Chapter 2: Our key accomplishments

In 2024-25, we continued to focus on the following strategic priorities, as outlined in our 2024-27 Strategic Plan:

• Integrity and security regime
• Supervisory renewal
• Culture
• Data management and analytics
• Critical functions
• Operational resilience

Integrity and security regime

Public confidence in Canada’s financial system relies on the integrity and security of its financial institutions. While financial institutions possess well-developed systems and processes to identify and respond to today’s complex and evolving risk environment, we support their understanding of current threats related to integrity and security, including risks of foreign interference. We also provide guidance on measures to strengthen their resilience. To manage their integrity and security risks effectively, we require financial institutions to implement appropriate policies and procedures as outlined in OSFI’s Integrity and Security Guideline.

Over the past year, we have examined national security issues affecting financial institutions we oversee by utilizing national security assessments and advice to inform our oversight activities. We have also collaborated closely with security and intelligence partners, as well as government departments and agencies. Our efforts have contributed to the GoC’s efforts to prevent, detect, and deter integrity and security threats against the financial sector.

Given the rapidly changing threat landscape, we initiated a range of activities in 2024-25 to address integrity and security risks:

• Continued to strengthen our relationships with security and intelligence partners to better assess integrity and security risks during approval processes and supervisory activities and to enhance the resilience of financial institutions to national security threats.

• Conducted holistic assessments of security risks posed by individuals and entities influencing financial institutions, with a particular focus on foreign jurisdictions.

• Facilitated classified threat briefings between the Canadian security and intelligence community and select financial institutions to discuss insights and assess geopolitical, cyber, and insider threats to them.

• Engaged in direct discussions and conducted targeted reviews and data analysis related to non-financial risks that underpin the integrity and security of financial institutions’ risk management.

• Collaborated with the private sector, Department of Finance, FINTRAC, and FCAC to deepen our understanding of how technology advancements, such as AI, could impact a broad range of risks related to integrity and security.

Supervisory renewal

We supervise financial institutions to determine whether they are in sound financial condition and comply with regulatory and supervisory requirements. Similarly, we oversee pension plans to confirm they meet minimum funding and other statutory obligations. A critical aspect of our supervisory work is evaluating the overall risk management practices of financial institutions to verify their alignment with the evolving risk environment in which they operate. As external risks and trends continue to change, establishing the right conditions and expectations, along with the consistent application of regulations and policies, is essential to enable timely risk responses and reinforce public confidence in the financial system.

Supervisory reporting

Part of our work involves sharing letters and other supervisory information with certain provincial regulators, where agreements are in place. Supervisory ratings and any changes to these ratings are communicated privately to the institution through written letters. These supervisory letters also serve to remind financial institutions of the legal prohibitions against inappropriate disclosure of supervisory information.

We similarly share information with foreign regulators under established agreements. Continuing our practice of convening colleges of supervisors to facilitate information sharing among regulators and to strengthen the supervision of Canada’s largest banks, we hosted five supervisory colleges in 2024-25. Financial institutions participate on a rotating basis to promote effective consolidated supervision.

2024-25 Supervisory activities

A supervisory approach for the future

Good prudential supervision is vital to protect the safety and soundness of Canada’s financial system. On April 1, 2024, we implemented the most transformative overhaul of our supervisory approach in 25 years with the introduction of our new Supervisory Framework. The modernized framework applies to both financial institutions and pension plans and is tailored where necessary to reflect the evolving risk dynamics, and distinctive characteristics of deposit-taking financial institutions, insurance companies, and pension plans.

While our new framework is still principles-based and forward-looking, it is designed to respond quickly to the most serious risks and provide greater transparency to financial institutions through the following:

• A 5-point scale Tier Rating that guides our work to identify risks and helps us apply our risk appetite. The tier rating is based on size, complexity, and potential for contagion.

• An expanded 8-point Overall Risk Rating scale for more nuanced risk assessments and better integrated critical risk categories such as business risk and operational resilience.

• For larger financial institutions, we include ratings for business risk, financial resilience, operational resilience, and risk governance.

• The Intervention Stage Rating continues along the existing scale; however, the new framework is more responsive to changes in risk, meaning financial institutions are likely to see their rating change more frequently, helping them address outcomes related to supervisory concerns.

Monitoring regulatory capital

We continuously monitor financial institutions’ regulatory capital positions and respond promptly to ensure they effectively manage risks and maintain financial resiliency.

To support this work, in 2024-25, we released the following guidelines:

• We published the OSFI guideline on International Financial Reporting Standards 17 (IFRS 17) Insurance Contracts in November 2024, which strengthens stability of the financial system. The guideline clarifies the accounting for certain insurance products and transactions to address concerns identified by stakeholder during the IFRS 17 transition project in Canada. The guideline also marks the completion of a seven-year project aimed to align accounting standards for all IFRS filers globally and support well-informed decision-making related to capital buffers for insurers, strengthening the stability of the financial system.

• We published the final Life Insurance Capital Adequacy Test Guideline in November 2024, which came into effect on January 1, 2025. The revision includes a new framework to determine capital requirements and improve segregated fund guarantee risk sensitivity for life insurers, adjusts the available capital calculation and the Base Solvency Buffer, and includes transition measures.

• Following public consultation that closed in September 2023, we published the final guideline on the Capital and Liquidity Treatment of Crypto-asset Exposures – Banking Guideline and Capital Treatment of Crypto-asset Exposures Insurance Guideline in February 2025 (with an effective date of November 2025 to January 2026). The final guideline aims to make sure that banks and insurers hold adequate capital and implement the appropriate liquidity treatment for their crypto-asset exposures.

• Throughout 2024-2025, we consulted with stakeholders on our draft guidelines that incorporated the Basel Committee on Banking Supervision final Pillar 3 standard on crypto-asset exposure disclosures by financial institutions, published in August 2024. As a result of the feedback received, we published final amendments to the Pillar 3 Disclosure Guidelines for domestic systemically important banks (D-SIBs)^{Footnote 1} and small and medium-sized deposit-taking institutions (SMSBs) in February 2025. The guidelines incorporate the crypto-asset disclosure requirements effective for the fiscal Q1 2026 reporting period.

• We announced a 60-day public consultation on proposed revisions to the Capital Adequacy Guideline in February 2025. At the same time, we deferred scheduled increases to the Basel III capital floor and committed to providing affected banks with at least two years’ notice before resuming any increases. While the proposed revisions are likely to enhance the financial resilience and stability of Canada’s financial system, there remains uncertainty about whether other jurisdictions will fully implement Basel III. Final implementation was paused to confirm that Canada’s banks will be well positioned to compete internationally.

• We issued the revised regulatory notice on commercial real estate (CRE) lending in November 2024, to clarify and reinforce expectations around forbearance practices for CRE lending. The updated expectations highlight the importance of prudent forbearance practices, including sound internal policies, limits, risk governance, and monitoring.

• We continued to provide guidance on risk management practices, such as the release of Guideline E-21: Operational Risk Management and Resilience to minimize the frequency and intensity of disruptions and losses and consider critical operations. We also released Guideline B-15: Climate Risk Management, which focuses on building resilience against climate-related risks to financial institutions.

To see our complete list of current guidance for financial institutions, consult OSFI’s Guidance library.

Policy modernization

Our Policy Modernization initiative aims to improve how we develop policy by focusing on timely, risk-based regulatory responses using the appropriate policy instruments. It seeks to ensure the right response, with the right tools, for the right risks, at the right time by:

• Providing enhanced predictability and transparency in our policy processes.
• Removing redundancy, duplication, and ineffective regulatory expectations.
• Offering greater clarity, focus, and accessibility in our policy documents.

As part of this initiative, we conducted a Policy Review, rescinding 20 guidelines and advisories assessed as outdated, redundant, or no longer fit-for-purpose. To enhance transparency and predictability, we adopted a new approach where we issue draft and final guidance and announcements on predetermined quarterly dates. These releases are followed by a dedicated industry day during which our experts are available to answer questions from stakeholders. In 2024-25, we held three successful and well-attended industry day events.

Supervision institute

The Supervision Institute supports our supervisors in achieving excellence in prudential supervision by providing essential tools, training, resources, and technologies. A new Supervision Institute portal was launched in April 2024 to support employees involved in supervision. As part of this effort, we introduced the Supervision Apprenticeship Program, a two-year program that trains apprentices through structured learning and developmental activities to deepen their supervision expertise. Additionally, we piloted the Supervision Human Library app, where subject matter experts within the organization act as “books” that can be “borrowed” to ask questions or learn more about certain topics. Finally, in March 2025, we released the OSFI Style Guide to support consistent drafting and formatting of supervision documents, including supervisory letters and external reports.

Information security

Improving our information security posture remains a top priority amid the global rise of increasingly sophisticated and prevalent cyber threats. Digital spaces have become battlegrounds for increasingly targeted attacks and disruptions. To safeguard our most critical functions and uphold strong information security, we must maintain cyber vigilance and continue strengthening the resilience of our information management/information technology (IM/IT) systems.

We enhanced our cyber and corporate security capabilities in 2024-25 through the following investments:

• Integrated cyber security engagement into all projects and programs, ensuring security validation for all solutions prior to rollout.

• Established a Tiger Team to address OSFI’s current cyber security risk profile, which developed a comprehensive strategic action plan to guide future cyber-related investments, ensuring alignment with identified gaps in the existing cyber security posture and reinforcing OSFI’s overall cyber defense capabilities.

• Initiated a comprehensive Insider Risk Management Program aligned with industry standards, GoC policies, and current threat mitigation practices for regulated financial institutions.

• Enhanced employee awareness about their role in ensuring our corporate security and informing them how to detect cyber threats, such as phishing scams.

• Mandated obligatory training for all employees on cybersecurity and security awareness, focusing on how to protect ourselves and our information and assets.

• Updated our Security Management Policy to clarify responsibilities and help employees classify and handle information based on sensitivity.

Office of the Chief Actuary (OCA)

The OCA operates as an independent actuarial centre, producing actuarial studies and reports, and providing actuarial advice that supports sound decision making. In 2024-25, the OCA conducted the following:

• Initiated work on the triennial Actuarial Report on the CPP as at 31 December 2024, which projects CPP revenues and expenditures over a 75-year period based on assumptions from historical and projected demographic and economic trends.

• Organized an interdisciplinary seminar in September 2024 on Demographic, Economic and Investment Perspectives for Canada, bringing together representatives from federal, provincial, and territorial governments, along with leading experts in the field. Participants exchanged professional insights and reflected on emerging trends.

• Prepared timely and accurate actuarial information on the cost of public programs and government pension and benefit plans by submitting the following actuarial reports to the President of Treasury Board for tabling before Parliament in 2024-25:

  • Actuarial Report on the Pension Plan for the Public Service of Canada as at 31 March 2023

  • Actuarial Report on the Public Service Death Benefit Account as at 31 March 2023

  • Special Actuarial Report on the Funding of the Pension Plan for Public Service of Canada as at 31 March 2024

• Submitted the 2025 Actuarial Report on the Employment Insurance Premium Rate to the Canada Employment Insurance Commission that was published in September 2024 and submitted the Actuarial Report on the Canada Student Financial Assistance Program as at 31 July 2023 to the Minister of Employment, Workforce Development and Official Languages, which was tabled before Parliament in September 2024.

• Submitted various actuarial reports to the Office of Comptroller General for the purpose of Public Accounts of Canada, presenting the obligations and costs, as at 31 March 2024, associated with federal public sector pension and benefit plans including future benefits to veterans.

• Published an actuarial study on the potential impacts of climate change on assumption-setting process of the OCA.

• Assisted several government departments in designing, funding, and administering the plans and programs for which they are responsible. Client departments included federal and provincial Departments of Finance, Employment and Social Development Canada, Treasury Board Secretariat, Veterans Affairs Canada, National Defence, Royal Canadian Mounted Police, the Department of Justice, Public Services and Procurement Canada, and Health Canada.

Internal audit

Risk based internal audit plan

As the third line in our three lines model, our Internal Audit (IA) group provides independent assurance and advice on the execution of our mandate and operations, and aims to strengthen our organizational governance and control environment. Using agile auditing, the IA group prioritizes increased collaboration, flexible approaches, and continuous learning.

Our 2024-26 Internal Audit Plan, released in June 2024, aligns to OSFI’s 2024-27 Strategic Plan and reflects the evolving risk environment. The plan was developed through a comprehensive analysis of all sectors, management activities, processes, policies, and control functions. The plan identifies four thematic areas for internal auditing over the next two years: including information management and technology, core functions, internal services and financial management, as well as risk management.

Canadian Audit Quality Roundtable

We co-hosted the sixth annual Canadian Audit Quality Roundtable in Toronto on October 21, 2024, alongside the Canadian Securities Administrators and the Canadian Public Accountability Board. The roundtable brought together financial regulators, audit firms and key stakeholders to explore current and emerging risks and their impact on audit quality in Canada. Discussions covered the impact of technologies like AI, climate-related risks in financial audits, and the evolving role of external auditors in capital markets, including growing demand for assurance services.