What are OSFI guidelines, and are they binding?
By Nick Jang, founder of MINERVA Studio ·
The short answer
OSFI guidelines are the written expectations OSFI sets for federally regulated banks, insurers and trust and loan companies, on capital, liquidity, risk management and governance. Most are not law in the way a statute is, but OSFI supervises against them, and an institution that ignores one can expect supervisory findings, a higher intervention stage and, for unsafe practices, a direction of compliance. In practice they are treated as mandatory.
Guidelines, regulations and the rest of OSFI’s guidance
Federal financial institutions answer to three layers. At the top are the statutes: the Bank Act, the Insurance Companies Act and the Trust and Loan Companies Act. Below them are regulations, made by the federal Cabinet, which are law. Then there’s OSFI’s own guidance, published in its guidance library in several forms:
- Guidelines set out what OSFI expects, often as principles with outcomes. E-23 on model risk and B-10 on third-party risk are guidelines.
- Advisories explain how OSFI reads a statute or a rule.
- Letters announce transitions, clarify a guideline or ask the industry for information.
- Bulletins, such as the July 2026 technology risk bulletin on generative and agentic AI, set out sound practices without being guidelines themselves.
The letter and number on a guideline (B-10, E-23) are an identifier inside OSFI’s library. What matters is the category, and most of the ones a risk team works with sit under “Sound Business and Financial Practices”.
Are OSFI guidelines legally binding?
Strictly speaking, no. But nobody at a bank treats them as optional, and here’s why:
- Supervision is done against it. OSFI’s supervisors assess each institution against its guidelines, and weaknesses become findings the institution must fix, with dates.
- Some guidelines carry a statute. The Bank Act requires a bank to maintain adequate capital and lets the Superintendent set guidelines on it, so the Capital Adequacy Requirements guideline is how that legal duty is measured. The same pattern holds for insurers’ capital tests.
- OSFI has tools beyond the guideline. It can raise an institution’s intervention stage, impose terms on its business, and issue a direction of compliance where it sees an unsafe or unsound practice. A direction is legally enforceable.
Guidelines are applied proportionately: OSFI expects a small trust company to meet the same outcomes as a large bank, with a lighter programme. Proportionality changes how much, never whether.
The OSFI guidelines risk and technology teams use most
| Guideline | What it covers | Status |
|---|---|---|
| E-23 Model Risk Management | Every model, including AI and machine learning: inventory, risk rating, independent review, approval, monitoring. | Final 11 Sept 2025; in effect 1 May 2027. |
| B-10 Third-Party Risk Management | Every third-party arrangement, from due diligence and contracts to monitoring and exit. | In effect 1 May 2024. |
| B-13 Technology and Cyber Risk | Technology governance, operations and resilience, and cyber security. See also incident reporting and the self-assessment. | In effect 1 January 2024. |
| E-21 Operational Risk and Resilience | Operational risk management, critical operations, tolerances for disruption, scenario testing. | Published Aug 2024; full adherence by 1 Sept 2026; scenario testing by 1 Sept 2027. |
| E-13 Regulatory Compliance Management | The compliance function, the Chief Compliance Officer and the compliance framework. | Issued Nov 2014. |
| B-15 Climate Risk Management | Governance and risk management of climate-related risks, and climate disclosure. | Published March 2023, phased in from fiscal 2024. |
| B-20 Residential Mortgage Underwriting | Mortgage underwriting standards, including the minimum qualifying rate. | In force; revised over time. |
| Corporate Governance | Board and senior management roles and oversight. | In force. |
| Integrity and Security | Protecting the institution from threats to its integrity and security, foreign interference included. | Published 31 Jan 2024; in effect 31 Jan 2025, background checks 31 July 2025. |
| B-12 Interest Rate Risk Management | Interest rate risk in the banking book: measurement, limits, shock scenarios and the outlier test. | 2027 version published 10 Sept 2026; in effect 1 Nov 2026 or 1 Jan 2027. |
| CAR, LAR, LICAT, MCT | Capital and liquidity for banks and insurers. | Updated regularly, often yearly. CAR 2027 in effect 1 Nov 2026 or 1 Jan 2027. |
Capital guidelines change the most often. OSFI usually consults on the Capital Adequacy Requirements and the insurance capital tests each year and publishes a new version with an effective date, so a team should track the version, not just the name.
How to keep track of OSFI guidelines
OSFI lists every current guideline in its online guidance library, filterable by sector and category, with the date it was issued and the date it takes effect. It also publishes a forward-looking regulatory plan that says which guidelines it intends to consult on next. For each guideline that applies, an institution typically keeps a gap assessment, an owner, a plan with dates and the evidence that the plan was carried out, which is exactly what a supervisor asks to see.
For model and AI guidelines in particular, the evidence is the hard part: who approved which model, on what review, with what open findings. That’s the record MINERVA keeps; see how it maps to E-23, B-10 and B-13.
Related questions
What happens if a bank does not follow an OSFI guideline?
OSFI raises supervisory findings the bank must fix. Persistent or serious weaknesses can raise its intervention stage and lead to restrictions on its business or a direction of compliance.
Do OSFI guidelines apply to credit unions?
To federal credit unions, yes. Provincially regulated credit unions follow their province’s rules, though provincial regulators often draw on OSFI’s guidelines.
What is OSFI B-15?
OSFI’s Climate Risk Management guideline, published in March 2023. It sets expectations for governing and managing climate-related risks and for climate-related disclosure, phased in from fiscal 2024 with the largest institutions first.
What is OSFI E-23?
OSFI’s Model Risk Management guideline. The current version was published on 11 September 2025 and takes effect on 1 May 2027; it covers AI and machine-learning models. See our guide to OSFI E-23.
Does OSFI consult before issuing a guideline?
Usually. OSFI publishes a draft, invites comments for a set period, then publishes the final guideline with a transition period before it takes effect.
Sources
- OSFI — Guidance library
- OSFI — Guideline E-23, Model Risk Management (2027)
- OSFI — Guideline B-10, Third-Party Risk Management
- OSFI — Guideline E-21, Operational Risk Management and Resilience
- Bank Act, section 485 (adequacy of capital)
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.