OSFI B‑13 · B‑10 · E‑21
OSFI B‑13, B‑10 and E‑21 compliance
Gap assessment, intelligence-led testing and third-party risk review for federally regulated financial institutions, mapped to the controls you already run.
WHO IT APPLIES TO
WHICH INSTITUTIONS THE GUIDELINES COVER
OSFI’s guidelines B‑13 (Technology and Cyber Risk Management), B‑10 (Third-Party Risk Management) and E‑21 (Operational Risk Management and Resilience) apply to all federally regulated financial institutions (FRFIs): banks and foreign bank branches, cooperative credit associations, life insurance and fraternal companies, property and casualty insurers, foreign insurance branches, and trust and loan companies.
They are supervisory guidelines, not statutes, so breaching one is not in itself a fineable offence. OSFI responds through supervisory findings and intervention, which can escalate to formal measures such as a direction of compliance under the institution’s governing statute.
WHAT EACH GUIDELINE COVERS
The practical shift is the same one DORA and NIS2 created in the EU: senior management that is accountable for technology and cyber risk, under board oversight, contracts with third parties that give OSFI and the institution audit rights, and evidence that the controls were tested and operated as intended, not just that a policy exists.
B‑13, B‑10 and E‑21 are each owned by a different team and need different evidence.
OSFI B‑13: TECHNOLOGY AND CYBER RISK
Covers three domains: governance and risk management, technology operations and resilience, and cyber security. It expects FRFIs to “regularly perform tests and exercises… using an intelligence-led approach,” naming penetration testing and red teaming directly, and to maintain a cyber incident response team available on a continuous basis.
OSFI B‑10: THIRD-PARTY RISK
Covers every third-party arrangement, technology vendors included, with intensity scaled to risk: due diligence, written agreements that give the FRFI and OSFI the right to evaluate and audit high-risk and critical arrangements, oversight of subcontractors, and contract terms that support OSFI’s incident reporting expectations, such as a duty to “promptly notify the FRFI” of technology and cyber security incidents.
OSFI E‑21: OPERATIONAL RESILIENCE
Sections 1 and 2 have applied since August 22, 2024 and section 4 since September 1, 2025. The whole guideline has applied since September 1, 2026, and scenario testing must be completed for every critical operation by September 1, 2027. E‑21 asks the follow-up question: when a B‑13 or B‑10 control fails, does the critical operation stay within its tolerance for disruption?
NO FINE, A SUPERVISORY RELATIONSHIP
None of B‑13, B‑10 or E‑21 sets a fine. What they set is a supervisory relationship: findings, remediation timelines, and — if ignored long enough — the kind of attention no FRFI wants from its regulator.
How we work with you
B‑13 gap assessment
Governance, technology operations and cyber security mapped against the guideline’s three domains, starting from the ISO 27001 or NIST controls you already run.
Intelligence-led testing
Penetration testing and red team assessments scoped the way B‑13 describes them: driven by relevant threat intelligence, not a generic checklist.
B‑10 third-party review
Due diligence criteria, contract clauses covering audit rights and incident notification, and subcontractor oversight for your critical technology vendors.
E‑21 critical operations mapping
Identifying critical operations, setting tolerances for disruption, and building the severe-but-plausible scenarios OSFI expects you to test against.
Incident response readiness
A cyber incident response capability and a reporting workflow built around OSFI’s stated expectations.
Evidence pack
Assessment results, test evidence and remediation status structured for a supervisory review, not just an internal audit.
A gap assessment across B‑13, B‑10 and E‑21, starting from the controls you already run.
Do OSFI guidelines carry fines, like DORA or NIS2?
No. B‑13, B‑10 and E‑21 are supervisory guidelines, not statutes, and none of them sets a penalty schedule. That does not make them optional. OSFI’s response to a gap is supervisory: findings, required remediation, closer monitoring and, if a gap persists, formal intervention such as a direction of compliance, whose breach can carry an administrative monetary penalty.
Does OSFI actually require penetration testing?
In substance, yes. B‑13 expects FRFIs to “regularly perform tests and exercises… using an intelligence-led approach,” and its examples are penetration testing and red teaming.
What is the deadline for E‑21?
Full adherence and operationalization were expected by September 1, 2026. If your critical operations aren’t yet mapped with tolerances for disruption, that milestone has already passed. The next one is completed scenario testing for all critical operations, due September 1, 2027.
Do you have Canadian clients?
Yes. We have worked with clients in Canada, and under NDA we cannot name them.
Our certificates
Team portfolio
Where to start?
You can copy our materials only after making sure that your services are safe.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.