What is OSFI Guideline E-21?
By Nick Jang, founder of MINERVA Studio ·
The short answer
OSFI Guideline E-21, Operational Risk Management and Resilience, published on 22 August 2024, asks every federally regulated financial institution to manage operational risk within an approved appetite and to keep its critical operations running through severe but plausible disruptions. Institutions were expected to adhere fully by 1 September 2026, with scenario testing done for all critical operations by 1 September 2027.
What E-21 covers
Operational risk is the boring-sounding risk behind most of the bad days in banking: a data centre goes dark, a payments file goes out twice, a ransomware crew gets in, a key supplier folds. E-21 ties two ideas together. Operational risk management keeps those risks inside a limit the board signed off on. Operational resilience assumes some of them will happen anyway, and asks whether customers can still get their money when they do.
It applies to all FRFIs, including foreign bank and insurance branches, in proportion to their size, strategy and complexity.
The three outcomes and eight principles
OSFI expects three outcomes: operational risk practices support resilience; operational risks are managed within the approved appetite and limits; and critical operations continue to be delivered through disruptions. Beneath them sit eight principles.
| Principle | In plain words |
|---|---|
| 1. Governance | The framework and the resilience approach are governed, documented and actually used. |
| 2. Framework | An enterprise-wide operational risk management framework is in place. |
| 3. Risk appetite | An operational risk appetite is set and kept to. |
| 4. Identification and assessment | Operational risks are found and assessed across the institution. |
| 5. Monitoring and reporting | Operational risks are monitored and reported continuously. |
| 6. Critical operations and mapping | Critical operations are identified, and their dependencies mapped end to end. |
| 7. Tolerances for disruption | A maximum tolerable disruption is set for each critical operation. |
| 8. Scenario testing | Tests check that critical operations stay within tolerance in severe but plausible scenarios. |
Critical operations, mapping and tolerances
A critical operation is a service or product whose disruption would threaten the institution’s viability or safety, or harm other institutions or the financial system. Making payments, giving customers access to deposits and settling trades are typical examples.
For each one, E-21 asks the institution to map what it depends on, end to end: people, technology, processes, information, facilities and third parties. Mapping is where weak points surface, such as a single vendor behind three critical operations, or an AI service nobody listed.
Then comes the tolerance for disruption: the most disruption the operation can absorb before the harm is unacceptable, measured in outage time, data loss, reduced service or customer impact. A tolerance is usually wider than the risk appetite, because it describes how bad a day can get, not how bad an ordinary month should be.
The E-21 timeline
| Date | What OSFI expects |
|---|---|
| 22 August 2024 | Guideline published. Sections on governance and operational risk management apply right away. |
| 1 September 2026 | Full adherence: critical operations identified and mapped, tolerances for disruption set. |
| 1 September 2027 | Scenario testing done for all critical operations. |
OSFI said it would check progress selectively during the transition. Scenario testing is meant to mature, starting with table-top exercises and moving towards simulations and live tests, and to be repeated when the risk environment changes.
Where AI meets E-21
E-21 doesn’t name artificial intelligence, but AI now sits inside critical operations: fraud scoring in payments, chat assistants in customer service, document extraction in lending. OSFI’s July 2026 bulletin on generative and agentic AI, which builds on E-21, B-13 and B-10, asks institutions to:
- map AI dependencies, internal and external, to the critical operations they support;
- test AI outages, with manual fallbacks that work;
- judge how replaceable each AI service is, and report material concentration on a few providers to senior management and the board;
- include AI disruption in continuity and recovery testing.
In practice that starts with an inventory that links each AI model, agent and vendor to the operations that depend on it. Our guide to OSFI’s AI bulletin covers the rest.
Where MINERVA fits
MINERVA isn’t a business continuity tool and doesn’t run scenario tests. It keeps the record E-21 mapping leans on for AI: every model, agent and AI supplier with its owner and rating, and what depends on each, hop by hop, so a supplier’s outage shows the operations it reaches. See third-party AI vendor risk software.
Related questions
When does OSFI E-21 take effect?
It was published on 22 August 2024 with governance and risk management sections applying immediately. Full adherence was expected by 1 September 2026 and scenario testing for all critical operations by 1 September 2027.
What is a tolerance for disruption?
The maximum level of disruption, in downtime, data loss or customer impact, that a critical operation can absorb under severe but plausible scenarios before the harm becomes unacceptable.
What is a critical operation under E-21?
A service or product whose disruption would put the institution’s continued operation, safety and soundness, or other institutions and the financial system at risk.
Does E-21 replace B-10 or B-13?
No. E-21 sits beside them: B-10 covers third-party risk, B-13 technology and cyber risk, and E-21 operational risk and resilience overall.
Is E-21 the same as business continuity planning?
It is broader. Continuity plans are one tool; E-21 also asks for an operational risk framework, an appetite, mapping, tolerances and scenario testing.
Sources
- OSFI — Operational Risk Management and Resilience, Guideline E-21
- OSFI — Operational Risk Management and Resilience, letter on the transition
- OSFI — Backgrounder: Guideline E-21
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.