CIRO fines PFSL $250,000 over electronic-signature and supervision failures

PFSL Investments Canada Ltd. has been fined $250,000 after admitting that weak electronic-signature controls, inadequate review of unusual transactions and deficient power-of-attorney policies failed to protect a vulnerable client.

In Re PFSL Investments Canada Ltd., 2026 CIRO 14, the Canadian Investment Regulatory Organization’s Ontario District hearing panel also approved $15,000 in costs and a requirement to comply with the relevant rules in future. The settlement was accepted March 26, 2026; the published reasons are dated May 11.

The client’s accounts were ultimately restored, with PFSL contributing $245,022 beyond funds recovered from the representatives involved. The panel nevertheless found that making the client whole did not erase the investor harm, breach of trust or damage to confidence in the securities industry.

Electronic signatures without effective identity checks

PFSL had adopted DocuSign for collecting client signatures in 2018. Its representatives entered a client’s email address, and the recipient could sign electronically. The system recorded information including the email and internet addresses used, as well as when documents were sent, viewed and signed.

In March 2023, nine redemption forms were signed in the client’s name using an email address different from the one PFSL held on file. In one instance, the internet address was associated with a city different from the client’s recorded home location. The dealer’s controls did not detect those issues.

PFSL requested signature guarantees from the representative handling the redemptions but did not establish that the client had actually authorized them. The panel criticized the dealer’s implementation of electronic signing, which allowed a name to be typed or a signature drawn without an effective check against the signature already on file.

Counsel for PFSL argued that guidance issued during the pandemic was not prescriptive and that the dealer had controls but was dealing with isolated misconduct by a rogue adviser. The panel rejected those arguments. The relevant guidance preceded the transactions by three years, and dealers remained responsible for evaluating technological risks and maintaining adequate controls.

An additional measure introduced in 2024 required the last four digits of the client’s social insurance number. The panel found that measure ineffective in the circumstances because representatives already had access to those numbers and the dealer’s procedures required them to communicate the digits to clients when sending documents. The criticism concerned PFSL’s implementation and supervision, not a ruling that electronic signatures themselves were invalid.

Large withdrawals and new deposits demanded questions

The nine redemptions totalled $987,562.04 and represented substantially all the elderly client’s investments with PFSL. Each called for the funds to be redeemed and the account closed. The proceeds initially went to the client’s bank account on file.

About two weeks later, the representative who serviced the client and another PFSL representative opened new accounts and deposited a combined $800,000. They described the source as personal savings, although their earlier investments with the dealer were much smaller. The required form for money sourced from a third party was not completed.

PFSL was responsible for both levels of supervisory review because the servicing representative was a branch manager, and seven of the nine redemptions exceeded the applicable review thresholds. The dealer did not contact the client directly to confirm the instructions or adequately ask why the accounts were being closed. It also failed to investigate the source of the representatives’ new deposits.

After a complaint, PFSL investigated and discovered that the representatives had exploited the weaknesses in its controls. The panel found that those failures had allowed the client’s money to be misappropriated. It emphasized that supervisors cannot resolve concerns simply by accepting assurances from the people they supervise.

Appointment policies and remedial commitments

A separate admitted breach concerned policies in place between at least 2019 and 2025. PFSL allowed representatives to accept appointments as a client’s attorney or executor without notifying the dealer until the appointment became active. The applicable rule generally prohibited accepting those appointments, subject to narrow exceptions involving related persons, notice and prior written dealer approval.

One of the representatives had been named as the client’s attorney and executor but had not reported the appointments. The reasons state there was no evidence that the representative carried out transactions as the client’s attorney. The breach was not a finding that the redemptions had been made using that authority.

The panel credited PFSL for investigating, reporting the suspected misconduct, cooperating with CIRO, terminating the representatives and surveying clients to identify other possible concerns. PFSL restored the affected accounts as though the redemptions had not occurred and revised its compliance manual on attorney, executor and trustee appointments.

PFSL also committed to an ongoing exception-review process and sample checks of electronic signatures, or other enhancements reasonably addressing the identified risks. The agreement requires it to report those control enhancements to CIRO by February 1, 2027. The decision records that commitment; it does not establish that the reporting requirement has already been fulfilled.

The panel reviewed the negotiated sanctions against a reasonable range of appropriateness, rather than substituting its own preferred penalty. It considered the assistance of counsel and a mediator, the admissions and saved hearing costs, but gave little weight to PFSL’s lack of previous disciplinary proceedings because of the seriousness of the failures.

The $250,000 fine and $15,000 costs are separate from the money PFSL contributed to restore the client’s accounts. The settlement permits further proceedings if its terms are breached. CIRO’s case page records the corporate proceeding as concluded; a focused later-status check identified no subsequent change, but neither that status nor the reasons establishes payment of the sanctions or completion of all remedial work.