What should an OSFI B-10 checklist cover?
By Nick Jang, founder of MINERVA Studio ·
The short answer
A B-10 checklist follows the life of a supplier: a framework the board owns, an inventory of third parties sorted by risk and criticality, due diligence before signing, a written contract with the Annex 2 terms, monitoring and incident handling while it runs, and a tested exit plan. How deep you go on each line depends on how risky and how critical the arrangement is.
Before you start: scale it
B-10 is proportionate, and a checklist that treats every supplier the same will drown your team. The office coffee service and the core banking provider are both third parties. Only one of them needs a stressed-exit playbook.
So the first column of any useful checklist isn't a tick box. It's the arrangement's risk (what could go wrong and how badly) and its criticality (how much a failure would hurt a critical operation). Everything below gets heavier as those two rise. The guideline has applied since 1 May 2024, and our overview of B-10 covers the eleven principles behind it.
The framework and the inventory
- The board and senior management accept that the institution stays accountable for third-party risk, whatever it hands to a supplier.
- One enterprise-wide third-party risk management framework covers the whole life of an arrangement, from sourcing to exit.
- The framework names who does what, sets a third-party risk appetite with metrics, and describes the method for rating risk and criticality.
- There's an inventory of third parties, sorted by risk and criticality. B-10 asks for one but doesn't list its fields, so decide them: owner, service, data shared, subcontractors, location, contract dates, last assessment, next review.
- The framework is reviewed regularly and after things go wrong, so past incidents change it.
Risk, criticality and due diligence before signing
For criticality, B-10 points at four questions: how bad a failure or insolvency would be, how easily you could substitute the supplier, how much it supports a critical operation, and what it would take to exit or bring the work back in-house.
Due diligence is scaled to the result. For a high-risk or critical supplier, cover the factors in the guideline's first annex:
| Area | What to check |
|---|---|
| Capability | Technical competence, experience and capacity, the supplier's own subcontractors included |
| Soundness | Financial strength, insurance, reputation, litigation and complaints |
| Controls | Risk management, internal controls and reporting; information security; ability to manage technology and cyber risk and report incidents in time |
| Resilience | Business continuity and disaster recovery, and how often and how well they're tested |
| Dependence | Subcontractors, concentration, location, how hard it is to substitute and how portable the service is |
| Fit | Legal and regulatory compliance where it operates, political and legal risk, values and conduct |
Check concentration before you sign as well as after: too much on one supplier, one subcontractor or one region inside the institution, and the systemic kind, where many institutions lean on the same provider.
The contract: Annex 2
For high-risk and critical arrangements, B-10's second annex lists what the written agreement should address. It reads like a contract review checklist, which is how most teams use it:
- nature and scope of the arrangement;
- roles and responsibilities, technology and cyber included;
- use of subcontractors;
- pricing;
- performance measures;
- ownership and access;
- security of records and data;
- notifications to the institution;
- dispute resolution;
- regulatory compliance;
- business continuity and recovery;
- default and termination;
- insurance;
- prudent risk management, including timely access to information and audit rights for the institution and OSFI.
This list summarizes the annex's headings. The guideline's own text says what each heading should contain; read it with counsel before you redline a contract.
While it runs: monitoring, incidents and exit
- Monitor delivery against the contract and the supplier's financial health, arrangement by arrangement and in aggregate.
- Use metrics and thresholds that show residual risk is inside the appetite, with clear triggers for escalation.
- Require the supplier to report material events promptly, and keep documented incident processes that reach its subcontractors too.
- Make sure a supplier's incident can feed your own OSFI incident reporting on time, and ask for root-cause analysis and a remediation plan you then track.
- For high-risk and critical arrangements, document exit plans with triggers, a stressed-exit playbook (failure or insolvency) and a non-stressed one (a planned move), enough detail to act quickly, and a regular review.
Two lines often get missed. The first is AML: an outsourced screening or monitoring service is a third party like any other, and FINTRAC's rules still sit with you. The second is AI. A supplier can add or swap a model inside a tool you already use, so ask about it at onboarding and at every review. Our page on AI vendor risk under B-10 walks through that.
Where MINERVA fits
MINERVA keeps the third-party side of the record: each supplier with its owner, its assessment and reassessment dates, the models that depend on it and the decisions taken about it. It doesn't replace your contract review or legal advice. See AI vendor risk.
Related questions
Does OSFI publish an official B-10 checklist?
No. The guideline sets out principles and two annexes, one on due diligence and one on contract provisions. Institutions build their own checklists from them.
Does every supplier need the full checklist?
No. B-10 is proportionate. Low-risk, non-critical arrangements get lighter due diligence and monitoring; high-risk and critical ones get the full treatment, including the Annex 2 contract terms and documented exit plans.
Does B-10 require a third-party register?
It asks for an inventory of third parties delineated by risk and criticality. It doesn't prescribe the fields, so institutions define them.
How often should third parties be reassessed?
B-10 asks for assessment before an arrangement starts and periodically after, at a frequency that reflects its risk and criticality. The institution sets the cycle in its framework.
Do intragroup services count?
Yes. Services from affiliates are third-party arrangements under B-10, though the work can reflect the lower risk of a well-governed group.
Sources
- OSFI — Third-Party Risk Management Guideline (B-10)
- OSFI — Technology and Cyber Security Incident Reporting
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.