Are OSFI guidelines binding?
By Nick Jang, founder of MINERVA Studio ·
The short answer
Not in the strict legal sense. OSFI says so itself: its guidelines are not laws, but institutions are expected to follow them. In practice they bind through supervision. A gap becomes a supervisory finding, findings feed the institution's rating and intervention stage, and OSFI can back them with directions, orders and capital add-ons that are enforceable in court.
The short legal answer
A guideline is not a statute and it isn't a regulation. Parliament writes the statutes (the Bank Act, the Insurance Companies Act, the Trust and Loan Companies Act). The federal Cabinet makes regulations under them. OSFI writes guidelines, and its own guidance page puts the status plainly: they aren't legally binding, they still carry weight, and an institution that ignores one may face increased scrutiny.
So nobody gets fined for "breaching E-23" the way they'd be fined for breaching a section of the Bank Act. That's the technically correct answer. It's also the answer that gets a risk team into trouble, because it skips how OSFI actually uses its guidelines.
How a guideline binds in practice
OSFI's supervisors use guidelines as the yardstick for whether an institution is managing a risk soundly. When they find a gap, it travels up a ladder:
- A supervisory finding. The institution is told what's wrong and by when it should be fixed. Findings are tracked and followed up.
- A weaker rating. Findings feed the institution's composite risk rating, which is confidential but drives how closely it's watched and what OSFI asks of it.
- A higher intervention stage. OSFI's Guide to Intervention runs from normal supervision through four stages of growing concern. Each stage brings more meetings, more reporting, tighter deadlines and, eventually, restrictions on the business.
- Formal powers. Under section 645 of the Bank Act the Superintendent can direct a bank to stop an unsafe or unsound practice and take steps to fix it. The bank gets a chance to make representations first. A direction can be enforced through the courts.
In other words, the guideline sets the standard and the statute supplies the teeth. Most institutions never get past the first rung, because they fix a finding long before it becomes a direction.
Where a guideline does have statutory force
Capital and liquidity are the exception people forget. Section 485(2) of the Bank Act lets the Superintendent make guidelines on adequate capital and liquidity, which is the legal footing for the Capital Adequacy Requirements (CAR) and Liquidity Adequacy Requirements guidelines. Section 485(3) then goes further: even when a bank meets those guidelines, the Superintendent may order it to increase its capital or hold more liquidity, and the bank has to comply within the time the order sets. The insurance and trust statutes carry matching provisions.
| Instrument | Legal force | Example |
|---|---|---|
| Statute | Binding law, passed by Parliament | Bank Act, Insurance Companies Act |
| Regulation | Binding law, made by Cabinet under a statute | Administrative Monetary Penalties (OSFI) Regulations |
| Guideline made under a statutory power | Expectation, backed by an order power in the same section | CAR, under Bank Act s. 485 |
| Other guideline | Expectation, enforced through supervision | E-23, B-10, B-13, E-21 |
| Advisory or regulatory notice | Clarifies a guideline or the law; temporary guidance | Notices issued between guideline updates |
| Order or direction | Binding on the institution named, enforceable in court | A s. 485(3) capital order, a s. 645 direction |
Can OSFI fine an institution for ignoring a guideline?
Not directly. OSFI's administrative monetary penalties apply to breaches of the statutory provisions listed in the AMP Regulations, not to gaps against a guideline on their own. Section 25(2) of the OSFI Act caps a penalty for an entity at $25,000 for a minor violation, $100,000 for a serious one and $500,000 for a very serious one, and at $10,000, $50,000 and $100,000 for an individual. OSFI revised how it assesses penalties for violations after 11 September 2025 and signalled it will use them more often.
The link to guidelines is indirect but real. A poor model risk framework won't earn a penalty by itself. If it leads a bank to misstate capital or file wrong returns, that can breach a listed provision, and OSFI's guide says it weighs its own instruments when judging whether a violation was intentional or negligent.
The penalty figures are the statutory maximums per violation. The amount in a given case depends on the factors in section 26 of the OSFI Act and OSFI's guide, and penalties are usually far less likely than a supervisory finding.
What this means for E-23
OSFI's Guideline E-23 on model risk management takes effect on 1 May 2027 for every federally regulated bank and insurer. It isn't law. It is, however, the standard supervisors will hold the model inventory, the risk ratings, independent review and approvals against, and a missing piece will show up as a finding with a deadline. Treat "expected to follow" as the working meaning of "mandatory" and you'll plan correctly.
One more practical point: E-23 is principles-based and proportional. It tells you what outcome to reach, not exactly how, and it scales with the size and complexity of the institution. That flexibility is real, but it cuts both ways. You have to be able to show why your approach meets the principle, which is a question of evidence rather than of having a policy on file.
Where MINERVA fits
MINERVA keeps the evidence supervisors ask for under E-23 and B-10: the model and AI inventory in E-23's fields, each model's rating, reviewer and approver, and every decision on a time-stamped trail. It doesn't make an institution compliant by itself and it isn't legal advice. See the E-23 platform.
Related questions
Is OSFI E-23 mandatory?
It isn't a law, but federally regulated banks and insurers are expected to follow it from 1 May 2027, and OSFI supervises against it. A gap becomes a supervisory finding.
What is the difference between an OSFI guideline and a regulation?
A regulation is law, made by the federal Cabinet under a statute. A guideline is OSFI's statement of what it expects; it's enforced through supervision and, where needed, the Superintendent's statutory powers.
Do OSFI guidelines apply to provincially regulated credit unions?
No. They apply to federally regulated institutions. Provincial regulators such as BCFSA, FSRA and Quebec's AMF set their own rules, and some borrow from OSFI's guidelines.
Can a bank comply with a guideline differently from what it says?
Most OSFI guidelines are principles-based, so an institution can choose its own method if it can show the method reaches the outcome. The burden of showing that is on the institution.
Are OSFI advisories binding?
Advisories clarify how OSFI reads an existing guideline or the law. They carry the same kind of supervisory weight as the guideline they explain, not the force of a statute.
Sources
- OSFI — Guidelines and regulatory notices
- OSFI — Basics of guidance
- Bank Act, section 485 (capital and liquidity)
- Bank Act, section 645 (directions of compliance)
- OSFI Act, section 25 (administrative monetary penalties)
- OSFI — Guide to Administrative Monetary Penalties
- OSFI — Guideline E-23, Model Risk Management (2027)
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.