A delegated regulator only gets to borrow public trust for so long before it must earn it again. That is why words like “independent” matter. They are not branding. They are the premise on which delegated authority rests.
On Feb. 19, the Canadian Investment Regulatory Organization (CIRO) opened a request for comments on amendments to section 5.4 of its bylaw No. 1. Directors serve two-year terms. CIRO proposes extending independent directors’ consecutive term limits from four terms to five (10 years) and, in effect, permitting an independent director serving as chair to remain for up to six consecutive terms (12 years) in the circumstances described in the proposal. Comments are due by March 23.
The stated rationale is boilerplate language: alignment with “governance best practices” and “leadership continuity.”
That rationale may sound benign in an ordinary corporate setting. CIRO is not an ordinary corporate setting.
It is a self-regulatory organization recognized by provincial regulators and exercising delegated authority over investment dealers and their registered representatives. In that context, “independent” is not a casual descriptor. It is a credibility claim that underwrites the model.
Term limits are not a referendum on anyone’s integrity. They exist because governance drifts. The longer directors sit inside an organization, the more the organization becomes their reference point. Relationships deepen. Information channels become routine. Challenge becomes harder — not because people become corrupt, but because proximity becomes normal.
In a shareholder-accountable corporation, that drift can mean softer oversight. In a delegated regulator, it can mean something more damaging: the public starts to see “independent” as a label rather than a real constraint.
CIRO will point out that directors face renewal every two years, and that is true. But renewals test contribution inside the existing culture. Term limits are meant to preserve distance from the culture. They serve different purposes.
This proposal asks the public to accept that a decade — potentially 12 years for a chair — is still consistent with independence in the sense that matters: independence that can be believed from the outside.
CIRO also says its proposal sits within an “accepted range,” based on a comparative review of Canadian and international bodies. That is a conclusion, not an argument. Which bodies? Which mandates? Which appointment processes? Which definition of independence? If “best practices” is doing the work here, CIRO should show what it relied on and why those comparators fit a self-regulatory organization exercising delegated authority.
Take a chair
Alongside the proposed bylaw change, CIRO has said its board intends to adopt a five-year term limit for the chair role. Fine, but that does not resolve what this proposal is really asking the public to accept. Even with a five-year chair cap, CIRO is still proposing a framework in which an independent director serving as chair can remain on the board for up to 12 consecutive years in the circumstances described.
Twelve years is a long time for anyone who is supposed to be independent of the organization they oversee. It is long enough for the label to begin to outlive the reality — even if the director remains conscientious. That is not a personal attack. It is a governance fact.
CIRO does not need hypotheticals. In August 2025, it identified a cybersecurity incident — and later confirmed that some investor information and registration information was impacted, and that a limited set of information was copied from its systems. That is the point continuity advocates miss: low-frequency, high-impact risk is exactly where complacent governance shows up. Boards that default to “more continuity” tend to treat yesterday’s controls as good enough — until the day they are not.
CIRO can extend term limits, but it cannot extend credibility by declaration. If “independent” begins to look like long service by another name, CIRO’s legitimacy will erode — quietly at first, and then suddenly when the next stress event hits.