OSFI’s Annual Risk Outlook – Fiscal Year 2023-2024

Introduction

This document provides OSFI’s 2023-2024 Annual Risk Outlook (ARO). It includes an overview of the current risk environment, as well as OSFI’s Supervisory and Regulatory actions.

The annex sets out our guidance priorities for federally regulated financial institutions (FRFIs) and federally regulated pension plans (FRPPs) for the 2023/2024 fiscal year.

 

Text description

Risk environment

The 9 financial risks that OSFI views as most pressing:

1. Housing market downturn risk
2. Liquidity and funding risk
3. Commercial real estate risk
4. Transmission risk from non-bank financial intermediaries sector
5. Corporate and commercial credit risk
6. Digital innovation risk
7. Climate risk
8. Cyber risk
9. Third party risk

Overview of changes to the risk environment

The financial system is adjusting to a higher interest rate environment. Given the rapidity at which interest rates globally have increased, the risk has grown that such an adjustment may not be completely smooth. This phenomenon places a premium on Canada’s notable financial system resiliency.

Other risks also present themselves on OSFI’s horizon. Growth and uncertainty in unregulated non-bank financial intermediation may increase the likelihood of risk transmission to the broader financial system during periods of volatility and market decline.

FRFIs and FRPPs face climate-related physical risks (e.g. weather events) and transition risks as Canada and its trading partners move toward a low greenhouse gas emitting or “low-carbon” economy. These climate-related risks in turn could exacerbate more traditional risks, including credit, market, insurance, and operational risks.

Geopolitical risks continue to contribute to market volatility and may increase the risk to the integrity and security of the financial sector and FRFIs.

Since the end of the Global Financial Crisis of 2008-09, OSFI has required that FRFIs increase their safety buffers (e.g., capital and liquidity requirements) to support their ability to operate through intensified bouts of financial system volatility.

Canadian FRFIs are now well-prepared to persevere through difficult situations, much more so than they were prior to the Global Financial Crisis.

Risk culture is critical to FRFI soundness

A FRFI’s culture can be a competitive advantage or an accelerant for reputational risks in the evolving risk environment.

Governance and promotion of a strong risk culture is critical to an institution’s continued soundness and ability to adapt to its risk environment. Strong and well-developed risk measurement, management, and internal challenge functions are critical to the ongoing financial and operational resilience of all FRFIs.

Non-financial risks also remain a key concern as reliance on third-party arrangements is growing and becoming more complex. Cyber-attacks continue to increase in frequency and sophistication.

We will be intensifying our focus on supervisory assessments of FRFIs’ capital, liquidity, and risk profiles to ensure they remain prudentially sound. OSFI will respond early and proactively to address vulnerabilities associated with a deterioration in a FRFI’s risk profile, in line with our stated risk appetite.

As announced in Budget 2023, the Government of Canada intends to introduce legislative amendments to modernize the federal framework to address emerging risks to Canada’s financial sector and to protect the integrity and security of FRFIs. OSFI will be working with the Department of Finance and other financial safety net partners to implement the changes announced in Budget 2023.

Highlighted risks and OSFI actions

OSFI assesses and manages a multitude of risks that can affect the FRFIs we regulate.

Below are nine key risks we are highlighting for the coming year. Although all risks are critical and we dedicate significant resources to addressing each, they are presented in perceived order of importance for the current risk environment.

---

1. Housing market downturn risk

Risk overview

The housing market changed substantially over the past year. Following record increases during the pandemic, house prices declined significantly in 2022. OSFI is preparing for the possibility that the housing market will experience continued weakness throughout 2023.

The steep increase in interest rates has eroded debt affordability. This is a growing concern from a prudential perspective. Mortgage holders may not be able to afford continued increases on monthly payments or might see a significant payment shock at the time of their mortgage renewal, leading to higher default probabilities.

Given the significant impact of real estate secured lending (RESL) activities in the Canadian financial system, a housing market downturn remains a key risk.

OSFI actions

Our supervisory work includes ensuring that FRFIs’ risk management practices are responsive to changing market conditions and that lending standards are aligned with Guideline B-20 (Residential Mortgage Underwriting Practices and Procedures) expectations.

FRFIs should ensure timely recognition of increased credit risk in provisions and capital management, and that proactive account management practices are in place to assist borrowers in times of stress. Prudent risk identification and sound decision making in residential mortgage lending practices are expected to be reinforced by Senior Management, with oversight from the Board, to ensure alignment to a FRFI’s risk appetite.

We continue to engage with industry on Combined Loan Plans to clarify the application of Guideline B-20 and supervisory expectations, as well as clarify communication on transitional arrangements and the applicable timelines.

This work is in addition to ongoing supervisory reviews and monitoring. We will continue monitoring mortgage asset quality closely for signs of credit deterioration.

We will continue to advance our holistic review of Guideline B-20 in 2023. We are currently assessing stakeholder feedback from the initial phase of the public consultation on Guideline B-20, which closed on April 14, 2023. In this consultation, OSFI has focused on debt serviceability measures designed to better control prudential risks arising from high consumer indebtedness. Feedback from the consultation will inform proposed changes to the guideline, which will be issued for public consultation in the form of a draft guideline.

The remainder of our review of Guideline B-20 will examine other areas to enhance credit quality and sound mortgage underwriting at FRFIs. We will also consider the scope of Guideline B-20, which currently focuses on mortgage origination, and assess whether expectations should extend to principles for management of existing mortgage accounts and incorporate more recent supervisory insights.

We continue to monitor the risk profiles of federally regulated deposit-taking institutions’ RESL lending activities. Notably, we are actively assessing the risks posed by variable rate fixed payment mortgages to determine whether the current capital treatment is fit-for-purpose or revisions are warranted.

Also, further to the administrative interpretations that OSFI issued to the Mortgage Insurer Capital Adequacy Test (MICAT) guideline in September 2022 for variable rate mortgages, we continue to monitor capital requirements for this group to ensure they remain appropriate.

---

2. Liquidity and funding risk

Risk overview

Liquidity and funding conditions will come under pressure as financial markets absorb the impact of monetary policy tightening, geopolitical uncertainties, and retrenched risk appetites of market participants in less certain economic conditions.

Asset repricing associated with rapidly rising interest rates and equity market downturns can also put downward pressure on the value and marketability of liquid asset holdings. These market forces will shape FRFIs’ access to wholesale funding as investors react to sector-wide or institution-specific stresses.

Unexpected liquidity demand can arise from sudden increases in derivative collateral calls, significant changes in borrower and depositor behavior, and liquidity draws from non-bank financial intermediaries or corporate clients. If markets were to tighten and clients begin holding cash reserves, liquidity draws are of particular concern for federally regulated deposit-taking institutions that lend to clients without operational relationships.

In addition, weakening mortgage performance can also trigger liquidity demand in securitization structures, impairing access to this funding channel and potentially causing second-order effects across other asset classes and funding markets. Distressed mortgage markets also increase cost and impair access to sources of emergency liquidity, both public and private.

As financial systems digitalize, the speed and amplitude of investor and depositor reactions to both environmental and idiosyncratic stresses will intensify. This phenomenon will challenge institutions and policy makers to adapt their business and regulatory infrastructure with agility and urgency.

These vulnerabilities may manifest as the slowdown in the general economy and weigh on households and industry.

OSFI actions

OSFI’s focus on market liquidity generally, and FRFIs’ liquidity positions specifically, will intensify.

We screen to detect early warning signals via material changes in deposit stability, funding access, and counterparty credit exposures. We are currently evaluating FRFIs’ liquidity coverage against stressed collateral needs, particularly those that could arise from derivatives hedging interest rate risk in the banking book and/or insurance and pension liabilities.

In addition, we are in the process of assessing FRFIs’ contingent exposures, such as put-back risks, to RESL assets backing secured funding structures, and other forms of liquidity guarantees extended to non-bank financial intermediaries (NBFI).

We expect FRFIs to maintain a robust, realistic, and actionable contingency funding plan and regularly conduct stress testing using scenarios relevant to the current risk environment to identify and act on potential vulnerabilities. We conducted a group review of contingency funding plans and expect FRFIs to align practices with our expectations set out in Guideline B-6 (Liquidity Principles).

We will implement revisions to capital and liquidity guidance, updated for Basel III reforms, in the first half of 2023. Revisions include increased risk sensitivity, provision of more granular data, and for liquidity risk, reducing any reporting lags significantly. This will ensure a fast and effective regulatory response should conditions begin to deteriorate. Standards also empower us to establish non-public supervisory minimums (e.g., net cumulative cash flow metric for liquidity) which can be set to higher levels in anticipation of potential stress.

Liquidity availability and the management of liquidity risk are fundamental for all financial institutions. We plan to issue a discussion paper on liquidity risk focused on insurance companies in the first half of 2024.

---

3. Commercial real estate (CRE) risk

Risk overview

Construction and development (C&D) and office assets are sub-segments facing the highest degree of uncertainty in the coming year. High inflation, potential rise of borrower defaults, reduced housing demand and on-going supply chain issues will continue to put pressure on C&D.

Hybrid work arrangements and reduction in staffing levels are likely to affect demand and, over time, have a negative impact on office asset valuations. Macroeconomic developments, particularly consumer spending preferences, can also have a negative impact on retail assets’ post-covid recovery.

Industrial properties have continued to see material increases in valuations. Sustainability of this trend, however, is uncertain given potential changes to the supply and demand mix. Stress-to-asset performance and/or valuation could lead to increased losses to institutions given the size of the commercial real estate sector.

OSFI actions

We are conducting targeted monitoring to identify signs of borrower and portfolio vulnerabilities. Our supervisory work includes enhanced monitoring of provisioning and account management practices, relative to exposure to capital.

FRFIs should expect follow-up questions, supervisory reviews, and detailed data requests as we consider the evolving and potentially longer-term nature of the issues confronting CRE lenders. We will continue to consider the merits of developing specific supervisory expectations for this sector.

In February 2023, OSFI updated our capital requirements to incorporate Basel III reforms. These updates included, among other amendments, more granular capital requirements for CRE lending. In particular, OSFI now requires additional capital for higher risk CRE exposures such as land development or projects with higher loan to value ratios. We will monitor the implementation and will adjust the framework as needed if issues are uncovered. We are also reviewing the capital requirements applicable to commercial exposures of mortgage insurers.

---

4. Transmission risk from non-bank financial intermediaries (NBFI) sector

Risk overview

Unrestrained money issuance, along with alternative credit strategies and structures within the NBFI sector, were key contributors to the global financial crisis in 2008-2009.

Since that time, the NBFI sector has continued to grow as a percentage of global financial assets and is now larger than the banking portion by some metrics (accounting for about 50% of financial assets globally). The NBFI sector is composed of broad categories of entities, including insurers, pension funds, financing companies, independent broker-dealers, and regulated and unregulated investment funds.

In times of elevated volatility, margin requirements throughout the financial system can surge for both margin exchanged bilaterally between counterparties and margin delivered to central counterparty clearinghouses (CCPs). As a result, CCPs could see their systemic role magnified. If CCP capital requirements and default fund rules are not appropriately stressed, measured, or anticipated, member default risk could be transmitted broadly.

The NBFI sector has taken on significant amounts of credit and liquidity transformation, which are traditional bank-like activities, while being subject to limited or no prudential regulations. The growth and associated direct and indirect interconnectedness with the banking system has created a potential structural vulnerability. NBFIs could amplify and transmit risk back to the financial system during market downturns.

OSFI actions

We have been conducting a cross-system review focused on higher risk transactions with higher risk NBFIs to identify areas where current practices need to be improved. We expect to engage with senior management of the large banks in the early part of the calendar year to share our observations.

We are conducting monitoring and information gathering to identify activities and transactions which may result in higher amounts of leverage or have “hidden leverage” embedded within their structure.

Counterparty risk is a key area of focus and recent events have highlighted the directs risks this can pose to FRFIs and the potential for contagion effects.

---

5. Corporate and commercial credit risk

Risk overview

Corporate and commercial debt remains a significant exposure for FRFIs. Economic uncertainties remain high across all jurisdictions, and there is the potential that a low-growth environment could persist for some time.

Geopolitical tensions, supply chain challenges and tightening of global financial conditions will continue to impact industries and put pressure on borrowers.

Persistent high inflation and the commensurate rapid rise in interest rates is increasing borrower financing costs, slowing new origination volumes and potentially challenge refinancing efforts. A significant portion of the corporate exposure includes leveraged loans (including covenant-lite loans) that contain higher vulnerabilities and fewer protections for FRFIs. Leveraged loans are particularly vulnerable to refinancing challenges which could result in higher risk exposures or losses.

OSFI actions

We are conducting FRFI-specific monitoring to assess borrower vulnerabilities in corporate and commercial debt exposures, leveraged loan risk management practices, relative provisions, and impacts on capital.

We are also conducting supervisory reviews of corporate and commercial loans, with a focus on syndication deals, to assess responses to the heightened credit risk environment, risk ratings, and account management practices.

---

6. Digital innovation risk

Risk overview

Digital innovation continues to accelerate and alter the way financial services are delivered.

While recent collapses of multiple cryptocurrency firms and projects (e.g., FTX, Celsius, Terra Luna) may imply diminishing risks for the mainstream financial sector, it is possible that the industry will recover.

Paired with the advancement in areas such as Artificial Intelligence/Machine Learning (AI/ML) (e.g., ChatGPT, Harvery) and the promise of quantum computing, potential risks and impacts emanating from digital innovation continue to grow.

OSFI actions

We are engaging with institutions as they innovate or partner with firms to offer new products and services. Areas of focus include strategic execution, business models, data governance, model risks, technology risks, and operational risks (e.g., third party, fraud, transaction processing).

Through the monitoring of the risks arising from emerging technologies, we are exploring systemic and institutional vulnerabilities associated with digital innovations including blockchain applications (e.g., cryptoassets, stablecoins, digital currencies, CeFi/DeFi), AI/ML, open finance, quantum computing, and other technologies.

We are engaging with other regulatory agencies, research centers and other industry practitioners (e.g., the Financial Industry Forum on Artificial Intelligence) to discuss how to enhance our current approach to ensure we effectively supervise these new risks. In addition, we will continue conducting supervisory reviews, surveys, and industry scans of evolving FRFI business models and activities.

We continue to work with other government agencies and international organizations to assess the implications of digital money innovations on our regulatory framework. We remain committed to updating our approach as needed to reflect ongoing developments, particularly in line with the Department of Finance legislative review focused on the digitalization of money.

We have also communicated the update to Enterprise-Wide Model Risk Guidance (E-23) to accommodate the increased use of models, stemming from broad adoption of AI/ML across regulated institutions.

As well, we have continuous engagement with Innovation, Science and Economic Development Canada (ISED) to ensure alignment of our guidance with future legislation (Artificial Intelligence and Data Act (AIDA) – Bill C27).

---

7. Climate risk

Risk overview

FRFIs and FRPPs are facing climate-related risks from both increasing physical risks (i.e., from climate change-related weather events) and transition risks (i.e., transition to a low greenhouse gas emitting or “low carbon” economy).

These climate-related risks in turn drive more traditional risks, including credit, market, insurance, and operational risks. For example, an increase in the frequency and severity of physical risks events may potentially impact exposed insurance liabilities, invested assets, and loan portfolios.

In addition, as FRFIs and FRPPs strive to meet climate-related public net-zero emissions target commitments and disclosure obligations, they could become increasingly exposed to climate-related legal and reputational risks.

Finally, there are heightened transition risks if global policy actions are delayed and Canada undergoes a more aggressive transition given the carbon-intensive make-up of its domestic economy. These factors can increase the probability of system-wide and institution-specific financial stress. 

OSFI actions

We will supervise climate-related risks in accordance with new principles-based regulatory expectations as recently published in Guideline B-15: Climate Risk Management.

These expectations seek to ensure that FRFIs advance their climate-related governance and risk management capabilities, increasing their resilience to both physical and transition risks. These expectations will be integrated with OSFI’s new Supervisory Framework, which is one of our transformational Blueprint initiatives.

To help build our and FRFI climate risk assessment capabilities, we are seeking to collect, analyze, and disclose new climate risk data. We are also planning to develop a standardized climate scenario analysis exercise that all FRFIs will undertake in 2024. This scenario exercise will incorporate learnings from two ongoing joint projects with the Bank of Canada: one on transition risk and one on a single-peril physical risk (flooding). The standardized climate scenario exercise will also build on the scenario analysis pilot work and report released in 2022.

Our principal regulatory response to address climate-related financial risks is reflected in the publication of Guideline B-15. This new Guideline details our foundational expectations for FRFIs to:

• Enhance their readiness and understand and manage the climate-related risks inherent in business plans and strategies
• Adopt appropriate climate-related governance, risk management, and disclosure practices
• Ensure they remain operationally and financially resilient to climate-related risks

In the near-term, we are actively working with the Bank of Canada and CDIC to develop a regulatory return to collect climate-related risk data from FRFIs, which will be an iterative process that will evolve as climate data matures.

Lastly, we have been expanding our engagement activities with stakeholders. We continue to build relationships and advance climate risk policy with domestic and international partners, taking leadership roles at different international fora (e.g., Basel Committee on Banking Supervision, Network for Greening the Financial System. and the International Association of Insurance Supervisors).

Later in 2023, We will be launching a domestic Climate Risk Forum to raise awareness and build capacity amongst stakeholders on the evolution of our climate risk management framework. The Climate Risk Forum will leverage industry information sessions, roundtables, and workstreams to help accelerate FRFIs’ readiness to manage climate-related financial risks, further strengthening public confidence in Canada’s financial system.

---

8. Cyber risk

Risk overview

Cyber-attacks continue to increase in frequency and sophistication. Evolving technology, combined with greater dependance on third-party technology providers, have increased both the attack surface and cyber risk.

Considering recent geopolitical events, the tactics used by nation states and non-nation state cyber actors have brought heightened attention to cyber risks given the interconnectivity of the global financial system and technology-based infrastructures. As new regional or global conflicts emerge, the risks from either targeted cyber-attacks and/or their fallout could become more prevalent.

A successful cyber-attack could result in impacts to the confidentiality, integrity, and availability of data and computer systems, which could result in loss of public trust, reputational damage, and financial loss.

OSFI actions

As noted in our 2022-2023 ARO, we piloted our own “intelligence-led cyber resilience testing” (I-CRT) to help institutions identify weaknesses in technology and cyber security controls to test their overall cyber resiliency. In spring 2023, we will publish an I-CRT framework to serve as an implementation guide for FRFIs to conduct periodic I-CRT assessments.

We will continue to work closely with FRFIs to monitor and adapt proactively to the cyber threat environment, conducting supervisory reviews of their technology and cyber risk management practices and transformative initiatives.

In response to rising technology and cyber threats and risks, we issued the Technology and Cyber Risk Management Guideline B-13 in July 2022, with an effective date of January 1, 2024. Guideline B-13 is risk-based guidance that allows FRFIs to compete and take full advantage of digital innovation while maintaining sound technology risk management. We strongly encourage FRFIs to self-assess against this guideline and ensure compliance with its expectations.

---

9. Third party risk

Risk overview

The financial services industry continues to expand its use of third-party arrangements.

Increased dependency on external arrangements heightens the risk that FRFIs could be unable to deliver critical services or that their data could become compromised. Third-party providers may also have external arrangements of their own, which creates additional complexity for oversight.

Geographic concentration of suppliers increases the risk of disruption arising from other risks such as natural disasters and climate-related or geopolitical events.

The emergence of dominant technology service providers and the frequency and severity of cyber incidents have also increased the risk of a systemic event. A 2022 telecommunications outage underscored the far-reaching impacts of a service provider disruption that operates both as a third party to many FRFIs and an important subcontractor to many other third parties.

OSFI actions

We are leveraging the learnings from a third-party data submission pilot in 2022-23 with a subset of FRFIs. We plan to work with industry to improve the consistency and quality of third-party risk data collected.

Enhancements are expected to expedite data aggregation, analysis and reporting processes, and improve the ability to identify trends and vulnerabilities associated with third-party arrangements that could impact the operational resilience and reputation of FRFIs.

Guideline B-10: Third-party Risk Management will be released in April 2023. Consistent with global regulatory trends and the expansion and complexity of the third-party ecosystem, the final revised Guideline B-10 applies beyond FRFI outsourcing arrangements to encompass a broad and comprehensive scope of third-party arrangements.

Final revised Guideline B-10 also reinforces the expectation that FRFIs manage their third-party arrangements proportionate to the level of risk and criticality of each arrangement, as well as the size, nature, scope, complexity of operations, and risk profile of the FRFI.

Annex

Guidance priorities

This annex updates our near-term plan of guidance priorities for FRFIs and FRPPs. The references below reflect calendar quarters and cover the periods from Q2 2023 to Q2 2024.

Our guidance priorities are divided into three streams: (i) Risk Management Guidance for FRFIs, (ii) Capital and Accounting Guidance for FRFIs and (iii) Guidance for FRPPs.

The timelines indicated below reflect our strategic plans and risk priorities. Plans may be changed or amended due to external factors causing us to reconsider the dates for the guidance impacted.

I. Risk management guidance for FRFIs

Deposit-taking institutions and insurance companies

II. Capital and accounting guidance for FRFIs

Deposit-taking institutions and insurance companies

III. Guidance for FRPPs

Private pension plans