-handling practice?

• A. A package of account statements and trade confirmations for the period in question
• B. A short note that the client declined compensation and the file was closed
• C. The representative’s written response and a branch manager sign-off
• D. A dated investigation memorandum covering the allegations, evidence reviewed, interviews, analysis, escalation, and outcome rationale

Best answer: D

What this tests: Application of Skills

Explanation: The strongest complaint file documentation is a contemporaneous investigation record that shows what the firm did, what it reviewed, and why it reached its conclusion. Good complaint files document process, evidence, analysis, and oversight, not just the final outcome.

In a Canadian dealer complaint context, the file should be complete enough for compliance, senior management, or a regulator to understand the matter without relying on memory. That means documenting the allegations, the evidence gathered, who was interviewed, what analysis was performed, whether the issue was escalated, and why the firm decided on its response or remediation.

A file that contains only source documents or only the closing communication is incomplete. Raw records may support the investigation, but they do not show how the firm assessed the complaint. A well-managed file is both decision-ready and regulator-ready: it demonstrates fair handling, independent review, and disciplined recordkeeping. The key point is that the file must show the reasoning behind the outcome, not just the outcome itself.

• Raw records only Account statements and confirmations may be relevant evidence, but by themselves they do not document the investigation or conclusions.
• Too narrow a record A representative’s response and manager sign-off do not show a full, independent assessment of the complaint.
• Outcome without process A closure note records the result, but not the evidence, analysis, or escalation supporting that result.

A well-managed complaint file should let an independent reviewer reconstruct the investigation, decision process, and basis for the firm’s response.

Question 82

Topic: Canada Regulation and Dealer Risks

A dealer’s CCO is setting next quarter’s oversight plan. The dealer prioritizes compliance work by residual risk, considering both inherent risk and control effectiveness.

Exhibit: Quarterly control snapshot

Which follow-up best reflects risk management in compliance oversight?

• A. Prioritize remediation and added monitoring for seniors/vulnerable clients.
• B. Split next quarter’s oversight equally across all three areas.
• C. Treat the seniors findings as evidence the controls are sufficient.
• D. Wait for a complaint before escalating the seniors findings.

Best answer: A

What this tests: Canada Regulation and Dealer Risks

Explanation: Risk management in compliance oversight means identifying where risk remains highest after considering existing controls, then focusing remediation and monitoring there. The seniors/vulnerable-clients area clearly ranks highest because it combines high inherent risk, partial control effectiveness, repeated exceptions, and aged issues.

In compliance oversight, risk management is a risk-based process: identify key risks, assess how well controls are working, determine where residual risk remains highest, and allocate escalation, remediation, and monitoring accordingly. It does not mean treating every area the same or waiting for actual harm before acting.

In the exhibit, the seniors/vulnerable-clients area starts with high inherent risk and has only partially effective controls. It also shows repeated exceptions and aged unresolved issues. That combination indicates the greatest residual risk and supports a stronger response, such as management escalation, targeted remediation, and closer follow-up. The other areas show lower risk and stronger control results, so routine oversight is more appropriate there. The key point is that compliance risk management is proactive and prioritized, not reactive or evenly distributed.

• Equal allocation ignores the stated residual-risk approach; oversight should follow risk, not be spread uniformly.
• Wait for harm is reactive; open exceptions and aged issues already justify escalation and remediation.
• Detection equals control misreads the dashboard; repeated exceptions with partial effectiveness show a control gap, not a resolved risk.

Risk management directs attention to the highest residual risk area, where inherent risk is high, controls are only partly effective, and issues remain open.

Question 83

Topic: Regulatory Investigations and Reporting

The board of a Canadian investment dealer receives the following excerpt from the CCO’s quarterly report.

Board-report excerpt

• Branch reviews completed: 7
• Findings identified: 18
• Findings closed this quarter: 11
• Client complaints received: 6, all reported as “resolved or in progress”
• Open internal investigations: 2, both noted as “being handled by management”
• Training completion: 99%

No additional detail accompanies this excerpt. Which deficiency in the reporting process is best supported?

• A. It does not show issue severity, age, or overdue remediation.
• B. It should include client identities and investigation notes.
• C. It should exclude open matters until investigations are complete.
• D. It should attach full branch-review workpapers.

Best answer: A

What this tests: Regulatory Investigations and Reporting

Explanation: The excerpt gives activity counts but not enough context for oversight. Without risk ranking, aging, and remediation status, the board cannot tell whether open findings or investigations are routine, overdue, or significant.

Effective compliance reporting to a board must be decision-useful, not just descriptive. Directors need enough information to understand what is open, how serious it is, whether remediation deadlines are being met, and whether issues are recurring or escalating. Here, the report provides only counts and generic status wording such as “resolved or in progress” and “being handled by management.” That leaves the board unable to distinguish minor items from material compliance concerns or to challenge delayed follow-up.

A stronger report would include, for significant open matters, items such as risk rating, age, accountable owner, target date, and overdue status. The main weakness is insufficient status and materiality information, not the absence of raw case detail.

• Client detail is not the key gap because boards usually need summarized oversight information, not personally identifying complaint or investigation file notes.
• Exclude open matters is inappropriate because boards should be informed about significant unresolved issues before they are closed.
• Full workpapers are unnecessary at board level; reporting should be concise and governance-focused rather than a dump of testing files.

Without severity, aging, and remediation status, the board cannot judge whether unresolved matters are material or deteriorating.

Question 84

Topic: Application of Skills

A registered representative at a Canadian investment dealer is being reassigned from Ontario to Alberta. The branch manager says several Alberta clients may move their accounts unless the representative calls them today, but the file shows only a submitted NRD amendment and no confirmation that Alberta registration is effective. What is the best next step for the CCO?

• A. Verify approval in NRD and restrict Alberta registrable activity until confirmed.
• B. Permit Alberta activity if the branch manager approves each order first.
• C. Allow calls to existing Alberta clients while the amendment is pending.
• D. Rely on the representative’s Ontario registration because the reassignment is urgent.

Best answer: A

What this tests: Application of Skills

Explanation: A submitted NRD amendment does not mean the individual’s registration is already effective in the new jurisdiction. The CCO should first verify the status and prevent Alberta registrable activity until the firm has clear confirmation.

The key compliance issue is whether the individual is actually registered in Alberta, not how strong the business pressure is. When registration status is unclear, the safest and most appropriate response is to treat the person as not yet authorized for registrable activity in that jurisdiction until approval is verified through NRD and the firm’s records.

• confirm the current registration status
• stop client-facing registrable activity in Alberta until confirmed
• document the restriction and escalation to business management

Manager oversight, existing client relationships, and urgency do not cure an unverified registration gap.

• Existing clients still involve registrable activity if the representative is advising or taking orders in Alberta without confirmed approval.
• Manager sign-off adds supervision, but it does not replace the requirement for proper registration.
• Ontario registration does not authorize activity in Alberta when jurisdictional approval is still unconfirmed.

A submitted amendment is not proof of effective registration, so registrable activity should stop until approval is verified.

Question 85

Topic: Canada Regulation and Dealer Risks

A dealer plans to email clients age 75 and over about a newly approved principal-protected note. There is no dealer policy that specifically bans age-based campaigns. Marketing says the proposal is mainly a privacy issue because the dealer already has consent to send promotional emails, and any purchase would later go through an advisor. The CCO must decide how to review the proposal before launch. What is the best next step?

• A. Confirm email consent first and defer securities-law review until trades occur.
• B. Analyze it first as a securities-law conduct issue and set supervisory controls.
• C. Launch a pilot first and add controls if complaints emerge.
• D. Reopen product approval first before reviewing the targeted message.

Best answer: B

What this tests: Canada Regulation and Dealer Risks

Explanation: In a principle-based regime, compliance should start with the lens that best addresses potential investor harm. A campaign targeting older clients about a complex product should first be reviewed under securities-law conduct standards for fair, balanced communications, vulnerable-client risk, and supervision.

The core issue is not just whether the dealer can send the email; it is whether the proposed outreach is consistent with securities-law conduct obligations. Under Canadian principle-based regulation, a communication can raise compliance concerns before any order is taken. Targeting clients age 75 and over with a principal-protected note may affect how risks, guarantees, liquidity limits, and conflicts are understood, and it can heighten concerns involving seniors or other vulnerable clients. That makes investor protection and dealer conduct the most relevant regulatory lens.

• assess whether the message is fair, balanced, and not misleading;
• consider vulnerable-client and conflict implications of the targeting;
• decide what approvals, training, scripts, and monitoring are needed.

Privacy consent and product approval still matter, but they are secondary to the initial securities-law analysis.

• Consent only fails because permission to send emails does not answer whether the content and targeting meet securities-law conduct expectations.
• Product approval first fails because an approved product can still be marketed in a problematic way to a specific client segment.
• Pilot then review fails because complaint monitoring is not a substitute for a pre-launch compliance assessment and controls.

The outreach itself can create client-communication and vulnerable-client risks, so the primary lens is securities-law conduct, not privacy or product approval.

Question 86

Topic: Application of Skills

A retail client alleges unsuitable trades and seeks $18,000 in compensation. After a documented internal review, the dealer sends a written decision denying compensation, and the client says she still wants the matter reviewed. Which action best aligns with the role of alternative dispute resolution in Canadian complaint resolution?

• A. Direct the client back to the advisor to negotiate a private settlement.
• B. Treat the firm’s written decision as the end of the complaint process.
• C. Offer outside review only if the client waives other complaint or legal options.
• D. Provide information on independent external dispute resolution and retain the complaint record.

Best answer: D

What this tests: Application of Skills

Explanation: Alternative dispute resolution gives a dissatisfied client an independent, lower-cost avenue after the firm’s internal complaint review. The best action is to explain that external option and keep full records, rather than using ADR to restrict rights, push the matter back to the advisor, or simply close the file.

In Canadian complaint handling, alternative dispute resolution is intended to supplement the firm’s internal process, not replace it. When a client remains dissatisfied after the dealer’s written response, compliance should inform the client about the independent external dispute resolution avenue, explain how to access it, and maintain a complete file of the complaint, investigation, response, and follow-up. This supports fairness, independence, and regulator-readiness.

• complete the internal review and written response
• provide access to independent external dispute resolution
• preserve records of the complaint and outcome

ADR should not be used to pressure the client into waiving regulatory, legal, or other avenues, and it should not be reduced to a private discussion with the advisor whose conduct is being challenged.

• Waiver condition fails because independent dispute resolution should not depend on surrendering other rights.
• Advisor negotiation fails because it lacks the independence expected when the complaint remains unresolved.
• Close the file fails because the firm’s response does not eliminate the client’s access to external resolution or the need for records.

ADR is meant to give a dissatisfied client an independent review path after the firm’s internal process, while the firm preserves a complete complaint record.

Question 87

Topic: Compliance Role and Structure

A Canadian investment dealer’s CCO reports administratively to the COO. For three consecutive quarters, branch supervision exceptions have recurred, but board updates are informal verbal summaries and unresolved issues are not assigned owners or target dates. Senior management wants a framework change that will preserve effective oversight even if executives change roles. What is the single best action?

• A. Adopt a board-approved compliance charter with direct board access and tracked remediation owners.
• B. Require annual compliance attestations from each business-line head to the COO.
• C. Rotate responsibility for compliance reporting among senior operating managers.
• D. Expand branch testing and wait for a larger exception trend before formal escalation.

Best answer: A

What this tests: Compliance Role and Structure

Explanation: Durable oversight depends on governance structure, not just additional monitoring. A board-approved compliance charter that gives the CCO direct access to the board and requires formal remediation tracking creates clear authority, escalation, and accountability that survive personnel changes.

A senior-level compliance framework is durable when it is embedded in governance rather than dependent on informal relationships. In the scenario, the recurring exceptions matter, but the larger weakness is that reporting to the board is informal and unresolved issues have no named owners or deadlines. That means oversight can weaken quickly if a senior executive changes roles or priorities.

The strongest response is to formalize the compliance function through a board-approved charter or mandate that gives the CCO direct access to the board or a designated board committee, supported by regular written reporting and documented issue tracking. This creates a stable escalation path, clearer accountability for remediation, and better evidence that senior leadership is overseeing material compliance risks.

More testing or management attestations can support the framework, but they do not replace formal governance and escalation design.

• More testing only fails because increased sampling does not fix the absence of formal board oversight or issue ownership.
• Annual attestations only help management monitoring, but they do not create direct senior-governance access or timely remediation accountability.
• Rotating reporting weakens consistency and ownership instead of strengthening an enduring compliance structure.

It formalizes mandate, escalation, and accountability at the senior level, which is the key weakness in the current framework.

Question 88

Topic: Canada Regulation and Dealer Risks

A Canadian investment dealer requires a designated supervisor to approve all new options accounts and document any exceptions. During a branch manager’s leave, no backup was assigned, and 18 options accounts were opened before supervisory review was completed. The accounts were later found suitable, and there have been no client complaints or regulator inquiries. When the CCO logs this issue in the firm’s risk register, which risk category is most directly implicated?

• A. Market risk
• B. Legal and regulatory risk
• C. Reputational risk
• D. Operational risk

Best answer: D

What this tests: Canada Regulation and Dealer Risks

Explanation: This issue is most directly operational risk because it arises from a breakdown in supervision and workflow design: no backup supervisor was assigned, and approvals were not completed on time. Regulatory or reputational consequences could follow, but they are secondary to the underlying process failure.

Operational risk is the risk of loss or harm arising from failed internal processes, people, systems, or external events. In a dealer context, missed approvals, weak supervisory coverage, incomplete documentation, and poor escalation are classic operational-risk indicators. Here, the core problem is the control structure: the firm depended on one designated supervisor and had no backup during the leave period. That process weakness allowed accounts to be opened before required review.

Legal and regulatory risk is a plausible downstream consequence because late approval may breach policy or regulatory expectations, but it is not the most direct classification of the stated problem. Market risk relates to adverse price movements, and reputational risk usually becomes primary when there is external fallout such as complaints, publicity, or regulator attention. The best risk classification starts with the root cause, not the possible later effects.

• Legal exposure is tempting because late approvals may create compliance concerns, but the stem points first to a failed supervisory process.
• Market risk does not fit because the problem is not driven by price movements or trading positions.
• Reputational risk is not primary here because the stem says there are no complaints, inquiries, or public consequences yet.

The immediate problem is a failed supervisory process and control gap, which is the hallmark of operational risk.

Question 89

Topic: Application of Skills

During a complaint review, a dealer discovers that one branch stored signed KYC update forms on a local drive instead of the firm’s approved repository. After an IT migration, eight months of scanned forms from that branch cannot be retrieved. Several affected accounts show material KYC changes, and there is no evidence of client loss yet. What is the single best compliance response?

• A. Investigate scope, preserve remaining records, reconstruct files, and escalate remediation.
• B. Have advisors recreate missing updates and rely on attestations.
• C. Defer action until a complaint outcome or regulator request.
• D. Revise the policy and test the branch next quarter.

Best answer: A

What this tests: Application of Skills

Explanation: This is a recordkeeping control breakdown, not just a branch process issue. Because records supporting material KYC changes are missing and may be needed for complaint or regulatory review, compliance should promptly preserve available evidence, determine scope, reconstruct support where possible, and escalate remediation.

The key recordkeeping concept is that a dealer must maintain complete, accurate, and retrievable records in approved systems. In this scenario, the branch used an unapproved storage method, and the firm cannot now produce records tied to material KYC changes. That creates both a books-and-records weakness and a regulator-readiness problem.

The best compliance response is to treat this as a documented control incident: preserve what remains, identify the affected period and accounts, reconstruct missing records from reliable source material where possible, assess any impact on supervision or client outcomes, and escalate the issue with a remediation plan. The absence of proven client loss does not make the failure minor, and a purely prospective fix does not address missing historical records.

• Advisor attestations are not a substitute for original firm records and do not establish the full scope of the breakdown.
• Waiting for an external trigger fails because missing records needed for complaints or reviews require prompt containment and assessment.
• Policy-only remediation is incomplete because a current control failure must be investigated, documented, and remediated now.

This response addresses a material books-and-records control failure by containing it, assessing impact, and formally remediating it.

Question 90

Topic: Application of Skills

A branch manager receives an email from a 74-year-old client alleging that her representative changed her KYC from balanced to aggressive without permission, placed a concentrated mining stock position, and relied on e-signature pages she says she never reviewed. The client reports a $62,000 loss and asks the firm to reverse the trades. The representative says the client is simply upset about market performance. What is the single best compliance response?

• A. Treat it as a market-loss complaint and let the branch manager resolve it.
• B. Treat it as a serious written complaint, preserve records, and escalate to compliance.
• C. Treat it as an informal concern until the client files a signed complaint letter.
• D. Treat it as a reimbursement request and send it to finance first.

Best answer: B

What this tests: Application of Skills

Explanation: This is more than dissatisfaction with market performance. The client makes a written allegation of unauthorized KYC changes, unsuitable trading, and questionable e-signature use, which creates elevated conduct, supervisory, and litigation risk and calls for immediate compliance involvement and record preservation.

Complaint classification turns on the substance of the allegation, not the representative’s characterization. A written complaint alleging unauthorized changes to KYC, unsuitable recommendations, or possible misuse of signatures is higher risk because it may indicate misconduct, supervision failures, and exposure to civil claims or regulatory scrutiny. The firm should promptly take the matter out of the representative’s hands, preserve the account-opening and KYC record, trading notes, approvals, and e-signature evidence, and escalate to compliance for an independent review. By contrast, a lower-risk service complaint usually involves delays, administrative errors, or communication issues without allegations of unauthorized activity. Market losses do not reduce the seriousness of a complaint that raises possible unauthorized conduct.

• Market-loss framing fails because the complaint alleges unauthorized KYC changes and possible document misuse, not just poor returns.
• Signed-letter requirement fails because the client’s email is already a written complaint that must be handled.
• Finance-first approach fails because reimbursement may be considered later, but classification and investigation belong with compliance first.

The email alleges unauthorized KYC changes and questionable documentation, creating elevated conduct and litigation risk that requires immediate compliance escalation.

Question 91

Topic: CCO Skill Requirements

Over the last six months, an investment dealer’s review of third-party EFT requests has found repeated exceptions for missing supervisor approval at the same three branches. Staff have already received two policy reminders, and the monthly compliance report lists exceptions one by one rather than by branch or cause. The CCO wants a risk-based enhancement that will better support escalation to senior management. What is the best monitoring enhancement?

• A. Increase the sample size for all branches each month.
• B. Reissue the policy and obtain branch manager attestations.
• C. Add trend reporting by branch and cause, with escalation triggers and follow-up testing.
• D. Remove repeat items once branches acknowledge the exceptions.

Best answer: C

What this tests: CCO Skill Requirements

Explanation: When the same exception keeps appearing, the issue is no longer just individual error; it suggests a control weakness that needs structured escalation and remediation. The strongest enhancement is to convert isolated exception reporting into trend-based monitoring that identifies concentration, assigns accountability, and tests whether the fix worked.

Recurring exceptions should push compliance beyond simple detection into analysis and remediation oversight. In this scenario, the same approval gap has continued after reminders, and the current report format does not show concentration by branch or root cause. The best enhancement is therefore to redesign monitoring so repeat issues are aggregated, escalated, and re-tested.

• Group exceptions by branch and cause.
• Set thresholds for escalation to business leaders and senior management.
• Assign remediation owners and target dates.
• Perform targeted follow-up testing at the affected branches.

A broader sample or another reminder may produce more activity, but neither gives management clear evidence that the underlying control failure has been identified and corrected.

• Bigger sample increases workload, but it is not targeted to the repeated branches or the underlying cause.
• Another reminder is weak because the firm has already tried reminders and the exceptions still recur.
• Stop repeat reporting undermines governance, since recurrence is exactly what should remain visible until fixed.

Recurring exceptions indicate an unresolved control weakness, so monitoring should aggregate patterns, trigger escalation, and verify remediation.

Question 92

Topic: CCO Skill Requirements

At a Canadian investment dealer, branch managers are applying the firm’s outside business activity procedure inconsistently. The current document is six pages of dense narrative, uses undefined terms, buries approval requirements inside paragraphs, and gives no clear escalation steps. The CCO wants a rewrite that managers can apply consistently and that Compliance can test. Which action best aligns with sound compliance practice?

• A. Replace the detailed procedure with high-level principles and let each branch create local checklists.
• B. Shorten the document by removing definitions, examples, and documentation instructions to make it easier to read.
• C. Rewrite it in plain language with headings, numbered role-based steps, defined terms, required records, and clear escalation points.
• D. Keep the existing narrative and send a reminder that managers should rely on professional judgment when facts differ.

Best answer: C

What this tests: CCO Skill Requirements

Explanation: Policies are followed consistently when they convert obligations into clear, repeatable actions. In this case, plain-language drafting with visible structure, defined terms, role-based steps, recordkeeping expectations, and escalation points best reduces interpretation gaps and supports supervisory testing.

The core concept is operational clarity. A policy or procedure should not just restate an obligation; it should tell the user what to do, who does it, what evidence must be kept, and when an issue must be escalated. Dense narrative, undefined terms, and buried approval requirements force managers to interpret the process for themselves, which leads to inconsistent application across branches. Rewriting the document in plain language with headings and numbered steps improves usability, training, and monitoring because staff can follow the same sequence and Compliance can test against the same standard. A shorter or more principles-only document may look simpler, but it weakens consistency when the real problem is uneven execution.

• Judgment memo fails because a reminder does not fix unclear wording, hidden steps, or missing escalation triggers.
• Local checklists fail because branch-built processes create avoidable variation in a control that should be applied consistently.
• Over-shortening fails because removing definitions and documentation instructions may improve readability but weaken execution and evidence.

Clear, structured, role-based drafting makes the procedure repeatable, easier to supervise, and easier to evidence during compliance testing.

Question 93

Topic: CCO Skill Requirements

A CCO at a Canadian investment dealer is reviewing a recurring KYC documentation problem in several branches. The same exception has appeared in three consecutive monthly monitoring reports.

Artifact: Excerpt from the CCO’s internal memo

• “Compliance will send another reminder to advisors.”
• “Escalation to branch managers is deferred to avoid friction during the sales campaign.”
• “No business unit owner assigned.”
• “Target completion date: after busy season.”

Based on the excerpt, what is the best supported next action for the CCO?

• A. Have compliance analysts conduct weekly follow-ups with advisors until forms are used.
• B. Close the issue once the reminder has been distributed.
• C. Keep the issue within compliance until the sales campaign ends.
• D. Assign branch management ownership, set deadlines, and require progress reporting.

Best answer: D

What this tests: CCO Skill Requirements

Explanation: The memo shows weak compliance leadership: a recurring issue has no business owner, no timely deadline, and escalation is being avoided to preserve harmony. The CCO should move from reminders to accountable first-line remediation with clear timelines and reporting.

A core leadership task in compliance is turning identified risk into accountable action. Here, the artifact shows three clear problems: the issue is recurring, escalation is being avoided to prevent friction, and no business unit owner has been assigned. In a dealer, compliance should challenge, coordinate, and escalate, but operational remediation should sit with line management.

The best next action is to engage branch management, assign ownership, set a firm timeline, and require status reporting until the control gap is addressed. That approach demonstrates accountability, constructive escalation, and effective influence across the business. It also helps prevent repeated reminders from becoming a substitute for actual remediation.

The closest distractor is the idea of more compliance follow-up, but extra chasing does not fix the leadership and ownership gap.

• Wait until later ignores that the issue is already recurring and lacks a responsible business owner.
• More compliance chasing is active, but it still leaves remediation with compliance instead of branch management.
• Close after a reminder treats communication as resolution even though no accountability or timeline exists.

Recurring exceptions with no line owner, no timeline, and delayed escalation require accountable business ownership and structured follow-up.

Question 94

Topic: Canada Regulation and Dealer Risks

An investment dealer’s written supervision policy requires the branch manager to sign the retail trade blotter each business day. During a review, the CCO finds that for six weeks the branch manager signed only weekly because an alternate reviewer monitored exception reports daily while covering a staffing shortage. No suspicious trading, unresolved exceptions, or client complaints were identified. In this scenario, securities legislation and CIRO requirements are described only as requiring reasonable supervision, not daily sign-off. What is the best compliance response?

• A. Document an internal control deficiency and assess whether supervision remained reasonable.
• B. Report a statutory securities-law breach to the provincial regulator immediately.
• C. Conclude there is no issue because no client harm was found.
• D. Treat weekly sign-off as an automatic CIRO rule breach requiring discipline.

Best answer: A

What this tests: Canada Regulation and Dealer Risks

Explanation: When a firm’s policy is stricter than external requirements, failing the policy does not automatically create a statutory breach. Here, the immediate issue is an internal control weakness, and compliance should then assess whether the principle-based duty of reasonable supervision was still met.

The key distinction is between external legal obligations and the firm’s own controls. The stem says securities legislation and CIRO require reasonable supervision, but it does not say that daily blotter sign-off is externally mandated. That means the missed daily signatures are first an internal control deficiency, because the firm adopted a stricter supervisory process in its policy.

Compliance should document the control break, test whether the alternate daily exception review kept supervision reasonably effective, and correct the backup-coverage process or policy design. Internal escalation may be appropriate under the firm’s governance framework, but immediate regulatory reporting is not supported by these facts alone. The main takeaway is that not every policy failure is automatically a securities-law or CIRO breach.

• Immediate reporting is too aggressive because the facts do not establish a statutory securities-law contravention.
• No issue is wrong because the firm’s own supervisory control was not followed and still requires remediation.
• Automatic CIRO breach skips the necessary analysis of whether supervision remained reasonable despite the policy lapse.

The missed daily sign-off breaches the firm’s own control, so compliance should remediate it and assess the broader supervisory standard rather than presume a statutory breach.

Question 95

Topic: Compliance Role and Structure

Northern Peak Securities, a Canadian investment dealer, is reviewing its draft compliance framework.

Artifact: Draft governance memo

• The CCO reports to the CFO.
• The Head of Retail Sales approves the annual compliance risk assessment and branch review schedule.
• Significant compliance issues are sent to the CFO, who decides which items are reported to the board.
• Business unit heads must remediate compliance findings assigned to them.

Which deficiency is best supported by the artifact?

• A. Annual approval of the review schedule shows weak monitoring.
• B. Business management can improperly control compliance priorities and board escalation.
• C. Compliance should own remediation of business-unit findings.
• D. The memo proves issue tracking records are missing.

Best answer: B

What this tests: Compliance Role and Structure

Explanation: This is a governance-design problem because the artifact gives business management influence over the compliance plan and over what reaches the board. Those are core structural elements of an independent senior-level compliance framework.

A governance-design problem concerns how compliance authority, reporting lines, and escalation are built. An execution or monitoring problem concerns whether reviews are performed, exceptions are tracked, or remediation is followed up.

Here, the main weakness is structural. The Head of Retail Sales approves the compliance risk assessment and branch review schedule, which allows the business line to shape compliance priorities. The CFO also decides which significant issues go to the board, which can dilute the CCO’s ability to escalate material matters directly. That undermines the independence and stature expected of the compliance function in a senior-level framework.

By contrast, having business unit heads remediate findings is generally appropriate first-line ownership. The artifact also does not prove that monitoring is weak or that records are missing.

• Remediation ownership is not the core gap because first-line management normally fixes its own control failures, with compliance providing oversight.
• Annual scheduling does not itself show poor monitoring; the issue is who approves the plan, not that a schedule exists.
• Missing issue log goes beyond the artifact because the excerpt does not say whether issue tracking exists elsewhere.

The artifact shows a structural independence gap because a business head approves the compliance plan and the CFO filters what reaches the board.

Question 96

Topic: Application of Skills

A dealer’s surveillance team sends the CCO the following note. Based on the exhibit, which is the most serious red flag requiring immediate escalation?

Exhibit: Investigation summary

• Monday 2:05 p.m.: Representative Chen was wall-crossed on a confidential takeover of Red Pine Energy and acknowledged receiving material non-public information (MNPI).

• Monday 2:11 p.m.: Chen called the number on file for his spouse.

• Monday 2:19 p.m.: Chen’s spouse’s online account bought 9,000 Red Pine shares; the account had not traded the issuer in 2 years.

• Tuesday 7:00 a.m.: The takeover was announced; the spouse sold that day for a $18,400 profit.

• A. Possible insider trading or tipping through a connected account

• B. Possible frontrunning of a pending client order

• C. Possible suitability failure in a speculative account

• D. Possible market manipulation through repeated trading

Best answer: A

What this tests: Application of Skills

Explanation: Immediate trading in a connected account after access to MNPI is the clearest criminal-trading red flag here. The call to the spouse, the lack of prior trading in the issuer, and the quick profit after public announcement all support urgent escalation as a potential insider-trading or tipping matter.

The core issue is potential insider trading or tipping. Chen was wall-crossed on a confidential takeover, meaning he had access to MNPI. Minutes later he contacted his spouse, and the spouse’s account, which had no recent history in the issuer, bought shares before the public announcement and then sold for a gain after the news became public. That sequence is the strongest red flag because it links confidential information, timing, and a connected account.

In a trading-offence review, the CCO should give greatest weight to facts suggesting misuse of MNPI or tipping, especially where trading occurs through a related person soon after the insider receives the information. The profit strengthens suspicion, but the key concern is the pattern of conduct, not the dollar amount alone. The closest distractor is unauthorized or unsuitable activity, but those concerns are not as directly supported or as serious on these facts.

• Frontrunning fails because the exhibit mentions no client order that was traded ahead of.
• Market manipulation is not supported by one pre-announcement purchase and one later sale without evidence of price-influencing conduct.
• Suitability is speculative because the exhibit gives no KYC, objective, or concentration facts, while the MNPI sequence is much more serious.

The timing of the spouse’s trade immediately after Chen received MNPI is the strongest indicator of potential insider trading or tipping.

Question 97

Topic: Regulatory Investigations and Reporting

A dealer’s CCO opens an internal investigation after a whistleblower alleges that a branch manager used personal email with clients and altered KYC forms. The firm has already issued a document-preservation notice and removed the manager from supervisory duties. The next day, CIRO requests records and asks the firm to name a contact for interviews. The CEO suggests waiting until the firm’s review is finished before responding. What is the single best compliance action?

• A. Finish the internal review first and send CIRO only the firm’s conclusions.
• B. Suspend the internal review until CIRO finishes, so only one investigation controls the facts.
• C. Continue the internal review, preserve evidence, and respond promptly to CIRO as a separate external investigation.
• D. Let the branch manager collect records and coordinate the response because it is a branch matter.

Best answer: C

What this tests: Regulatory Investigations and Reporting

Explanation: The firm should continue its own fact-finding and remediation while treating CIRO’s request as a separate external investigation that must be answered promptly. An internal investigation helps the dealer assess misconduct and control failures; an external investigation is led by the regulator and cannot be deferred until the firm’s review is complete.

An internal investigation is initiated by the firm to establish facts, contain risk, assess policy or supervisory failures, and decide on remediation or discipline. An external investigation is conducted by a regulator or other authority under its own mandate, scope, and information demands. Once CIRO has requested records and interview coordination, the dealer should not wait for its internal review to finish or substitute a summary for the material requested. The sound compliance response is to preserve evidence, continue the internal review in a controlled way, designate an appropriate firm contact, and respond to the regulator directly and promptly.

• Preserve and collect relevant records.
• Keep the firm’s review and the regulator’s inquiry clearly documented.
• Avoid any action that could delay or compromise the external process.

The closest distractor is sending only the firm’s conclusions, but that confuses a firm-led review with a regulator-led investigation.

• Pause everything fails because the firm still needs to investigate, contain risk, and preserve evidence while CIRO proceeds.
• Send only conclusions fails because CIRO may require underlying records, not just the firm’s summary.
• Use the subject manager fails because the person under review should not control evidence gathering or regulator communications.

Internal investigations are firm-led for fact-finding and remediation, while CIRO’s request starts a separate external investigation that requires a timely response.

Question 98

Topic: Compliance Role and Structure

A Canadian investment dealer has grown through acquisition. Supervisors in retail, institutional, and operations now escalate issues inconsistently, and the board wants clearer visibility into the compliance function. The CCO proposes a formal compliance governance document. Which action best reflects the purpose of that document?

• A. Define compliance authority, independence, reporting lines, and escalation paths.
• B. Compile all open alerts, complaints, and investigations.
• C. Record annual training completion and staff attestations.
• D. Describe detailed surveillance tests for each business line.

Best answer: A

What this tests: Compliance Role and Structure

Explanation: A compliance governance document exists to formalize how the compliance function is positioned and how it interacts with line management, senior management, and the board. In this scenario, the firm needs role clarity, independence, and escalation discipline, not a testing script or a file of current cases.

The core purpose of a compliance governance document is to describe the compliance function’s mandate within the firm: its authority, independence, responsibilities, reporting relationships, and escalation routes. In a Canadian dealer, it helps clarify what line supervisors own, what compliance monitors and challenges, when issues must be elevated, and how senior management and the board receive oversight information. That makes it a governance framework, not an operating record. Detailed surveillance tests belong in procedures or monitoring programs, while issue inventories and training logs are supporting records. When escalation is inconsistent and board visibility is weak, documenting mandate and reporting architecture is the most appropriate response.

• Testing detail belongs in procedures or a monitoring program, not in the document that sets governance roles.
• Issue inventory is a snapshot of current matters, not the framework for how compliance is governed.
• Training evidence supports supervision and recordkeeping, but it does not define the compliance function’s mandate.

A governance document should formalize the compliance function’s mandate, independence, reporting relationships, and escalation routes across the firm.

Question 99

Topic: Application of Skills

A Canadian dealer is adding representatives in several provinces. The CCO wants one process for submitting registration information, tracking registration status, and maintaining good records without confusing registration administration with broader supervision. Which action best aligns with the high-level role of the National Registration Database?

• A. Use NRD as the central log for complaints and investigations.
• B. Use NRD instead of internal proficiency reviews and supervision records.
• C. Use internal HR files for changes; use NRD only if asked.
• D. Use NRD for registration filings and status tracking; keep support internally.

Best answer: D

What this tests: Application of Skills

Explanation: NRD is the Canadian electronic system for registration filings and registration status information. A prudent dealer uses it for applications and updates, while keeping its own supporting documents and supervision records.

The core concept is that NRD is a registration infrastructure tool, not a complete compliance system. In this scenario, the dealer should use NRD to submit registration applications and amendments and to monitor current registration status across jurisdictions. That supports consistent, regulator-facing registration recordkeeping. However, NRD does not replace the firm’s own duties to assess proficiency, supervise conduct, investigate complaints, or retain documentary support for what was filed. Good compliance practice is to treat NRD as the official electronic channel for registration information while maintaining internal records that substantiate filings and support oversight. The closest distractors fail because they either overstate NRD’s role or reduce it to a passive reference system.

• Too broad: The option treating NRD as a complaints and investigations log confuses registration administration with broader compliance case management.
• Wrong reliance: The option replacing internal proficiency reviews and supervision records ignores the firm’s independent supervisory responsibilities.
• Reactive approach: The option using NRD only when requested misses its routine role in filing and updating registration information.

NRD is the electronic system for registration submissions and status information, while the firm must still retain supporting records and supervisory evidence.

Question 100

Topic: Regulatory Investigations and Reporting

At a Canadian investment dealer, compliance is investigating repeated manual overrides of client risk ratings at one branch. The review involves 12 senior client accounts, the branch had a similar finding last quarter, and remediation deadlines are already overdue. The quarterly board package describes the matter only as “branch training completed” and does not mention the repeat nature, the unfinished review, or possible unsuitable trades. Which reporting deficiency is most significant?

• A. Not naming the affected registered representatives in the board package
• B. Not attaching the account files and surveillance records
• C. Not comparing the branch to all other branches
• D. Not clearly escalating a recurring material issue with unresolved client impact

Best answer: D

What this tests: Regulatory Investigations and Reporting

Explanation: The most serious deficiency is that the board report understates a live, repeat compliance problem with possible client harm. By reducing the issue to completed training, the report prevents the board from properly overseeing an unresolved and potentially material matter.

Board reporting should give directors a fair, clear view of significant compliance issues so they can exercise effective oversight. Here, the issue is recurring, affects senior client accounts, may involve unsuitable trades, and has overdue remediation. Reporting it only as completed training omits the facts the board needs most: that the problem repeated, the investigation is not finished, client impact is still being assessed, and corrective action is already behind schedule.

For a matter like this, the board should receive a concise summary of:

• the nature and severity of the issue
• whether it is a repeat finding
• current client impact and investigation status
• remediation ownership, timing, and overdue items

Providing less detail may make the issue appear closed when it is not. That is a more serious governance weakness than missing names, source documents, or peer comparisons.

• Names are secondary because the core problem is the board was not told the issue was material, recurring, and unresolved.
• Raw files are unnecessary because directors need an accurate escalation summary, not every underlying record.
• Benchmarking is helpful but not decisive because comparing branches does not fix the understatement of a live risk issue.

The board needs complete, decision-useful reporting on significant repeat issues, especially where client harm and remediation remain unresolved.

Continue with full practice

Use the CSI CCO Practice Test page for the full Securities Prep route, mixed-topic practice, timed mock exams, explanations, and web/mobile app access.

Focused topic pages

• CSI CCO: Compliance Role and Structure
• CSI CCO: Canada Regulation and Dealer Risks
• CSI CCO: CCO Skill Requirements
• CSI CCO: Application of Skills
• CSI CCO: Regulatory Investigations and Reporting

Free review resource

Read the CSI CCO guide on SecuritiesMastery.com for concept review, then return here for Securities Prep practice.