OSFI E-23

• OSFI published the final Guideline E-23 on 11 September 2025; it takes effect on 1 May 2027 after an 18-month transition.
• It is principles-based and risk-based: the effort a firm spends on a model should match the model's risk rating.
• It is organised around 3 outcomes and 12 numbered principles: (1) model risk is understood and managed across the enterprise, (2) model risk is managed with a risk-based approach, (3) governance covers the whole model lifecycle.
• Its model definition names AI/ML methods directly and points to the OECD definition of an AI system. AI-specific expectations appear throughout: explainability, bias, black-box and autonomous models, self-learning drift and third-party libraries.
• It widens the 2017 E-23 (which covered only deposit-taking institutions) to all federally regulated financial institutions, including insurers and foreign branches; pension plans were dropped from the final version.
• Status (as of 2026-10-19): final but not yet in effect.

• All federally regulated financial institutions (FRFIs): banks, foreign bank branches, life insurance and fraternal companies, property and casualty companies, and trust and loan companies. Foreign bank and foreign insurance branches are covered to the extent consistent with Guideline E-4.
• Application is proportional to size, strategy, risk profile, nature and complexity of operations, and interconnectedness (A.3).
• All models are in scope, but only models with non-negligible inherent risk must go in the inventory and through full lifecycle governance.
• Not in scope: federally regulated pension plans (removed after consultation).
• Vendor and third-party models are covered through the institution's own duties and Guideline B-10 (Third-Party Risk Management).
• Not extraterritorial. Non-Canadian companies are reached only as vendors or parent groups of Canadian FRFIs.

• The guideline states no penalties. It sets supervisory expectations, not statutory offences.
• OSFI checks compliance through supervision; institutions should be able to show evidence that they are structured and resourced for sound model governance (Principle 1.1).
• OSFI did not add a grace period for third-party models, but its cover letter says an exceptions policy may allow limited use before validation is complete.
• The cover letter says OSFI will support institutions during the transition; it sets no specific interim milestones before 1 May 2027.

• Indian banks with Canadian subsidiaries or branches (for example ICICI Bank Canada): from 1 May 2027 every model, including AML, credit and treasury models, needs a risk rating, inventory entry, independent review, approval and monitoring proportionate to its risk. Start the model census and gap assessment now.
• IT, analytics and AI vendors supplying Canadian banks and insurers: model reviews may cover your platforms, sub-components, data and libraries (Principle 3.4), and deployment needs cyber and operational risk assessments (Principle 3.5). Expect requests for documentation, explainability evidence, data lineage, version update notices and support for decommissioning.
• Insurers: unlike PRA SS1/23 and the US guidance, E-23 also covers life and P&C insurers, so Indian insurers or insurtech suppliers with Canadian exposure are affected.
• Comparison with RBI: E-23 is the closest overseas match to where RBI is heading. RBI's draft model risk guidance (24 June 2026, still draft as of 2026-10-19) also covers AI and ML models, and RBI FREE-AI asks for board-approved AI policy, model inventory, explainability, bias checks and decommissioning. An E-23-aligned framework would cover most of that ground.
• Of the three model risk texts in this library, E-23 is the most AI-explicit; the US version (US Interagency MRM Guidance (SR 26-2, formerly SR 11-7)) carves out generative and agentic AI, while E-23 does not.

Principle numbers are from sections B to D of the guideline; section letters and numbers are given where no principle number applies.

• Approved MRM framework and model risk appetite.
• Org chart, role descriptions and resourcing analysis for MRM, including AI skills.
• Model identification survey results and triage records.
• Enterprise model inventory with all Appendix 1 fields, including decommissioned models.
• Risk rating methodology with criteria for autonomy, customer impact and data reliability, and evidence of trigger-based re-rating.
• Model rationale documents for AI/ML models, covering explainability needs, bias and privacy risks.
• Data governance evidence: lineage, quality check results, synthetic and proxy data controls.
• Independent review reports and approval records, including approvals with known limitations.
• Pre-deployment cyber and operational risk assessments and production test results.
• Monitoring dashboards, thresholds, contingency plans and criteria for material change in self-learning models.
• Decommissioning records and retained model archives.
• Third-party model files linked to B-10 vendor risk assessments.

• Waiting for May 2027. Building an enterprise inventory and rating every model takes longer than most teams expect.
• Treating E-23 as a banking-only rule; insurers and trust and loan companies are now in scope.
• Leaving vendor and foreign-office models out of the inventory.
• Rating AI models only on business size and ignoring autonomy, explainability and customer impact.
• Monitoring a self-learning model without a defined point at which change counts as "material" and triggers review and approval.
• Forgetting to check third-party libraries and version updates, which E-23 explicitly names.
• Deleting retired models instead of keeping them as benchmarks or fallbacks.

• OSFI: Office of the Superintendent of Financial Institutions, Canada's federal regulator for banks, insurers and federally regulated pension plans.
• FRFI: federally regulated financial institution, the set of firms OSFI supervises.
• Guideline: an OSFI document setting out supervisory expectations for sound practice.
• Inherent model risk: the risk a model carries before any controls are applied.
• Residual model risk: the risk left over after controls, validation and monitoring.
• Model risk rating: the risk tier assigned to a model, which decides how much scrutiny it gets.
• Model lifecycle: design, review, deployment, monitoring and decommission of a model.
• Explainability: how well people can understand why a model produced a given output.
• Self-learning model: a model that updates its own parameters as new data arrives.
• Synthetic data: artificially generated data used in place of, or alongside, real data.
• B-10: OSFI's guideline on third-party risk management.

• Final on 11 September 2025, effective 1 May 2027; status is supervisory with the effective date still ahead.
• Covers every model at every FRFI, including insurers and foreign branches; pension plans excluded.
• The most AI-explicit of the three model risk texts: AI/ML is in the model definition, and explainability, bias, autonomy, drift and third-party libraries are addressed directly.
• 24 obligations across 3 outcomes and 12 principles, from model identification to decommissioning.
• A strong template for Indian banks and vendors preparing for RBI's model risk guidance.

• Guideline E-23: Model Risk Management (2027), accessed 2026-10-19
• Guideline E-23 (2027) cover letter, accessed 2026-10-19
• Backgrounder: Guideline E-23, Model Risk Management, accessed 2026-10-19