The cost of self-regulation is expected to jump by 10% in the current fiscal year, led by rising investments in cybersecurity, according to the Canadian Investment Regulatory Organization’s (CIRO) latest annual report.
The industry SRO is projecting operating expenses of $188.2 million in fiscal 2027, a 10% increase from its budget for fiscal 2026, which was itself up 10% from the previous year.
The largest source of the increase is projected to be increased cybersecurity spending, which comes in the wake of the major cyber breach the SRO suffered in August 2025, exposing the personal and financial information of industry firms and investors.
The SRO reported that almost half of the projected increase in expenses (4.7%) will come from spending on its “multi-year cyber security resilience program.”
CIRO said that these investments will be financed from its existing reserves, and not through its member fees, with most of the costs coming from its unrestricted fund reserves.
Another chunk of the increased spending (1.8%) is also associated with the costs of the breach, with “higher planned spend on strategic initiatives and necessary cyber security incident response costs” — that will also be funded out of the SRO’s existing reserves, it said.
According to the report, total revenues in the SRO’s unrestricted fund are projected to come in at $174.9 million for fiscal 2027 — resulting in an expected deficit of $13.3 million for the year.
“The deficit reflects the strategic use of reserves to offset fee impacts associated with several key initiatives, including the cyber security incident response and resilience program, the Vancouver office relocation, credentialing start-up costs, and the proficiency program shortfall,” the report said.
In fiscal 2026, the unrestricted fund also recorded an operating deficit of $1.45 million, down from a $7.3 million surplus in fiscal 2025. CIRO said that a deficit was planned for fiscal 2026, due to its expanded responsibilities, but that the cyber breach added incremental costs too.
Alongside the stepped up spending on cybersecurity, costs are also rising due to CIRO’s expanded responsibilities for registration, and new duties in Quebec; along with rising technology costs and amortization expenses.
Against that backdrop, fees on CIRO members are also projected to rise by 6.3% for fiscal 2027 to $148.6 million, driven by the regulator’s expanded duties.
Indeed, the SRO said that fees to recover the costs of its newly delegated responsibility for registration, and its expanded duties in Quebec, will drive a 7% increase in member fees that’s partly offset by a 1% reduction in “business-as-usual” fees — stemming from “staffing efficiencies achieved in [fiscal] 2026, lower project operating costs, higher interest and investment income and timely disclosure fees.”
The report also revealed that the direct cost of specifically responding to the cyber breach was $4.2 million (as of March 31, 2026, its fiscal year end) net of insurance coverage.
Additionally, the SRO is defending class action lawsuits that have been filed in Quebec and British Columbia over the breach — but the report indicated that it hasn’t recorded a liability for these legal actions based on the expectation that “a resolution will not result in incremental financial exposure beyond existing insurance coverage,” it said.