The Office of the Superintendent of Financial Institutions (OSFI) published its final guideline on third-party risk management. OSFI also published its annual risk outlook for 2023-24, along with a new framework to strengthen the federally regulated financial institutions’ ability to withstand sophisticated cyber-attacks.
The Guideline B-10 on third-party risk management sets out outcomes-focused, principles-based expectations for federally regulated financial institutions on the sound management of third-party risk. The Guideline outlines a principles-based approach with an increased emphasis on a risk-based approach to manage third-party arrangements. The Guideline also adopts a pragmatic approach to managing subcontractor and concentration risks according to the level of risk and criticality of the given third-party arrangement. OSFI expects the federally regulated financial institutions to understand the risk and criticality of all its third-party arrangements and apply this Guideline in a manner that is proportionate to both the risk and criticality of each third-party arrangement and the size, nature, scope, complexity of operations and risk profile of the federally regulated financial institution. The Guideline applies to all federally regulated financial institutions, excluding foreign bank branches and foreign insurance company branches. The Guideline will come into effect on May 01, 2024, roughly one year after its publication, to provide federally regulated financial institutions sufficient time to self-assess and build third-party risk management programs that comply with the new requirements of the Guideline, with the expectation that third-party arrangements commencing on or after the effective date adhere to the guideline and those entered into prior are being reviewed and updated at the earliest opportunity so that they adhere to the guideline by its effective date or as soon as possible thereafter.
The Annual Risk Outlook report outlines the significant risks faced by the financial system in Canada, along with the regulatory and supervisory response of OSFI to those risks. The risks include housing market downturn risk, liquidity and funding risk, commercial real estate (CRE) risk, transmission risk from the non-bank financial intermediaries (NBFI) sector, corporate and commercial credit risk, digital innovation risk, climate risk, cyber risk and third-party risk. In addition, OSFI published near-term plan, along with the timelines, of guidance priorities for federally regulated financial institutions and private pensions in 2023-24. Key highlights of the report are as follows:
- Climate Risk—OSFI will supervise climate-related risks in accordance with new principles-based regulatory expectations published in Guideline B-15: Climate Risk Management. OSFI also plan to develop a standardized climate scenario analysis exercise for all federally regulated financial institutions in 2024. Later in 2023, OSFI will launch a domestic Climate Risk Forum to raise awareness and build capacity amongst stakeholders on the evolution of the climate risk management framework.
- Cyber Risk—OSFI plan to publish an Intelligence-Led Cyber Resilience Testing (I-CRT) framework to serve as an implementation guide for federally regulated financial institutions to conduct periodic I-CRT assessments by spring 2023. In response to rising technology and cyber threats and risks, OSFI issued the Technology and Cyber Risk Management Guideline B-13 in July 2022, with an effective date of January 01, 2024.
- Digital Innovation Risk—OSFI plan to explore systemic and institutional vulnerabilities associated with digital innovations including blockchain applications (for example, crypto-assets, stablecoins, digital currencies, decentralized finance), artificial intelligence and machine learning (AI/ML), open finance, quantum computing, and other technologies.
In addition to Annual Risk Outlook, OSFI released a framework to strengthen financial institutions’ resilience to cyber-attacks. The Intelligence-Led Cyber Resilience Testing (I-CRT) framework outlines a methodology and serves as an implementation guide for federally regulated financial institutions conducting I-CRT assessments. Under the I-CRT framework, OSFI provides guidance and oversight throughout the assessment, while FRFIs manage overall testing. The I-CRT framework is a supervisory tool that supplements Guideline B-13 on Technology and Cyber Risk Management, with I-CRT assessments that allow federally regulated financial institutions to proactively identify and address issues with their cyber resilience. The I-CRT framework currently applies to the systemically important banks and the internationally active insurance groups (IAIGs) in Canada. OSFI expects these institutions to conduct an I-CRT assessment at least once during each three-year supervisory cycle, beginning in 2023.
- Press Release on Third-Party Risk Management Guideline
- Guideline on Third-Party Risk Management
- Press Release on Annual Risk Outlook
- Annual Risk Outlook for 2023-24
- Press Release on I-CRT Framework
- Implementation Guide on I-CRT Framework
Keywords: Americas, Canada, Banking, Cloud Service Providers, Liquidity Risk, Business Continuity, Annual Risk Outlook, ESG, Third-Party Risk, Guideline B-10, Concentration Risk, Climate Change Risk, Credit Risk, Cyber Risk, Operational Risk, Basel, Regtech, Cryptoassets, Subeadline, Operational Resilience, OSFI
Hasan leads Moody’s Analytics ESG methodology development. He is expert on carbon transition, nature related risks and is a guest lecturer at ESSEC Business school on sustainable finance.
Previous ArticleECB Finds Banks Unprepared for Pillar 3 Climate Risk Disclosures
The European Banking Authority (EBA) has published the final templates, and the associated guidance, for collecting climate-related data for the one-off Fit-for-55 climate risk scenario analysis.
The European Banking Authority (EBA) recently published a report that recommends enhancements to the Pillar 1 framework, under the prudential rules, to capture environmental and social risks.
As a follow on from its prudential standard on the treatment of crypto-asset exposures, the Basel Committee on Banking Supervision (BCBS) proposed disclosure requirements for crypto-asset exposures of banks.
The Basel Committee on Banking Supervision (BCBS) and the European Banking Authority (EBA) have published results of the Basel III monitoring exercise.
The Prudential Regulation Authority (PRA) recently issued a few regulatory updates for banks, with the updated Basel implementation timelines being the key among them.
The U.S. Department of the Treasury has recently set out the principles for net-zero financing and investment.
The European Commission (EC) launched a stakeholder survey on the draft International Guiding Principles for organizations developing advanced artificial intelligence (AI) systems.
The finalization of the two sustainability disclosure standards—IFRS S1 and IFRS S2—is expected to be a significant step forward in the harmonization of sustainability disclosures worldwide.
Decentralized finance (DeFi) is expected to increase in prominence, finding traction in use cases such as lending, trading, and investing, without the intermediation of traditional financial institutions.
The Basel Committee on Banking Supervision (BCBS) published reports that assessed the overall implementation of the net stable funding ratio (NSFR) and the large exposures rules in the U.S.