What is OSFI Guideline E-13?
By Nick Jang, founder of MINERVA Studio ·
The short answer
OSFI Guideline E-13, Regulatory Compliance Management (RCM), sets out how a federally regulated financial institution should manage the risk of breaking the laws and regulations that apply to it. Issued in November 2014, it asks for an enterprise-wide compliance framework with eight elements, overseen by a Chief Compliance Officer who is independent of the business, reports to the board and gives an opinion on compliance at least once a year.
What E-13 is for
A mid-sized Canadian bank answers to hundreds of legal requirements at once: consumer protection, privacy, anti-money laundering, tax reporting, sanctions, securities rules, and the financial statutes on top. E-13 doesn’t list any of them. What it asks is simpler and harder: know which ones apply to you, have controls that keep you inside them, and be able to prove those controls work.
OSFI calls the risk it addresses regulatory compliance risk: the risk of not complying with applicable laws, rules and regulations. The current text dates from 30 November 2014 and replaced OSFI’s 2003 Legislative Compliance Management guideline. It applies to banks, foreign bank branches, life, fraternal and property and casualty insurers, foreign insurance branches, and trust and loan companies.
The eight elements of an RCM framework
E-13 sets a minimum: the framework must have these eight parts, scaled to the institution’s size and complexity.
- The role of the Chief Compliance Officer, with a written mandate.
- Procedures to identify, assess, communicate, manage and mitigate regulatory compliance risk, including keeping track of new and changed requirements.
- Day-to-day compliance procedures in the business lines, which own the controls.
- Independent monitoring and testing of those controls.
- Internal reporting to senior management and the board.
- The role of Internal Audit, or another independent function, in reviewing the framework itself.
- Adequate documentation.
- The role of senior management in overseeing the framework and acting on findings.
The Chief Compliance Officer under E-13
At the heart of E-13 is one person. Somebody has to own compliance risk for the whole institution, and that somebody can’t be running a business line or chasing revenue at the same time. They need the seniority to tell the business “no” and make it stick. OSFI calls them the Chief Compliance Officer, or equivalent.
The CCO should have a documented mandate, unfettered access to people and information, and a direct functional reporting line to the board. At least once a year the CCO assesses whether day-to-day controls are adequate and followed, and gives an opinion on compliance across the enterprise. Material non-compliance and its remediation are reported to the board as they arise, not saved for the annual report.
E-13 doesn’t ask for a separate CCO in every business. It asks that oversight be independent of what is being overseen, and that the board hear from the person who holds it.
How E-13 connects to models and AI
Compliance teams rely on models more every year. Transaction monitoring, sanctions screening, know-your-customer risk scoring and regulatory reporting all run on rules engines, statistical models or AI. Two consequences follow:
- Those systems are models under E-23 when they turn data into results through assumptions or statistics. A transaction-monitoring model needs an owner, a risk rating, an independent review and monitoring like any credit model, and regulatory risk is one of the factors in its rating. See what counts as a model.
- A weak compliance model is a compliance failure, not just a model failure. The CCO’s annual opinion leans on evidence that the monitoring model was validated and is performing, so the model record and the compliance record need to meet.
Regulatory change is the other link. New rules, such as E-23 itself or OSFI’s AI bulletin, have to be identified, assessed and assigned an owner under element 2 of the framework.
E-13 compared with E-21 and B-10
| Guideline | The risk | Who usually owns it |
|---|---|---|
| E-13 | Breaking a law or regulation | Chief Compliance Officer |
| E-21 | Losses or disruption from failed processes, people, systems or external events | Chief Risk Officer and operational risk |
| B-10 | Risk arising from third parties, including AI vendors | Third-party risk management, often under the CRO |
The three overlap. A vendor that mishandles customer data creates a third-party incident, an operational loss and a privacy compliance breach at once, and each guideline asks for its own view of it.
Related questions
When was OSFI E-13 issued?
The current version was issued on 30 November 2014. It replaced the 2003 Legislative Compliance Management guideline.
Does E-13 require a Chief Compliance Officer?
It requires a person independent of operational management to hold overall responsibility for compliance risk, designated at least functionally as the CCO or equivalent, with a direct functional line to the board.
How often must the RCM framework be reviewed?
At least once a year, with the CCO’s opinion on enterprise-wide compliance and reports to senior management and the board.
Does E-13 cover anti-money laundering?
AML is part of regulatory compliance, but OSFI and FINTRAC also have specific AML expectations. E-13 provides the overall framework those sit inside.
Is E-13 the same as E-23?
No. E-13 is regulatory compliance management; E-23 is model risk management. They meet where compliance relies on models.
Sources
- OSFI — Regulatory Compliance Management (RCM), Guideline E-13 (2014)
- OSFI — Corporate Governance Guideline
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.