OSFI B-13

Nothing changed in the last 90 days. Sign in to read further back.

1. 2026-06-15 The Critical Cyber Systems Protection Act (S.C. 2026, c. 9), which names the Superintendent of Financial Institutions among its regulators, receives Royal Assent; its provisions come into force by order
2. 2025-11-03 OSFI publishes the updated technology and cyber risk management self-assessment tool
3. 2024-02-22 OSFI amends B-13 to clarify its application to foreign branches
4. 2024-01-01 Guideline B-13 becomes effective

1. 2024-02-22
   Guideline B-13 (amended February 2024) RevisionCurrent

   Clarified that B-13 applies to foreign bank branches and foreign insurance company branches to the extent consistent with their obligations in Canada; OSFI says this does not change its practical application to branches. source

2. 2022-07-13
   Guideline B-13 (final, July 2022) Major version

   Final guideline on technology and cyber risk management, effective 1 January 2024. source

   More

   • OSFI described the final text as less prescriptive than the draft, with clearer definitions and expectations.

OSFI's expectations for technology and cyber risk at every FRFI, organised in three domains and meant to be implemented risk-based rather than as a checklist.

Who

All FRFIs, including foreign bank branches and foreign insurance company branches, to the extent consistent with applicable requirements and legal obligations for their business in Canada. source

Domains

Governance and risk management; technology operations and resilience; cyber security. source

Risk-based

There is no one-size-fits-all approach; the guideline should be read and implemented according to the FRFI's size, the nature, scope and complexity of its operations and its risk profile. source

Institutions manage and test their own controls, may use OSFI's voluntary self-assessment tool, and must report technology and cyber incidents to OSFI within 24 hours.

Threat testing

FRFIs should set triggers and minimum frequencies for intelligence-led threat assessments and regularly run tests such as penetration testing and red teaming. source

Self-assessment tool

OSFI's voluntary technology and cyber risk management self-assessment tool is aligned with B-13 and rates each process or control on a 0-5 maturity scale. source

Incident reporting

Report a technology or cyber security incident to OSFI's Technology Risk Division and the Lead Supervisor within 24 hours, or sooner if possible. source

OSFI supervises adherence as part of its judgment-based supervisory framework, with intervention stage ratings anchoring its actions.

Supervision

OSFI's supervisory framework, announced to take effect in April 2024, is judgment-based; intervention stage ratings are the anchor for its intervention activities. source

Ratings

Institutions receive a viability risk rating on an 8-point scale and, for larger ones, ratings of operational resilience and risk governance among others. source

1. Standard Guideline B-13 - Technology and Cyber Risk Management
2. Guidance OSFI releases final Guideline B-13 (letter, 13 July 2022)
3. Guidance Technology and Cyber Security Incident Reporting (advisory)
4. Template Technology and cyber risk management self-assessment tool
5. Law text Critical Cyber Systems Protection Act (S.C. 2026, c. 9, Part 2)

1. OSFI cyber self-assessment

   OSFI's voluntary questionnaire for measuring an institution's maturity against B-13.

2. APRA CPS 234

   Australia's binding information security standard for APRA-regulated entities, with a 72-hour incident notification.

3. DORA

   The EU regulation on digital operational resilience for financial entities.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to OSFI B-13 (RSS)