Technology & Cyber in Canada

Key dates

2026-10-15

OSFI published its statement endorsing the FSB Sound Practices for Responsible Adoption of Artificial Intelligence; the FSB also published the final Sound Practices on this date.

Suggested considerations

• Compliance teams may wish to map the 12 FSB practices against existing controls under OSFI’s Corporate Governance Guideline, Integrity and Security Guideline, Guideline B-10, Guideline B-13, Guideline E-21 and Guideline E-23.
• Firms should consider maintaining an enterprise-wide inventory of AI use cases, including internally developed systems, embedded vendor functionality and generative or agentic AI, with documented owners, intended purposes, materiality assessments and lifecycle status.
• Boards and senior management may wish to review whether the institution’s business strategy, risk appetite and governance framework clearly address AI adoption, accountability, escalation and human oversight.
• Firms should consider assessing AI use cases for operational, technology, cyber, third-party, model, data, privacy, conduct and governance risks, with controls proportionate to the materiality and risk of each use case.
• Compliance and risk functions may wish to review AI development and deployment documentation, validation, monitoring, change management, testing, incident escalation, explainability and retirement processes, including for systems supplied by third parties.
• Institutions should consider evaluating whether existing B-10 outsourcing and third-party risk controls address vendor model changes, data access, subcontracting, concentration risk, resilience, audit rights and exit arrangements for AI-enabled services.
• Internal audit or an equivalent independent assurance function may wish to assess whether AI governance and lifecycle controls operate effectively and whether management reporting to the board is sufficiently complete.
• Firms may wish to monitor subsequent OSFI technology risk bulletins, supervisory communications and future revisions to the FSB practices, since OSFI stated that it will continue monitoring how AI changes the risk environment and institutional operations.

What changed

OSFI formally endorsed the FSB Sound Practices and identified them as complementary to existing OSFI expectations. The FSB practices cover organization-wide AI governance and management across the AI lifecycle, including strategic direction, accountability, risk management, human oversight, data governance, controls, adaptability and coordination. The publication is non-binding guidance rather than a new OSFI rule, capital requirement, reporting obligation or prescribed compliance deadline.

Key dates

21 May 2026

- OSFI publishes the backgrounder and launches a 60‑day public consultation on proposed updates to the Capital and Liquidity Treatment of Crypto‑asset Exposures (Banking) Guideline

20 July 2026 Deadline

- Consultation period closes; deadline for stakeholders to submit comments to OSFI at [email protected]

September 2026

- OSFI expects to publish the final revised Capital and Liquidity Treatment of Crypto‑asset Exposures (Banking) Guideline

01 November 2026

- Implementation date for the final guideline for banks with a fiscal year ending 31 October

01 January 2027

- Implementation date for the final guideline for banks with a fiscal year ending 31 December

Suggested considerations

• Assess whether your institution currently has, or plans to have, exposures to Group 2a crypto‑assets traded on regulated exchanges of traditional financial assets, and map all related positions, hedges, and trading strategies.
• Review existing market‑neutral and cross‑exchange hedging strategies for crypto‑asset exposures to determine how expanded recognition of cross‑exchange hedges could change risk‑weighted assets, leverage exposure, and liquidity metrics under OSFI’s proposed treatment.
• Perform an impact assessment and scenario analysis comparing existing capital and liquidity requirements for Group 2a exposures under the current guideline versus the proposed cross‑exchange hedge recognition, quantifying potential capital relief or shifts in capital allocation.
• Update internal capital policy documentation, trading desk procedures, and risk‑management standards to incorporate the proposed hedging recognition framework, including eligibility criteria for “regulated exchanges of traditional financial assets,” subject to final OSFI requirements.
• Prepare and submit a consultation response to OSFI by 20 July 2026, highlighting any operational, risk‑measurement, model, or documentation challenges with implementing cross‑exchange hedge recognition and recommending clarifications where needed.

What changed

• - OSFI is proposing targeted revisions to the existing Capital and Liquidity Treatment of Crypto‑asset Exposures (Banking) Guideline, rather than a wholesale rewrite, in order to better reflect...
• The draft changes would explicitly recognize cross‑exchange hedging for Group 2a crypto‑assets when the instruments are traded on regulated exchanges of traditional financial assets, allowing more...
• Under the proposal, banks’ market‑neutral strategies in Group 2a crypto‑assets would receive capital treatment that more closely reflects actual economic risk, reducing instances where only partial...
• No change is proposed to the risk weights applied to Group 2a crypto‑assets, meaning existing Group 2a capital charge levels remain intact under the draft revisions.
• No change is proposed to the eligibility of Group 2a crypto‑assets as collateral, so current collateral treatment and related haircuts remain unchanged by this consultation.