The statutes, rules and standards we help you meet
One page, for independent insurance, mortgage and investment professionals. It lists the laws that apply, the regulators' own rules and guidance we follow, and the ISO standards our safeguards and procedures are mapped to, with how each of our services supports them.
IPMahir and CapabilityNext support, evidence and train for compliance with these instruments. We do not certify, audit as a regulator, give legal advice or guarantee compliance. Which instruments apply depends on your licence, products and employer, so confirm with your agency or dealer compliance contact and your advocate.
Which statutes usually apply to you
| Statute | Insurance | Mortgage | Investments |
|---|---|---|---|
| Personal Information Protection Act | ● | ● | ● |
| Personal Information Protection and Electronic Documents Act | ○ | ○ | ○ |
| Proceeds of Crime | ● | ● | ● |
| Canada's Anti-Spam Legislation | ● | ● | ● |
| Financial Institutions Act | ● | – | – |
| Mortgage Brokers Act | – | ● | – |
| Securities Act | – | – | ● |
● usually applies · ○ applies in some situations · – not usually. Confirm with your agency or dealer compliance contact.
Statutes
Personal Information Protection Act (British Columbia)
SBC 2003, c. 63What it asks of you. The organisation is responsible for personal information under its control, names a person responsible, collects and uses information only with consent and for stated purposes, makes reasonable security arrangements, gives people access to and correction of their information, and keeps and disposes of it properly.
How we support it. Privacy training for you and your helpers; technical safeguards and an evidence file; access-request and wrong-recipient procedures; vendor due-diligence file; client consent wording.
Privacy trainingTechnical safeguardsProcedures (SOPs)
Personal Information Protection and Electronic Documents Act (PIPEDA)
SC 2000, c. 5What it asks of you. Applies to federal works and where personal information crosses provincial or national borders in commercial activity. Breaches of security safeguards that create a real risk of significant harm must be reported to the Privacy Commissioner and notified to individuals, and every breach must be recorded.
How we support it. Breach plan and notification decision tree; incident log; breach procedures SOP-01 to SOP-15.
Procedures (SOPs)Technical safeguards
Proceeds of Crime (Money Laundering) and Terrorist Financing Act and its regulations
SC 2000, c. 17What it asks of you. Reporting entities, including life insurance agents and brokers, securities dealers and, since 11 October 2024, mortgage services, must run a compliance programme, identify clients, keep records, treat politically exposed persons with extra care and report suspicious and large cash transactions.
How we support it. Anti-money-laundering procedures SOP-16 to SOP-22; protected identity-records store and retrieval test; compliance-programme templates; training. The compliance officer role and every reporting decision stay with you or your agency.
Anti-money-laundering supportProcedures (SOPs)Technical safeguards
Canada's Anti-Spam Legislation (CASL)
SC 2010, c. 23What it asks of you. Commercial electronic messages need the recipient's consent, a clear sender identification and a working way to unsubscribe.
How we support it. Consent records and opt-outs built into the connected assistant; outreach drafted for your approval before it is sent.
Connected AI assistant
Financial Institutions Act (British Columbia), insurance licensing
RSBC 1996, c. 141What it asks of you. Sets the licensing framework for insurance agents and agencies, administered by the Insurance Council of British Columbia, with conduct and record-keeping expectations.
How we support it. Client-file, privacy and cyber safeguards that support the Council's expectations on confidentiality; training record; evidence file.
Privacy trainingTechnical safeguards
Mortgage Brokers Act (British Columbia)
RSBC 1996, c. 313What it asks of you. Sets the registration and conduct framework for mortgage brokers, with oversight by the BC Financial Services Authority, including record keeping and safeguarding client information.
How we support it. Protected mortgage-file records, access reviews, closed-file clean-up and backups with an evidence file.
Technical safeguardsProcedures (SOPs)
Securities Act (British Columbia) and the rules of the Canadian Investment Regulatory Organization
RSBC 1996, c. 418What it asks of you. Registrants and dealing representatives must know their client, keep records and supervise; the dealer's rules add specific record, privacy and cyber expectations.
How we support it. Secure exchange for know-your-client forms, call-back routine for instructions, protected records and a dealer-ready evidence file.
Technical safeguardsPrivacy training
Regulators' rules and guidance
Insurance Council of British Columbia: rules and guidelines
What it asks of you. Licensee duty to protect client confidentiality and privacy, and the Council's guidance on cybersecurity readiness, including when using generative AI.
How we support it. Safeguards, training and an AI use rule that match the Council's published expectations.
Privacy trainingTechnical safeguardsConnected AI assistant
BC Financial Services Authority: mortgage broker rules and guidance
What it asks of you. Registration, conduct and record-keeping expectations for mortgage brokers in British Columbia.
How we support it. Protected files, retention schedule and evidence file for mortgage practices.
Technical safeguardsProcedures (SOPs)
Canadian Investment Regulatory Organization (CIRO): dealer and rep rules
What it asks of you. Dealer-level rules on records, supervision, privacy and cybersecurity that apply to registered representatives.
How we support it. Evidence file and procedures you can show your dealer on request.
Technical safeguardsProcedures (SOPs)
FINTRAC guidance for reporting entities
What it asks of you. How to build a compliance programme, identify clients, keep records and report suspicious, large cash and terrorist property transactions.
How we support it. SOP-16 to SOP-22, reporting calendar, red-flag cards and a protected records store.
Anti-money-laundering supportProcedures (SOPs)
BC Information and Privacy Commissioner: guidance
What it asks of you. Practical guidance on protecting personal information away from the office, on breach notification, and on new technology such as AI.
How we support it. Home and device safeguards, breach procedures, AI use rule.
Technical safeguardsProcedures (SOPs)Connected AI assistant
Joint principles for responsible generative AI from Canada's privacy regulators
What it asks of you. How existing privacy law applies when personal information is used with generative AI: lawful basis, openness, safeguards and accuracy.
How we support it. Approved assistant, no client details in public AI tools, human check on anything sent to a client, consent wording.
Connected AI assistantPrivacy training
Canadian Centre for Cyber Security: baseline controls for small and medium organisations
What it asks of you. A short set of practical cyber controls for small organisations: separate work and personal data, encrypt devices, install apps from trusted sources, back up and patch.
How we support it. The device, account, backup and home-network safeguards in our implementation list.
Technical safeguards
ISO standards our work is mapped to
ISO/IEC 27002:2022 Information security controls
What it asks of you. The catalogue of security controls we use as the yardstick for reasonable security: access, devices, cryptography, backup, suppliers, incidents, awareness.
How we support it. Every safeguard and every procedure is mapped to its control number, with a one-page evidence file.
Technical safeguardsProcedures (SOPs)Privacy training
ISO/IEC 27001:2022 Information security management systems
What it asks of you. The management-system standard: scope, risk assessment, policies, monitoring and review.
How we support it. Our method follows the same cycle at small-practice scale. We do not certify; a certification body does.
Technical safeguards
ISO/IEC 27701 Privacy information management
What it asks of you. Extends the security standard to the handling of personal information: purposes, consent, access, retention.
How we support it. Our privacy training, access-request procedure and retention schedule follow its structure.
Privacy trainingProcedures (SOPs)
ISO/IEC 27017 and ISO/IEC 27018 Cloud security and protection of personal information in public clouds
What it asks of you. Security controls for cloud services and for personal information held by public-cloud providers.
How we support it. Vendor due-diligence file for each software system, and the cloud-only practice review.
Technical safeguards
ISO/IEC 42001:2023 Artificial intelligence management system
What it asks of you. Responsible governance of AI: purpose, risk, oversight, transparency and monitoring.
How we support it. AI use rule, approval step, activity log and review calendar for the connected assistant.
Connected AI assistant
ISO 31000 Risk management and ISO 22301 Business continuity
What it asks of you. How to assess risk and how to keep working, and recover, after a disruption.
How we support it. Health-check ratings, risk assessment worksheet, backup design and breach-plan rehearsal.
Technical safeguardsProcedures (SOPs)
See it applied
Take the free health check, play the agency decisions game, or read how each procedure in our SOPs maps to these instruments.
Free health check Agent track Contact us for prices