Peter Routledge participates in a fireside chat at Global Risk Institute (GRI)

Check against delivery

Moderator:

As the risk environment changes, what should our financial institution leaders be prepared to approach differently, and where should they remain cautious despite pressure to support greater growth and competition?

Superintendent Peter Routledge:

• Leaders should be prepared to balance resilience with growth, competition, innovation, and adaptation. Strong prudential foundations are not obstacles to growth; they are the conditions that make sustainable growth possible.
• Institutions should be prepared to consider how they might support economic adaptation through investment in infrastructure, energy, technology, and business growth, rather than relying exclusively on traditional sources of growth.
• Boards and management should remain vigilant regarding cyber risk, AI-enabled threats, money laundering, integrity and security risks, and operational resilience. These rapidly evolving risks can undermine confidence in financial institutions and spread quickly across an interconnected system.
  • Our 2026 Semi-Annual Risk Outlook identifies frontier AI as a new and rapidly evolving risk that can amplify interconnected cyber, technology, third-party and reputational risks.
• Strong governance and sound judgment will be increasingly important. Boards and management need to identify emerging risks early, challenge assumptions, and adapt to a rapidly changing economic, technological, and geopolitical environment. The resilience that served institutions well over the past 20 years will not necessarily be enough for the next 20 years.

Moderator:

Where are institutions potentially more cautious than OSFI requires them to be?

Superintendent Peter Routledge:

• OSFI is doing its part to support competition, economic growth and adaptation:
  • OSFI has adjusted risk-weighted capital requirements in the 2027 Capital Adequacy Requirements Guideline to better reflect underlying risks and support lending to smaller businesses and the construction sector.
  • We also lowered the Domestic Stability Buffer (DSB) level and range, giving Canada’s largest banks greater flexibility to deploy capital for lending and investment while preserving resilience. These changes support competition and economic growth without compromising sound risk management.
• Institutions should continually reassess whether existing business practices remain appropriate for a changing environment. Our decision to lower the level and range of the DSB was in recognition that there is ample capital in the system to support growth, innovation and economic adaptation without compromising sound risk management.
• A resilient financial system should be able to support economic adaptation, including for example, a focus on infrastructure, energy, technology, and business growth.
• Institutions should be careful not to confuse resilience with risk avoidance. Prudently taking and managing risk is part of supporting customers, innovation, and long-term economic growth, which may include providing financing and investment capacity for small and medium sized businesses. However, those business decisions are squarely within the authority, strategy and accountability of financial institution boards and senior management.

Moderator:

Looking across housing, non-bank financial institutions, and liquidity and funding risk, where do you see the greatest potential for stress to move across markets or institutions in ways that boards may not fully anticipate?

Superintendent Peter Routledge:

• The greatest concern is often not a single risk, but how high debt, housing, funding, liquidity, cyber, operational and broader economic risks interact and reinforce one another. Evolving links among banks, non-bank financial institutions, counterparties and intermediaries, combined with sovereign bond stress and geopolitical shifts, create new channels for risk to spread. AI can improve risk-taking but also accelerate poor decisions, leaving boards to assess how these pressures could combine in a more hostile and interconnected financial system.
• Non-bank financial institutions (NBFIs) are also an important part of that interconnected risk environment. Banks remain closely connected to NBFIs through funding relationships, market activity, derivatives and credit exposures. As private credit and other segments of the NBFI sector grow, understanding those linkages becomes increasingly important for financial resilience
• Boards and senior management should understand how stress in one area could affect confidence, funding conditions, operational resilience and business performance elsewhere in the institution. What appears to be a localized problem can quickly spread through interconnected markets, counterparties and financial institutions. The focus should remain on the most serious material risks and on exercising sound judgment during periods of uncertainty.
• The lesson is not to anticipate every possible shock, but to remain focused on the most material vulnerabilities and ensure the institution can continue operating through uncertainty. Resilience depends on being prepared for risks that are interconnected, evolving and often outside the institution's direct control.

Moderator:

Decision-making under uncertainty: What would you expect financial institutions, their boards and senior management, to decide in advance, rather than attempting to resolve once a crisis is underway?

Superintendent Peter Routledge:

• Key governance structures, accountabilities, and escalation processes should be established and practiced before a crisis occurs. Roles, responsibilities, and decision-making authorities should be clear when conditions are stable, not developed in the middle of a disruption.
• Boards should have a clear understanding of the institution's risk appetite and the trigger points that would prompt intervention or management action, particularly with respect to capital, liquidity and operational resilience.
• Crisis-management and communication protocols should be established in advance, including how the institution will engage with regulators, customers, counterparties and critical third-party service providers during a disruption
• Management should identify in advance the actions required to maintain critical operations during cyber incidents, technology failures, liquidity stress events, or market disruptions. The objective is to ensure the institution can maintain critical operations and exercise sound judgment during periods of uncertainty.

Moderator:

Climate-related: What has OSFI learned from its work on physical climate risk about the need to consider multi-year or multi-event scenarios, and does that lesson apply more broadly to catastrophic-risk preparedness?

Superintendent Peter Routledge:

• One of the biggest lessons from our climate risk work is that institutions need to think beyond a single event. The question is no longer just, "Can you withstand the storm?" It's "Can you withstand the next storm before you've recovered from the last one?"
• Preparedness is increasingly relevant in thinking about catastrophic risk and anticipating events based on geolocation. Communities, businesses and insurers now face multiple severe events within short periods. A major wildfire season may be followed by significant flooding. Repeated events can strike the same region before recovery is complete. The challenge isn't just one event's impact. The challenge is how events accumulate and create new vulnerabilities.
• Our work also shows that climate risk doesn't necessarily stay where it starts. If insurance becomes less available or affordable, households and businesses retain more risk themselves. That can weaken recovery, affect property/asset values, and increase risk for lenders. In that sense, climate risk is not just an insurance issue. It can affect the broader financial system.
• Catastrophic risk is financial risk. In the months ahead, we're working to make more catastrophic risk information publicly available through a new dashboard. It will help institutions, regulators and Canadians better understand where exposure to catastrophic events are concentrated across Canada, the financial risks these events can create, and how those risks could evolve over time.
• Risk doesn't disappear because it becomes harder to insure. Someone else ends up holding it. Institutions need to understand where that risk goes and how it changes over time. Ultimately, resilience isn't about predicting every event. It's about continuing to operate through a wide range of plausible scenarios.

Moderator:

As institutions expand their use of AI, in your view, what should boards understand well enough to challenge management on where AI is being deployed, the risks being accepted and whether existing controls remain adequate?

Superintendent Peter Routledge:

• Boards should have visibility into material uses of AI and understand how they affect the institution’s risk profile, operations and controls. They need sufficient information to oversee AI effectively and challenge management decisions.
  • AI can amplify operational, model, cyber, technology and governance risks, increasing the speed and scale at which they develop. It can also introduce new risks as AI systems act more autonomously, interact with other systems or operate beyond their authorized scope.
• Strong governance and clear accountability are essential. Boards should challenge management on guardrails, monitoring, controls and human oversight, and understand how AI risks fit within the institution’s broader risk appetite and resilience frameworks.
  • Oversight should extend across the organization and to third-party AI solutions. Clear cross-functional coordination is needed to manage AI risks consistently and prevent gaps between risk-management functions.
• Institutions remain responsible for the outcomes of their use of AI. They should manage the risks of moving too quickly while avoiding excessive caution that prevents appropriate defensive uses, particularly against cyber and fraud threats.
• OSFI supports the Financial Stability Board’s work on Sound Practices for Responsible Adoption of Artificial Intelligence and looks forward to their final report.

Moderator:

How should our sector balance the risk of moving too quickly against the strategic and operational risks of moving too slowly?

Superintendent Peter Routledge:

• Act with urgency, it is easier to switch direction when you are moving forward.
• Resilience gives financial institutions the capacity to take reasonable risks, compete, innovate and adapt as economic and technological conditions change. Building resilience does not mean avoiding risk altogether; it means taking risks in a deliberate and disciplined way.
• The challenge is not choosing between change and caution, but balancing resilience with innovation, competitiveness, and long-term growth. Institutions need to adapt to a changing environment, supported by strong prudential foundations that enable them to compete, innovate and support sustainable economic growth.
• Progress should come through continuous learning and adjustment. Testing new approaches, evaluating outcomes and refining decisions over time is often preferable to waiting for perfect information before acting.
• In a rapidly changing environment, the risk of moving too slowly can become as significant as the risk of moving too quickly. The focus should remain on the most serious material risks and on exercising sound judgment during periods of uncertainty.