The OSC should do more on investor protection

Last November, the Ontario Securities Commission (OSC) published its proposed statement of priorities for 2026–2027 and invited comment. The process is designed to give investors and industry a voice in what the regulator focuses on.

When announcing the consultation, CEO Grant Vingoe described it as an opportunity to demonstrate “agility, timely and strategic responsiveness and a sharpened focus on competitiveness.” The comment period ended Jan. 12.

In its submission, the OSC’s own investor advisory panel called for resource balance across all elements of the mandate, measurable timelines on investor-protection priorities and greater regulatory attention to the risks AI poses to retail investors. The consultation and the comment letters it generated were intended to inform the OSC’s final business plan for 2026–2027, promised for spring 2026. It has yet to appear.

That gap, both temporal and substantive — between what investors ask for and what the regulator delivers — is not new. It is the product of a shift that accelerated in 2021 when the Ontario legislature expanded the OSC’s mandate.

The taskforce that recommended the change assured that the additions would “not detract from the OSC’s existing mandate, including but not limited to maintaining investor protection.”

The Canadian Securities Administrators (CSA) was not persuaded, warning publicly that the expanded mandate risked paying insufficient attention to investor protection. Four years on, the CSA’s concern looks better founded than the taskforce’s assurance.

Since 2021, the OSC has created an Office of Economic Growth and Innovation. It established LaunchPad, a program providing exemptive relief to firms testing products before full compliance requirements apply. It advanced a semi-annual reporting pilot, reducing disclosure frequency for venture issuers over the objections of investor advocates. It moved its long-term asset fund initiative into live markets before the investor-protection questions raised in consultation were resolved.

This year’s OSC Dialogue — its signature annual event — was themed “Competitive Edge.” As recently as two weeks ago, at the Bloomberg Forum for Investment Management, Vingoe announced specific capital market improvements: one fewer year of audited financials required for IPOs and follow-on offerings without substantial review within a year of listing.

The will and the ability

On capital formation, the OSC has demonstrated both the will and the ability to move quickly and deliver.

On investor protection, the same will and urgency have not been demonstrated. Ombudsman for Banking Services and Investments (OBSI) binding authority — long recommended, long deferred — means firms still cannot be compelled to pay what OBSI recommends as fair. Complaint handling timelines are unreformed. The structural conflict embedded in bank-affiliated proprietary shelves — a problem Vingoe himself named at a Senate hearing — has produced no regulatory action proportionate to the documented harm.

In each case the problem is identified, the analysis is done and the case for action is established. Action has not followed.

When the OSC addresses capital formation it responds with infrastructure, programs and dedicated staff. When it addresses investor protection, it leads with consultations. Process is not the same as action.

Nowhere is that gap more consequential than on AI. The OSC has engaged with AI — tracking how registrants use it, issuing guidance on governance and accountability for market participants, consulting on its role in capital markets. The question of what AI does to investors is not asked.

It should be. The OSC has no dedicated regulatory or supervisory technology program to identify harm to retail investors faster and at scale. Nor has it produced a framework protecting consumers from algorithmically generated advice, AI-driven product marketing or automated profiling used to steer them toward unsuitable products.

At the Bloomberg Forum, Vingoe described the OSC as “technology neutral” — even as he acknowledged AI may be too transformative for existing approaches to hold. Asked whether a dedicated consumer framework is needed, his answer was that it “remains to be seen.”

Consumers exposed to AI-generated advice and automated profiling are not protected by “remains to be seen.” They are exposed by it.

The regulator that mobilizes quickly to accommodate market innovation has not found the same urgency when the question is protecting investors from AI.

Four years of discretionary choices have produced a consistent answer. Capital formation has an office, a program and a themed annual event. Investor protection has a wish list.

The fix is administrative, not legislative. Investor-protection priorities should carry the same weight as capital formation initiatives — specific commitments, named and dated. That includes a dedicated regtech and suptech program for investor protection and a consumer framework for AI-driven harm — not subordinate to its market-innovation agenda.

Investors are named first in the statute. In recent years, something else comes first. The mandate hasn’t changed. The priorities have — at the expense of consumers.