The regulatory starting gun didn't sound like one. On December 5, 2024, the Canadian Securities Administrators published Staff Notice 11-348 — a 14-page document that, in the quietest possible bureaucratic register, told every AI-powered fintech in Canada that existing law already governs what they built. No new statute. No grace period. No safe harbour.
For BC founders shipping LLM-driven financial features, that notice is not a warning about the future. It is a description of the present.
The Threshold Nobody Is Measuring Against
The BC Securities Act defines "advising" functionally, not technologically. Strip away the interface — the chat window, the risk-tolerance slider, the personalized dashboard — and ask one question: is this system telling a client something about buying or selling securities, and is the client relying on it? If yes, you are advising. If you are advising for compensation, directly or indirectly, you need to be registered.
The BCSC has applied this logic since roughly 2014, when the first robo-advisor wave hit Vancouver. The commission required discretionary portfolio management platforms to register as portfolio managers under BC securities law without amending a single line of the Securities Act. The statute was written in the 1990s to catch offshore boiler rooms and unlicensed stock promoters. It caught algorithmic rebalancing tools too, because the functional test does not care about the delivery mechanism.
CSA Staff Notice 11-348 is that same move applied to AI. The notice confirmed that National Instrument 31-103 — the core registration and conduct rule for all Canadian registrants — applies to AI systems that "may directly affect registerable services provided to clients." Suitability obligations apply. Know-your-client obligations apply. Conflict-of-interest disclosure applies. The fact that the recommendation came from a transformer model rather than a licensed adviser does not create a carve-out, because no carve-out exists.
An LLM that tells a user "based on your risk profile, you should hold more fixed income" is not a chatbot. It is an unregistered portfolio manager.
What the BCSC's Track Record Actually Shows
The panic framing deserves a check. A securities lawyer who has shepherded robo-advisor registrations through the BCSC since 2014 would note — correctly — that the commission has never brought an enforcement action against a fintech that engaged the Fintech and Innovation Team early, disclosed its product architecture honestly, and moved toward registration in good faith. The BCSC's actual posture with innovative firms has been collaborative. Staff Notice 11-348 is, in that reading, better understood as an invitation to come talk than as an enforcement shot across the bow.
The real risk is the founder who reads a LinkedIn post about regulatory exposure and does nothing. Inaction is the one behaviour the BCSC has consistently punished.
Two Vancouver-area fintech pilots — neither of which made headlines — wound down quietly after BCSC inquiries around 2021 and 2022. Both had launched "personalized savings recommendation" engines without registering. The lesson the founders took was not that regulators are slow. It was that the CSA Collaboratory sandbox exists for a reason, and you use it before you ship, not after your Series A closes.
The BCSC's Fintech and Innovation Team contact lines are publicly posted. That is the practical first call for any BC founder who is uncertain whether their AI feature has crossed the registration threshold. Uncertainty, here, is not a defensible position — it is a billable hour waiting to happen.
The Liability Is Personal, Not Just Corporate
This is the part that gets glossed over in most coverage of fintech compliance. Under NI 31-103, the Ultimate Designated Person and the Chief Compliance Officer of a registered firm carry individual accountability for the firm's compliance systems. For a firm that should have registered and didn't, the exposure runs directly to the principals.
Founders who shipped an AI recommendation feature in mid-2024 and have not yet had a registration conversation with the BCSC are accumulating personal liability with every day the product runs. The corporate structure does not insulate them.
The federal Regulators' Capacity Fund — a C$14.2 million pool intended to support AI oversight capacity across federal regulators — was exhausted by March 2025 with no replacement announced. That sounds, superficially, like enforcement risk is declining. It isn't. The BCSC is provincially funded and has been consistently aggressive on registration requirements since the first robo-advisor wave. Provincial funding does not track federal capacity gaps.
The AIDA Gap and What Fills It
Canada's proposed Artificial Intelligence and Data Act — part of Bill C-27 — died on the order paper when Parliament prorogued ahead of the 2025 federal election. AIDA would have created defined obligations around high-impact AI systems, transparency requirements, and an AI and Data Commissioner. It would have given provincially regulated fintechs a national baseline.
Without it, a BC fintech navigates a patchwork:
- BCSC registration rules under the BC Securities Act
- CSA Staff Notice 11-348 — principles-based guidance, not law, with no legal certainty and no safe harbours
- CIRO member rules if the firm is registered as an investment dealer
- OSFI Guideline E-23, published September 11, 2025, effective May 1, 2027 — enterprise-wide model risk management requirements for all federally regulated financial institutions
That last item is technically irrelevant to a provincially incorporated BC fintech that is not a bank, insurer, or trust company. But only technically. Any BC fintech pursuing a bank partnership, a white-label distribution deal, or an acquisition exit will face E-23-style model governance due diligence from the institutional buy side well before May 2027. Charter banks are already pricing this in. Building without model governance documentation today means a painful retrofit at exactly the moment you are trying to close a deal.
The OSC's 2026-27 proposed priorities, published January 2026, name AI oversight as a front-and-centre regulatory item alongside binding compensation frameworks. The CSA's comment period on Notice 11-348 closed March 31, 2025 — those responses are informing the next round of guidance. The regulatory map is being drawn in real time.
The Competitive Signal Most Founders Are Leaving on the Table
Regulatory certainty, in this environment, is a moat. Founders who pre-clear through the CSA Collaboratory sandbox before shipping an AI advisory feature are not just managing downside risk — they are acquiring something their unregistered competitors cannot easily replicate: a documented, good-faith regulatory engagement record.
Between June and November 2025, the CSA used machine learning to deactivate 6,918 fake URLs across 3,961 fraudulent investment websites, according to the Ontario Securities Commission's January 2026 report. The regulator is not a passive observer of AI in financial services. It is an active participant, deploying the same tools it is being asked to govern.
The second-order effects from here are predictable. BCSC registration inquiries will spike as AI chatbot features ship inside BC fintech apps through 2026. Compliance counsel fees become a product cost line item, which disadvantages pre-seed founders against better-capitalized competitors who absorbed that cost early. CIRO's forthcoming guidance on order-execution-only platforms will redraw the DIY broker channel and force AI feature rollbacks at several platforms that have been operating in a grey zone.
The founders who will navigate this cleanly are not the ones waiting for a purpose-built AI statute — AIDA is gone and nothing is replacing it on a short timeline. They are the ones who picked up the phone, called the BCSC's Fintech and Innovation Team, and got a registration determination before their product hit the App Store.
The tripwire fired in December 2024. The question now is whether you are standing on the right side of it.
