Data Security

OSFI Strengthens Security and Integrity Requirements for Financial Institutions

by
money and security

Recent Updates from Canada’s OSFI

The Office of the Superintendent of Financial Institutions (OSFI) has recently implemented new regulations to ensure stronger security and integrity practices among federally regulated financial institutions (FRFIs) in Canada. These updates include:

  • Final Release of the Integrity and Security Guideline (IS Guideline): Published in January 2024, the IS Guideline outlines OSFI’s expectations for FRFIs to manage risks related to integrity and security, including foreign interference. This final version incorporates feedback received during a public consultation period.
  • Amendments to Guideline B-10 (Third-Party Risk Management) and Guideline B-13 (Technology and Cyber Risk Management): Released in February 2024, these amendments clarify that both guidelines now apply to foreign bank and insurance company branches operating in Canada, aligning them with the new IS Guideline.

Key Requirements of the IS Guideline

The IS Guideline introduces new and expanded expectations for FRFIs, including:

  • Leadership and Culture: Senior personnel must demonstrate good character, and the FRFI’s culture should promote ethical behavior. Codes of conduct and clear communication are essential.
  • Compliance Management: FRFIs should have robust systems to ensure adherence to regulations and ethical standards, considering reputational risks.
  • Whistleblowing: Effective channels for employees and stakeholders to report non-compliance are crucial.
  • Background Checks: Risk-based background checks for employees and contractors are required.
  • Data Security: Data classification and access controls must consider vulnerability to malicious activity and foreign interference.
  • Third-Party Due Diligence: Thorough due diligence is necessary for third parties accessing FRFI resources. Procurement processes should be transparent and objective.
  • Incident Reporting: FRFIs must report incidents of potential undue influence, foreign interference, or malicious activity to law enforcement.

Implementation Timeline

  • IS Guideline Compliance: OSFI will apply expectations proportionally based on FRFI characteristics. FRFIs must assess their risk exposure and implement mitigating actions if they face challenges in meeting the guidelines.
  • Questionnaires: Completed by FRFIs by April 2, 2024.
  • Compliance Plan: Submission of a comprehensive plan outlining interim deliverables to achieve compliance by July 31, 2024.
  • Full Compliance: All new or expanded expectations (except background checks) must be met by January 31, 2025. Background check compliance deadline is July 31, 2025.

Foreign Branches – Important Note

Canadian branches of foreign banks and insurers are now subject to Guidelines B-10 and B-13, with a deadline of March 31, 2025 for adherence to Guideline B-10.

Conclusion

These regulatory updates from OSFI demonstrate Canada’s commitment to a strong and secure financial sector. FRFIs must take necessary steps to comply with the new guidelines and ensure robust integrity and security practices.