OSFI published a discussion paper that focuses on risks arising from rapid technological advancement and digitalization. The discussion paper presents the recent work of OSFI on a wide range of risks in technology. The discussion paper addresses operational risk and resilience and data risk, with cyber security, advanced analytics (including artificial intelligence and machine learning), and use of third-party services (such as cloud computing) as the key focus areas. The paper shares preliminary direction of OSFI on the key focus areas and seeks stakeholder views to inform future prudential policy development. Stakeholders can provide feedback by December 15, 2020.
At this time, OSFI is not presenting any firm proposals and intends to follow this consultation process with one or more consultative documents. Through this paper, OSFI shares some of its thinking and recent work, inviting stakeholder feedback on a range of issues surrounding technology and related risks, including:
- Operational risk and resilience and the need for a holistic assessment of the overarching regulatory architecture for technology and other non-financial risks
- Understanding technology risk and the role of prudential regulators with respect to technology and data risk management
- Core principles to guide future regulatory guidance development in relation to three priority areas—cyber security, advanced analytics, and the technology third-party ecosystem
Data is foundational to each theme of this paper; thus, this paper includes a separate discussion on data risk management. Each thematic section presents the perspective of OSFI in the respective area and, where applicable, the existing regulatory guidance and supervisory work of OSFI. The Canadian regulator OSFI is interested in receiving stakeholder feedback based on questions posed in each section. The consultation supports a strategic objective of OSFI to ensure that federally regulated financial institutions and pension plans are better prepared to identify and develop resilience to non-financial risks, before these risks negatively affect the financial condition of institutions.
Comment Due Date: December 15, 2020
Keywords: Americas, Canada, Banking, Insurance, Technology Risk, Operational Risk, Cloud Computing, Third Party Risk, Fintech, Cyber Risk, Artificial Intelligence, OSFI
Previous ArticleHKMC Enhances Terms of SME Loan Guarantee Scheme Amid Pandemic
The European Commission (EC) published the Delegated Regulation 2022/786 with regard to the liquidity coverage requirements for credit institutions under the Capital Requirements Regulation (CRR).
The European Banking Authority (EBA) published the final draft regulatory technical standards specifying the criteria to identify shadow banking entities for the purposes of reporting large exposures.
The European Insurance and Occupational Pensions Authority (EIOPA) published a report assessing insurers' exposure to physical climate change risks
The European Commission (EC) published the results of a public consultation, held in October 2021, on the review of the Web Accessibility Directive.
The Network for Greening the Financial System (NGFS) published two reports to aid central banks and regulators in their oversight of the financial sector and in their central bank operations
The Monetary Authority of Singapore (MAS) and the SC-STS are jointly consulting, until June 10, 2022, on setting adjustment spreads for the conversion of legacy SOR contracts to SORA reference rate.
The Office of the Superintendent of Financial Institutions (OSFI) published the strategic plan for 2022-2025 and the departmental plan for 2022-23.
The European Banking Authority (EBA) is consulting, until August 31, 2022, on the draft implementing technical standards specifying requirements for the information that sellers of non-performing loans (NPLs) shall provide to prospective buyers.
The European Council and the Parliament reached an agreement on the revised Directive on security of network and information systems (NIS2 Directive).
The European Banking Authority (EBA) published the final draft regulatory technical standards specifying information that crowdfunding service providers shall provide to investors on the calculation of credit scores and prices of crowdfunding offers.