OSFI published a discussion paper that focuses on risks arising from rapid technological advancement and digitalization. The discussion paper presents the recent work of OSFI on a wide range of risks in technology. The discussion paper addresses operational risk and resilience and data risk, with cyber security, advanced analytics (including artificial intelligence and machine learning), and use of third-party services (such as cloud computing) as the key focus areas. The paper shares preliminary direction of OSFI on the key focus areas and seeks stakeholder views to inform future prudential policy development. Stakeholders can provide feedback by December 15, 2020.
At this time, OSFI is not presenting any firm proposals and intends to follow this consultation process with one or more consultative documents. Through this paper, OSFI shares some of its thinking and recent work, inviting stakeholder feedback on a range of issues surrounding technology and related risks, including:
- Operational risk and resilience and the need for a holistic assessment of the overarching regulatory architecture for technology and other non-financial risks
- Understanding technology risk and the role of prudential regulators with respect to technology and data risk management
- Core principles to guide future regulatory guidance development in relation to three priority areas—cyber security, advanced analytics, and the technology third-party ecosystem
Data is foundational to each theme of this paper; thus, this paper includes a separate discussion on data risk management. Each thematic section presents the perspective of OSFI in the respective area and, where applicable, the existing regulatory guidance and supervisory work of OSFI. The Canadian regulator OSFI is interested in receiving stakeholder feedback based on questions posed in each section. The consultation supports a strategic objective of OSFI to ensure that federally regulated financial institutions and pension plans are better prepared to identify and develop resilience to non-financial risks, before these risks negatively affect the financial condition of institutions.
Comment Due Date: December 15, 2020
Keywords: Americas, Canada, Banking, Insurance, Technology Risk, Operational Risk, Cloud Computing, Third Party Risk, Fintech, Cyber Risk, Artificial Intelligence, OSFI
Previous ArticleHKMC Enhances Terms of SME Loan Guarantee Scheme Amid Pandemic
FSB finalized the toolkit of effective practices to assist financial institutions in their cyber incident response and recovery activities.
HKMA urged authorized institutions to take early action to adhere to the IBOR Fallbacks Protocol, which ISDA is expected to publish soon.
FSB published a global transition roadmap for London Inter-bank Offered Rate (LIBOR).
HM Treasury published a document that summarizes the responses received from a consultation on the approach of UK to transposition of the revised Bank Resolution and Recovery Directive (BRRD2).
HM Treasury published the government response to the feedback received on the consultation for updating the prudential regime of UK before the end of the Brexit transition period.
In a recent statistical notice, BoE announced publication of the reporting schedule for statistical returns for 2021.
EC welcomed the joint declaration by 25 EU member states on building the next generation of cloud in Europe.
MAS published amendments to Notice 648 on the issuance of covered bonds by banks incorporated in Singapore.
FDIC has selected 14 technology companies—including Accenture Federal Services, LLC, Fed Reporter, Inc, and S&P Global Market Intelligence, LLC—for inclusion in the next phase of the rapid prototyping competition.
GLEIF announced that financial institutions worldwide can realize a variety of cost, efficiency, and customer experience benefits by assuming a new “validation agent” role within the Global Legal Entity Identifier (LEI) System.