OSFI published a discussion paper that focuses on risks arising from rapid technological advancement and digitalization. The discussion paper presents the recent work of OSFI on a wide range of risks in technology. The discussion paper addresses operational risk and resilience and data risk, with cyber security, advanced analytics (including artificial intelligence and machine learning), and use of third-party services (such as cloud computing) as the key focus areas. The paper shares preliminary direction of OSFI on the key focus areas and seeks stakeholder views to inform future prudential policy development. Stakeholders can provide feedback by December 15, 2020.
At this time, OSFI is not presenting any firm proposals and intends to follow this consultation process with one or more consultative documents. Through this paper, OSFI shares some of its thinking and recent work, inviting stakeholder feedback on a range of issues surrounding technology and related risks, including:
- Operational risk and resilience and the need for a holistic assessment of the overarching regulatory architecture for technology and other non-financial risks
- Understanding technology risk and the role of prudential regulators with respect to technology and data risk management
- Core principles to guide future regulatory guidance development in relation to three priority areas—cyber security, advanced analytics, and the technology third-party ecosystem
Data is foundational to each theme of this paper; thus, this paper includes a separate discussion on data risk management. Each thematic section presents the perspective of OSFI in the respective area and, where applicable, the existing regulatory guidance and supervisory work of OSFI. The Canadian regulator OSFI is interested in receiving stakeholder feedback based on questions posed in each section. The consultation supports a strategic objective of OSFI to ensure that federally regulated financial institutions and pension plans are better prepared to identify and develop resilience to non-financial risks, before these risks negatively affect the financial condition of institutions.
Comment Due Date: December 15, 2020
Keywords: Americas, Canada, Banking, Insurance, Technology Risk, Operational Risk, Cloud Computing, Third Party Risk, Fintech, Cyber Risk, Artificial Intelligence, OSFI
Previous ArticleHKMC Enhances Terms of SME Loan Guarantee Scheme Amid Pandemic
EC published the Implementing Regulation 2021/763 that lays down implementing technical standards for supervisory reporting and public disclosure of the minimum requirement for own funds and eligible liabilities (MREL).
EBA published a report that examines the convergence of prudential supervisory practices in 2020 and offers conclusions of the EBA college monitoring activity.
APRA announced the standardization of quarterly reporting due dates for authorized deposit-taking institutions.
The private sector working group of ECB on euro risk-free rates published the recommendations to address events that would trigger fallbacks in the Euro Interbank Offered Rate (EURIBOR)-related contracts, along with the €STR-based EURIBOR fallback rates (rates that could be used if a fallback is triggered).
Bundesbank published a list of "EntryPoints" that are accepted in its reporting system; the list provides taxonomy version and name of the module against each EntryPoint.
EBA published the phase 1 of its reporting framework 3.1, with the technical package covering the new reporting requirements for investment firms (under the implementing technical standards on investment firms reporting).
The Sustainable Finance Taskforce of IOSCO held two roundtables, with global stakeholders, on the IOSCO priorities to enhance the reliability, comparability, and consistency of sustainability-related disclosures and to collect views on the practical implementation of a global system architecture for these disclosures.
Asia Pacific Australia Banking APS 111 Capital Adequacy Regulatory Capital Basel RBNZ APRA
ESMA published the final guidelines on outsourcing to cloud service providers.
EBA published annual data for two key concepts and indicators in the Deposit Guarantee Schemes (DGS) Directive—available financial means and covered deposits.