OSFI Finalizes Third-Party Risk Guideline and Publishes Risk Outlook

The Guideline B-10 on third-party risk management sets out outcomes-focused, principles-based expectations for federally regulated financial institutions on the sound management of third-party risk. The Guideline outlines a principles-based approach with an increased emphasis on a risk-based approach to manage third-party arrangements. The Guideline also adopts a pragmatic approach to managing subcontractor and concentration risks according to the level of risk and criticality of the given third-party arrangement. OSFI expects the federally regulated financial institutions to understand the risk and criticality of all its third-party arrangements and apply this Guideline in a manner that is proportionate to both the risk and criticality of each third-party arrangement and the size, nature, scope, complexity of operations and risk profile of the federally regulated financial institution. The Guideline applies to all federally regulated financial institutions, excluding foreign bank branches and foreign insurance company branches. The Guideline will come into effect on May 01, 2024, roughly one year after its publication, to provide federally regulated financial institutions sufficient time to self-assess and build third-party risk management programs that comply with the new requirements of the Guideline, with the expectation that third-party arrangements commencing on or after the effective date adhere to the guideline and those entered into prior are being reviewed and updated at the earliest opportunity so that they adhere to the guideline by its effective date or as soon as possible thereafter.

The Annual Risk Outlook report outlines the significant risks faced by the financial system in Canada, along with the regulatory and supervisory response of OSFI to those risks. The risks include housing market downturn risk, liquidity and funding risk, commercial real estate (CRE) risk, transmission risk from the non-bank financial intermediaries (NBFI) sector, corporate and commercial credit risk, digital innovation risk, climate risk, cyber risk and third-party risk. In addition, OSFI published near-term plan, along with the timelines, of guidance priorities for federally regulated financial institutions and private pensions in 2023-24. Key highlights of the report are as follows:

• Climate Risk—OSFI will supervise climate-related risks in accordance with new principles-based regulatory expectations published in Guideline B-15: Climate Risk Management. OSFI also plan to develop a standardized climate scenario analysis exercise for all federally regulated financial institutions in 2024. Later in 2023, OSFI will launch a domestic Climate Risk Forum to raise awareness and build capacity amongst stakeholders on the evolution of the climate risk management framework.
• Cyber Risk—OSFI plan to publish an Intelligence-Led Cyber Resilience Testing (I-CRT) framework to serve as an implementation guide for federally regulated financial institutions to conduct periodic I-CRT assessments by spring 2023. In response to rising technology and cyber threats and risks, OSFI issued the Technology and Cyber Risk Management Guideline B-13 in July 2022, with an effective date of January 01, 2024.
• Digital Innovation Risk—OSFI plan to explore systemic and institutional vulnerabilities associated with digital innovations including blockchain applications (for example, crypto-assets, stablecoins, digital currencies, decentralized finance), artificial intelligence and machine learning (AI/ML), open finance, quantum computing, and other technologies.

In addition to Annual Risk Outlook, OSFI released a framework to strengthen financial institutions’ resilience to cyber-attacks. The Intelligence-Led Cyber Resilience Testing (I-CRT) framework outlines a methodology and serves as an implementation guide for federally regulated financial institutions conducting I-CRT assessments. Under the I-CRT framework, OSFI provides guidance and oversight throughout the assessment, while FRFIs manage overall testing. The I-CRT framework is a supervisory tool that supplements Guideline B-13 on Technology and Cyber Risk Management, with I-CRT assessments that allow federally regulated financial institutions to proactively identify and address issues with their cyber resilience. The I-CRT framework currently applies to the systemically important banks and the internationally active insurance groups (IAIGs) in Canada. OSFI expects these institutions to conduct an I-CRT assessment at least once during each three-year supervisory cycle, beginning in 2023.

Related Links

• Press Release on Third-Party Risk Management Guideline
• Guideline on Third-Party Risk Management
• Press Release on Annual Risk Outlook
• Annual Risk Outlook for 2023-24
• Press Release on I-CRT Framework
• Implementation Guide on I-CRT Framework