## EXECUTIVE SUMMARY ## Source details **Canonical URL:** [EXECUTIVE SUMMARY](https://www.imf.org/-/media/files/publications/cr/2025/english/1canea2025003-source-pdf.pdf) ## Other formats - [Markdown version](/-/media/files/publications/cr/2025/english/1canea2025003-source-pdf.pdf.md) - [Structured JSON version](/-/media/files/publications/cr/2025/english/1canea2025003-source-pdf.pdf.json) --- ### Overview and key statistics - Cyber risk is highly relevant to the financial sector and financial stability of Canada. - According to the Canadian Centre for Cyber Security (CCCS), in 2021, 23.9 percent of finance and insurance enterprises were impacted by cyber security incidents, placing Finance into the top four of the Critical Infrastructure Sectors being targeted by cyber actors. - Cyber-attacks on the financial sector have tripled from 2022 to 2023 and these cyber-attacks against Canadian financial institutions (FIs) are increasing in both frequency and sophistication. - Disruptive technologies identified by CCCS with potential to disrupt fields: digital assets and decentralized finance, machine learning, and quantum computing. ### Risks and technological trends - Digital assets (cryptocurrencies and decentralized finance) are both targets and tools for cyber threat actors. - Machine learning automations can be exploited to launch large-scale fraud campaigns. - Quantum computing has the potential to threaten current systems of maintaining trust and confidentiality online. - These factors increase the need for a strong ecosystem: forward-thinking strategies, robust regulation and supervision, and effective coordination among stakeholders. ### Institutional strengths - Canada has a mature cyber ecosystem with broad stakeholder coordination and cooperation across public and private sectors. - Strong public-private structures support free-flowing information and initiatives across parties, performing policymaking, supervisory and operational roles. - Five Eyes membership provides access to intelligence across the Five Eyes network. - CCCS described as an outward looking institution designed to work with the private sector to support cyber resilience. - Bank of Canada (BOC) leadership: established the Canadian Financial Sector Resilience Group (CFRG) to facilitate operational resiliency initiatives and coordinate critical finance sector responses to systemic-level operational incidents. - Office of the Superintendent of Financial Institutions (OSFI) Technology Risk Division (TRD), which is only 3–4 years old, has made significant progress maturing OSFI’s cyber risk supervision. ### Identified gaps and governance recommendations - No provincial-level cyber strategies for financial sectors and no joint federal cyber strategy currently exist. - A cyber strategy would define roles and responsibilities, an implementation plan, and enable coordination, cross-fertilization of initiatives and pooling of resources. - The national strategy for critical infrastructure requires sectors like Finance to establish a “sector network” to enhance coordination, cooperation, and communication. - Recommendation: federal and provincial authorities should establish or enhance mandates of existing structures to build sector networks and leverage them to develop aligned cyber strategies. ### Regulatory and supervisory observations - Federal and provincial authorities have comprehensive regulations and guidelines largely in line with international standards. - Authorities should better integrate guidelines into supervisory and oversight processes for more structured and systematic risk-based supervision. - Example: BOC and Canadian Securities Administrators (CSA) conduct joint oversight of systemically important FMIs based on two largely similar regulations — mapping and a joint oversight methodology would help ensure no gaps. - BCFSA and Québec’s Autorité des Marchés Financiers (AMF) should map and consolidate their cyber-specific requirements and integrate them into supervisory manuals. - Strengthen supervisory practices: increase onsite examinations for some systemically important entities; BCFSA should consider increasing cyber supervision resources. ### Interconnectedness, third-party risk, and incident reporting - Deepen analysis of operational interconnectedness via “cyber mapping” to identify transmission channels that could trigger financial instability and concentration risk from third-party providers. - Federal and provincial authorities have no direct legal and regulatory powers over third-party providers and rely on outsourcing guidelines. - Increasing powers over third-party providers may enable better management of systemic cyber risk; jurisdictions such as the EU, UK and US have moved in this direction. - Incident reporting regimes are strong but could be reviewed and aligned further with the Financial Stability Board (FSB) FIRE Framework. - Authorities do not currently share relevant cyber incident information with each other; legal barriers and modalities for information sharing should be addressed to reduce systemic risk. ### Cyber testing, exercises, and information sharing - OSFI has developed a Threat Led Penetration Testing (TLPT) Framework but should monitor its evolution and introduce further enhancements. - As framework is operationalized, include further types of tests and clear criteria for testers to allow more economical and competent testing. - BOC, OSFI and CSA participate in market-wide exercises; all authorities may benefit from conducting exercises on their respective financial sectors, including third-party providers and a broader suite of FIs, more frequently. - Leverage existing fora (e.g., Senior Advisory Committee, Financial Institutions Supervisory Committee) to manage systemic incidents with decision coordination, clearly defined incident management protocols, and a tested playbook of extreme but plausible scenarios. - Canada has a fairly mature cyber threat intelligence and information sharing ecosystem, but exchanges are often ad-hoc and not accessible to all. - Authorities should catalyze information and intelligence sharing networks within private sectors across provinces to build a “network of networks.” - Conduct a legal review to ensure a fit-for-purpose information-sharing framework (address data privacy laws and legal liability issues). ### Table 1. Canada: Recommendations on Cyber Resilience of the Financial Sector (selected entries; Recommendation Timing and Authorities preserved) - The federal authorities (Department of Finance (DoF), OSFI, BOC, Canada Deposit Insurance Corporation (CDIC) and CCCS) and all provincial financial authorities should establish, leveraging already existing structures, a “financial sector network” that aims to build, to the fullest extent possible, effective and efficient coordination, cooperation and communication mechanisms for cyber resilience. - Timing: I - Authorities: All authorities (federal and provincial) and CCCS - The financial sector network should work closely together to develop cyber strategies for the financial sectors at the federal and provincial level. - Timing: ST - Authorities: All authorities (federal and provincial) and CCCS - The BOC may consider updating its Expectations for cyber resilience for designated FMIs (ECR) with regards to third party risk management in light of the ongoing work of the Committee on Payments and Market Infrastructure (CPMI)- International Organization of Securities Commissions (IOSCO). - Timing: MT - Authorities: BOC - The federal and provincial authorities should consider increasing their legal and regulatory powers over third-party providers. - Timing: MT - Authorities: DoF, OSFI and BOC and provincial authorities - BCFSA and AMF may consider reviewing their suite of different guidelines and map the cyber-specific requirements to their cyber supervision and oversight frameworks. - Timing: ST - Authorities: BCFSA and AMF - BOC and CSA members should continue to map their respective regulatory requirements and integrate them into a common oversight methodology. - Timing: ST - Authorities: BOC and CSA - BCFSA and AMF should develop a cyber supervisory manual that aligns all cyber-specific requirements from their guidelines. - Timing: ST - Authorities: BCFSA and AMF - BCFSA should conduct onsite examinations for cyber resilience on its most systemic PRFIs, including Central 1. - Timing: I - Authorities: BCFSA - BCFSA should consider increasing its staffing and/or expertise in cyber supervision. - Timing: ST - Authorities: BCFSA - CSA members and BOC should conduct an onsite examination related to cyber resilience of its regulated entities. - Timing: I - Authorities: CSA and BOC - The federal and provincial authorities could benefit from collectively reviewing their existing incident reporting regimes and updating them in line with the FSB’s FIRE Framework. Consideration should be given on how to include third-party providers into the scope of incident reporting. - Timing: MT - Authorities: All authorities (federal and provincial) - The federal authorities should undertake a legal review and take the necessary steps to facilitate the sharing of relevant incident information between federal and provincial regulators. - Timing: MT - Authorities: DoF, OSFI and BOC - Federal and provincial authorities should work with their respective financial sectors to develop and operationalize cyber information and intelligence sharing networks. - Timing: ST - Authorities: All authorities (federal and provincial) and CCCS - Authorities should consider how to develop a network of networks that facilitates sharing of information and intelligence between the different provincial financial sectors. - Timing: MT - Authorities: All authorities (federal and provincial) and CCCS - Federal and provincial authorities should conduct a legal review (e.g. data privacy) on information and intelligence sharing between financial sector participants, to facilitate the sharing of such information without legal barriers (if feasible and permissible). - Timing: ST - Authorities: All authorities (federal and provincial) and CCCS - OSFI should monitor the implementation of the I-CRT Framework and ensure that it has the right level of resources and expertise for its successful deployment. - Timing: ST - Authorities: OSFI - OSFI should include, in the I-CRT Framework, clear criteria and conditions for threat intelligence and red-team testing providers. - Timing: MT - Authorities: OSFI - CCCS should consider developing a Generic Threat Landscape (GTL), in close collaboration with other relevant agencies, such as the RCMP and CSE. - Timing: MT - Authorities: CCCS - OSFI should consider updating its framework, with the integration of a GTL component, purple and gold team testing, and use the potential GTL report for other purposes such as developing playbooks, scenarios and conducting exercising. - Timing: MT - Authorities: OSFI - The BOC and provincial regulators should consider applying the I-CRT for their own systemically important FIs. - Timing: MT - Authorities: BOC, AMF, BCFSA - BOC, OSFI, BCFSA and AMF should conduct more regular cyber simulation exercises with other authorities and a broader selection of financial entities (e.g., banks, FMIs, insurance companies), and including third-party providers. - Timing: ST - Authorities: BOC, OSFI, BCFSA and AMF - The financial sector network should work together in sharing their experiences of exercises. - Timing: MT - Authorities: All authorities (federal and provincial) and CCCS - The federal authorities (e.g. Finance Canada, BOC, OSFI and CDIC) should consider leveraging existing structures (e.g. FISC, CFRG, SAC, etc.) to put in place a process to manage a systemic cyber incident, with decision coordination, clearly defined criteria and threshold of systemic cyber incidents, and with a clear playbook of cyber scenarios, that are regularly tested. - Timing: I - Authorities: DoF, BOC, OSFI, CDIC and CCCS - The AMF and BCFSA should develop and document a sector-wide crisis management and coordination plan. - Timing: ST - Authorities: BCFSA and AMF - The authorities should collect information and data of third-party providers and the technology being used by financial entities and use this data to conduct analysis of how the financial sector is operationally interconnected. - Timing: ST - Authorities: All authorities (federal and provincial) - Timing legend: I Immediate (within 1 year); ST Short Term (within 1–2 years); MT Medium Term (within 3−5 years). *Source: EXECUTIVE SUMMARY, Canada: IMF assessment document.* ### EXECUTIVE SUMMARY __________________________________________________________________________ 5 ### EXECUTIVE SUMMARY ### Overview and key statistics - Cyber risk is highly relevant to the financial sector and financial stability of Canada. - According to the Canadian Centre for Cyber Security (CCCS), in 2021, 23.9 percent of finance and insurance enterprises were impacted by cyber security incidents, placing Finance into the top four of the Critical Infrastructure Sectors being targeted by cyber actors. - Cyber-attacks on the financial sector have tripled from 2022 to 2023 and these cyber-attacks against Canadian financial institutions (FIs) are increasing in both frequency and sophistication. - Disruptive technologies identified by CCCS with potential to disrupt fields: digital assets and decentralized finance, machine learning, and quantum computing. ### Risks and technological trends - Digital assets (cryptocurrencies and decentralized finance) are both targets and tools for cyber threat actors. - Machine learning automations can be exploited to launch large-scale fraud campaigns. - Quantum computing has the potential to threaten current systems of maintaining trust and confidentiality online. - These factors increase the need for a strong ecosystem: forward-thinking strategies, robust regulation and supervision, and effective coordination among stakeholders. ### Institutional strengths - Canada has a mature cyber ecosystem with broad stakeholder coordination and cooperation across public and private sectors. - Strong public-private structures support free-flowing information and initiatives across parties, performing policymaking, supervisory and operational roles. - Five Eyes membership provides access to intelligence across the Five Eyes network. - CCCS is described as an outward looking institution designed to work with the private sector to support cyber resilience. - Bank of Canada (BOC) leadership: established the Canadian Financial Sector Resilience Group (CFRG) to facilitate operational resiliency initiatives and coordinate critical finance sector responses to systemic-level operational incidents. - Office of the Superintendent of Financial Institutions (OSFI) Technology Risk Division (TRD), which is only 3–4 years old, has made significant progress maturing OSFI’s cyber risk supervision. ### Identified gaps and governance recommendations - No provincial-level cyber strategies for financial sectors and no joint federal cyber strategy currently exist. - A cyber strategy would define roles and responsibilities, an implementation plan, and enable coordination, cross-fertilization of initiatives and pooling of resources. - The national strategy for critical infrastructure requires sectors like Finance to establish a “sector network” to enhance coordination, cooperation, and communication. - Recommendation: federal and provincial authorities should establish or enhance mandates of existing structures to build sector networks and leverage them to develop aligned cyber strategies. ### Regulatory and supervisory observations - Federal and provincial authorities have comprehensive regulations and guidelines largely in line with international standards. - Authorities should better integrate guidelines into supervisory and oversight processes for more structured and systematic risk-based supervision. - Example: BOC and Canadian Securities Administrators (CSA) conduct joint oversight of systemically important FMIs based on two largely similar regulations — mapping and a joint oversight methodology would help ensure no gaps. - BCFSA and Québec’s Autorité des Marchés Financiers (AMF) should map and consolidate their cyber-specific requirements and integrate them into supervisory manuals. - Strengthen supervisory practices: increase onsite examinations for some systemically important entities; BCFSA should consider increasing cyber supervision resources. ### Interconnectedness, third-party risk, and incident reporting - Deepen analysis of operational interconnectedness via “cyber mapping” to identify transmission channels that could trigger financial instability and concentration risk from third-party providers. - Federal and provincial authorities have no direct legal and regulatory powers over third-party providers and rely on outsourcing guidelines. - Increasing powers over third-party providers may enable better management of systemic cyber risk; jurisdictions such as the EU, UK and US have moved in this direction. - Incident reporting regimes are strong but could be reviewed and aligned further with the Financial Stability Board (FSB) FIRE Framework. - Authorities do not currently share relevant cyber incident information with each other; legal barriers and modalities for information sharing should be addressed to reduce systemic risk. ### Cyber testing, exercises, and information sharing - OSFI has developed a Threat Led Penetration Testing (TLPT) Framework but should monitor its evolution and introduce further enhancements. - As framework is operationalized, include further types of tests and clear criteria for testers to allow more economical and competent testing. - BOC, OSFI and CSA participate in market-wide exercises; all authorities may benefit from conducting exercises on their respective financial sectors, including third-party providers and a broader suite of FIs, more frequently. - Leverage existing fora (e.g., Senior Advisory Committee, Financial Institutions Supervisory Committee) to manage systemic incidents with decision coordination, clearly defined incident management protocols, and a tested playbook of extreme but plausible scenarios. - Canada has a fairly mature cyber threat intelligence and information sharing ecosystem, but exchanges are often ad-hoc and not accessible to all. - Authorities should catalyze information and intelligence sharing networks within private sectors across provinces to build a “network of networks.” - Conduct a legal review to ensure a fit-for-purpose information-sharing framework (address data privacy laws and legal liability issues). ### Table 1. Canada: Recommendations on Cyber Resilience of the Financial Sector (selected entries; Recommendation Timing and Authorities preserved) - The federal authorities (Department of Finance (DoF), OSFI, BOC, Canada Deposit Insurance Corporation (CDIC) and CCCS) and all provincial financial authorities should establish, leveraging already existing structures, a “financial sector network” that aims to build, to the fullest extent possible, effective and efficient coordination, cooperation and communication mechanisms for cyber resilience. - Timing: I - Authorities: All authorities (federal and provincial) and CCCS - The financial sector network should work closely together to develop cyber strategies for the financial sectors at the federal and provincial level. - Timing: ST - Authorities: All authorities (federal and provincial) and CCCS - The BOC may consider updating its Expectations for cyber resilience for designated FMIs (ECR) with regards to third party risk management in light of the ongoing work of the Committee on Payments and Market Infrastructure (CPMI)- International Organization of Securities Commissions (IOSCO). - Timing: MT - Authorities: BOC - The federal and provincial authorities should consider increasing their legal and regulatory powers over third-party providers. - Timing: MT - Authorities: DoF, OSFI and BOC and provincial authorities - BCFSA and AMF may consider reviewing their suite of different guidelines and map the cyber-specific requirements to their cyber supervision and oversight frameworks. - Timing: ST - Authorities: BCFSA and AMF - BOC and CSA members should continue to map their respective regulatory requirements and integrate them into a common oversight methodology. - Timing: ST - Authorities: BOC and CSA - BCFSA and AMF should develop a cyber supervisory manual that aligns all cyber-specific requirements from their guidelines. - Timing: ST - Authorities: BCFSA and AMF - BCFSA should conduct onsite examinations for cyber resilience on its most systemic PRFIs, including Central 1. - Timing: I - Authorities: BCFSA - BCFSA should consider increasing its staffing and/or expertise in cyber supervision. - Timing: ST - Authorities: BCFSA - CSA members and BOC should conduct an onsite examination related to cyber resilience of its regulated entities. - Timing: I - Authorities: CSA and BOC - The federal and provincial authorities could benefit from collectively reviewing their existing incident reporting regimes and updating them in line with the FSB’s FIRE Framework. Consideration should be given on how to include third-party providers into the scope of incident reporting. - Timing: MT - Authorities: All authorities (federal and provincial) - The federal authorities should undertake a legal review and take the necessary steps to facilitate the sharing of relevant incident information between federal and provincial regulators. - Timing: MT - Authorities: DoF, OSFI and BOC - Federal and provincial authorities should work with their respective financial sectors to develop and operationalize cyber information and intelligence sharing networks. - Timing: ST - Authorities: All authorities (federal and provincial) and CCCS - Authorities should consider how to develop a network of networks that facilitates sharing of information and intelligence between the different provincial financial sectors. - Timing: MT - Authorities: All authorities (federal and provincial) and CCCS - Federal and provincial authorities should conduct a legal review (e.g. data privacy) on information and intelligence sharing between financial sector participants, to facilitate the sharing of such information without legal barriers (if feasible and permissible). - Timing: ST - Authorities: All authorities (federal and provincial) and CCCS - OSFI should monitor the implementation of the I-CRT Framework and ensure that it has the right level of resources and expertise for its successful deployment. - Timing: ST - Authorities: OSFI - OSFI should include, in the I-CRT Framework, clear criteria and conditions for threat intelligence and red-team testing providers. - Timing: MT - Authorities: OSFI - CCCS should consider developing a Generic Threat Landscape (GTL), in close collaboration with other relevant agencies, such as the RCMP and CSE. - Timing: MT - Authorities: CCCS - OSFI should consider updating its framework, with the integration of a GTL component, purple and gold team testing, and use the potential GTL report for other purposes such as developing playbooks, scenarios and conducting exercising. - Timing: MT - Authorities: OSFI - The BOC and provincial regulators should consider applying the I-CRT for their own systemically important FIs. - Timing: MT - Authorities: BOC, AMF, BCFSA - BOC, OSFI, BCFSA and AMF should conduct more regular cyber simulation exercises with other authorities and a broader selection of financial entities (e.g., banks, FMIs, insurance companies), and including third-party providers. - Timing: ST - Authorities: BOC, OSFI, BCFSA and AMF - The financial sector network should work together in sharing their experiences of exercises. - Timing: MT - Authorities: All authorities (federal and provincial) and CCCS - The federal authorities (e.g. Finance Canada, BOC, OSFI and CDIC) should consider leveraging existing structures (e.g. FISC, CFRG, SAC, etc.) to put in place a process to manage a systemic cyber incident, with decision coordination, clearly defined criteria and threshold of systemic cyber incidents, and with a clear playbook of cyber scenarios, that are regularly tested. - Timing: I - Authorities: DoF, BOC, OSFI, CDIC and CCCS - The AMF and BCFSA should develop and document a sector-wide crisis management and coordination plan. - Timing: ST - Authorities: BCFSA and AMF - The authorities should collect information and data of third-party providers and the technology being used by financial entities and use this data to conduct analysis of how the financial sector is operationally interconnected. - Timing: ST - Authorities: All authorities (federal and provincial) - Timing legend: I Immediate (within 1 year); ST Short Term (within 1–2 years); MT Medium Term (within 3−5 years). *Source: EXECUTIVE SUMMARY, Canada: IMF assessment document.* ### INTRODUCTION ### INTRODUCTION ### A. Background: Cyber Risk as a Financial Stability Concern - CCCS National Cyber Threat Assessment (2023–24) findings: - Ransomware is a persistent threat and "almost certainly the most disruptive form of cybercrime facing Canadians." - Critical infrastructure is increasingly at risk; cybercriminals exploit downtime that harms industrial processes and customers. - Cyber threat actors are attempting to influence Canadians through misinformation, disinformation, and malinformation (MDM); CCCS has observed MDM evolution over the past two years. - Disruptive technologies (digital assets, cryptocurrencies, decentralized finance, machine learning) create new opportunities and threats; they are both targets and tools for cyber threat actors. - Global and operational context: - Malicious actors continue to evolve tactics, techniques, and procedures (TTP). - Recent global threat landscape characterized by exploitation of critical vulnerabilities, supply chain attacks, ransomware attacks, and distributed denial-of-service attacks. - Non-malicious incidents (accidental data disclosures, configuration/implementation/processing errors) remain important sources of cyber risk. - Government strategy: - National Cyber Security Strategy (2019–24) defines three goals: - (i) Secure and Resilient Canadian Systems; - (ii) An Innovative and Adaptive Cyber Ecosystem; - (iii) Effective Leadership, Governance and Collaboration. - Strategy emphasizes enhanced capabilities, research and innovation support, cyber skills development, and federal-provincial-private sector collaboration. ### B. Review Scope: Banks, Securities, Insurance, and Financial Market Infrastructures - Scope of this technical note: - Reviews cyber regulatory and supervisory framework elements for the financial sector including: role/practices of Canadian authorities in cyber strategy; development/maintenance of cyber regulatory framework; on-site and off-site supervisory processes; interconnectedness and financial stability; cyber risk information and intelligence sharing; cyber incident reporting, monitoring, response, and recovery. - Limited to frameworks within the mandate of OSFI and the BOC; provincial approaches of Québec (AMF) and British Columbia (BCFSA); and members of the CSA with regard to FMI cyber regulation and supervision. - Québec and British Columbia included as examples of provincial oversight frameworks; other provinces may have similar but different functions outside scope. - Recommendations pertain to authorities in scope; where applicable, recommendations for federal-provincial coordination can be considered more widely. - Information sources used by the FSAP team: - Questionnaire answers from OSFI, BOC, AMF, BCFSA, CSA, BCSC and OSC; interviews with authorities, DoF, CCCS, CDIC, Public Safety Canada; private sector participants; relevant national laws and reports; and authorities’ documentation. - Benchmarking and good practice: - No binding international regulatory standards on cyber risk management; assessment used internationally recognized regulatory good practice including: FSB “Stocktake of Publicly Released Cybersecurity Regulations, Guidance and Supervisory Practices” (2017); BCBS “Cyber-resilience: Range of practices” (2018); IMF Departmental Paper on “Cybersecurity Risk Supervision”; G7 “Fundamental Elements for Effective Assessment of Cybersecurity in the Financial Sector”; “Basel Principles for Operational Resilience”; revised “Principles for Sound Management of Operational Risk”; CPMI-IOSCO Guidance on cyber resilience for FMIs. ### INSTITUTIONAL ELEMENTS #### A. Institutional and Regulatory Arrangements — Overview - Canada has a strong and mature ecosystem of financial authorities, governmental agencies, and public-private coordination bodies for cybersecurity and cyber resilience, reflecting federal and provincial complexity. - Section covers roles of key institutions, regulatory arrangements, national and sectoral cyber strategy, and effectiveness of institutional arrangements. #### Office of the Superintendent of Financial Institutions (OSFI) - Mandate and coverage: - Regulates and supervises federally regulated financial institutions (FRFIs): all banks and federally regulated trust and loan companies and insurers. - Mandate: contribute to public confidence in the Canadian financial system by regulating and supervising approximately 400 FRFIs and 1200 federally regulated pension plans (FRPPs). - Expects FRFIs to adequately identify and manage technology and cyber threats and risks to support operational resilience. - Organizational capabilities: - Cyber and technology risk response led by the Technology Risk Division (TRD), supporting the Supervision Sector. - TRD core pillars: Supervision, Reviews and Monitoring (SRM); Incident Response Management (IRM); Policy, Instruments and Tools (PIT); Data Driven Intelligence (DDI); and External and Internal Stakeholder Affairs (SHA). - TRD has developed a 3-year build plan focused on enhancing supervisory processes, implementing the testing framework, enhancing incident response, and structuring and automating data and key reports. - Cyber and Technology Threat Intelligence Centre (CATTIC) established in 2022 to identify and monitor macro cyber and technology threats and risks within the financial sector; its threat risk assessments inform OSFI prioritization and response. - National Security Sector (NSS) established in 2023 to assess integrity and security risks, including foreign interference; will provide national security assessments, advice, and intelligence coordination within OSFI. - Authorities and coordination: - OSFI’s legislative authorities allow a range of supervisory actions. - OSFI works with CCCS and other partners to facilitate threat information sharing with institutions under its oversight. - Collective functions enable identification of traditional/commercial-level cyber risks and sophisticated/classified cyber threats for supervision and sector contribution. #### Bank of Canada (BOC) - Mandate and oversight: - Central bank responsible for financial stability; under the Payment Clearing and Settlement Act (“PCSA”) the BOC ensures clearing and settlement systems (FMIs) adequately control systemic or payments system risk, including cyber risk. - Systemically important and prominent payment systems overseen by the BOC pursuant to the PCSA. - The Bank and provincial securities commissions (CSA) jointly oversee systemically important SSS, CCPs, and CSDs. - Public-private coordination: - Established the CFRG (formerly JORM Program), a public-private partnership led by the BOC to strengthen financial sector critical infrastructure resilience, including cyber incidents. - CFRG governance: executive sponsors, steering committee, coordination directorate, and secretariat; no multipartite agreement currently governing collaboration or information exchange between members. - Established the Resiliency of the Wholesale Payment System (RWPS), a public-private partnership to promote stability through collective cyber resilience for the wholesale payment system (focus: prevention and detection; coordination and response; recovery). - Established the Canadian Financial Authorities Cyber & Technology Committee (CFACT) to bring together federal financial authorities. #### Department of Finance (DoF) - Role: - Overall responsibility for the financial sector; supports the Minister’s policy and legislative authorities and acts as main federal point of contact on sector issues. - Does not supervise financial institutions; largely responsible for cybersecurity policymaking for the financial sector at the federal level and leads the Senior Advisory Committee (SAC). - Legislation: - Bill C-26, An Act Respecting Cyber Security, introduced in the House of Commons in June 2022; Part II enacts the Critical Cyber Systems Protection Act (CCSPA). - Bill C-26 is currently at third reading in the Senate and has been sent back to the House of Commons. - Public Safety Canada is lead department for the federal government in cybersecurity and lead for Bill C-26; DoF leads primarily on the financial sector. - Purpose of CCSPA: protect critical cyber systems underpinning critical infrastructure in four federally regulated sectors: finance, telecommunications, energy, and transportation. #### Canada Deposit Insurance Corporation (CDIC) - Mandate: - Provide deposit insurance, act as resolution authority for members, and promote financial system stability, including if a failure happens as a consequence of a cyber incident. - Resolution readiness: - Focuses planning on ensuring resolution readiness with necessary planning, processes, tools, systems, financial capacity, and personnel. - Per the Resolution Planning By-law and CDIC Resolution Plan Guidance for DSIBs, CDIC requires DSIBs to identify reliance on key systems, IT services, and third party providers and to assess continuity of core business and critical functions in a resolution event. #### Public Safety Canada - Role: - Spearheads protection of safety and security of Canadians by coordinating federal departments and agencies tasked with protection; develops policies and provides advice to the Minister of Public Safety and Emergency Preparedness. - Functions as a centralized hub coordinating counterterrorism, critical infrastructure, and cyber security initiatives and programs. #### Canadian Centre for Cyber Security (CCCS) and CSE - Organizational roles: - Communications Security Establishment (CSE) is the national cryptologic agency providing the Government of Canada with information technology security and foreign signals intelligence. - CCCS, part of CSE, is the technical authority for cyber security and information assurance. - CSE activities support information assurance under the CSE Act; CSE acquires, uses, and analyzes information to provide advice, guidance, and services to protect electronic information and infrastructures important to the Government of Canada. - Regulatory and operational roles: - CCCS is not a regulatory body but is responsible for addressing cyber security incidents and working with Canadian businesses to strengthen cyber security. - CCSPA (Part of Bill C-26) would mandate reporting of cyber security incidents to CSE and CCCS for designated operators in federally regulated finance, energy, telecommunications, and transportation sectors. - CSE would provide technical advice and guidance leveraging CSE Act mandate; CSE and CCCS would not assess compliance with regulatory obligations and their advice would not be binding. #### Royal Canadian Mounted Police (RCMP) - Jurisdiction and mandate: - RCMP Federal Policing has jurisdiction over all federal laws across provinces and territories and works with local law enforcement. - RCMP Federal Policing Criminal Operations (FPCO) Cybercrime program investigates federal cybercrime offences, focusing on high-level cyber-criminality with significant economic or cross-jurisdictional impact. - RCMP defines cybercrime as any crime where a cyber element has a substantial role in commission of the offence. - FPCO Cybercrime works with domestic and international partners to identify, disrupt, prosecute, and prevent major threats including malware, ransomware, espionage, foreign interference, and attacks against government institutions, key business assets, and critical infrastructure of national importance. *Source: INTRODUCTION — 1canea2025003-source-pdf* ### 27. The National Cybercrime Coordination Centre (NC3) and Canadian Anti-Fraud Centre ### 27. The National Cybercrime Coordination Centre (NC3) and Canadian Anti-Fraud Centre (CAFC) ### NC3 and CAFC: mandate and operations - NC3 established in 2018; receives cybercrime reporting through other Canadian and international police partners. - NC3 national leadership role: ensuring connectivity, specialized support and coordination of law enforcement cybercrime activities in prevention, disruption, and response/apprehension—both domestically and internationally. - CAFC receives cybercrime and fraud reports from individuals and organizations, enriches reporting with available intelligence, and connects this information with national and international investigations. ### Federal law enforcement engagement with financial sector - RCMP partnership outreach actively engages representatives from the Canadian finance sector to: - share information and intelligence; - promote reporting of cybercrime to law enforcement; and - coordinate efforts to support investigation with the police of jurisdiction (RCMP or other) that may contribute to prosecution. - RCMP collaborates with the financial sector either individually or through national associations such as the Canadian Bankers Association (CBA) to reduce cybercrime impact and assist prosecutions. ### Provincial authorities: British Columbia (BC) — mandates and gaps - BCFSA supervises and regulates provincially regulated financial institutions (“PRFI”)—credit unions, pension plans, insurers, and trust companies—to determine whether they are in sound financial condition and are complying with their governing laws and supervisory standards. - BCSC derives regulatory mandate under the Securities Act (British Columbia) (the B.C. Act); the B.C. Act provides authority to recognize certain persons, including exchanges, quotation and trade reporting systems, clearing agencies and trade repositories. - In British Columbia, cybersecurity responsibility for financial institutions (FIs) lies with: BCFSA, BCSC, OSFI, Insurance Council of British Columbia, Office of the Information and Privacy Commissioner and Consumer Protection BC. - Information sharing: - BCFSA has information sharing agreements with several entities; agreements are not specific to information security but generally permit sharing on information security issues. - There is no MOU or similar arrangement for sharing of information; for example, OSFI does not share cyber incident related information for banks or federally regulated insurance companies authorized to carry out business in British Columbia. ### Provincial authorities: Québec — mandates and coordination - AMF mandated by Government of Québec to regulate Québec’s financial markets and assist consumers; oversees insurance, securities, derivatives, deposit institutions—other than banks—and distribution of financial products and services. - AMF’s mandate under the Act respecting the Regulation of the Financial Sector (RFSA); role includes supervision of regulated entities, FIs, and credits assessment agents, which includes IT and cybersecurity. - In 2021, Québec created Ministère de la Cybersécurité et du Numérique (MCN) to consolidate technology services, digital infrastructure expertise, and cybersecurity/cyber threat prevention across government. - MCN priorities: preventing cyber-attacks against the state, protecting public data, and enhancing digital systems. - MCN mission: lead and coordinate Québec government actions in cybersecurity and digital technology; propose policy directions, determine priority sectors, advise public bodies, and propose measures to increase effectiveness against cyber-attacks and cyber threats. - AMF largely exempted from application of MCN’s Act; AMF remains independent but collaborates and shares cyber threat intelligence with MCN and the cellule gouvernementale de cyberdéfense, and is part of the réseau d’alerte gouvernemental. - MCN’s activities do not cover private sector entities (including financial sector). AMF works with CCCS and CFRG on financial-sector cyber matters. ### Canadian Securities Administrators (CSA) and clearing agencies - CSA: umbrella organization of provincial and territorial securities regulators to improve, coordinate, and harmonize regulation of Canadian capital markets; not a legal entity but an association of member regulators. - Securities regulators cooperate to adopt harmonized requirements for clearing agencies; conduct ongoing monitoring and inspections, and review proposed rules and rule changes—coordinated with the BOC when applicable. - Clearing agencies must apply for recognition or exemption under securities legislation and comply with NI 24-102 Clearing Agency Requirements (NI 24-102), which adopts the international standards in the PFMIs. ### Assessment of legal/regulatory framework and limits - Overall view: Canadian financial system has a strong legal and regulatory framework for managing cyber risk but: - there is no regulatory power over critical service providers; - financial authorities are limited to indirect power by ensuring FIs govern outsourcing relationships adequately. - At federal and provincial levels, authorities have appropriate legal and regulatory pillars to supervise different types of FIs, but none have regulatory power over the broader supply chain or critical service providers. ### National and financial sector cyber strategy - Public Safety Canada defines national cyber strategy and National Strategy for Critical Infrastructure; goal: build a safer, more secure, and more resilient Canada. - National Strategy for Critical Infrastructure objectives: - Build partnerships; - Implement an all-hazards risk management approach; and - Advance the timely sharing and protection of information among partners. - Strategy proposes establishing “sector networks” for each critical infrastructure sector (including Finance) to leverage existing coordination mechanisms and enable sector-specific activities (risk assessments, plans, exercises). - Functions of sector networks include: - Promotion of timely information sharing; - Identification of national, regional or sectoral issues; - Use of subject-matter expertise to guide on current and future challenges; - Development of tools and best practices across prevention, mitigation, preparedness, response and recovery. - Public Safety Canada developed the 2025 National Cyber Security Strategy (the Strategy) with three core pillars: - working with partners to protect Canadians and Canadian businesses from cyber threats; - making Canada a global cyber security industry leader; and - detecting and disrupting cyber threat actors. - Two overarching principles of the 2025 Strategy: - whole-of-society partnerships (establishment of the Canadian Cyber Defense Collective (CCDC) to formalize collaboration and information sharing across governments, law enforcement, private industry including financial sector, Indigenous organizations, municipalities, academia); - an agile approach to cyber threats via issue-specific action plans developed with CCDC and other partners. ### Central bank, supervisor, and provincial strategy status - OSFI: - has not developed a dedicated public cyber strategy for regulated institutions; - identifies cyber and technology risk in OSFI's Annual Risk Outlook and responds via TRD’s 3-year plan focusing on: enhancing supervisory processes, implementing the testing framework, enhancing incident response, and structuring and automating data and key reports. - Bank of Canada (BOC): - has a dedicated cyber strategy for the financial sector; vision: “To strengthen the cyber resilience of the Canadian financial system against an evolving threat environment” with three key goals from 2022–24: 1) Continue to integrate cyber resilience into all BOC business operations as the Bank evolves; 2) Expand financial sector resilience through collaboration and partnerships; and 3) Inspire confidence in the financial system through clear cyber security guidance within the Bank’s mandate. - BOC strategy divided into internal strategy (build cyber resilience of the central bank) and external strategy (strengthen resilience of the wider financial system). - Provincial authorities: - British Columbia (BCFSA) and Québec (AMF) have no dedicated cyber strategies for their financial sectors; both focused in the last 4–5 years on building regulatory and supervisory frameworks and acknowledged that developing a cyber strategy would be a useful next step. ### Coordination across authorities: strengths and gaps - Canada has a mature cyber ecosystem with a broad range of public and private stakeholders coordinating to ensure cybersecurity of the financial system; DoF, Public Safety, CCCS, RCMP, OSFI and BOC have built capacity and strong public-private structures for information flow. - Improvements needed in cooperation, coordination and communication at federal and provincial levels: - Inconsistency in provincial involvement (e.g., AMF participates in CFRG while BCFSA and systemically important Central 1 are notably absent). - No provincial forums that specifically bring local regulators together on cyber risk; some provincial regulators coordinate via CSA committees. - Risk of gaps in cooperation and fragmentation could lead to ineffective management of a cyber incident with national systemic impact. - Federal-level fora include Financial Institutions Supervisory Committee (FISC) chaired by OSFI, SAC led by DoF, and CFACT led by BOC—each serves different purposes. - Public-private coordination: - CFRG instrumental in conducting exercises and developing a crisis coordination playbook. - Private sector and authorities raised concerns that CFRG and related fora could be reviewed and refreshed due to potential duplication, fragmentation, lack of senior-level involvement, limited decision-making capacity, and excessive focus on granular operational matters instead of strategic issues. ### Recommendations (selected) - Federal authorities (DoF, OSFI, BOC, CDIC and CCCS) and all provincial financial authorities should establish a “financial sector network” to: - build effective and efficient coordination, cooperation, and communication mechanisms for cyber resilience across the financial sector; - reflect a partnership model enabling stakeholders to develop structures, communication modalities, and protocols for activities that enhance cyber resilience; - provide clearly defined roles and responsibilities and clear governance structures for implementation. - The financial sector network could build on existing structures and could leverage and further enhance CFACT to achieve the concept of a financial sector network. *Source: IMF staff summary of chapter content.* ### 58. The financial sector network should work closely together to develop cyber strategies ### 1canea2025003-source-pdf - 58. The financial sector network should work closely together to develop cyber strategies ### Financial sector network and objectives - Develop cyber strategies for the financial sectors at federal and provincial level that facilitate convergence in approach and include: - Promotion of timely information sharing; - Identification of issues of national, provincial or sectoral concern; - Improvement of public-private coordination in all areas; - Approaches to catalyze tools and initiatives that address cyber risk and strengthen the resiliency of financial sectors across the full spectrum of prevention, mitigation, preparedness, response and recovery; and - Sharing of best practices between all parties. - Example model referenced: “Hub and Spoke” (Annex 1). Other referenced models: UK’s Financial Sector Cyber Collaboration Centre (FSCCC) and USA’s Financial and Banking Information Infrastructure Committee (FBIIC). ### Regulatory framework — overview and identified issues - Federal and provincial authorities reviewed have a broad and comprehensive suite of regulation and guidelines to address cyber risk. - Cyber and technology-related guidelines are largely aligned across both federal and provincial authorities and are broadly principles-based, allowing for a risk-based supervisory approach. - Across five authorities (OSFI, BOC, BCFSA, AMF, and CSA), there are 21 guidelines, regulations, or guidance that include expectations or requirements around cyber risk management. - Concern: The significant number of guidelines may make supervision challenging as supervisors must consider multiple requirements across several guidelines, complicating application of a risk-based and proportionate approach. - Notable gap: Currently, none of the federal nor provincial authorities have any legal or regulatory powers over third-party providers. Authorities rely on outsourcing guidelines to manage third-party risk; concentration risk among providers could enable a cyber incident at a provider to trigger financial instability. ### Office of the Superintendent of Financial Institutions (OSFI) - OSFI guidelines relevant to cyber risk include: - Technology and Cyber Risk Management Guideline - Technology and Cyber Security Incident Reporting Guideline - Third-Party Risk Management Guideline - Integrity and Security—Guideline - Operational Risk Management and Resilience—Guideline - Guideline on Technology and Cyber Risk Management (B-13): - Principles-based, focusing expectations on three domains: governance and risk management, technology operations and resilience, and cyber security. - Defined outcomes: - (i) Technology and cyber risks are governed through clear accountabilities and structures, and comprehensive strategies and frameworks; - (ii) A technology environment that is stable, scalable, and resilient. The environment is kept current and supported by robust and sustainable technology operating and recovery processes; and - (iii) A secure technology posture that maintains the confidentiality, integrity, and availability of the FRFI’s technology assets. - OSFI sets out principles and practical steps to operationalize these outcomes. - Assessment: B-13 is comprehensive and largely in line with international standards; expectations cover main components of cybersecurity regulation and allow flexibility for proportionate implementation. ### Bank of Canada (BOC) - BOC oversight standards adopt CPMI-IOSCO Principles for Financial Market Infrastructures (PFMIs) and associated guidance. - Cyber-specific issuances: - “Expectations for Cyber Resilience for Designated FMIs” (“ECR”) - “Guideline for Designated Financial Market Infrastructures: Reporting Technology and Cyber Security Incidents” (“Incident Reporting Guidelines”) - ECR: - Based on CPMI-IOSCO Guidance for cyber resilience of FMIs (Cyber Guidance). - Provides practical steps for FMIs to operationalize Cyber Guidance, covering governance, identification, protection, detection, response and recovery, testing, situational awareness, and learning and evolving. - BOC is considering updating the ECR with requirements pertaining to third party risk management in light of supply chain risk and CPMI-IOSCO work. ### Department of Finance (DoF) and CCSPA - DoF role: develop and implement financial sector policies and legislation; central agency role coordinating Government agenda. - Canada Critical Cyber Systems Protection Act (CCSPA) aims to establish a regulatory framework to improve baseline cybersecurity for services and systems vital to national security and public safety. - Schedule 1 includes banking systems and clearing and settlement systems. - Schedule 2 would define classes of operators and designate regulators responsible for enforcement. - CCSPA would require designated operators to: - Establish a cyber security program (CSP) to protect and ensure resilience of critical cyber systems; - Have measures to detect cyber security incidents and minimize impacts on critical cyber systems; - Take steps to manage cyber security risks associated with supply chain and third-party products and services; - Respond to cyber security directions from the Government of Canada (mechanism to compel action). - Proposed regulator designations: - OSFI to be designated as regulator for banking systems; - BOC to be designated as regulator for clearing and settlement systems. - CCSPA would grant new powers to relevant regulators including inspection powers and the ability to issue an “order of compliance” where thresholds are met. - Limitation: CCSPA does not give financial authorities legal and regulatory powers over third-party service providers. Recommendation: DoF, OSFI, and BOC should explore strengthening their legal and regulatory powers over third-party service providers. ### Provincial regulators — British Columbia (BCFSA) and Québec (AMF) - BCFSA: - Issued an Information Security Guideline for B.C. regulated credit unions, insurance companies, pension plan administrators, and trust companies (“PRFIs”). - Revising Information Security Guideline for B.C. registered pension plan administrators. - Issued, for consultation, a draft incident reporting guideline for extraprovincial insurance and trust corporations. - Issued an Outsourcing Guideline requiring regulated entities to ensure outsourced service providers meet information security guidelines. - Issued a Recovery Plan Guideline requiring PRFIs to prepare to respond to and recover from material operational changes or significant internal and external events. - BCFSA’s Information Security Guideline is principles-based, aligned with international standards, based on the NIST Cybersecurity Framework, covering Governance, Information Security Risk Management Program, Identify, Protect, Detect, Respond and Recover. - AMF (Québec): - Regulatory expectations on privacy, cybersecurity, third-party relationships, outsourcing and incident disclosure across insurers, deposit-taking institutions, trust and loan companies, firms and representatives, securities and derivatives, market infrastructures and mortgage brokers. - AMF guidelines integrating cyber resilience: - Sound Commercial Practices Guideline; - Guideline on Information and Communications Technology Risk Management; - Outsourcing Risk Management Guideline; - Operational Risk Management Guideline; - Business Continuity Management (BCM) Guideline; - Financial Crime Risk Management Guideline; - Governance Guideline; and - Integrated Risk Management Guideline. - Upcoming Regulation respecting the management and reporting of information security incidents by certain FIs and credit assessment agents (CAA): - Public consultation ended on February 20, 2024; awaiting approval from Québec’s ministère des Finances; will come into force on April 23, 2025. - AMF’s Guideline on Information and Communications Technology Risk Management is principles-based and covers governance, risk management, ICT security, ICT operations, outsourcing and cloud computing, and change projects and programs. ### Canadian Securities Administrators (CSA) and clearing agencies - Clearing agencies operating in provinces/territories must apply for recognition or exemption and must comply with NI 24-102 Clearing Agency Requirements (NI 24-102), which adopts PFMIs. - NI 24-102 cyber resilience and operational risk requirements include: - Implementation of adequate internal controls over systems; - Implementation of adequate cyber resilience and information technology general controls (information systems operations, information security, change management, problem management, network support, system software support); - Annual capacity stress testing and capacity estimates; - Prompt notification of incidents to regulatory authorities; - Keeping a record of any incidents; - Annual vulnerability assessments; - Annual system reviews by external auditors; - Implementation and testing of business continuity plans, including disaster recovery plans; - Participation in industry-wide business continuity tests. - CSA guidance on cybersecurity: - CSA Staff Notice 11-338 CSA Market Disruption Coordination Plan (dated October 18, 2018). - CSA Staff Notice 11-336 Summary of CSA Roundtable on Response to Cyber Security Incidents (dated April 6, 2017). - CSA Staff Notice 11-332 Cyber Security (date September 17, 2016). - CSA Staff Notice 11-326 Cyber Security (dated September 26, 2013). - Assessment: NI 24-102 requirements are comprehensive and cover appropriate controls for cybersecurity, in line with international standards. ### Assessment, gaps, and harmonization needs - Overall assessment: Guidelines are well drafted, in line with international standards, and broadly principles-based, allowing proportionate implementation by firms. - Issues identified: - Significant number of discrete guidelines with cyber dimensions may complicate supervision and the application of a proportionate risk-based approach. - Need to rationalize and map cyber-specific requirements to an integrated and standardized approach for cyber supervision at some provincial authorities. - BOC’s ECR and NI 24-102 are largely aligned but should be mapped and integrated into a common standardized methodology for joint oversight of CDS and CDCC. - None of the authorities currently have legal/regulatory powers over third-party providers; exploration of increasing such powers is recommended. ### Recommendations (explicit) - The BOC may consider updating its ECR with regards to third party risk management in light of the ongoing work of the CPMI-IOSCO. - The federal and provincial authorities should explore mechanisms that will increase their legal and regulatory powers over third-party providers. As a reference, authorities may look at legal/regulatory frameworks such as the Euro Area’s Digital Operational Resilience Act (DORA) and the UK’s Financial Services and Markets Act (FSM) Act 2023, which granted HM Treasury new powers to designate service providers as critical third-party providers (CTPs) if their failure would pose a threat to financial stability or confidence in the U.K. financial system. - BCFSA and AMF may consider reviewing their suite of different guidelines to identify requirements related to cyber risk management and map these requirements to their cyber supervision and oversight frameworks to enable a more structured and complete approach to assessment processes. - BOC and CSA members should continue to map their respective cyber-specific regulatory requirements to ensure integration into a common oversight methodology and allow a standardized approach for cooperative FMI oversight. ### Supervisory arrangement — OSFI supervisory priorities and processes - OSFI supervisory approach: - Combines onsite, offsite, and thematic review in a risk-based approach. - Uses tools such as the Cyber Security Self-Assessment tool and independent assurance. - Onsite examination process is detailed and structured; OSFI has conducted a substantial number of onsite examinations in the last three years relative to peer jurisdictions. - Review and risk rating on operational resilience (which includes cyber risk) is well integrated into overall risk rating and tiering for FRFIs. - Reports on onsite examinations and subsequent findings are well drafted and communicated to FRFIs. - TRD has made significant progress in a short time to build maturity in OSFI’s cyber supervision; its 3-year plan promises continued maturity with more integrated processes and automated tools. *Source: 1canea2025003-source-pdf - 58. The financial sector network should work closely together to develop cyber strategies* ### 88. OSFI’s Supervisory Framework applies proportionality in its supervisory approach ### OSFI’s Supervisory Framework applies proportionality in its supervisory approach ### OSFI supervisory approach and risk rating - Supervisory approach applies proportionality based on risk, size, and complexity of the institution. - Each institution is given a risk rating based on its ability to manage: business risk; financial resilience; operational resilience; and risk governance. - The operational resilience category includes an assessment of technology, cyber, and operational risks. ### OSFI policy instruments and tools - Uses a range of policy instruments and tools for cyber security and technology supervision. - Includes the Cyber Security Self-Assessment tool originally published in 2013 and updated in August 2021 to assist FRFIs in conducting self-assessments in cyber security. ### Focus areas and triggers for supervisory work - Focus areas for onsite examination or offsite monitoring are driven by risks observed for a specific FRFI or the sector. - Example: conducted cloud computing reviews in 2020/2021 across all the large banks due to rapid adoption of cloud services. - OSFI may select reviews for specific areas of risk at an FRFI (e.g., incident response or disaster recovery). ### Onsite examination conduct and scope - Onsite examinations involve: - Conducting discovery meetings with key stakeholders to inform scope, coverage, and identify material to be supplied by institutions. - Requesting and reviewing detailed artifacts prior to the examination to understand governance, control environment, risk assessment, monitoring, reporting, and controls; followed by multiple meetings to clarify understanding and request additional artifacts. - Requesting walkthroughs and demonstrations of processes and tools as needed. - Typical review workload during a review: - OSFI conducts 10–15 meetings and reviews 100+ documents provided by institutions. - Control effectiveness testing is part of onsite reviews. - Recent focus placed on foundational controls related to governance and oversight, risk management, and cloud computing. ### Monitoring / offsite processes - Offsite processes are less intrusive and use a risk-based approach to monitor technology and cyber risks by requesting and reviewing risk management artifacts such as architectural documentation, risk management framework, policies and standards, and board reports with key technology and cyber related KPIs and KRIs. ### Supervisory activity and thematic reviews - In the last three years, OSFI has conducted 35 technology and cyber related onsite examinations, some including post-incident examinations. - Thematic examinations and monitoring can result in supervisory letters with recommendations and industry letters. - Example outcomes: supervisory letters from thematic monitoring of Business Continuity (BCP) and Disaster Recovery (DRP) of small and medium size institutions; comparative analysis shared with targeted institutions from thematic monitoring of Cloud and Cyber risks and Technology Currency Management processes. - OSFI has developed Criteria Matrices (supervisory assessment guides) aligned to B13 Guideline topics. ### Third-party risk and reliance on assurance - OSFI’s mandate is limited to assessing the quality of third-party risk management at FRFIs via monitoring and onsite reviews. - Reliance on independent cybersecurity attestation or other assurance varies by factors such as OSFI oversight, whether the attestation was commissioned by an independent party, and the nature and purpose of the assessment. - Limited reliance is placed on assessments and attestations led by institutions for internal or commercial purposes (e.g., SOC2 type 2); results can inform OSFI monitoring. - Limited reliance is placed on self-assessments; results are validated through follow-up meetings and requests for information. ### Findings, ratings, and remediation follow-up - OSFI does not formally define risk ratings for individual findings; severity of findings influences the institution’s risk rating. - Priorities and areas of concern are communicated in the annual supervisory letter; specific cyber findings may be communicated separately if appropriate. - OSFI follows up on all findings and assesses sustainability of remediation. - For institutions with robust risk management and internal audit, OSFI requests that they verify and challenge closure of findings. *Source: OSFI supervisory descriptions in the provided IMF chapter excerpt.* --- ### Bank of Canada (BOC) oversight of FMIs — CAR methodology and practice ### Oversight framework and CAR process - Oversight framework consists of oversight standards, periodic assessments (“CAR”) against those standards, regular monitoring, and approval of significant changes. - CAR on cyber risk assesses FMI practices against the ECR and incident reporting guidelines. - Bank staff request cyber security frameworks, policies, and annual self-assessments to form the basis of initial offsite assessments. - Onsite meetings supplement document review with targeted questions; BOC does not perform technical testing or verifications as part of onsite examinations. - The Bank’s cycle for conducting cyber-CARs is every three years. ### Recent CARs and flexibility - Cyber-CARs performed during the last cycle: - 2022 - Payments Canada (Lynx, ACSS) TMX Group (CDCS, CDSX) Interac (e-Transfer) - 2023 - Interac Inter-member network (IMN; review began in late 2023 following IMN’s designation as a prominent payment system and ended in early 2024) - CAR cycle is generally every three years per subject area; off-cycle reviews can be conducted if warranted (e.g., industry trends or repeated risk events). - One thematic review performed to date on third-party risk management (which includes a cyber component). ### Gap assessment, ratings, and remedial actions - CAR assesses gaps against the ECR and uses gaps to develop potential risk scenarios. - Scenarios are assessed against a likelihood and severity matrix to derive gap ratings ranging from Tier 1 to Tier 4. - Oversight staff propose remedial actions (“oversight expectations”); ORAC provides challenge to severity and remedial proposals. ### Testing, third-party risk, and assurance - FMIs are expected by the ECR to establish and maintain comprehensive testing programs as part of cyber resilience; the Bank reviews summaries of test findings but is not involved in the tests. - ECR is used to assess third-party risk; BOC also applies the PFMIs for oversight expectations applicable to critical service providers. ### Communication, follow-up, and assurance approaches - The BOC does not share risk ratings; key findings are shared with designated FMIs following CARs. - Findings/matters of concern are reviewed annually by ORAC to determine oversight expectations, which are formally communicated to senior management and discussed with the Board. - Each oversight expectation includes an associated timeline for completion. - The Bank follows up semi-annually at Executive Meetings with senior management and the BOC on progress. - Depending on scenario, the BOC could request an audit or professional acknowledgement; typically seeks assurance directly from the FMI in the form of updated documentation and implementation evidence. ### Assessment of BOC approach - BOC’s ECR provides a holistic basis for overseeing FMIs; combination of offsite and onsite examinations allows effective monitoring of FMIs’ cyber capacities. - During the FSAP assessment, CAR methodology was found robust: ECR basis, detailed documentation and evidence, mature evaluation and root-cause analysis, clear findings and reporting, and timely follow-up. *Source: Bank of Canada oversight descriptions in the provided IMF chapter excerpt.* --- ### British Columbia Financial Services Authority (BCFSA) supervision of PRFIs ### Supervisory philosophy and standards - Supervision of PRFIs is principles-based and focused on risk-based supervision (RBS). - PRFIs and pension plan administrators are subject to BCFSA’s Information Security Guideline, modelled after the NIST Cyber Security Framework. - Central 1 adheres to ISO 27001 and is independently assessed annually against ISO requirements. ### Offsite supervision focus areas - Offsite supervision focuses on: - Adoption of any new technology that may pose cyber risk. - Major changes to systems supporting critical business functions. - Review of IT-related internal audit reports for timely addressing of significant findings. - Review of enterprise-risk-management (ERM) dashboard and material changes direction on cyber risk. - Review of Committee meeting package and minutes (e.g., IT Committee) and follow up with regulated FI. ### Onsite examinations and testing expectations - Onsite examinations follow the Information Technology Assessment Criteria and cover all assessment areas. - BCFSA prepares interview questions for key personnel (IT staff, management, internal auditors) to verify processes and controls for critical systems, applications, and data. - Per Information Security Guideline, regulated financial institutions are expected to establish testing processes that may include penetration tests, vulnerability assessments, or table-top exercises, depending on size and complexity; supervisors review test reports and ensure critical/high importance findings are addressed in a timely manner. - Supervisors are not involved in conducting tests but review outcomes. ### Use of external assurance and work of others - Supervisors, where appropriate, use the work of others to reduce supervisory scope. - BCFSA accepts assurance reports from independent third parties as independent assurance. - Cybersecurity self-assessments and internal audit work may be used and validated through interviews or working paper comparisons where appropriate. ### Prioritization, follow-up, and proportionality - No risk rating for individual findings; BCFSA prioritizes findings by requirement (high priority), recommendation (medium priority), and observation (low priority), with due dates for formal plans to address findings. - Supervisors follow up on findings classified as requirements or recommendations. - Proportionality applied: expectations differ by size and complexity; systemic institutions expected to have more robust BCP and cyber incident response plans and higher frequency/level of detail in management reports to the Board. ### Observations and capacity constraints - BCFSA has not conducted any credit union on-site cybersecurity examinations in the past 3 years, including Central 1; has not performed a thematic cybersecurity review in the last 3 years. - BCFSA is a relatively new authority and prioritized governance, strategy, and long-term viability in its first three years, focusing cyber supervision mostly on continuous monitoring rather than onsite examinations. - BCFSA does not have a specific cyber risk supervisor position and relies on one Subject Matter Expert for information security; this results in a lack of dedicated cyber supervision resources against a large number of FIs. - The Information Technology Assessment Criteria has not been mapped to other BCFSA Guidelines (Outsourcing Guideline and Recovery Plan Guideline) and is not a supervisory manual; a dedicated manual mapping cyber requirements across guidelines is recommended to support generalist supervisors. *Source: BCFSA supervisory descriptions in the provided IMF chapter excerpt.* --- ### Québec Autorité des marchés financiers (AMF) cyber supervision ### Supervisory focus and guidance basis - Primary focus is governance of cyber risk and integration into the global risk management framework. - Supervision process is based on: ICT guideline, Operational risk management guideline, Outsourcing risk management guideline, Business continuity guideline, Integrated risk management, and Governance guideline. - There is no supervisory manual that sets out processes for offsite, onsite, and thematic reviews against all cyber-specific requirements; cyber-specific requirements in these Guidelines have not been mapped. ### Offsite supervision practices - Offsite cyber supervision practices include: - Quarterly and ad-hoc meetings with structures managing operational, ICT, and cyber risks. - Granular data minimally analyzed quarterly (e.g., operational incidents and loss structures) to challenge institutions. - Regular meetings with first, second, and third lines of defense to exchange/challenge findings and action plans; meetings with senior officers (e.g., CISO, chief compliance officer). - Requesting a process for notification of material operational risk incidents; each notification is analyzed and requires timely resolution demonstration. - Following major initiatives such as prioritization of critical activities, impact analysis, management of shadow banking, systems modernization, automation, ICT operations, and ICT risk management. - Requesting D-SIFI to develop indicators linking deployment and operationalization of initiatives to reduction of operational risk. - Adding quantitative analysis to obtain a complete picture of exposures. *Source: AMF supervisory descriptions in the provided IMF chapter excerpt.* *Source: Excerpt from the IMF country FSAP chapter on Canada supervisory practices.* ### 120. The AMF’s risk profiles of its regulated entities are updated minimally annually with ### 1canea2025003-source-pdf - 120. The AMF’s risk profiles of its regulated entities are updated minimally annually with ### AMF supervisory scope and examination process - The AMF’s risk profiles of its regulated entities are updated minimally annually with these mechanisms and the output of on-site supervisions. - The main cyber risk areas supervised by the AMF are aligned with the six domains defined by the 2024 NIST (CSF) framework. - The AMF’s onsite examinations are based on the Financial Institutions Supervisory Framework and the Guideline on Information and Communications Technology Risk Management. - The scope of the AMF’s examinations is based on the financial institution’s risk assessment and the proportionality principle and covers the following subjects: - Types of ICT risks (Taxonomy) - ICT governance - ICT risk management - Organizational framework - Cybersecurity policies - Supply chain risk management - Asset management - Risks assessments - Identity and access management - Security Training and awareness - Data security measures - Platform security - Technology infrastructure resilience - Monitoring - Security event monitoring - Incident management and reporting - Resilience, business continuity and disaster recovery - Network security - Vulnerability and patch management - Intrusion testing - Independent conducted cybersecurity posture maturity assessments - ICT and security architectures - When performing examinations, the AMF will ask for all relevant documentation pertaining to the scope as determined by the proportionality principle. - The AMF will meet and interview relevant personnel including high level executives such as the VP of IT, the CISO, the VP of audit, and the VP of Compliance. - The AMF will examine Board meeting minutes and submit reports on cybersecurity and risks, including those to the audit and risk committees. - The AMF also receives regular reports from the second line of defense (Integrated Risk Management), which may include cyber risks assessments. - In the last 3 years, the AMF has performed 10 on-site cybersecurity examinations, but no thematic reviews on cybersecurity. ### Independent assessments, penetration testing, and maturity assessments - The AMF expects FIs to obtain independently conducted cybersecurity maturity assessments and penetration tests and/or red team tests. - The AMF does not impose any framework for these assessments, and the AMF is not involved in their execution. - The AMF recommends internally conducted maturity assessments, intrusion testing and risk analysis according to their cybersecurity maturity posture, ICT cybersecurity practices and risk management practices. - For regulated entities with a high-risk profile in the securities sector, the AMF requires vulnerability and penetration testing to be performed and the results to be provided on a quarterly basis. - The AMF follows up on observations and further investigates with the information security office when necessary. - The AMF relies on independently conducted assessments of the cybersecurity maturity, intrusion tests and security controls appropriateness and efficacy. These assessments are used to evaluate comprehensiveness and maturity and to compare the cybersecurity posture of the FI’s peers. - The AMF relies on the FI’s self-assessments to a lesser degree, mostly as a measurement of progress of security initiatives or actions plans, and validates their results with independently performed assessments or with third line of defense assessments on a case-by-case basis. ### Examination findings communication and remediation timelines - The AMF communicates the findings and the severity rating of the recommendations of the examination to the concerned FI. - The AMF follows up on all recommendations from its examinations. - FIs are expected to respond within 30 to 45 days after receipt of the examination report and its recommendations. - The AMF relies on the institution’s third line of defense to provide assurances on the appropriateness and on effectiveness of the implementation of the cybersecurity measures outlined in the recommendations on a case-by-case basis, as well as independent cybersecurity auditors. - Assessment: The AMF has a sound cyber supervisory framework, which includes onsite and offsite examinations. However, there are a significant number of guidelines that FIs must adhere to, and these should be analyzed and mapped to cyber-specific requirements, and thereafter integrated into the supervisory assessment processes, documented in a dedicated cyber supervisory manual. ### Securities regulators’ oversight of clearing agencies (CSA and provincial regulators) - Securities regulators monitor and assess compliance of clearing agencies with the systems review requirements described in NI 24-102; periodic reviews must include an assessment of how clearing agencies are compliant with the regulatory requirements. - Regulated entities must conduct an annual self-assessment, further to which the relevant securities regulator conducts its own annual risk assessment. - As part of offsite cyber risk supervision for clearing agencies, relevant provincial securities regulators mandate quarterly provision of: - cyber security events identified, - threats and vulnerabilities identified, - penetration tests performed, - training and awareness exercises conducted (Quarterly Cybersecurity Report). - Where a security incident has occurred, the relevant provincial securities regulators require a full report on both the incident and steps to remediate any issues identified and monitor action to remediate issues identified. - The securities regulators, jointly with the Bank of Canada, participate in a quarterly call with the clearing agencies to review results of the quarterly cyber-security report and operational risk events, and track remediation of self-identified exploitable vulnerabilities. - Focus areas of on-site cybersecurity examinations by securities regulators are based on annual risk assessment results and have included: - organizational structure and roles/responsibilities of information security department, senior management and the Board; - IT security surrounding APT (Advanced Persistent Threats) attacks; - results of disaster recovery tests; - internal audit IT risk assessment and monitoring work; - processes and procedures pertaining to IT; - clearing agency’s policies and procedures relating to security, including oversight of third-party service providers; - reports and records provided by internal audit, external auditors, vulnerability and penetration testers, and other third parties. - The securities regulators have not performed an on-site cybersecurity examination of clearing agencies in the last 3 years for reasons including CDCC implementation of a new risk system in 2019 and CDS modernization beginning in 2018 and still ongoing; the most recent IT related examinations were completed in 2015 and in 2018. - The securities regulators use a formal rating system to assess the risk profile, ensuring uniformity across clearing agencies; annually, the risk rating of each clearing agency is benchmarked against each other and previous years ratings. - For clearing agencies, regulators rely on the annual system reviews performed by external auditors as required under NI 24-102; clearing agencies must perform vulnerability and penetration testing and provide the results on a quarterly basis. - Clearing agencies must submit an action plan within 30 days following receipt of the final oversight review report that includes timelines for addressing all findings and/or a description of corrective actions already taken; compensating controls may be required until findings are resolved. - The securities regulators periodically follow up on clearing agency progress in implementing action plans; any changes affecting corrective actions or timelines must be communicated to the securities regulators. - Assessment: The oversight framework for regulated clearing agencies is robust and cooperation between CSA, securities regulators and BOC is well-defined; however, it is essential that the CSA and respective regulators conduct an onsite examination of the CSD and CCP with regard to cyber resilience and to map regulatory requirements to a standardized oversight methodology to guide joint oversight more efficiently. ### Recommendations (excerpts) - BCFSA and AMF should review and map all of their Guidelines to identify the cyber and technology-specific requirements and thereafter develop a supervisory manual that includes these requirements and sets out the process for onsite, offsite, and thematic reviews to supervise them, in line with the RBS framework. - BCFSA should conduct onsite examinations for cyber resilience on its most systemic PRFIs, including Central 1. - BCFSA should consider increasing its staffing and/or expertise in cyber supervision. - CSA members and BOC should conduct an onsite examination related to cyber resilience of its regulated entities. ### Incident reporting arrangements - OSFI, BOC, BCFSA, AMF and CSA all have comprehensive cyber incident reporting regimes in place with clear definitions for cyber incidents, severity ratings/thresholds, timelines for reporting, and clear procedures for reporting. - Financial entities must report cyber incidents to their respective financial authorities. - The incident reporting regimes do not consistently require third-party providers to report incidents; if there is an incident at a provider, FIs may not be able to report such incidents due to confidentiality and legal constraints. - The incident reporting regime is mature and authorities receive incident notifications in an efficient manner. - OSFI’s TRD receives as many as 2000 incident notifications per year and has a robust process to review incidents, invoke incident response protocols if required, analyze incidents on an aggregate level annually, and disseminate an analysis of the incidents to FRFIs. - Authorities could improve sharing of relevant incident information with each other when appropriate and feasible, and improve convergence (example: BCFSA and AMF are not informed of relevant incidents in British Columbia and Québec by OSFI). - Follow-up incident reporting for entities overseen by multiple authorities can be cumbersome due to different requirements and templates. - Recommendations: - Review the work of the FSB’s Cyber Incident Reporting working group and update existing incident reporting regimes in line with the FSB’s framework Format for Incident Reporting Exchange (FIRE), align them as much as possible, and consider mechanisms for cross-authority information sharing of relevant incidents, when appropriate and if legally feasible. - Authorities should consider how to integrate third-party providers into the reporting processes. - The federal authorities should undertake a legal review and take necessary steps to facilitate the sharing of relevant incident information between federal and provincial regulators. ### Supervisory resources (selected agency details) - OSFI: - TRD has 29 full-time employees. - The incident response team has grown from one resource to five in the past two years. - Tools and automation are being considered to reduce manual processes; progress has been slow due to lack of dedicated IT resources and funding. - The CATTIC team was established in 2022 to identify and monitor macro cyber and technology threats and risks within the financial sector; currently there are 3 full-time employees in CATTIC. - In 2023, OSFI established a NSS to support its mandate to consider if FRFIs have adequate policies and procedures to address threats and risks related to integrity and security, including foreign interference. - Bank of Canada: - The BOC’s FMI oversight team includes two full-time cyber specialists. - Oversight has an agreement with the Bank’s Information Technology Services department to get additional technical support as required. ### Information sharing arrangements - The information and intelligence sharing ecosystem in Canada is mature but there is room for improvement. - OSFI shares information, without disclosing confidential information with FRFIs through various means, including: - Issuing technology and cyber bulletins across the sector on themes and trends observed (examples in the past 24 months include MOVEiT transfer vulnerability, HTTP/2 Rapid Reset vulnerability, ransomware and API security). - Issuing an annual report on themes and trends noted around incident reporting to share themes, trends, and root causes of technology and cyber security incidents reported to OSFI. - Sharing, every quarter, incident trends, insights, and themes when meeting with the large banks and insurance companies to discuss technology and cyber risks. - Participating in CFACT, a new initiative to identify and share key risks, vulnerabilities, and opportunities in the financial sector; membership includes all FISC agencies along with the CCCS and FINTRAC. - Meeting quarterly with the US Treasury to share information on cyber topics together with the DoF, BOC, and Payments Canada. *Source: https://www.imf.org/-/media/files/publications/cr/2025/english/1canea2025003-source-pdf.pdf* ### 149. The BOC chairs the CFRG, which acts as the Canadian critical financial sector’s primary ### 1canea2025003-source-pdf - 149. The BOC chairs the CFRG, which acts as the Canadian critical financial sector’s primary ### Information sharing arrangements and stakeholders - The BOC chairs the CFRG, which acts as the Canadian critical financial sector’s primary forum for sharing information and coordinating a response related to operational incidents (including cyber) between the government and private sectors. Information sharing is on a voluntary basis. - The BOC is a member of the Financial Services Information Sharing & Analysis Centre (FS-ISAC). FS-ISAC Canada has been active since the early 2010s and involves many major players from across the country’s finance sector. The group provides intelligence to its members. - The Canadian Centre for Cyber Security (CCCS): - Participates in finance-sector arrangements for cyber information and intelligence sharing. - Collaborates with FIs and communities of interest to share threat intelligence. - Is a member of high-level trust groups within the Canadian finance sector and has capabilities for sharing IOCs and receiving intelligence reports. - The Canadian Cyber Threat Exchange (CCTX): - Aggregator providing CCCS with wide distribution to Canadian critical infrastructure organizations. - CCTX Board members include representatives from large Canadian private-sector organizations across finance, energy, telecommunications, and transportation. - CCCS participates in the weekly threat calls. - CCTX Data Exchange and portal are used to analyze and share cyber threat information and best practices. - It is unclear what proportion of the financial sector (federal and provincial) are involved in CCTX. - Private-sector networks: - A limited number of large banks have access to threat intelligence from the CSE; this level of intelligence is not available to other large systemically important FIs. - Canadian CISO Collaboration (C3) is an offshoot of FS-ISAC Canada that brings private-sector CISOs together for informal sharing. - There is no automated platform that facilitates easy sharing of strategic, operational and tactical information across the sector. ### Provincial-level arrangements and gaps - British Columbia (BCFSA): - BCFSA is not part of a provincial cyber information/intelligence sharing arrangement, though it participates in CCCS Cyber Threat briefings. - No information and intelligence sharing network exists at the provincial level among market participants. - General information sharing exists with other regulators through Credit Union Prudential Supervisors Association (CUPSA). - There are no information sharing arrangements with the federal regulator OSFI. - Québec (AMF): - Many financial-sector members are in FS-ISAC, but the AMF is not on FS-ISAC. - AMF and many sector organizations work with CCCS for cyber threat intelligence and best practices. - Cross-jurisdictional gaps: - Gaps in maturity of information and intelligence sharing between federal and provincial sectors. - Not all provincial entities have access to intelligence provided by CCCS, OSFI, and BOC. - FS-ISAC is efficient for commercial threat intelligence but is not designed to build trust among smaller networks that share actionable ex-ante intelligence. - No apparent threat intelligence sharing between federal and provincial entities. - Information and intelligence sharing initiatives appear ad-hoc, not accessible to all, and unstructured or not formalized. ### Rationale for sharing and sector benefits - Financial entities should have effective cyber threat intelligence processes and actively participate in sharing arrangements and trusted stakeholder collaboration. - Exchanging cyber intelligence enables members to: - Leverage collective knowledge, experience, and capabilities. - Gain a more complete understanding of threats. - Make threat-informed decisions on defensive capabilities, detection techniques and mitigation strategies. - The Canadian financial sector would benefit if federal and provincial entities participate in industry-wide networks and if more structured federal–provincial mechanisms exist. - Private-sector feedback highlighted: - Desire for effective, structured information and intelligence sharing accessible via automated platforms and in-person networks. - Concerns that legal constraints (perceived contravention of data privacy) and legal liability issues limit sharing. - Recommendation for a legal review by authorities on confidentiality and information sharing and potential legal exemptions to facilitate sharing under financial stability and national security pretexts. ### Recommendations on information and intelligence sharing - Federal and provincial authorities should work with financial sectors to develop and operationalize cyber information and intelligence sharing networks using a structured approach and close industry engagement. This should include: - Drafting Terms of Reference and Rulebook for participants; - Developing an operational platform (e.g., MISP) and creating a CISO network for in-person meetings to foster trust and sharing; - Detailing the types of strategic, operational, and tactical information and intelligence to be shared; - Setting out the principles for sharing and analyzing information. - As networks are established, authorities should improve sharing between federal and provincial levels in a systematic and structured manner, potentially using the Sector Network as a basis for coordination and establishing a network of networks. - Federal and provincial authorities should conduct a legal review on information and intelligence sharing to facilitate sharing without legal barriers (if feasible and permissible) and promote sharing among FIs without fear of legal liability. - Footnote: In some jurisdictions, such a network is also established through a Financial Sector Computer Emergency Response Team (FINCERT), which Canadian authorities and CCCS could also explore. ### Cyber testing frameworks and current status - OSFI I-CRT: - OSFI developed and published its Intelligence Led Cyber Resilience Testing (I-CRT) Framework in April 2024. - Current scope applies to all Systemically Important Banks (SIBs) and Internationally Active Insurance Groups (IAIGs), which OSFI will cover on a 3-year cycle. - TLPT / red team testing: - TLPT framework models the UK’s CBEST and the ECB’s TIBER-EU and aligns with the G7 Fundamental Elements for TLPT. - TLPT/red team tests mimic TTPs of real-life threat actors based on threat intelligence and simulate attacks on an entity’s critical functions and underlying systems to assess protection, detection, and response capabilities. - OSFI has overseen two-three tests on FIs under I-CRT to date. - Framework maturity and implementation considerations: - I-CRT is well drafted but in its infancy; OSFI should monitor implementation and resource/skills requirements. - I-CRT requires tests on live production systems, increasing risk; such tests should be conducted by competent and qualified providers. - Unlike CBEST (CREST-accredited providers) or TIBER-EU, the I-CRT currently does not mandate accreditation nor set out criteria and conditions for providers. OSFI should consider incorporating such criteria and conditions. - Cost and optimizations: - TLPT tests are significantly expensive. - Introducing a GTL report could improve cost-effectiveness by elaborating the Canadian financial system threat landscape and informing specific threat assessments for FIs. - The GTL could consider key participants and critical functions (banks, broker dealers, FMIs, FMUs, other critical third parties), threat actors and common vulnerabilities. - The CCCS is suggested as perhaps best placed to develop the GTL, in collaboration with agencies such as CSE and RCMP. - OSFI’s TRD indicated a future deliverable is an I-CRT Lite Framework; inclusion of purple and gold team testing would provide more economical tests and enable proportionate implementation across a broader set of FIs. - Other authorities: - BOC, BCFSA, and AMF do not have a dedicated TLPT testing framework. - Other authorities should consider TLPT for their systemically important entities (e.g., FMIs). ### Testing recommendations - OSFI should monitor I-CRT implementation and ensure adequate resources and expertise. - OSFI should include clear criteria and conditions for threat intelligence and red-team testing providers to ensure appropriately qualified providers can conduct I-CRT tests. - CCCS should consider developing a GTL in close collaboration with relevant agencies (RCMP, CSE). - OSFI should consider updating the framework over time to integrate a GTL component, purple and gold team testing, and use the GTL for playbooks, scenarios and exercising. - The BOC and other provincial regulators should consider applying I-CRT to their own systemically important FIs. ### Exercises: objectives, current activity, and gaps - Purpose of industry-wide cyber crisis simulation exercises: - Rehearse collective response of the financial sector to major operational disruption. - Test decision-making and crisis communication arrangements. - Validate collective contingencies. - Enable participants to practice response protocols. - Improve sector-level response coordination between public and private sectors and with other jurisdictions. - Identify gaps in operational resilience, information sharing arrangements, and priorities to strengthen response and recovery capabilities. - OSFI: - Participates in CFRG and G7 Cyber Expert Group (CEG) exercises. - Conducted one exercise including two banks in 2020 and aims to conduct a further exercise as part of its 3-year plan; exercises to date have been limited. - Bank of Canada (BOC) and CFRG: - CFRG held two industry-wide exercises to test the CFRG Crisis Coordination Playbook under BOC leadership; participants included CFRG’s executive Steering Committee members. - Exercises led to Playbook updates, documenting processes related to public-facing communications and coordination. - In 2024, CFRG and CSTAC partnered on the first cross-sectoral exercise between financial and telecommunications sectors with over 40 organizations; actioning findings includes formalizing cross-sector crisis coordination processes. - Canada Deposit Insurance Corporation (CDIC): - Conducted a tabletop exercise with its Board in April 2022 to explore CDIC’s role and toolkit in the event a D-SIB was impacted and depositors unable to access deposits for a prolonged undefined period. - Exercise explored CDIC’s role as resolution authority and deposit insurer when critical services are interrupted by an operational event; contributed to preparedness. - CDIC has participated in CFRG exercises but has not conducted an exercise with FIs as participants against a cyber event background. - Provincial regulators: - BCFSA has not conducted cyber exercises with FIs nor was it involved in BOC’s exercises as it is not a CFRG member. - AMF has not conducted sector-wide exercises, though it was involved in CFRG exercises. - Securities regulators: - Canadian securities regulators formed the Market Disruption and Cybersecurity Coordination Group (MDCCG) in 2017 to improve communication and information sharing for large-scale market disruptions, including cybersecurity incidents. - MDCCG developed the CSA Market Disruption Coordination Plan in 2018; periodic testing occurs. - CIRO biennial industry Business Continuity Plan (BCP) tests in 2021 and 2023 included market disruption simulation components testing the CSA Plan. - The most recent CIRO BCP test was conducted in December 2023 on a scenario affecting TSX that led to trade breaks and rumors of a coordinated cyber-attack on Canadian marketplaces and clearing agencies. ### Observations and exercising recommendations - Exercises conducted have been positive but too infrequent and limited in participant breadth (e.g., limited inclusion of insurance companies, Central 1). - Recommendation: Increase frequency and coverage of cyber exercises to build resilience and enhance crisis preparedness across a broader range of financial-sector participants. - Recommendation: Authorities and industry should action cross-sector and cross-jurisdictional exercise findings to formalize coordination processes. *Source: Excerpt from the IMF PDF chapter/section (content unit provided).* ### 182. Third-party providers play a critical role within the Canadian financial sector, as well as ### Third-party providers play a critical role within the Canadian financial sector, as well as other sectors ### Role of third-party providers and cyber exercises - Third-party providers fall outside the legal and regulatory perimeter but can be involved as participants in cyber exercises. - Inclusion of third-party providers in exercises can: - Foster relationships between authorities, the broader financial sector, and critical third-party providers. - Integrate such providers in sector-wide incident management processes. - Facilitate information sharing between all parties, leading to stronger cyber resilience across the ecosystem. - Recommendation: - DoF, BOC, OSFI, BCFSA, and AMF should conduct regular (e.g. annual) cyber simulation exercises with other authorities, sectors (e.g. telco) and a broader selection of financial entities in their federal and provincial sectors (e.g., banks, FMIs, insurance companies, etc.), including third-party providers. - The proposed financial sector network should share experiences of exercises, scenarios, approaches, results to enable a more structured and standardized approach to cyber exercising, improving public-private coordination and sectoral cyber incident response frameworks. ### C. Systemic Response and Recovery — Institutional capabilities and protocols - Office of the Superintendent of Financial Institutions (OSFI) - OSFI chairs the FISC; the forum is flexible and can be used to coordinate on cyber risk issues though coordination mechanisms are not outlined in formal agreements. - OSFI has sector-wide crisis communication protocols for its regulated entities. - OSFI has contingency plans and crisis communication protocols for largescale cyber-attacks, including the OSFI Technology and Cyber Incident Response Protocol for FRFIs. - TRD monitors incidents continuously (e.g. using tools such as Down Detector) and can invoke incident management protocols. - OSFI follows CCCS guidance and is developing updated playbooks (e.g., Ransomware). - Bank of Canada (BOC) - BOC’s Incident Reporting Guidelines require designated FMIs to inform the Bank promptly of significant cyber events; FMIs and the Bank maintain reciprocal contact lists. - Notices of significant incidents are reported to senior management and internal stakeholders including IT Services and Financial Stability. - For incidents with material impact on an FMI, the Idiosyncratic Crisis Management Advisory Committee (ICMAC) would be invoked; responses could include lending to the FMI or declaring an FMI non-viable and invoking the Bank’s resolution authority. ICMAC advises on public communications. - A cyber event with potential financial system-wide impact would trigger the CFRG, which coordinates responses and advises on public communications. CFRG has a Crisis Coordination Playbook for potential or actual systemic operational incidents (including cyber). - CFRG shares information and coordinates responses but is explicitly not a decision-making body: “CFRG is not a decision-making body, although it can influence decision-making bodies to fulfil its mandate”. - Department of Finance (DoF) - DoF maintains a cyber contingency plan for largescale cyber-attacks on the financial sector. - DoF participates in FISC processes and has crisis communication protocols. - DoF developed an Interagency Cyber Preparedness Playbook outlining protocols and agreements for information sharing and liaison among FIs and financial sector agencies during cyber incidents. - British Columbia Financial Services Authority (BCFSA) - BCFSA may activate its Crisis Communication Plan for largescale cyber-attacks materially impacting regulated financial institutions. - There is no playbook for different cyber scenarios that PRFIs might encounter, and the plan has not been tested. - Autorité des marchés financiers (AMF, Québec) - Each business sector has its own business continuity plan (BCP), last updated in 2022. - Since January 2024, Integrated Risk Management and Performance centralizes and updates BCPs with business lines as part of the operational resilience program. - Corporate business continuity policy is approved by the CEO and links BCPs with other emergency plans (e.g. Crisis management plan); policy is available on the corporate intranet. - AMF has 13 playbooks addressing common cyber threats (phishing, malware, data leak, intrusion, DDoS) to facilitate incident management. - The BCP is largely internal; there is no sector-wide crisis management plan or crisis coordination playbook for incidents that could impact the broader financial system in Québec. ### Findings on systemic response and decision coordination - Efficient response and recovery by authorities is essential to limit financial stability risks arising from: - Interconnected IT systems between multiple financial entities or between financial entities and third-party service providers. - Loss of confidence in a major financial entity or group. - Impacts on capital arising from losses due to the incident. - Existing federal bodies (FISC, CFRG, SAC) can manage systemic incidents but there is no dedicated cyber-specific decision-making structure for systemic cyber incidents. - An “Authority’s Response Framework” is essential to: - Allow relevant stakeholders to coordinate and communicate when the threshold for systemic cyber risk is breached. - Provide clear decision coordination and clarity on actions (e.g., invoking emergency lending, disconnecting FIs from FMI networks, public communications, interacting with international regulators). - SAC and FISC have mandate flexibility to address systemic cyber incidents: - FISC (led by OSFI) can initiate FI-focused cyber discussions. - SAC (Chaired by the Deputy Minister of Finance) can lead discussions extending beyond FISC’s FI focus and make decisions or recommendations to the Minister of Finance. - Both committees include principal decision-makers and can invite additional deputy heads or delegates, enabling rapid informed decision-making. - Authorities would benefit from formalizing decision coordination specifically for systemic cyber incidents, with clearly defined criteria/thresholds and regularly tested playbooks. - Recommendations (Systemic response and recovery) - Federal authorities (e.g. Finance Canada, BOC, OSFI and CDIC) should consider leveraging existing structures (e.g. FISC, CFRG, SAC, etc.) to put in place a process to manage a systemic cyber incident, with decision coordination, clearly defined criteria and threshold of systemic cyber incidents, and with a clear playbook of cyber scenarios, that are regularly tested. - AMF and BCFSA should develop and document a sector-wide crisis management and coordination plan, as well as playbooks for different extreme but plausible cyber scenarios. ### D. Systemic analysis and concentration risk — data, mapping, and stress testing - Current gaps - OSFI, BOC, BCFSA and AMF do not develop cyber maps of their financial sectors. - They have not identified and documented transmission channels through which cyber risks can affect financial stability. - They have not identified and documented cybersecurity risk contagion scenarios. - Cyber risk has not been included in their stress testing programs. - Data collection and analysis gaps - Not all authorities collect information on vendors and service providers of IT systems used by financial entities for their core business, nor the status of major external systems (e.g., connections to other systems, participating entities, and providers’ operating systems). - Without this data, authorities cannot estimate the extent to which an incident at a particular vendor or service provider could spill over into the financial sector. - Operational Risk Division within OSFI has collected data from 29 FRFIs and undertaken initial analysis of potential concentration risk caused by dominant providers. - CFRG conducted a cross-sector interdependencies analysis recently, providing valuable insight to FIs. - Benefits of cyber mapping and interconnectedness analysis - Collecting data and analyzing operational interconnectedness would help: - Understand potential systemic impacts and develop mitigation strategies and actions to manage crises. - Identify operational dependencies and critical nodes (e.g., payment and settlement systems, clearing services, underpinning technology systems). - Estimate impact of a cyber-attack on any node via financial sector network mapping. - Cyber mapping is an emerging field with few jurisdictions having advanced development; deepening analysis will identify systemic risks from interconnectedness and concentrations, enabling scenario development and stress testing. - Recommendations (Systemic analysis and concentration risk) - Authorities should collect information and data of third-party providers and the technology being used by financial entities; they should use this data to conduct analysis of how the financial sector is operationally interconnected. This entails developing network analysis of how the different critical sub-sectors are connected through common technologies and service providers, thereby allowing the identification of critical nodes. The authorities should use this analysis to: - Identify threats and their impact on the sector; - Develop a range of different scenarios that could threaten the sector(s) on a systemic level and develop mitigation strategies accordingly; - Conduct scenario-based tests or stress testing based on cyber scenarios; and - Improve incident response capabilities. - In developing the cyber map, the authorities could consider the approach described in Figure 3. _Italicized source: Excerpt from Canada Financial Sector Cyber Risk assessment (pages 54–60, 182–192, 197–199) as provided in the supplied PDF content._ --- _Source: https://www.imf.org/-/media/files/publications/cr/2025/english/1canea2025003-source-pdf.pdf_