When a meeting updates KYC information or leads to a recommendation, Canadian securities rules and CIRO guidance expect the file to show what you learned about the client, what you recommended and on what basis, and what the client decided. Regulators also expect evidence that a reasonable range of alternatives was considered, at the firm level or in your note.

A defensible meeting record is one a reviewer can read years later and rebuild the conversation from. "No changes" on its own doesn't qualify.

The last line isn't my opinion. CSA and CIRO staff wrote it in a staff notice in December 2025, and much of this guide relies on what they wrote. Every link in this guide was checked on 30 October 2026.

Who do CIRO's documentation rules apply to?

CIRO, the Canadian Investment Regulatory Organization, is the self-regulatory organization that oversees investment dealers and mutual fund dealers and the advisors who work for them. In Québec, CIRO took over the supervision of mutual fund dealer representatives on 4 July 2026.

Every registered firm in Canada is also subject to National Instrument 31-103 (OSC consolidation to 13 September 2023), the national rule on registrant obligations. For CIRO members, some of its sections, including suitability, are replaced by CIRO's own rules. Its record-keeping sections apply to everyone, and CIRO's rules add their own.

If you only sell insurance, CIRO doesn't regulate you. Your provincial insurance regulator (the AMF in Québec) sets your documentation rules, and the insurers and MGA you place business through may add their own requirements. If you hold both licences, the checklist below applies to the investment side of the same meeting.

Some of the guidance quoted below, MFDA Staff Notices MSN-0069 and MSN-0035, was written for mutual fund dealers. At an investment dealer, the same duties sit in CIRO's Investment Dealer and Partially Consolidated Rules (KYC, Rule 3200; suitability, Rule 3400), with guidance in IIROC Guidance Note GN-3400-21-004. Check your dealer's policy for the exact wording.

One more thing before the list. I'm not a lawyer or your compliance officer. This guide tells you what the rules ask for, what regulators found when they checked, and what I'd add as good practice. I label which is which. Your dealer's policies may be stricter than what's here. Follow them.

What does CIRO expect advisors to document after a client meeting?

Rules and guidance point to six things to record when a meeting updates KYC or leads to a recommendation: what you learned or confirmed about the client, any significant change, what you recommended and on what basis, the alternatives considered, what the client decided, and any instructions and how they were given. Some are firm-level duties your dealer may document centrally. The list below says where each comes from.

As good practice, write it while the meeting is fresh, date it, and keep it where your firm keeps client records.

Three terms run through all of it. KYC, short for know your client, is the information you must collect about each client, including identity, personal and financial circumstances, investment needs and objectives, investment knowledge, risk profile and investment time horizon (NI 31-103, s. 13.2). KYP means know your product. Suitability means that, on a reasonable basis, an investment action fits the client's KYC, your understanding of the product, its impact on the account, its costs and the alternatives available, and puts the client's interest first (NI 31-103, s. 13.3, and CIRO's matching rules).

1. What you learned about the client, or proof that you checked. KYC isn't a form you fill once. CIRO's guidance for mutual fund dealers (MSN-0069) says to "collect, review and refresh a client's KYC information after a meaningful and documented interaction with the client". If nothing changed, write what you asked and what the client said. Record how the risk profile was set: CIRO's September 2026 bulletin on KYC asks dealers to document how risk tolerance and risk capacity were assessed and how the overall profile was determined. Under NI 31-103, you must also take reasonable steps to have the client confirm the accuracy of their KYC information within a reasonable time (s. 13.2(3.1)), and to obtain the name of a trusted contact person and the client's written consent to contact them (s. 13.2.01).

2. Any significant change. A job loss, a long illness, the death of a spouse, a big change in income or net worth (examples from MSN-0069). Update the client's KYC within a reasonable time, and review the account's suitability when the change could make it unsuitable (NI 31-103, ss. 13.2(4) and 13.3(2), and CIRO's matching rules).

3. What you recommended, and on what basis. Your firm's records, including your note, have to show the reasonable basis for the recommendation: how it fits the client's KYC (goals, time horizon, risk profile) and the other suitability factors, including costs. CSA and CIRO staff say this documentation can come from firm and individual processes together, as long as it's detailed enough to show a meaningful suitability determination.

4. The alternatives you considered. Suitability includes considering a reasonable range of alternatives available through your firm. Regulators found the documentation missing at many firms (more on that below). Your firm may document this centrally. When you choose among suitable options yourself, staff guidance says to consider lower-cost alternatives available through the firm and document the basis for your choice.

5. What the client decided, especially a "no". CIRO's guidance for mutual fund dealers recommends keeping a summary of your discussions, including recommendations the client didn't act on (MSN-0035), and says advice should be properly recorded "particularly if the client declines to follow the recommendation" (MSN-0069). If a client asks for a trade you consider unsuitable, the rules require more: tell the client why, recommend a suitable alternative, and get a recorded confirmation of their instruction before you proceed (NI 31-103, s. 13.3(2.1), and CIRO's matching rules).

6. Instructions and how they were given. Every firm needs an audit trail of client instructions (NI 31-103, s. 11.5). For mutual fund dealers, CIRO's guidance adds that unrecorded verbal instructions need a detailed record of what was asked and how it was given, by phone or in person, plus a way to verify the client's identity.

I'd add a seventh, which is good practice more than a named rule: every commitment made in the meeting, on both sides, with a date. A commitment that lives only in your head isn't part of anyone's file. I covered that handoff in how an advisor and assistant stop losing commitments.

Why isn't "no changes" enough?

Because it doesn't prove a conversation happened.

In December 2025, CSA and CIRO staff published joint Staff Notice 31-368, the results of a review of 105 registered firms on KYC, KYP and suitability. Their wording on KYC updates is blunt: a note stating only "no update" or "no changes" in the client file "is insufficient without other evidence that a meaningful interaction took place". They say the same about suitability reassessments: "generic notes like 'no changes' are insufficient".

The rules also set a minimum review rhythm (NI 31-103, s. 13.2(4.1), and CIRO's matching rules). The suitability-related KYC must be reviewed at least every 12 months for managed accounts and at least every 36 months in other cases, or sooner if you learn the client's circumstances have significantly changed. Exempt market dealers, which CIRO doesn't regulate, have their own 12-month rule. Each periodic review also calls for a suitability reassessment, and many firms failed to document those properly.

Alternatives were a problem too. Many firms had no written process for considering a reasonable range of alternatives. In many cases, firms and advisors couldn't show evidence that alternatives were considered at the time of the decision. Some firms said their advisors did the analysis, but nothing was written down. In a review, work you can't show is hard to defend.

The notice does accept doing and documenting this through a centralized or periodic firm process, as long as that analysis is what your recommendation relies on.

Why do meeting notes matter so much?

Because when an advisor and a client remember a meeting differently, the notes can decide who's believed.

In October 2024, Torys LLP wrote up a CIRO hearing that shows it: Re White, 2024 CIRO 67. CIRO Enforcement alleged an advisor failed to make sure his recommendations were suitable for three clients. The advisor and his clients told very different stories. The panel relied on his notes as a credible record for one client and found the allegation about her wasn't proven. He had admitted that some investments recommended to two other clients were unsuitable, and the panel found a breach on those. His handwritten notes had stayed in the dealer's custody until it produced them to CIRO, so, the panel noted, he had no opportunity to change them. The case was decided under IIROC's former Dealer Member Rule 1300.1(q), not today's rules.

Torys makes the point that matters for every advisor: you speak with many clients a week, and a client speaks with you only occasionally, so a panel may find the client's memory of one conversation more convincing than yours. Your notes are what carries your side.

A full record cuts both ways, though. One advisor I spoke with recently put it plainly: a complete record helps in a compliance review, and it can also expose problems. That's not a reason to write less. It's a reason to write it well.

How long do you have to keep client meeting notes in Canada?

Seven years. Under NI 31-103 (section 11.6), a registered firm must keep its required records for 7 years from the date each record is created, and that includes CIRO dealers. A meeting note is covered when it's one of those records: KYC, the basis for a recommendation, client instructions. Records have to be kept in a safe location and a durable form, and the firm must be able to produce them for the regulator in a reasonable time (in Ontario, the Securities Act sets that timing). CIRO's mutual fund dealer rules set the same seven years for client instructions (Rule 5.6, as MSN-0035 explains).

Write it promptly anyway: a note written a week later is weaker evidence of what was said.

The firm keeps the official record, but much of it starts with you. If your notes sit in a personal notebook or an app your dealer can't reach, they may not count as the firm's record at all. Ask your compliance team where meeting notes have to live.

What makes a meeting record defensible?

As good practice, a defensible record is dated, written at the time, specific to this client, protected from later edits, and easy to find. Here's the difference in practice:

The examples are illustrative, not a template. Your dealer may require its own wording.

The record also needs to resist edits. CIRO's guidance for mutual fund dealers on client instructions (MFDA Staff Notice MSN-0035) says records kept on electronic or other devices need "appropriate internal controls in place to guard against the risk of falsification". Torys says the same in plain terms: notes that can't be changed after the fact help answer any claim that they were altered or back-dated. A system that locks approved notes, or logs every later change, is built for this. A Word file on your desktop isn't. Your dealer decides what qualifies.

What's yours and what's your firm's in KYP?

Know your product is split between you and your firm. Under NI 31-103 (section 13.2.1), the firm assesses and approves a security before it makes it available to clients, then monitors it. You can only recommend, or buy for a client, securities your firm has approved. And you have to understand each one you recommend or trade for a client: its structure, features, risks, initial and ongoing costs, and the impact of those costs.

After a meeting, your part of KYP shows up in the recommendation itself: why you chose this product among the suitable alternatives, including its costs. The firm's product due diligence doesn't belong in your meeting note. Your reasoning does.

How can advisors automate KYP and KYC documentation after meetings?

Advisors automate KYP and KYC documentation by letting software write the first draft from the meeting, and keeping their own review as the step that makes it a record.

Two things software can't do for you. You stay responsible for the KYC, and you still have to take reasonable steps to have the client confirm their KYC information within a reasonable time. Staff guidance also says changes like an address or banking details should be formally documented with the client's written verification, or other appropriate verification.

A CRM is a filing cabinet you have to fill. An Un-CRM fills itself, then does the work that comes after: the client record stays current from your conversations, and the documents are drafted for you to approve. The trade-off: your client files have to move over, so ask what that involves and who does it.

Practices tend to document meetings one of three ways:

None of the three writes your judgment for you. A template has to ask for the alternatives and the client's decision, or no tool will capture them.

A simple setup works with any of them:

1. Build your template from your dealer's checklist. One heading per item above: KYC check (including risk profile), significant changes, recommendation and basis, alternatives, client decision, instructions, commitments.

2. Capture the meeting, with consent, and review the draft the same day. Recording a client meeting generally requires the client's meaningful consent under Canadian privacy law, and your dealer may require a specific consent process. The compliance guide to AI note takers covers consent, privacy law (PIPEDA) and data residency. Fix what the draft got wrong while you still remember the meeting.

3. Send the approved note to the client file, dated. KYC changes go to the profile and to the client to confirm, commitments get an owner and a date, and the record keeps its edit history. Ask your compliance team whether the recording itself must be kept, and for how long.

What should a tool for audit-ready meeting notes do?

A tool for audit-ready meeting notes should produce a record your dealer can stand behind, not just a summary. Whatever you're looking at, check six things:

• Consent. It supports the client's consent before anything is recorded.

• Your checklist. It drafts from a template you control, built on your dealer's checklist, including alternatives and the client's decision.

• You approve. Nothing becomes the record until the advisor reviews it.

• Edit history. Every change after approval is dated and visible.

• Hosting and training. You know where client data is stored, ideally in Canada, and your dealer is comfortable with it. Ask whether it's ever used to train AI models.

• Export. You can take every record out, in full, if you leave.

If a tool can't show you all six, treat what it produces as a draft, not your record. Ask for each one in writing before you buy.

Automating meeting notes without creating compliance risk goes deeper on the privacy side of that list.

How do you make sure your team actually logs client interactions for auditors?

Make the record a by-product of the meeting, then check it on a schedule. CIRO's guidance for mutual fund dealers suggests that branch managers reviewing trades also check, on a sample basis, whether an advisor "has maintained adequate notes and instructions". A reviewer may only read a sample, and you won't know which notes. So it's safest to keep every note complete.

Logging is easy to skip when it means retyping what was just said. When the note is drafted from the meeting and the advisor only has to review it, that step is already done.

Three habits help every team, whatever the software:

• One place for every client interaction. Calls, meetings and emails that change the plan belong on the same client file. Notes split between an inbox, a CRM and a notebook make it hard to show an auditor the full story.

• A weekly check of unreviewed notes. Someone owns the list of meetings without an approved note, and it's empty by Friday.

• A quarterly spot check. One simple way to do it: pick three meetings at random per advisor and read each note against the checklist above. If something is missing every time, fix the template, not the person.

This is one reason advisors resent their CRM: a system built to record your work, never to do it. Documentation is where that hurts most, because it's what a regulator asks to see.

Write down what you learned, what you recommended, what else you considered and what the client decided. That's what the rules and CIRO's guidance point to. Do it while the meeting is fresh, and it becomes strong evidence if a client remembers things differently.