If you sell to a Canadian bank, insurer or trust company, you have probably noticed longer due diligence, new contract clauses and more frequent evidence requests. Much of that traces back to OSFI’s Guideline B-10, Third-Party Risk Management.
OSFI published the final guideline on 30 April 2023, and it came into effect on 1 May 2024. B-10 applies to federally regulated financial institutions (FRFIs), not to suppliers directly. But its expectations land on suppliers through contracts and oversight.
Who counts as a third party?
The definition is broad. B-10 covers “any type of business or strategic arrangement” between an FRFI and another entity or individual, by contract or otherwise, other than customer relationships and employment. The guideline gives examples such as outsourced services, professional consultants, cloud service providers, utilities, telecommunications and subcontractors in the supply chain.
In other words, B-10 is not limited to traditional outsourcing. If you provide software, data, infrastructure or services to a FRFI, you are likely in scope of its program.
What FRFIs must do, and what that means for you
Risk-based assessment
The guideline is proportionate: FRFIs assess arrangements according to risk and criticality, and B-10 states that the FRFI remains ultimately accountable for the risks of all third-party arrangements. Expect to be asked how critical your service is, what data you handle and what would happen if you were unavailable.
Due diligence before and during the relationship
B-10 describes due diligence covering areas such as financial condition, legal and regulatory compliance, technical capability, business continuity and how you manage your own subcontractors. Have current evidence ready rather than assembling it under deadline.
Contract terms
For higher-risk and critical arrangements, B-10 expects written agreements that address roles and responsibilities, performance, data security, audit rights and termination. Common requests include:
- rights for the institution, and OSFI, to access information and audit;
- notification, or approval, before you change material subcontractors;
- prompt notification of incidents that affect the service;
- data location, protection and return or destruction at the end of the contract.
Incident notification
B-10 expects third parties to report incidents promptly so the FRFI can meet its own reporting obligations. Check that your incident response plan includes customer notification steps with realistic timeframes.
Exit planning and concentration
For critical arrangements, FRFIs need documented exit plans for both planned and stressed exits. They must also consider concentration risk, both on a single provider and across the sector. Be prepared to explain how a client could move off your service in an orderly way.
Ongoing monitoring
Due diligence is not a one-time event. FRFIs monitor performance, financial soundness and residual risk. Expect annual or periodic re-assessments, updated questionnaires and requests for refreshed reports.
How suppliers can get ahead
- Hold recognized independent evidence. An ISO/IEC 27001 certificate, a SOC 2 Type 2 report or, where card data is involved, PCI DSS validation reduces the number of questions and gives reviewers something they can rely on.
- Know your own subcontractors. Keep an up-to-date list of material subcontractors and how you oversee them. B-10 expects FRFIs to look down the supply chain.
- Prepare a standard evidence pack. Policies, recent penetration test summary, business continuity test results, insurance certificates and incident process.
- Review your contract templates. Decide in advance what audit, notification and exit terms you can accept, so legal reviews do not stall each deal.
- Consider the companion guideline. Technology and cyber expectations come from OSFI’s Guideline B-13. Banks often assess vendors against both.
How we can help: Ubitrak helps suppliers prepare the independent evidence financial institutions ask for, Accel GRC tracks controls and evidence over time, and KW Consulting supports remediation. See a security review, security testing, remediation, our KW Consulting division, or contact us.
Sources
Does this apply to you? A free 30-minute consult maps the requirement to your systems and tells you what to do next.
Book a free consult