What is OSFI Guideline B-10?
By Nick Jang, founder of MINERVA Studio ·
The short answer
OSFI Guideline B-10, Third-Party Risk Management, sets out how federally regulated financial institutions manage the risks of every arrangement with an outside party, not only outsourcing. It took effect on 1 May 2024 and rests on eleven principles, from accountability and due diligence to written contracts, audit rights, monitoring, incidents and exit plans, applied in proportion to each arrangement’s risk and criticality.
From outsourcing to every third party
The 2009 version of B-10 was about outsourcing, meaning you hand a business function to a supplier. The 2023 rewrite is much wider. It covers any third-party arrangement, which OSFI defines as any business or strategic arrangement with an outside party, by contract or otherwise. Consultants count. So do brokers, cloud providers, utilities, payment networks and the services your own affiliates provide. Customers and employment contracts don’t.
The starting point is blunt: the institution remains accountable for the risk, whatever it hands to a supplier. Arrangements entered on or after 1 May 2024 are expected to follow the guideline, and existing ones were to be brought in line at their next renewal or as soon as possible.
The six outcomes and eleven principles
B-10 expects six outcomes: clear governance and accountability; third-party risks identified and assessed; risks managed within the risk appetite; performance monitored and incidents handled; a programme that can handle many kinds of relationship over time; and third parties’ technology and cyber operations that are transparent, reliable and secure.
| Principle | What it asks |
|---|---|
| 1. Accountability | The institution is accountable for all third-party risk. |
| 2. Framework | A third-party risk management framework covers the whole life of an arrangement, from sourcing to exit. |
| 3. Risk and criticality | Each arrangement is assessed before it starts and periodically after. |
| 4. Due diligence | Due diligence, scaled to risk and criticality, before contracting and on an ongoing basis. |
| 5. Subcontracting | Risks from the supplier’s own suppliers are managed. |
| 6. Written agreements | Rights and responsibilities are set out in writing, reviewed by legal counsel. |
| 7. Data and records | Confidentiality, integrity and availability of records and data are protected. |
| 8. Information and audit | The institution, and OSFI, have timely access to information and the right to audit. |
| 9. Business continuity | Operations continue through disruption, with contingency plans for critical arrangements. |
| 10. Monitoring | Arrangements are monitored to confirm the supplier keeps meeting its obligations. |
| 11. Incidents | Incidents are identified, escalated and remediated under documented processes. |
Risk, criticality and what scales with them
B-10 is proportionate. Each arrangement gets a risk assessment (what could go wrong and how badly) and a criticality assessment (how much a disruption would hurt the institution’s critical operations). A catering contract and a core banking provider are both third parties; only one needs a full exit playbook.
As risk and criticality rise, so does the work: deeper due diligence, the full set of contract provisions in Annex 2, closer monitoring, tested contingency plans and documented exit strategies.
What B-10 expects in contracts, subcontracting, cloud and exit
- Contracts. For high-risk and critical arrangements, Annex 2 lists provisions to cover: scope, roles including technology and cyber, subcontracting, pricing, performance measures, ownership of assets, security of data, notifications of incidents and material changes, dispute resolution, regulatory compliance, continuity, default and termination, and insurance, plus audit and information rights for the institution and OSFI.
- Subcontracting. Know how many subcontractors a supplier relies on and how critical they are. Contracts can ban subcontracting for some functions, require notice, give a right to refuse a subcontractor and allow audits.
- Concentration. Watch for over-reliance on one supplier or one geography inside the institution, and for systemic concentration when many institutions use the same provider.
- Cloud. Set cloud-specific controls, consider portability and use strategies such as multi-cloud design where concentration is a concern.
- Exit. High-risk and critical arrangements need exit plans with triggers, a stressed-exit playbook and a non-stressed one, enough operational detail to act fast, and regular review.
How B-10 reaches AI vendors
B-10’s text doesn’t single out AI, and it doesn’t need to: an AI supplier is a third party like any other. What makes AI vendors harder is that the product can change under the contract. A supplier can retrain or swap the model behind it, an update can add AI to a tool that had none, and customer data can travel on to the supplier’s own model provider, which is a subcontractor.
OSFI closes the loop from two other directions. Guideline E-23 asks institutions to inventory, rate and review vendor models on their own, down to their data and libraries, in line with B-10. And the July 2026 AI bulletin asks institutions to extend third-party risk management to vendors’ use of AI and to have vendors disclose it. Our guide to third-party AI vendor risk under B-10 applies each principle to AI, and the procurement guide lists the due-diligence questions.
Related questions
When did OSFI B-10 take effect?
On 1 May 2024. OSFI published the final guideline in April 2023.
What did the new B-10 replace?
The 2009 guideline on outsourcing of business activities, functions and processes. The new version covers every third-party arrangement, not only outsourcing.
Does B-10 apply to intragroup arrangements?
Yes. Services from affiliates are third-party arrangements under B-10, though the work can reflect the lower risk of a well-governed group.
Does B-10 require OSFI audit rights in contracts?
For arrangements where it is relevant, the contract should give the institution and OSFI timely access to information and the right to audit.
Does B-10 cover cloud providers?
Yes. Cloud and technology providers are named as examples of third parties, and the guideline has a section on cloud-specific controls and portability.
Is a vendor risk assessment required under B-10?
A risk and criticality assessment is required before entering any arrangement and periodically after, with due diligence scaled to the result.
Sources
- OSFI — Third-Party Risk Management Guideline (B-10)
- OSFI — Guideline E-23, Model Risk Management (2027)
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.