OSFI B-10: Third-Party Risk Guide for Canadian Banks

What Is OSFI B-10?

OSFI B-10 is the Office of the Superintendent of Financial Institutions' guideline for third-party risk management, requiring Canadian federally regulated financial institutions (FRFIs) to assess, monitor, and manage risk from vendors, cloud providers, and outsourced service providers across the full relationship lifecycle. It replaced a 2009 guideline and took effect May 1, 2024.

Who Does OSFI B-10 Apply To?

OSFI B-10 applies to all federally regulated financial institutions in Canada, including domestic banks, foreign bank branches, insurance companies, and trust and loan companies. Requirements scale proportionally to an institution's size and the criticality of its third-party arrangements, but no federally regulated FI is exempt.

What Changed From the 2009 Guideline?

The prior guideline predated cloud computing and modern outsourcing models and focused mainly on initial due diligence. OSFI B-10 introduces continuous monitoring requirements, a comprehensive risk-classified inventory of all third-party arrangements, defined exit strategies for critical vendors, and explicit board and senior management accountability — a significant shift from point-in-time assessments to ongoing risk management.

Key Requirements Under OSFI B-10

• Third-Party Inventory: A complete, risk-classified register of all arrangements, updated continuously.
• Risk Assessment: Due diligence proportionate to the criticality and complexity of each arrangement before onboarding and throughout the relationship.
• Contract Standards: Mandatory contractual provisions for critical arrangements including audit rights, data residency, business continuity, and exit rights.
• Continuous Monitoring: Ongoing oversight of vendor performance and risk profile — not just annual reviews.
• Fourth-Party Risk: Understanding and managing risk introduced by a critical vendor's own subcontractors.
• Exit Planning: Documented, tested plans for terminating critical third-party arrangements without disrupting operations.
• Board Reporting: Regular reporting to senior management and the board on third-party risk concentration and program performance.

Demonstrating Compliance

Institutions demonstrate OSFI B-10 compliance by maintaining a current, risk-classified third-party inventory, evidencing continuous monitoring rather than annual reviews, showing contractual controls like audit rights and exit provisions are in place for critical vendors, and providing the board with regular reporting on third-party risk concentration.

Frequently Asked Questions

OSFI's Examination Approach Under B-10

OSFI supervises federally regulated financial institutions through a risk-based examination cycle. For third-party risk, examiners assess whether institutions have implemented a framework proportionate to their size and the complexity of their vendor relationships. B-10 provides the standard; OSFI's supervisory expectations communicated through annual supervisory letters and examination feedback provide the operational detail.

Common examination findings under B-10:

• Incomplete inventory. Institutions that lack a comprehensive, risk-classified register of all third-party arrangements are typically asked to remediate this as a first step. OSFI expects the inventory to be maintained continuously, not compiled at examination time.
• Proportionality gaps. Institutions that apply the same due diligence intensity to all vendors regardless of criticality, or that apply only light-touch reviews to high-criticality arrangements, both fail the proportionality test.
• Insufficient fourth-party visibility. For critical cloud and technology arrangements, OSFI examiners increasingly ask institutions to demonstrate that they understand the subcontractor chain, not just that they have asked their vendor for disclosure.
• Exit strategy gaps. Plans that exist on paper but have never been tested, and plans written at onboarding and not updated as the relationship evolved, are both examination findings.

OSFI B-10 vs. DORA: Compliance for Multi-Jurisdiction Firms

Canadian financial institutions with EU operations must satisfy both OSFI B-10 and the EU's Digital Operational Resilience Act (DORA), which took effect January 17, 2025. The two frameworks share a common architecture — both require comprehensive third-party inventory, lifecycle management, contract standards, and board reporting — but differ in specific requirements that matter for programme design.

Key differences that affect multi-jurisdiction programmes:

• Critical provider designation. DORA establishes a formal ESA-led process for designating critical ICT third-party providers. OSFI B-10 does not have an equivalent designation regime; institutions make their own criticality determinations based on the guideline's principles.
• Contractual minimums. DORA Article 30 specifies minimum contractual provisions with considerable specificity. OSFI B-10's contract requirements are principles-based, giving institutions more flexibility but less certainty about what will satisfy an examiner.
• Exit plans. DORA requires documented exit strategies for critical ICT providers and expects institutions to demonstrate substitutability. OSFI B-10 requires exit strategies for critical arrangements broadly and expects the exit strategy to be tested.

Institutions operating under both frameworks are best served by building to the higher standard on each dimension: DORA's contract specificity combined with OSFI B-10's breadth of arrangement coverage and exit testing requirements.

Fourth-Party Risk Under OSFI B-10: What It Means in Practice

OSFI B-10's fourth-party provisions are among its most consequential requirements for technology-intensive institutions. A fourth party is a subcontractor of a direct vendor — the entity that delivers the cloud infrastructure your SaaS vendor runs on, or the data centre operator that physically houses the servers your core banking platform uses.

Most third-party risk programmes stop at the direct vendor relationship. Under B-10, institutions must understand and, where material, assess the risk introduced by the subcontractors of critical vendors. This requires:

• Contractually requiring critical vendors to disclose their material subcontractors and notify the institution when that sub-contractor chain changes.
• Assessing whether any single fourth party creates concentration risk — if multiple critical vendors use the same cloud infrastructure provider, the institution has a fourth-party concentration risk that does not appear in the direct vendor inventory.
• Understanding the geographic footprint of the fourth-party chain, particularly for data residency and operational resilience purposes.

Technology and Cloud-Specific Requirements Under B-10

OSFI B-10 applies to all third-party arrangements, but technology and cloud arrangements receive particular attention. OSFI's Cloud Adoption Guidance (2020) and FRFI Advisory on Cyber Security Incident Reporting complement B-10's requirements for this category. For cloud arrangements specifically, OSFI expects institutions to address:

• Data classification and residency. Understanding what data is stored in cloud environments, whether residency requirements are met, and whether the cloud provider's data centre locations are consistent with the institution's commitments to regulators and customers.
• Shared responsibility model documentation. Each major cloud provider publishes a shared responsibility model defining which security controls the provider handles and which are the customer's responsibility. OSFI expects institutions to have reviewed this model and addressed any gaps on the customer side.
• Configuration management. Cloud misconfiguration is one of the most common causes of data exposure incidents. OSFI expects systematic processes for identifying and remediating configuration errors in cloud environments.

OSFI B-10 Compliance Roadmap

Institutions building or remediating their B-10 compliance programmes should sequence their efforts as follows:

Immediate priorities (0-90 days): Conduct a gap assessment against B-10's requirements using the guideline's own structure as the framework. Identify the most significant gaps in inventory completeness, due diligence quality for critical arrangements, contract provisions, and exit plan documentation. Escalate the gap assessment to senior management and establish a remediation programme with accountable owners and deadlines.

Medium-term priorities (90-180 days): Complete the third-party inventory and establish a risk classification methodology. Initiate contract reviews for critical arrangements to identify missing provisions. Begin developing or improving exit plans for critical arrangements, including specifying substitution sources for each critical vendor.

Ongoing programme: Establish the continuous monitoring cadence for each risk tier. Implement board and senior management reporting on third-party risk concentration and programme performance. Build fourth-party visibility into due diligence and monitoring processes. Run annual exit plan exercises for at least one critical arrangement per year.

How OSFI B-10 Compares to the US Interagency Guidance

Canadian institutions with US subsidiaries or US parent companies often need to align their third-party risk programmes with both OSFI B-10 and the OCC/Fed/FDIC 2023 Interagency Guidance on Third-Party Relationships. The two frameworks share a lifecycle management structure and a principles-based approach, but OSFI B-10 is more explicit about fourth-party risk and exit testing requirements, while the US guidance provides more detailed treatment of fintech partnerships and Banking-as-a-Service arrangements.

Institutions maintaining programmes under both frameworks can typically achieve compliance with a single programme by adopting the more specific requirement where the two frameworks differ. A programme that addresses both produces a stronger framework than either alone and demonstrates regulatory maturity across multiple supervisory relationships.