OSFI B-13 compliance for Canadian financial services
OSFI B-13 has been in force since 2024-01-01, and the first question isn't which controls to buy. It's whether the guideline binds you at all. For a lot of the firms that ask us it doesn't, and they're still answering for it through somebody else's programme.
By the numbers
Years of experience
Enterprise deployments
Senior engineers
Support
Which rules apply to you?
A photo means it applies to you now. A white tile depends on you. A dark tile isn't in force yet.
- Applies now
OSFI B-13
Technology and cyber risk across three domains: governance, technology operations and resilience, and cyber security. It binds federally regulated institutions, and only those.
In force 2024-01-01
- Applies now
OSFI B-10
Third-party risk, and the route by which B-13 reaches suppliers who aren't regulated themselves. It reaches subcontractors too, which is why the questionnaire asks about your suppliers.
In force 2024-05-01
- Applies conditionally
Provincial credit union regimes
Credit unions are provincially regulated, with three federal exceptions. Ontario, British Columbia and Quebec run operational resilience expectations of their own.
If you're a credit union in Ontario, British Columbia or Quebec.
- Not yet in force
OSFI E-23
Model risk management, covering AI and machine learning models whether you built them or bought them. The only item here with runway left.
In force 2027-05-01
- Not yet in force
CCSPA (Bill C-8)
Banking is one of six Schedule 1 sectors. Schedule 2 is empty, so no organisation carries the duty today.
Royal assent 2026-06-15
Which services answer them?
- AI Governance E-23 covers AI models from 2027-05-01. Model inventory and approval records, built.
- Third-Party Risk Management B-10 expects you to evidence it, not assert it.
- SOC 2 Compliance Services The report your enterprise customers ask for before signing.
- ISO 27001 Certification Support Where an international counterparty prefers the ISO route.
- Penetration Testing Testing at the cadence your regulator and your customers expect.
- Identity and Access Management Segregation of duties, provable per transaction.
- Cloud Security B-13 doesn't exempt anything because it's managed.
- Managed Security Services (MSSP) Detection that runs after hours, which is when it matters.
- Cybersecurity Consulting Where the three B-13 domains meet, and where most gaps sit.
Whose kit does this run on?
The platforms we design, build and support. Named because a buyer with an estate already standardised on one of them needs to know before the first call, not after it.
Cisco, Palo Alto, F5, Azure, AWS, VMware
What do you need from us?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Sector
- Financial Services and Fintech
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584