OSFI consults on draft guideline for model risk management

Publication type
Sound Business and Financial Practices
Foreign Bank Branches,
Life Insurance and Fraternal Companies,
Property and Casualty Companies,
Trust and Loan Companies
Table of contents

Today, the Office of the Superintendent of Financial Institutions (OSFI) is launching a public consultation on the revised draft Guideline E-23: Model Risk Management. This guideline will come into effect July 1, 2025, at which time it will replace OSFI’s current Guideline E-23. OSFI’s plan to consult on this revised Guidance was communicated in its Annual Risk Outlook 2023-24.

Federally Regulated Financial Institutions (FRFIs) and Federally Regulated Private Pension Plans (FRPPs) increasingly rely on models to support or help drive key decisions. The financial services industry is experiencing rapid growth in digitalization and model usage. As the use of these technologies continues to evolve, current model risk management frameworks must adapt to remain relevant, forward-looking, and responsive to organizational needs.

In consideration of this evolving space, on May 20, 2022, OSFI published a letter, Proposed Revisions to Guideline E-23 on Model Risk Management, informing all FRFIs and FRPPs that Guideline E-23 is being revised and seeking feedback from stakeholders on the proposed expansion of the scope of application and other elements of the current Guideline E-23. Feedack was received from various entities, including banks, insurance companies, industry associations, and pension plan sponsors. OSFI has considered the feedback received in updating Guideline E-23. Appendix 1 provides a non-attributed summary of stakeholder comments received in response to the May 2022 letter, along with OSFI responses.

Considering the increasingly fast-paced development and deployment by FRFIs and FRPPs of complex models, the expectations set out in this revised Guideline E-23 are intended to be principles-based. They apply to all regulated FRFIs and FRPPs, regardless of industry, and to all models, whether they require formal regulatory approval or not. FRFIs and FRPPs should implement the guidance in a manner commensurate with the complexity of operations and the risk ratings of the models being deployed.

Stakeholders who wish to submit comments should send them to consultations@osfi-bsif.gc.ca by March 22, 2024. Stakeholders are encouraged to use the Feedback Template.

Next steps

Feedback from this consultation will inform the final guideline, which will be published by July 2024. A non-attributed summary of comments and OSFI responses will accompany the issuance of the final guideline. Furthermore, during the consultation participants will have an opportunity to engage with OSFI, providing comments and asking questions. Notably, on January 17, 2024, OSFI will be hosting an information session for all sectors to share information and answer questions. Please register here for the all-sector session. Capacity for this session is limited.

Amar Munipalle
Executive Director, Risk Advisory Hub
Supervision Sector

Appendix 1: Summary of public consultation comments on OSFI’s May 2022 industry letter and OSFI responses
Subject Comment OSFI Response
Implementation timeline

Stakeholders commented there is not enough time to implement the new guideline, considering its broadened scope and application.

OSFI has extended the consultation window (to four months) and time to implement the final guideline. This will allow more time to discuss and consider changes that are being proposed, Comments received will inform revisions to the draft guideline, ahead of its finalization by July 2024.

As well, in order assist in transitioning to the new guideline (e.g., develop and implement processes and infrastructure), it will become effective 12 months following the publication of the final guideline (i.e., effective July 1, 2025).


Proportionality should be considered when determining the application of OSFI’s expectations for model risk management.

With the revised Guideline E-23, OSFI is taking a risk-based approach to model risk. FRFIs and FRPPs will retain significant flexibility in their management of own model risks in a manner that is commensurate with their size, nature, scope, complexity of operations, and risk profile.


Existing industry guidance may conflict with what is communicated in Guideline E-23.

Guideline E-23 sets out minimum expectations.

Source of Compliance

Requests to rely on pre-existing professional standards.

We acknowledge that other bodies may also publish expectations in this space. Nevertheless, OSFI believes that communicating its minimum expectations around model risk governance is important for transparency and to ensure consistency in treatment across FRFIs and FRPPs.