What is OSFI’s Integrity and Security Guideline?
By Nick Jang, founder of MINERVA Studio ·
The short answer
OSFI’s Integrity and Security Guideline, published on 31 January 2024, sets out what every federally regulated financial institution should do to protect itself against threats to its integrity and security, foreign interference included. It has two outcomes and ten principles, covering conduct and culture on one side and the security of premises, people, technology, data and third parties on the other. Everything had to be in place by 31 January 2025, except background checks, which were due by 31 July 2025.
Why OSFI wrote it
In June 2023 Parliament amended the OSFI Act through Bill C-47. Since then OSFI’s mandate has included checking that banks and insurers have adequate policies and procedures to protect themselves against threats to their integrity or security, and the Act names foreign interference as one of those threats. A new mandate needed a yardstick, and this guideline is it. OSFI described it as the building blocks it would use to judge how institutions are doing.
None of the ideas are new on their own. Background checks, codes of conduct and physical security were already normal at any bank. What changed is that OSFI now expects them to work as one programme, with the board able to see it.
Two outcomes, ten principles
The guideline is short. It has two outcomes, and each outcome has its own principles.
| Outcome | Principles | What it means in practice |
|---|---|---|
| Integrity: actions, behaviours and decisions match the letter and intent of laws, rules and codes of conduct. | Character · Culture · Governance · Compliance | Responsible persons are suitable for their roles, the culture rewards honest conduct, oversight is clear and compliance actually works. |
| Security: operations, premises, people, technology assets and data are resilient and protected against threats. | Physical premises · People · Technology assets · Data and information · Third-party risks · Undue influence, foreign interference and malicious activity | Buildings, staff, systems, data and suppliers are each protected, and the institution watches for people trying to sway it from outside. |
Several principles lean on other guidelines rather than repeating them. Technology assets point to B-13, third parties to B-10, and compliance to E-13. Where the guideline refers to another one, that guideline’s own timeline applies.
Background checks
This is the part most institutions had to build out, and it’s why it got six more months. OSFI expects risk-based background checks for responsible persons, employees and contractors:
- done before someone starts, not after;
- renewed on a regular cycle, and repeated off-cycle when something changes;
- at least confirming identity and background, with criminal record and credit checks for higher-risk roles;
- scaled to the role, so a trader with system access gets more scrutiny than a temporary receptionist.
OSFI can also ask that particular people get a higher security clearance. Contractors count. A consultant with administrator rights to the core banking system needs checking just as much as the staff around them.
Foreign interference and reporting
The guideline defines foreign interference as clandestine or deceptive activity, or activity involving a threat, that harms Canada’s interests and aims to influence, intimidate or corrupt people or institutions on behalf of a foreign actor. For a bank it can look like pressure on an employee, an unusual ownership structure in a supplier, or a board candidate with undisclosed ties.
When there are reasonable grounds to believe an incident has happened, OSFI encourages institutions to report it to CSIS and the RCMP, and expects to be told immediately when they do. That expectation started on the day the guideline came out. Incidents below that threshold aren’t ignored either. They should be documented, kept in an inventory and reported to senior management.
Third-party due diligence picks up the same thread. When assessing a supplier, institutions should consider where it operates, any links to foreign governments and who really owns it.
The timeline
| Date | What OSFI expected |
|---|---|
| June 2023 | Bill C-47 amends the OSFI Act and widens OSFI’s mandate to integrity and security. |
| 31 January 2024 | Guideline published. Notifying OSFI of reports to law enforcement starts immediately. |
| 2 April 2024 | Responses to OSFI’s information request on existing policies due. |
| 31 July 2024 | Implementation plans shared with OSFI. |
| 31 January 2025 | All new and expanded expectations met, except background checks. |
| 31 July 2025 | Background check expectations met. |
All of those dates have passed. OSFI now supervises against the guideline as written, so the conversation has moved from "do you have a plan" to "show me it works".
Where AI comes in
The guideline doesn’t mention artificial intelligence. AI still touches several principles. A model trained on customer data is a data security question. An AI vendor hosted abroad is a third-party and foreign-ownership question. A generative tool that staff paste confidential files into is all of those at once. OSFI’s July 2026 AI bulletin is where the AI-specific expectations live, and it points back to the same guidelines.
The practical first step is knowing which AI systems you run and who supplies them. MINERVA keeps that record, each model, agent and AI supplier with its owner, and what depends on it. See third-party AI vendor risk.
Related questions
When did the OSFI Integrity and Security Guideline take effect?
It was published on 31 January 2024. Most expectations applied from 31 January 2025 and the background check expectations from 31 July 2025. Notifying OSFI about reports to law enforcement applied immediately.
Who does the Integrity and Security Guideline apply to?
All federally regulated financial institutions, including foreign bank branches and foreign insurance company branches, applied in proportion to their size and risk.
Do contractors need background checks under the guideline?
Yes. OSFI expects risk-based checks for responsible persons, employees and contractors, done before they start and renewed over time, with deeper checks for higher-risk roles.
Who should an institution report foreign interference to?
OSFI encourages reports to CSIS and the RCMP where there are reasonable grounds to believe an incident occurred, and expects to be notified immediately when a report is made.
Is the Integrity and Security Guideline the same as B-13?
No. B-13 covers technology and cyber risk. The Integrity and Security Guideline is broader, covering conduct, culture, people, premises, data and foreign interference, and it refers to B-13 for technology.
Sources
- OSFI — Integrity and Security Guideline
- OSFI — Assistant Superintendent Tolga Yalkin’s media briefing on the final guideline (31 January 2024)
- Office of the Superintendent of Financial Institutions Act
- McCarthy Tétrault — OSFI issues final Integrity and Security Guideline
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.