OSFI’s Guideline B-13, Technology and Cyber Risk Management sets out how federally regulated financial institutions (FRFIs) should manage technology and cyber risk. OSFI published it in July 2022 and stated that it would be effective as of January 1, 2024.
Like Guideline B-10, B-13 applies to FRFIs, not directly to their suppliers. But when a bank or insurer relies on your platform, your controls become part of its technology risk. Fintechs and technology vendors should expect B-13 to shape the questions they receive.
The three domains
B-13 is organized around three outcomes.
1. Governance and risk management
FRFIs are expected to have clear accountability for technology and cyber risk, a technology and cyber strategy, and a risk management framework covering appetite, policies and monitoring. For vendors, this shows up as questions about your own governance: who owns security, how risk is assessed and reported, and how often leadership reviews it.
2. Technology operations and resilience
This domain covers architecture, asset management, the system development life cycle, change and release management, patching, incident and problem management, and disaster recovery. B-13 says asset management should include third-party assets that store or process FRFI information, and that disaster recovery testing should include critical third-party technologies and integration points.
That language matters for vendors. Expect requests to participate in recovery tests, to provide your recovery objectives, and to explain how changes to your service are controlled and communicated.
3. Cyber security
The cyber domain follows a familiar cycle: identify, defend, detect, respond and recover. It includes threat and vulnerability assessment, data classification, layered controls, cryptography, identity and access management including multi-factor authentication, secure configuration baselines, application scanning, centralized logging and incident response.
What vendors and fintechs should prepare
- Secure development evidence. Show how security is built into your development process: code review, dependency management, application scanning and pre-release testing.
- Vulnerability and patch management. Define timelines by severity and be able to show that you meet them.
- Independent testing. Regular penetration tests of external surfaces, applications and APIs, with remediation tracked to closure. Many institutions ask for a summary letter or executive report.
- Identity and access. Multi-factor authentication for administrative and remote access, least privilege, and periodic access reviews.
- Logging and detection. Centralized logs, defined alerting and a way to share relevant events with clients when needed.
- Incident response. A tested plan that includes notifying affected financial institution clients promptly.
- Resilience. Documented recovery time and recovery point objectives, tested backups and a willingness to join a client’s exercise.
How B-13 fits with other frameworks
B-13 is principles-based and does not prescribe a specific framework. In practice, a vendor with a mature ISO/IEC 27001 management system or a SOC 2 Type 2 report will already have much of the evidence an FRFI wants. Where cardholder data is involved, PCI DSS remains a separate requirement.
The gap is often in the technical detail: secure configuration, testing depth and resilience exercises. That is where independent validation adds value beyond a certificate.
Fintechs at an earlier stage should not wait for a certificate before acting. A documented control set, a recent penetration test with tracked remediation and a tested recovery plan already answer many of the questions an institution’s technology risk team will ask.
A practical sequence
- Map your current controls against the three B-13 domains and note gaps.
- Prioritize gaps that clients actually ask about: testing, MFA, patching, recovery.
- Commission an independent test and fix what it finds.
- Package the results with your certificate or report into a standard evidence pack for financial institution clients.
- Review it at least annually and after major changes.
How we can help: Ubitrak performs penetration testing and assessments, KW Consulting delivers IT projects and remediation, and Accel GRC maps controls to B-13 and other frameworks. See security testing, remediation, our Ubitrak division, or contact us.
Sources
Does this apply to you? A free 30-minute consult maps the requirement to your systems and tells you what to do next.
Book a free consult