## Financial Sector Structure, end 2012 (_cr1471)

## Source details

**Canonical URL:** [Financial Sector Structure, end 2012 (_cr1471)](https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr1471.pdf)

## Other formats

- [Markdown version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr1471.pdf.md)
- [Structured JSON version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr1471.pdf.json)

---

### Summary and key findings
- Canada has a very high level of compliance with the Basel Core Principles for Effective Banking Supervision (BCPs).
- Banking system concentrated in six domestic players ("Big Six Banks": RBC, TDB, BNS, CIBC, Bank of Montreal, National Bank of Canada); limited foreign presence.
- OSFI applies risk-based, proportionate, and "close touch" supervisory practices; perceived as authoritative but accessible.
- OSFI emphasizes early intervention within a risk tolerance framework that does not aim for a zero failure regime; depositor protection motivates early intervention.
- OSFI uses guidelines/advisories/letters/rulings and has comprehensive supervisory powers; guidance is treated as binding in practice.
- OSFI operates at a relatively principles-based level and could issue a more comprehensive suite of risk management standards.

### Institutional setting and market structure — key statistics (C$mn, end-2012)
- Total Assets: 6,283,054 (100% of federal system); equals 346% of GDP
- Banks: 3,846,877 (61%); 212% of GDP
- Life insurers and segregated funds: 980,340 (16%); 54% of GDP
- Investment funds: 782,179 (12%); 43% of GDP
- Credit unions and caisses populaires: 297,894 (5%); 16% of GDP
- Non-depository credit intermediation: 227,285 (4%); 13% of GDP
- Trust and mortgage loan companies: 50,490 (1%); 3% of GDP
- Property and casualty insurance: 97,989 (2%); 5% of GDP
- Banks held 61 percent of the federal system assets; 93 percent of the bank assets are held by the D-SIBs.
- Assets held by banks represented 212 percent of GDP as at end-2012.
- Tier 1 capital levels have remained above 13 percent.

### Preconditions, public infrastructure and legal framework
- Government fiscal strategy: return to balanced budgets by 2015–6 (context noted).
- Bank of Canada inflation target: current target annual rate of 2 percent.
- Federal statutes: Bank Act, Trust and Loan Companies Act, Insurance Companies Act, Cooperative Credit Associations Act; legislation subject to five-year reviews and sunset clauses.
- Corporate/insolvency framework: BIA, CCAA, WURA.
- Accounting standards: mandatory IFRS adoption for publicly accountable enterprises for financial periods beginning January 1, 2011 (with specified deferrals for some entities).
- Audit oversight: Canadian Public Accountability Board (CPAB) oversees external audit quality.

### Federal bodies and interagency coordination
- Minister of Finance: overall financial system stability responsibility.
- Bank of Canada: monetary policy, liquidity provision, payment/clearing oversight, systemic risk assessment.
- OSFI: prudential regulator for banks and federally regulated financial institutions; statutory mandate set out in OSFI Act (Section 3.1; Subsection 4(2); Section 6).
- CDIC: federal deposit insurer and resolution authority for federally regulated deposit-takers; insures eligible deposits up to a maximum of $100,000 per depositor, per member institution.
- FCAC: financial consumer protection agency.
- Formal coordination mechanisms: Financial Institutions Supervisory Committee (FISC); Senior Advisory Committee (SAC); Heads of Agencies (HoA); CDIC Board; Systemic Risk Committee (CSA).

### Supervisory powers, responsibilities and governance (OSFI)
- Statutory mandate: supervise institutions to determine sound financial condition and compliance; promptly advise management/board and require corrective measures (OSFI Act, subsection 4(2)).
- Legal instruments and supervisory communications: Guidelines; Advisories; Letters; Rulings; Discussion papers.
- Statutory powers (Bank Act excerpts preserved):
  - Information and examination powers: sections 628, 643, 644.
  - Corrective and sanctioning powers: sections 54, 187, 325, 419, 480, 485, 485(3), 644.1, 645, 646, 647, 647.1, 648–656, 973.03.
  - Ability to require undertakings (section 470) and to enter prudential agreements (section 644.1).
  - Taking control powers and associated stages: sections 648–656; Section 649 suspends directors’ and officers’ powers when Superintendent takes control.
- Enforcement tools include criminal sanctions (sections 980, 985) and Administrative Monetary Penalties (OSFI) Regulations.
- OSFI publishes institution-specific data and aggregate banking statistics on its website; Section 642 requires an annual report to Parliament.

### Independence, accountability, resourcing and legal protection
- Superintendent appointment: Governor in Council appointment for a fixed term of seven years; removal "for cause" (good behaviour).
- OSFI fiscal independence: financed through fees levied on federally regulated financial institutions (subsection 17(2) and section 23 of the OSFI Act); a small portion tied to appropriations for Chief Actuary functions.
- Staffing: staff complement increased by approximately 120 persons or 24 percent between fiscal year-end 2008-2009 and 2011-2012.
- Compensation target: 75th percentile of base salary of competitive financial services market (OSFI sets its own executive compensation; non-executive adjustments require Treasury Board mandate).
- Training: estimated two percent of human resources budget; $1.5 million expensed in fiscal 2011-2012; target average of five days training per employee per year.
- IM/IT: $12.8million allocated to IM/IT in 2011-2012 (~10 percent of OSFI’s overall budget); OSFI Business Intelligence Tool consolidates supervisory inputs.
- Travel budget: "3.1 percent of its total budget." Sufficient for domestic and international on-site visits and international commitments.
- Legal protection: Section 39 of the OSFI Act provides legal protection to OSFI and staff against lawsuits for actions taken in good faith.

### Cooperation and collaboration — domestic and international
- Domestic cooperation mechanisms:
  - FISC (established 1987): OSFI, CDIC, Bank of Canada, FCAC, Department of Finance; chaired by Superintendent; meets at least quarterly; members entitled to information in each other's possession.
  - SAC: same membership as FISC, chaired by Deputy Minister of Finance; policy forum.
  - Heads of Agencies (HoA): chaired by Governor of Bank of Canada; includes DoF, OSFI and provincial securities regulators.
  - OSFI–CDIC Strategic Alliance Agreement; Guide to Intervention (jointly developed and publicly disclosed).
- International cooperation:
  - OSFI has MoUs with over 30 foreign supervisory authorities.
  - Participates in supervisory colleges, crisis-management groups, Basel Committee, FSB and related bodies.
  - Routine quarterly calls with foreign regulators; Relationship Managers maintain contacts.
- Observed weakness: less developed structured arrangements with provincial regulators; recommendation to enhance federal–provincial information sharing.

### Licensing, ownership, and significant changes
- Two-step licensing: Minister issues letters patent (section 22, subsection 25(1)) on OSFI recommendation; Superintendent issues Order to Commence and Carry on Business (section 49).
- Initial capital: at least $5 million (paragraph 52(1)(b)) or greater as specified by Minister; OSFI practice: initial capital must be greater of $5 million; capital to remain above target risk-based capital ratio for first three years or until profitable; or capital to remain below authorized assets to capital multiple for same period.
- Fit and proper assessments performed at licensing; OSFI does not routinely perform ongoing post-licensing fit and proper checks — recommendation to assess fit and proper as new directors/senior managers join.
- Significant ownership and control:
  - Significant interest if beneficial ownership exceeds 10% of a class (section 8).
  - Major shareholder thresholds: 20% voting shares or 30% non-voting shares (section 2.2).
  - No person may be a major shareholder of a bank with equity of $12 billion or more (section 374) and control-in-fact restrictions apply (section 377).
  - Annual "Return of Shareholders" must be submitted within 60 days of annual meeting; format not prescribed and may not identify ultimate beneficial owners.
  - Recommendation: standardized form for annual shareholder reporting and periodic "look-through" to identify ultimate beneficial ownership; explicit reporting requirement for material adverse changes affecting suitability of a major shareholder/controller.

### Supervisory approach, risk assessment and tools
- Supervisory Framework (revision December 2010) built on seven principles: focus on material risk; forward-looking early intervention; sound predictive judgment; understanding drivers of risk; differentiate inherent risks and risk management; dynamic adjustment; assessment of whole institution.
- Risk assessment methodology:
  - Identify Significant Activities;
  - Assess six categories of inherent risk: credit, market, insurance, operational, regulatory compliance, strategic;
  - Rate Net Risk: low, medium, above average, high; Direction of Risk: decreasing/stable/increasing;
  - Aggregate into Overall Net Risk and combine with Earnings, Capital, Liquidity (strong/acceptable/needs improvement/weak) to obtain Composite Risk Rating and Intervention Rating (0–4).
- Supervisory planning:
  - Annual Supervisory Strategy with three-year horizon; supervisory year April to end March; main planning in September with refresh in February.
  - Supervisory intensity and resource allocation proportional to size/complexity/risk profile and D-SIB status.
- On-site and off-site mix:
  - No structural separation; Relationship Managers (RMs) lead institution-specific supervision supported by specialist teams.
  - Example on-site frequencies: major firm ~15 significant reviews over two years; smaller institutions 3–6 on-site reviews per year.
- Follow-up and escalation:
  - Use of FUD (Follow Up Document) to record findings; items remain until OSFI verifies closure.
  - Supervisory Letters issued within 45 calendar days of completion of work; responses required within 30 calendar days.
- Data and reporting:
  - Legal reporting powers: section 628 (information requests), subsection 643(2) (access to records).
  - Standard regulatory returns cover capital adequacy, balance sheet, profitability, liquidity, market risk, asset quality.
  - Gaps: formal regular reporting on related parties and large exposures is limited; recommendation to review prudential data needs and require solo data for all regulated banks within groups.

### Capital, liquidity, and prudential standards
- OSFI CAR Guideline implements Basel II/2.5/III; Basel III effective 1 January 2013.
- OSFI expects institutions to attain "all-in" target capital ratios of 8.5 percent for total tier 1 and 10.5 percent for total capital by the first quarter of 2014.
- Assets to capital multiple (ACM) test: total assets must be no greater than 20 times capital; may be exceeded to no greater than 23 times with Superintendent's prior approval; ACM privately communicated.
- Canada announced a 1 percent D-SIB surcharge by 2016 for the six systemic banks.
- Liquidity metrics:
  - OSFI’s NCCF (Net Cumulative Cash Flow) survival horizon metric; minimum survival horizon extended from several weeks to 13 weeks and later to 20 weeks for consolidated balance sheet of largest banks.
  - OSFI expects banks to achieve 100% LCR by end of 2013 (Basel III implementation context).
- Model approvals: OSFI has approved internal market risk models for seven banks and advanced credit risk models for 10 banks; one bank approved for AMA operational risk.

### Crisis management, recovery and resolution
- Roles:
  - OSFI: prudential regulator.
  - Bank of Canada: provide liquidity (including Emergency Lending Assistance up to six months renewable).
  - CDIC: resolution authority; statutory mandate to provide deposit insurance and promote financial stability; resolution tools include liquidation/payout, agency agreement, assisted transaction, forced sale, open bank assistance, bridge bank arrangements, restructuring powers (Sections 39.1–39.37 and 39.371–39.3723).
- Guide to Intervention: OSFI and CDIC jointly developed guide classifying stages 0–4 (No significant problem → Non-viability/insolvency imminent) with coordinated actions.
- Trigger for resolution: Superintendent’s determination of non-viability precedes CDIC resolution powers.
- Recovery and resolution planning:
  - Banks required to develop recovery plans; CDIC develops resolution plans.
  - First generation resolution plans for major banks completed in December 2012; recovery plan iterations received in Q1 2013 and updated per OSFI direction.
- Government powers: Financial Administration Act allows Government to contract, lend, guarantee or provide liquidity where Minister judges necessary to promote stability or maintain efficiency.
- Recommendations: consider legislative adjustments (e.g., codifying prudential veto; revisit Ministerial intervention after 16 days in taking control; consider bail-in regime consistent with FSB Key Attributes).

### Consumer protection and safety net
- CDIC deposit insurance: insures eligible deposits up to $100,000 per depositor, per member institution.
- Mortgage default insurance: federally regulated lenders must obtain mortgage insurance when borrower equity < 20 percent; CMHC and private mortgage insurers provide coverage; Government provides 90 percent guarantee of private insurers' obligations; CMHC liabilities fully backed by Government.
- FCAC: financial consumer protection and external complaints body proposals noted (2013 proposals).

### AML/CFT (Principle 29) — key elements
- Primary statute: Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA); FINTRAC is the FIU.
- OSFI–FINTRAC MOU (2004) enables information sharing; joint OSFI-FINTRAC AML/ATF assessments implemented.
- OSFI AML/ATF Guideline and AMLC unit: risk-based assessments; categorization and assessment frequencies (highest risk ~ every three years; others ~ every four to five years).
- Customer Due Diligence changes: beneficial ownership threshold identification requirement change effective February 1, 2014; enhanced measures for high-risk customers.
- OSFI expects CAMLO (compliance officer) to be of management stature (recommendation to explicitly state).
- Assessment: Principle 29 graded Largely Compliant; FATF follow-up noted with expected exit from regular follow-up when new CDD regulations come into force on February 1, 2014.

### Related party transactions and large exposures (Principles 19–20)
- Related party regime: Part XI (Self-Dealing) with definitions (Section 486) and limits.
- Aggregate limit for exposures to directors, officers and their interests: 50 percent of capital (subsection 497(2)).
- Large exposures: 25 percent of capital for individual counterparty.
- Observed issues:
  - No formal regulatory return for related party exposures or large exposures covering all banks.
  - Bank Act limit of 50 percent of capital for aggregate related party exposures is high relative to large exposure limit.
- Recommendations: formalize regular regulatory reporting for related-party transactions and large exposures; consider lowering 50 percent aggregate related-party limit; update Large Exposure Guideline (1994) in light of BCBS work.

### Supervisory assessments — summary observances and ratings (selected)
- Principle 1: Assessment Compliant.
- Principle 2: Assessment Largely Compliant — de jure ambiguity on Ministerial approvals and prudential veto; recommendations to codify prudential veto and enhance OSFI autonomy.
- Principle 3: Assessment Compliant — strong domestic federal cooperation; desire for stronger provincial engagement.
- Principle 4: Assessment Compliant.
- Principle 5: Assessment Largely Compliant — licensing robust but OSFI should assess fit and proper post-licensing.
- Principle 6: Assessment Largely Compliant — annual Return of Shareholders does not always identify ultimate beneficial owners; no formal notification of material adverse changes in major shareholders.
- Principle 7: Assessment Compliant.
- Principle 8: Assessment Compliant.
- Principle 9: Assessment Compliant.
- Principle 10: Assessment Compliant.
- Principle 11: Assessment Compliant.
- Principle 12 (Consolidated supervision): Assessment Compliant — recommendations to obtain solo data for all regulated banks within groups and enhance intra-group exposure monitoring.
- Principle 15 (Risk management): Assessment Largely Compliant — high-quality supervision but OSFI could issue more comprehensive written guidance across risk areas.
- Principle 16 (Capital adequacy): Assessment Compliant.
- Principle 20 (Related parties): Assessment Largely Compliant.
- Principle 22 (Market risk): Assessment Compliant.
- Principle 23 (Interest rate risk): Assessment Compliant.
- Principle 24 (Liquidity risk): Assessment Compliant — recommendation to ensure regular on-site liquidity reviews despite extensive off-site monitoring.
- Principle 25 (Operational risk): Assessment Compliant.
- Principle 26 (Internal control and audit): Assessment Compliant.
- Principle 27 (Financial reporting and external audit): Assessment Compliant.
- Principle 28 (Disclosure and transparency): Assessment Compliant — recommend issuing Pillar 3 in Guideline form and improving time series data access/usability.
- Principle 29 (Abuse of financial services / AML/CFT): Assessment Largely Compliant.

### Selected supervisory recommendations (CP1–CP29 excerpts preserved)
- CP1: Explore ways to strengthen enforceability of guidelines through statutory changes to OSFI’s powers under the Bank Act; consider migrating key prudential standards to regulations.
- CP2: Codify the “prudential veto” in the Bank Act for approvals where prudential considerations are relevant; consider exempting supervisors from government fiscal controls to enhance OSFI’s financial autonomy.
- CP3: Establish more frequent and structured federal–provincial arrangements for proactive information sharing.
- CP4: Assess and, if necessary, revise laws/arrangements to ensure soundness/stability of the entire Canadian financial system, not only federal aspect.
- CP5: OSFI should assess fit and properness of all new board members and new senior management executives on joining.
- CP6: Introduce standardized annual shareholder reporting and institute annual checks on ultimate beneficial ownership; require notification of material adverse changes affecting suitability of major shareholders/controllers.
- CP7: Amend Bank Act to require approval or notification to OSFI when an acquisition is made through a foreign or provincially-regulated subsidiary.
- CP8: Intensify group analysis from a legal-entity perspective and improve coordination with non-bank regulators for consolidated groups.
- CP9: Enhance internal monitoring systems to support an overarching risk-focused supervisory view; require banks to notify OSFI in advance of material adverse developments (amend Bank Act or otherwise).
- CP10: Review prudential data needs (esp. recovery and resolution planning) and require solo data for all regulated banks within groups.
- CP11: Institute post facto reviews of staging cases and consider further legal authority to address non-viable business models more promptly.
- CP12: Require solo data for all regulated banks in consolidated groups; require periodic intra-group transaction data; formalize parental data access and notification as licensing condition where parent is not regulated.
- CP13: In recovery planning, anticipate potential needs of supervisors in jurisdictions where Canadian entities are material.
- CP15–CP18: Expand/clarify guidance on risk management and credit risk; consider D-SIB surcharge differentiation and seek BCBS clarification on 'purchase for cancellation' for capital instruments.
- CP19: Strengthen large exposure reporting and monitoring; update Large Exposure guidance; reconsider higher exposure limit for subsidiary banks.
- CP20: Formalize regular regulatory reporting for related-party transactions; consider lowering the 50 percent aggregate related-party exposure limit.
- CP21–CP25: Issue guidance on country/transfer risk, clarify market risk expectations for branches and small trading banks, ensure on-site liquidity coverage, and consider more comprehensive operational risk guidance.
- CP28: Consider issuing Pillar 3 requirements in Guideline format and publish more usable time series supervisory data.
- CP29: Explicitly expect CAMLO appointment at management level and strengthen outsourcing screening in Guideline B-10.

*Source: IMF staff assessment material drawn from the 2013 FSAP update for Canada (content unit _cr1471).*

### 1. Financial Sector Structure, end 2012 _____________________________________________________________7

### 1. Financial Sector Structure, end 2012

### Summary and Key Findings
- Canada has a very high level of compliance with the Basel Core Principles for Effective Banking Supervision (BCPs).
- The Canadian banking system is highly concentrated in six domestic players ("Big Six Banks": RBC, TDB, BNS, CIBC, Bank of Montreal, National Bank of Canada) with limited foreign presence.
- OSFI applies risk-based, proportionate, and "close touch" supervisory practices; supervised entities perceive OSFI as authoritative but accessible.
- Entry to the Canadian banking market is subject to demanding prudential entry standards; new entrants undergo an intensive process to familiarize with OSFI’s expectations.
- OSFI emphasizes early intervention within a risk tolerance framework that does not aim for a zero failure regime; depositor protection is a central objective motivating early intervention.
- OSFI has comprehensive supervisory powers but does not resort to legal intervention quickly to preserve openness in the supervisory relationship; this requires early identification of failures to meet minimum standards and a premium on maintaining direction, momentum and timely resolution.
- OSFI maintains close cooperative relationships with other authorities domestically and internationally; however, fragilities exist in the consistency and quality of communication with relevant provincial regulators.
- OSFI is an early adopter of international regulatory reforms (e.g., Basel 3, D-SIB standards) and uses guidelines rather than legal regulations to maintain nimbleness; firms treat guidelines as binding due to OSFI’s wide range of intervention powers.
- OSFI operates at a relatively principles-based level and does not issue extensive, detailed risk management guidance; as a world-leading regulator it could be expected to issue a comprehensive suite of risk management standards (even if high level or BCBS-based).

### Information and Methodology Used for Assessment
- The BCP assessment is part of the 2013 FSAP update for Canada.
- The assessment of OSFI was conducted during an IMF mission that visited Canada from June 12 to 28, 2013.
- Canada was among the first countries assessed against the BCP methodology issued by the Basel Committee on Banking Supervision (BCBS) in September 2012.
- Authorities’ self-assessment addressed both essential and additional criteria; assessors based conclusions on compliance with both criteria.
- The revised BCP methodology (2012) contains 247 separate essential and additional criteria.
- The assessment team reviewed laws, rules, guidance, and held meetings with OSFI, BoC, Department of Finance, auditing firms, and banking sector participants; authorities provided a comprehensive self-assessment and facilitated access to supervisory documents and files.
- The assessment team comprised Katharine Seal (IMF) and Heidi Richards (Australian Prudential Regulation Authority, Consultant).
- Ratings categories used: compliant; largely compliant; materially noncompliant; noncompliant; non-applicable. Definitions for each category are provided, including criteria for “compliant”, “largely compliant”, “materially noncompliant”, and “noncompliant”.

### Overview of Institutional Setting and Market Structure
- Canada’s federally regulated financial subsystem is distributed across a small number of banks and insurance companies.
- In March 2013 OSFI designated six federally regulated banks as domestic systemically important banks (D-SIBSs). The Québec-headquartered bancassurance group, DesJardins, was designated as a D-SIFI by the provincial supervisor.
- Banks hold 61 percent of the federal system assets; 93 percent of the bank assets are held by the D-SIBs.
- Assets held by banks represented 212 percent of GDP as at end-2012.
- Historical comparisons:
  - 2000 FSAP: banks held 60 percent of financial system assets; bank assets represented 150 percent of GDP.
  - 2008 FSAP (2006 data): concentration of assets in the D-SIBs was 85 percent of bank assets.
- Canadian D-SIBs have large international operations concentrated primarily in the U.S. and the Caribbean region.
- The D-SIBs’ international business is largely commercial banking—credit intermediation funded by local deposits—rather than global investment banking and trading.
- Canadian banking system characteristics:
  - Well capitalized and profitable with low nonperforming loans (NPLs).
  - Banks reported solid earnings in 2012 driven by growth in consumer and commercial loan volumes, improved capital markets results, and higher fees.
  - Tier 1 capital levels have remained above 13 percent.
  - Leverage is still below pre-crisis levels.
- Market-based financing activities (CP, ABCP, asset securitizations and repo finance) are comparable in size to traditional lending activities of the banks.
- The non-bank ABCP market underwent industry-led restructuring completed in January 2009; federal and provincial governments provided a senior funding facility to help this restructuring.
- Steps have been taken to improve disclosure and transparency of the ABCP market since the restructuring.

Key statistics (C$mn, end-2012):
- Total Assets: 6,283,054 (100% of federal system); equals 346% of GDP
- Banks: 3,846,877 (61%); 212% of GDP
- Life insurers and segregated funds: 980,340 (16%); 54% of GDP
- Investment funds: 782,179 (12%); 43% of GDP
- Credit unions and caisses populaires: 297,894 (5%); 16% of GDP
- Non-depository credit intermediation: 227,285 (4%); 13% of GDP
- Trust and mortgage loan companies: 50,490 (1%); 3% of GDP
- Property and casualty insurance: 97,989 (2%); 5% of GDP

### Preconditions for Effective Banking Supervision
1. Sound and sustainable macroeconomic and financial sector policies
- The Government of Canada prepares and publishes an annual federal government budget within the context of a medium term fiscal strategy, which is currently to return to balanced budgets by 2015–6.
- The Government publishes a debt issuance strategy and program for debt issues.
- The Bank of Canada’s monetary policy strategy is based on inflation targeting with a current target annual rate of 2 percent; policy is flexibly applied to take account of prevailing monetary and financial conditions.
- Financial sector legislation is subject to regular review; all financial sector legislation includes provisions requiring review and renewal five years from enactment. Unless amended, authorizing legislation lapses due to a sunset clause.

2. Well established framework for financial stability policy formulation
- Federal and provincial governments share jurisdiction over the financial services sector; under the Canadian Constitution the Government of Canada has exclusive jurisdiction over banks and banking, although deposit taking entities can be incorporated and regulated at provincial level.
- Responsibilities for supervision are divided among federal and provincial authorities; the securities sector is wholly regulated at the provincial level.
- Insurance, trust and loan, credit unions can be incorporated and regulated at federal or provincial level; trust and loan companies may be regulated by both levels.
- A new federal framework (established December 2012) will allow for the establishment of federal credit unions.
- Credit Union Central of Canada ('CUCC') is federally incorporated and solely regulated at the federal level by OSFI; credit union centrals function as liquidity managers and payments processors and are provincially incorporated and regulated at the provincial level, with many choosing to register federally under the Cooperative Credit Associations Act (CCAA).

### Federal Bodies and Interagency Coordination
- The Minister of Finance: responsible for all matters relating to financial affairs of Canada, including overall financial system stability; Department of Finance supports the Minister.
- The Bank of Canada: four main responsibilities—monetary policy, currency, financial system, and funds management; promotes stability and efficiency of the Canadian financial system by providing liquidity; overseeing key domestic payment, clearing and settlement systems; participating in development of financial system policies; and assessing systemic risks.
- The Office of the Superintendent of Financial Institutions (OSFI): independent agency established in 1987 to contribute to public confidence in the Canadian financial system; supervises and regulates all banks and federally regulated life and property & casualty insurers, trust and loan companies, cooperative credit associations, fraternal benefit societies, and private pension plans subject to federal oversight; responsible for reviewing and monitoring safety and soundness of Canada Mortgage and Housing Corporation’s (CMHC) commercial activities.
- The Canada Deposit Insurance Corporation (CDIC): federal deposit insurer and resolution authority for federally regulated deposit-taking institutions; a Crown corporation established in 1967 by the Canada Deposit Insurance Corporation Act.
- The Financial Consumer Agency of Canada (FCAC): federal regulatory body to protect and inform consumers of financial products and services.
- There are a number of mechanisms to facilitate ongoing collaboration and information sharing among federal agencies.

*International Monetary Fund — assessment material drawn from the 2013 FSAP update for Canada.*

### 23.      Several mechanisms have been created to facilitate cooperation and information

### _cr1471 - 23.      Several mechanisms have been created to facilitate cooperation and information

### Mechanisms to facilitate cooperation and information sharing
- The Financial Institutions Supervisory Committee (FISC)
  - Established in 1987.
  - Mandated in the Office of the Superintendent of Financial Institutions Act to facilitate consultation and exchange of information between OSFI, CDIC, the Bank of Canada, FCAC, and the Department of Finance.
  - Provisions entitle every member to any information on matters relating directly to the supervision of financial institutions, bank holding companies or insurance holding companies that is in the possession or under the control of any other member.
  - Chaired by the Superintendent of Financial Institutions.
  - Meets at least quarterly, and more often as needed.
  - Responsible for coordination and communication amongst federal agencies on strategies and action plans for addressing problem financial institutions and other emerging issues, and ensuring effective coordination of responses to events and requests.
- The Senior Advisory Committee (SAC)
  - Same membership as FISC but chaired by the Deputy Minister of Finance.
  - Acts as a discussion forum for financial sector policy issues, including financial stability and systemic vulnerabilities, to inform advice to the Minister of Finance.
  - Other government agencies are invited when appropriate (e.g., the CMHC).
  - Each SAC member formulates policies to address identified vulnerabilities consistent with their mandates; policy issues discussed to ensure coordination and assess effects on banks and the financial system.
- The CDIC Board of Directors
  - Responsible under the CDIC Act for decisions and/or recommendations on the use of resolution tools for federally-regulated member institutions.
  - Board comprises the Deputy Minister of Finance, the Governor of the Bank of Canada, the Superintendent of Financial Institutions, a Deputy Superintendent of Financial Institutions, the Commissioner of the Financial Consumer Agency and six others drawn from the Canadian private sector, including the Chair.
  - Use of some CDIC resolution tools requires approval of the Minister of Finance and/or the Governor-in-Council (Cabinet).
- The Heads of Agencies (HoA) Committee
  - Chaired by the Governor of the Bank of Canada and includes the Department of Finance, OSFI, and four provincial Securities Regulators: the Ontario Securities Commission (OSC), Autorité des marchés financiers (AMF), Alberta Securities Commission (ASC), and British Columbia Securities Commission (BCSC).
  - Allows federal authorities and provincial securities market regulators to exchange information and coordinate actions on issues of mutual concern.
- Systemic risk coordination via the Canadian Securities Administrators (CSA)
  - CSA established a Systemic Risk Committee in October 2009 to develop a process to identify and analyze systemic risks in the Canadian capital markets.
  - The Committee works with other CSA committees and with domestic regulators or agencies such as IIROC, the Bank of Canada, and OSFI.

### Well-developed public infrastructure and legal framework
- Federal financial institutions statutes
  - Four federal statutes: the Bank Act, Trust and Loan Companies Act, Insurance Companies Act, and Cooperative Credit Associations Act.
  - Government reviews statutes governing federally regulated financial institutions every five years; most recent review completed in 2012.
- Corporate and insolvency law framework
  - Federal and provincial frameworks include the Canada Business Corporations Act; Ontario Business Corporations Act; the Bankruptcy and Insolvency Act (BIA); the Companies’ Creditors Arrangement Act (CCAA); and the Winding Up and Restructuring Act (WURA).
  - BIA, CCAA and WURA provide court administered processes for dealing with insolvencies.
- Privacy and data protection
  - The Privacy Act (1983) limits collection, use and disclosure of personal information by federal government departments and agencies and gives individuals the right to access and request correction of personal information held by these organizations.
- Consumer protection framework
  - Financial consumer protection rests on disclosure, limits on practices not beneficial to consumers, consumer choice, and access to an effective complaint handling system.
  - Legislation proposed to require all banks and authorized foreign banks to belong to an external complaints body for impartial reviews.
  - Government proposals in 2013 include development of a comprehensive financial consumer code addressing digital and remote banking and needs of vulnerable Canadians.
- AML/CFT framework
  - The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) is the main legislative basis.
  - PCMLTFA establishes FINTRAC as Canada’s financial intelligence unit; FINTRAC is an independent agency reporting to the Minister of Finance and is the competent authority for AML/CFT regulation.

### Judicial, accounting, and audit infrastructure
- Independent judiciary
  - Courts system and legal infrastructure are highly developed; independence of the judiciary is respected and secured through provisions for security of tenure, financial security and administrative independence.
  - Institutions fostering judicial independence include the Canadian Judicial Council, the Commissioner for Federal Judicial Affairs and the National Judicial Institute.
- Accounting standards
  - Canada adopted International Financial Reporting Standards (IFRS); use of IFRS became a requirement for Canadian “publicly accountable profit-oriented enterprises for financial periods beginning January 1, 2011.”
  - IFRS application: mandatory since 2011; rate regulated entities permitted a deferral until January 1, 2015; investment companies had a deferral until January 1, 2014.
- Audit standards and oversight
  - Banks must be audited in accordance with Generally Accepted Auditing Standards as required under the Bank Act, with standards as set out in the Handbook of the Canadian Institute of Chartered Accountants (CICA), except where otherwise specified by OSFI.
  - The AASB adopted International Standards on Auditing (ISAs) for financial statement audits for periods ending on or after December 2010; audits of federally-regulated financial institutions are conducted in accordance with ISAs, including ISA 700.
  - The Canadian Public Accountability Board (CPAB) oversees the quality of external audit firms; CPAB is a Federal not-for-profit corporation created by the Canadian Securities Administrators, OSFI and the CICA and is a member of the International Forum of Independent Audit Regulators.

### Skills, regulation of other markets, and statistics
- Professional competence
  - Accounting profession self-regulated by the Canadian Institute of Chartered Accountants (CICA) and provincial/territorial institutes; CICA participates in the Global Accounting Alliance and International Federation of Accountants.
  - Legal profession self-regulated by provincial/territorial law societies (e.g., Law Society of Upper Canada).
- Securities regulation
  - Securities regulation is provincial/territorial; each has its own regulator and laws, though most regulations are harmonized.
  - Ongoing discussions on possible creation of a common securities regulator.
  - The CSA is a voluntary umbrella organization; members (except Ontario) have developed a “passport system” using a “principal regulator” as conduit for approvals across jurisdictions.
- Credit bureaus and statistics
  - Credit bureaus are provincially regulated; required to maintain accurate and up-to-date records and permit consumer access to credit files.
  - Statistics Canada is legislated to produce statistics on population, resources, economy, society and culture at provincial, territorial and federal level.

### Payment, clearing, and settlement systems
- Oversight and designation
  - Payment clearing and settlement infrastructure is subject to regulation and oversight by the Minister of Finance, the Bank of Canada, OSC, AMF, ASC, and Manitoba Securities Commission (MSC).
  - The Minister has oversight powers regarding the Canadian Payments Association (CPA) and payments systems under the Canadian Payments Act (CP Act), including the Automated Clearing and Settlement System (ACSS) and the Large Value Transfer System (LVTS).
  - Under the Payment Clearing and Settlement Act the Bank identifies clearing and settlement systems that could pose systemic risk and, subject to Minister approval, oversees these systems.
  - Five systems designated as systemic: the LVTS; the CDSX; the Canadian Derivatives Clearing Service (CDCS); CLS Bank; and LCH Clearnet’s SwapClear (OTC interest rate swaps).

### Crisis management, recovery and resolution framework
- Institutional roles in crisis
  - OSFI is the prudential regulator.
  - The Bank of Canada can provide liquidity to illiquid but solvent financial institutions.
  - CDIC is the resolution authority for federally regulated deposit-taking institutions.
  - The Department of Finance advises the Minister; these agencies meet regularly through FISC and the CDIC Board.
- Government powers
  - Under the Financial Administration Act the Government can enter into contracts (purchasing, lending, selling, pledging securities; providing loans, lines of credit, guarantees, loan insurance or credit insurance) with any entity operating in Canada if the Minister of Finance judges it necessary to promote stability or maintain efficiency of the financial system.
- Resolution and intervention tools
  - Options include supervisory actions, taking control of a federally regulated financial institution, and CDIC resolution tools.
  - OSFI’s early intervention policy requires it to “promptly advise the management and board of a financial institution in the event the institution is not in sound financial condition or is not complying with its governing statute law or supervisory requirements under that law and, in such a case, to take, or require the management or board to take, the necessary corrective measures or series of measures to deal with the situation in an expeditious manner”.
  - The Bank of Canada can provide Emergency Lending Assistance (ELA) to any member of the CPA facing serious and persistent liquidity problems that the Superintendent judges to be solvent; lending may be against broader collateral and is subject to a maximum term-to-maturity of six months; loans can be renewed as often as the Bank deems appropriate.
- CDIC resolution tools
  - CDIC’s statutory mandate: provide deposit insurance and promote and contribute to financial stability.
  - Tools include: liquidation and payout; agency agreement; assisted transaction; forced sale (share or asset); open bank assistance (ranging from a one-time finite loan to a blanket guarantee for all creditors); and bridge bank arrangements.
  - Canada’s largest banks required to develop recovery plans; CDIC has developed resolution plans; both will be reviewed, updated and enhanced regularly.
- Future regime developments
  - Government’s comprehensive risk management framework for systemically important banks planned to be consistent with the Financial Stability Board’s Key Attributes; it is proposed to include a “bail-in” regime and the Government will consult stakeholders on implementation.

### Public safety net and protections
- Deposit insurance
  - CDIC insures eligible deposits up to a maximum of $100,000 per depositor, per member institution.
  - Deposits with provincially regulated cooperative financial institutions (credit unions) are covered by provincial deposit insurance programs.
- Mortgage default insurance
  - Federally regulated lenders required by law to obtain mortgage insurance when borrowers provide less than 20 percent of the equity.
  - Mortgage default insurance provided by Canada Mortgage and Housing Corporation (CMHC) or private mortgage insurers.
  - CMHC is a Crown corporation and its liabilities are fully backed by the Government of Canada.
  - The Government provides a 90 percent guarantee of mortgage insurance obligations made by private insurers.

### Market discipline and governance
- Corporate governance and disclosure
  - Corporate governance requirements set out in federal and provincial statutes, including the Canada Business Corporations Act (CBCA), prescribing board structure and minimum number of independent directors.
  - Securities laws and Toronto Stock Exchange listing standards set disclosure and governance requirements.
  - Banks expected to comply with BCBS Pillar 3 requirements.
- Market monitoring
  - Institutional investors actively monitor corporate governance at public corporations.
  - Financial analysis available from media, rating agencies, brokers, etc.
  - Canadian regulatory authorities set disclosure requirements on federally regulated institutions (see CP 28).

*Source: _cr1471 - 23.      Several mechanisms have been created to facilitate cooperation and information*

### 52.      More stringent public disclosure obligations apply to Domestically Systemically

### 52.      More stringent public disclosure obligations apply to Domestically Systemically

### Key findings
- More stringent public disclosure obligations apply to Domestically Systemically Important Banks (D-SIBs).
- OSFI has outlined, among other requirements, more stringent public disclosure obligations that explicitly referenced the recommendations of the Financial Stability Board’s Enhanced Disclosure Task Force (EDTF).

### Expectations for D-SIBs
- Canadian D-SIBs are expected to have public information disclosure practices covering their financial condition and risk management activities that are among the best of their international peers.
- D-SIBs are expected to adopt the EDTF disclosure recommendations in the banking arena, as well as evolving domestic and international bank risk disclosure best practices.

*Source: IMF content unit _cr1471 - 52.      More stringent public disclosure obligations apply to Domestically Systemically*

### 53.      OSFI publishes institution-specific data on its website for public access. This includes

### _cr1471 - 53.      OSFI publishes institution-specific data on its website for public access. This includes

### DETAILED ASSESSMENT — Overview
- The Office of the Superintendent of Financial Institutions (OSFI) is the federal prudential regulator and supervisor for banks in Canada, accountable to Parliament through the federal Minister of Finance.
- OSFI’s mandate, responsibilities and objectives are publicly defined in the Office of the Superintendent of Financial Institutions Act (OSFI Act), including purposes and objects set out in Section 3.1 and Subsection 4(2), and Superintendent powers in Section 6.
- OSFI is the sole federal agency responsible for prudential supervision of banks but collaborates with other federal bodies: the Department of Finance; Canada Deposit Insurance Corporation (CDIC); Bank of Canada; Financial Consumer Agency of Canada (FCAC); and FINTRAC.
- Coordination mechanisms include the Financial Institutions Supervisory Committee (FISC) and the Senior Advisory Committee (SAC).

### A. Supervisory Powers, Responsibilities, and Functions — Principle 1 (Responsibilities, objectives and powers)
- Principle statement: An effective system requires clear responsibilities and objectives for each authority, and a legal framework that provides necessary powers to authorize banks, conduct ongoing supervision, address compliance, and undertake timely corrective actions.

#### EC1 — Responsibilities and objectives clearly defined and publicly disclosed
- Findings:
  - Canada’s Constitution vests Parliament with exclusive jurisdiction over banking and incorporation of banks; Parliament delegated prudential supervision to OSFI.
  - OSFI’s statutory purpose (Section 3.1): ensure financial institutions are regulated by an office of the Government of Canada to contribute to public confidence in the system.
  - OSFI’s objects (Subsection 4(2)) include:
    - (a) supervise financial institutions to determine sound financial condition and compliance with governing statute law and supervisory requirements;
    - (b) promptly advise management and board when an institution is not in sound financial condition or not complying, and take or require necessary corrective measures expeditiously;
    - (c) promote adoption by management and boards of policies and procedures to control and manage risk;
    - (d) monitor and evaluate system-wide or sectoral events or issues that may negatively impact financial institutions.
  - OSFI shall strive to protect depositors’ rights and interests having due regard to allowing institutions to compete and take reasonable risks (Subsection 4(3)).
  - Superintendent’s powers, duties and functions assigned pursuant to the Bank Act and regulations (Section 6).
  - Governing statutes and each organization’s roles are publicly available (Department of Justice Canada) and on official websites.

#### EC2 — Primary objective is safety and soundness of banks
- Findings:
  - OSFI functions solely as a prudential supervisor; primary object (subsection 4(2) of the OSFI Act) is safety and soundness of financial institutions.
  - OSFI does not have other objectives such as consumer protection; that is FCAC’s mandate.
  - OSFI’s statutory objectives require early intervention, promotion of risk-control policies, and monitoring of system-wide risks.

#### EC3 — Framework to set and enforce prudential standards and ability to increase requirements
- Findings:
  - The Bank Act and supporting regulations provide the legal framework for setting and enforcing minimum prudential standards on ownership, governance, capital, liquidity, self-dealing, investments, specialized financing, and borrowing.
  - OSFI is administratively empowered to publish guidance of several forms with an internal protocol:
    - Guidelines: establish policy on minimum best or prudent practices; generally static for one to several years; categories include capital, accounting, prudential limits and restrictions, and sound business and financial practices.
    - Advisories: more technical, narrower in scope; inform stakeholders of OSFI’s views or concerns or interpretations; expectations for compliance are the same as for guidelines.
    - Letters: provide detailed guidance not found in guidelines or advisories; may inform FRFIs of international guidance or implementation timelines.
    - Rulings: describe how OSFI has applied or interpreted provisions in specific cases.
    - Discussion papers: articulate OSFI’s general policy direction.
  - Advisories and letters are often transitory and can be incorporated into updated guidelines; about 20 advisories and letters were incorporated into the 2013 CAR guideline.
  - OSFI can use intervention tools (prudential agreement, direction of compliance, capital order) to address breaches of guidance; staging is normally the first approach if informal tools fail.
  - OSFI’s use of guidance does not require Ministerial or Parliamentary involvement.
  - Example: Pillar 3 Disclosure requirements issued as an Advisory due to technical and limited scope.
  - The Bank Act (section 485(3)) provides the legal power for OSFI to require higher capital than set in guidelines or regulations made pursuant to section 485(2).

#### EC4 — Laws, regulations, and prudential standards are updated as necessary and subject to public consultation
- Findings:
  - Bank Act contains a “sunset” clause (Section 21) requiring review every five years; reviews occurred in 1996, 1997, 1999, 2001, 2007 and 2012 (a one-year extension was approved in 2006).
  - Department of Finance leads broad public consultations during legislative reviews; OSFI often consults directly with stakeholders; legislative review concludes with public review and debate by Parliament.
  - Amendments can also be made through annual budget implementation legislation or by regulation via Governor-in-Council, which requires public consultations and publication of draft amendments.
  - OSFI created a Guideline Review Committee to monitor and review guidance effectiveness.
  - OSFI conducts formal public consultations on guidance; posts consultation papers/draft guidance and publishes summaries of industry comments with OSFI’s responses concurrently with final guidance.
  - Recent public consultations include guidelines on Capital Adequacy Requirements, Mortgage Underwriting and Corporate Governance.

#### EC5 — Powers of access, consolidated review, and supervision of foreign activities
- EC5(a) — full access to boards, management, staff and records:
  - Legal authorities under the Bank Act:
    - Banks must provide information as the Superintendent may require (Subsection 628(1));
    - Superintendent has powers of examination and inquiry into bank business and affairs (Subsection 643(1));
    - Superintendent (or person acting under direction) must be provided access to records, cash, assets and security and may require directors, officers and the auditor to provide information and explanations (Subsection 643(2));
    - Superintendent vested with powers of a commissioner under Part II of the Inquiries Act for obtaining evidence under oath (Section 644).
- EC5(b) — review overall activities of banking group, domestic and cross-border:
  - Supervision is conducted on a consolidated basis assessing all material entities (subsidiaries, branches, joint ventures) domestically and internationally.
  - Bank Act section 635 allows direction to a person who controls a bank or affiliated entity to provide necessary information.
  - Section 470 can require undertakings to provide access to records of controlled domestic and foreign subsidiaries.
  - OSFI identifies a bank’s “significant activities” and plans supervisory work at that level, from ongoing monitoring to extensive on-site reviews at domestic or foreign premises.
- EC5(c) — supervise foreign activities of banks incorporated in jurisdiction:
  - OSFI supervises on a fully consolidated basis irrespective of legal entities’ locations.
  - Information sharing permitted under Subsection 22(2) of the OSFI Act allows agreements with foreign regulators.
  - OSFI typically enters Memoranda of Understanding with foreign regulators to facilitate confidential information sharing; practices include non-domestic on-site inspections, file reviews, visits and coordination with host supervisors, including colleges of supervisors.

#### EC6 — Powers to require corrective action, impose sanctions, and revoke licence
- EC6(a) — take or require timely corrective action:
  - OSFI must promptly advise management and board when institution is not in sound financial condition or not complying and take or require necessary corrective measures expeditiously (statutory mandate).
  - OSFI’s Supervisory Framework and Guide to Intervention support early identification of issues and escalation to timely corrective actions; frequency and intensity of monitoring increase for urgent issues.
  - Bank Act provides discretionary early intervention powers: special examinations, prudential agreements, directions of compliance, application to a court for order of compliance, and taking control of the bank.
- EC6(b) — impose a range of sanctions:
  - Powers under the Bank Act include:
    - impose conditions/limitations or vary conditions on Order to Commence and Carry on Business (Section 54);
    - require external auditor to enlarge scope or perform other procedures and report (Section 325);
    - order divestiture of loans, investments or subsidiaries (Section 480);
    - issue order to direct bank to increase capital or provide additional liquidity (Section 485);
    - enter into a Prudential Agreement (Section 644.1);
    - issue a Direction of Compliance to cease or prevent unsafe or unsound practice (Section 645);
    - apply for a court order to require compliance with a prudential agreement or Direction of Compliance (Section 646);
    - remove a person from office, such as a director or senior officer (Section 647.1);
    - deny approval of transactions, approve subject to conditions, or require a Letter of Undertaking restricting operations;
    - defined role in determining non-viability and effecting orderly resolution including assuming control of assets or bank and seeking winding-up order (Sections 648 to 656).
  - Non-compliance with Bank Act provisions is an offence, potentially subject to criminal sanctions and civil monetary penalties under the Administrative Monetary Penalties (OSFI) Regulations.
  - Guide to Intervention outlines application of supervisory tools and sanctions as situations escalate.
- EC6(c) — revoke the bank’s licence:
  - Bank Act (Section 973.03) provides Minister and Superintendent authority to revoke, suspend or amend any approval, including revocation of Letters Patent by the Minister and revocation of Order to Commence and Carry-on Business (OCCB) by the Superintendent.
  - Neither Minister nor Superintendent has used powers under section 973.03 to revoke approval.
  - If Superintendent revokes the OCCB, the bank cannot operate as a bank though it remains a legal entity and can retain corporate presence but cannot take deposits or make loans.
  - In practice, OSFI would more likely exercise Section 54 powers to make OCCB subject to conditions or limitations or amend/revoke authorizations in the OCCB.
  - Subsection 973.03(2) is broad and largely duplicative of other provisions.

*Source: _cr1471 - 53.      OSFI publishes institution-specific data on its website for public access. This includes.*

### section 54. The subsection was added to legislation in 2007.

### _cr1471 - section 54. The subsection was added to legislation in 2007.

### EC6(d) — Powers to cooperate, collaborate and trigger orderly resolution
- The Bank Act provides a wide range of discretionary, early intervention powers allowing OSFI to intervene to address concerns and to cooperate and collaborate with all relevant authorities (domestic and foreign).
- OSFI and CDIC jointly developed, documented, and publicly disclosed the Guide to Intervention, which outlines their coordinated approach at each increasing stage of intervention.
- Bank Act (sections 648 to 656) defines the Superintendent’s role in deciding when and how to trigger the orderly resolution of a problem bank.
- When the Superintendent determines an institution is at the stage of “non-viability/insolvency imminent”, possible actions include:
  - assuming temporary control of the assets of the bank and the assets under its administration;
  - taking control of the bank’s assets or taking control of the bank; or
  - requesting that the Attorney General of Canada apply for a winding-up order under the Winding-up and Restructuring Act in respect of the bank, where the assets of the bank are under the control of the Superintendent or the bank is under the Superintendent’s control.
- The Superintendent’s determination of non-viability is the pre-requisite trigger for CDIC resolution powers under the CDIC Act, which include:
  - Sections 39.1 to 39.37—restructuring the financial institution pursuant to a Financial Institution Restructuring Plan; and
  - Sections 39.371 to 39.3723—establishing a bridge bank to preserve critical bank functions and help maintain financial stability.
- OSFI can collaborate with foreign authorities: subsection 22(2) of the OSFI Act and section 470 of the Bank Act provide that the Superintendent can enter into Memoranda of Understanding with foreign regulators.
- Other tools for internationally active banks include supervisory colleges and crisis-management groups.

### EC7 — Powers to review parent and affiliated company activities
- The Superintendent has powers to access information in respect of a person who controls a bank or an entity that is affiliated with a bank (subsection 635(1) of the Bank Act).
- The Bank Act definition of an affiliate (section 6) includes an entity that exerts control over another.
- The Superintendent may issue an order directing a person who controls a bank or any entity affiliated with a bank to provide information or documents when necessary to be satisfied that the Bank Act provisions are being observed and that the bank is in sound financial condition.
- Ownership and “widely held” rules:
  - The “widely held” restriction applies to banks with equity of more than 12 billion Canadian dollars and covers the five largest domestic banks in Canada.
  - Bank Act (section 378) “deems” certain banks “to be a bank with equity of twelve billion dollars or more”. Three banks (National Bank, Laurentian Bank and Canadian Western Bank) are deemed to have equity of 12 billion or more under section 378.
  - A major shareholder is permitted for banks under the threshold of 12 billion dollars.
  - A smaller bank, below 2 billion dollars in equity can be “closely” held and the parent can be a commercial entity.
- OSFI’s consolidated approach focuses primarily on the federally regulated financial institution and its subsidiaries, but risk assessment also considers activities of parent companies and affiliates where they exist.
- During incorporation review, OSFI evaluates financial resources and the proposed corporate structure pursuant to section 27 of the Bank Act, considering:
  - (a) the nature and extent of the proposed financial services activities to be carried out by the bank and its affiliates; and
  - (b) the nature and degree of supervision and regulation applying to the proposed financial services activities to be carried out by the affiliates of the bank.
- OSFI may use supervision opportunities around amalgamations and acquisitions of significant interest to secure undertakings from other entities in the group, including parent companies.

### Assessment of Principle 1 — Compliance and supervisory approach
- Assessment: Compliant
- Key findings and observations:
  - OSFI has the sole legal mandate for the supervision of banks in Canada and operates within the scope of that mandate.
  - The Bank Act provides a wide range of powers essential for effective supervision and includes a mandatory five-year revision to keep the framework current.
  - The Bank Act enables OSFI to set and enforce minimum prudential standards and to increase prudential requirements for individual banks and banking groups to reflect risk profile and systemic importance.
  - OSFI issues guidelines as a means to communicate supervisory expectations swiftly and outside the political process. While guidelines are not directly enforceable in law, failure to meet a guideline is indicative of failure to meet the underlying legal standard, and OSFI has sufficient tools to compel compliance.
- Recommendations:
  - Explore ways to strengthen the enforceability of guidelines through statutory changes to OSFI’s powers under the Bank Act.
  - Consider whether any key prudential standards would benefit from migration to the format of a regulation.

### Principle 2 — Independence, accountability, resourcing and legal protection (EC1 and EC2)
- EC1 — Operational independence, accountability and governance:
  - OSFI is established by Parliament under the Office of the Superintendent of Financial Institutions Act (OSFI Act, subsection 4(1)) with purpose in section 3.1.
  - The Minister of Finance presides over and is responsible for OSFI; the Superintendent is the Deputy Head of OSFI.
  - The Minister has no statutory powers of direction under the OSFI Act and cannot issue Ministerial Directions to the Superintendent.
  - OSFI is fiscally independent of government; its budget is not dependent on government appropriations. OSFI is financed through fees levied on federally regulated financial institutions (subsection 17(2) and section 23 of the OSFI Act). A small portion of OSFI’s budget relating to certain functions performed by the Office of the Chief Actuary is dependent on appropriations, but these functions are not connected to the supervision of financial institutions.
  - OSFI has authority to act independently for staffing and resource requirements by virtue of its categorization as a separate agency (Schedule V of the Financial Administration Act (FAA)) and delegation of powers to the Superintendent.
  - OSFI’s employees must be appointed in accordance with the Public Service Employment Act (PSEA), administered by the Public Service Commission (PSC). The PSC has delegated staffing authorities to the Superintendent subject to terms and conditions; OSFI does not have full discretion to establish its own staffing framework.
  - OSFI’s agreement with the PSC imposes operational and reporting requirements; prior to external recruiting OSFI must consider public service employees on a priority hiring list, typically resolved within two to three working days.
  - Where ministerial approvals are required under the Bank Act, OSFI focuses on prudential considerations and provides recommendations to the Minister. OSFI does not, in practice, provide “negative recommendations” to enable ministerial second-guessing of prudential vetoes.
  - OSFI is accountable to Parliament through the Minister of Finance (section 4 of the OSFI Act). OSFI must produce an Annual Report which the Minister must table before Parliament (section 40). Section 6 requires the Superintendent to report to the Minister from time to time on matters connected with administration of the Bank Act.
  - Conflict of interest measures and codes of conduct in the OSFI Act and internal policies include a prohibition on owning shares of federally regulated financial institutions, disclosure requirements for borrowings from federally regulated financial institutions, and prohibition on acceptance of any grant or gratuity.
  - OSFI is subject to government-wide fiscal restraints and Treasury Board guidance. Current guidance examples:
    - approval of the Minister of Finance is required for single events involving hospitality over Can$10,000; and
    - approval is required when costs associated with activities not directly related to the delivery of OSFI’s core mandate exceed Can$25,000 on a per event basis.
  - These restrictions have not imposed practical constraints on OSFI’s operational independence, including ability to obtain resources or meet international obligations.
- EC2 — Appointment and removal of head(s):
  - The Superintendent is the “Deputy Head” of OSFI, supported by an Executive Management Team.
  - OSFI does not have a separate governing body such as a board of directors.
  - The Superintendent has sole power to appoint the executive management team.

*Source: _cr1471 - section 54. The subsection was added to legislation in 2007.*

### Section 5 of the OSFI Act provides that OSFI will be headed by a Superintendent who is

### _cr1471 - Section 5 of the OSFI Act provides that OSFI will be headed by a Superintendent who is

### Superintendent appointment, term, removal, and interim appointment
- The Superintendent is appointed by the Governor in Council for a fixed term of seven years.
- The seven-year term is not linked to the usual four-year mandate of the government in power.
- The appointment is made “during good behaviour” (as opposed to “during pleasure”), meaning the Superintendent can only be removed for cause (e.g., misconduct) by the Governor in Council.
- The specific reasons for which the Superintendent can be removed are not specified in the OSFI Act; common law precedence would apply in determining reasonable cause.
- Where the Superintendent is removed from office, the Order in Council providing for the removal must be laid before Parliament and is public; the details of the reason for removal would be set out.
- Appointment process:
  - Follows a competitive hiring process, including a public call for applicants.
  - Selection is coordinated by the Privy Council Office (Senior Personnel Secretariat) on behalf of the Prime Minister’s Office.
  - The Superintendent is appointed by the Governor in Council (i.e., the Governor of the Privy Council).
- Re-appointment and interim arrangements:
  - The Superintendent, on the expiration of any term of office, may be re-appointed for a further term of office.
  - In the event of absence or incapacity, or if the office is vacant, the Governor in Council may appoint a qualified person to hold office instead of the Superintendent for a term not exceeding six months, with all powers, duties and functions of the Superintendent.
  - This interim appointment may be renewed for subsequent six month terms.

### EC3 — Transparency, objectives, and accountability
- OSFI publishes objectives and performance against objectives publicly on an annual basis in several publications:
  - Annual Report — summarizes key activities, discusses objectives and performance, outlines future plans and priorities, and includes OSFI’s audited financial statements.
  - Report on Plans and Priorities — provides detail over a three-year period on main priorities by strategic outcomes, program activities and planned/expected results.
  - Departmental Performance Report — outlines results achieved against planned performance expectations as set out in the Report on Plans and Priorities.
- All the above documents are publicly available on OSFI’s website; OSFI’s Annual Report is tabled in Parliament.
- OSFI discloses significant information about its business and regulated institutions, including financial data, speeches, media interviews, external consultations and reports.
- Audit and oversight:
  - OSFI has an internal audit group and a formal Audit Committee.
  - Financial statements are audited by a private audit firm.
  - OSFI is subject to periodic “value for money” audits by the Office of the Auditor General of Canada (OAG); audit reports are publicly available on OSFI’s website.
  - OSFI is subject to the Access to Information Act, subject to statutory exclusions related to supervisory activities, institution-specific confidential information, privacy, national security, etc.

### EC4 — Internal governance, communications, and emergency decision-making
- Framework for Exercising the Superintendent’s Powers (FESP) (section 10 of the OSFI Act):
  - Outlines regulatory and supervisory powers retained by the Superintendent and those assigned to specific positions.
  - Delegation based on principle that only persons in positions of sufficient authority can exercise the Superintendent’s powers.
  - Establishes lines of communication and accountability; in cases of doubt, refer to senior level of authority.
  - Seeks to ensure timely supervisory decisions at the appropriate level.
  - Responsibilities and accountabilities are reflected in job descriptions created for every position at OSFI.
  - The framework has been reviewed and refreshed five times since first prepared in 2002, most recently in 2007.
- Written procedures for sectors (Regulation, Supervision, Corporate) address key regulatory and supervisory functions and complement the FESP and job descriptions.
- Enterprise-wide Risk Management (ERM) framework facilitates identification, evaluation, prioritization and mitigation initiatives for organizational risks.
- Audit Committee advises the Superintendent on non-prudential (corporate) matters, focusing on risk management, control and governance frameworks, accountability and auditing systems.
- Regular internal meetings:
  - Regular meetings between senior operational management within and between sectors.
  - Regular executive management meetings with heads of all sectors (Superintendent; Deputy Superintendent, Supervision Sector; Assistant Superintendent, Regulation Sector; Assistant Superintendent, Corporate Services).
- Emergency arrangements:
  - Section 5 provides for appointment of a qualified person in the Superintendent’s absence or incapacity to exercise all powers, duties and functions for up to six months.
  - The FESP contains provisions for emergency exercise of certain powers normally exercised only by the Superintendent.
  - OSFI has a Business Recovery Plan covering business interruption and decision making in emergencies.
- Ethics and conflict of interest:
  - All employees must abide by OSFI’s Statement of Values and Code of Conduct and a Conflict of Interest Policy.
  - Section 19 of the OSFI Act establishes conflict of interest measures for the Superintendent, Deputy Superintendent and members of FISC, including prohibitions on owning shares of federally regulated financial institutions, disclosure on borrowings from such institutions, prohibition on acceptance of grants or gratuities, and consequences for contravention.
  - Statutory requirements are reflected in OSFI’s Conflict of Interest Policy which applies to all employees.

### EC5 — Professionalism, integrity, and restrictions on use of information
- OSFI’s core values: professionalism, integrity and respect for people in its Statement of Values and Code of Conduct.
- Stakeholder consultations:
  - Since 1998, OSFI has commissioned regular consultations with key stakeholders carried out by independent third-party consultants; results are published on OSFI’s website.
  - The 2012-2013 deposit-taking institutions sector consultation confirmed OSFI’s professionalism, describing OSFI as professional, reasonable, fair, focused on relevant risks and contributing to public confidence; Relationship Managers were described as capable, responsive and hardworking.
- Statutory conflict-of-interest rules (Sections 19–21 of the OSFI Act) for Superintendent, Deputy Superintendent, and FISC members:
  - Prohibits owning shares of federally regulated financial institutions.
  - Prohibits acceptance or receipt of any grant or gratuity from federally regulated financial institutions; outlines consequences (e.g., monetary fines and/or imprisonment).
  - Imposes disclosure requirements for borrowings from federally regulated financial institutions.
- Confidentiality and use of information:
  - Section 22 of the OSFI Act and section 636 of the Bank Act deem information about federally regulated financial institutions and OSFI’s interactions with them confidential and restrict use to lawful supervisory purposes, subject to limited exceptions.
  - Superintendent must be satisfied that shared information will be treated as confidential and used exclusively for lawful supervisory purposes.
  - These statutory requirements are reflected and expanded in OSFI’s internal Conflict of Interest Policy and Statement of Values and Code of Conduct.
  - Employees review these policies annually and sign documents confirming compliance (e.g., prohibition on owning shares of federally regulated financial institutions).
- Sanctions and enforcement:
  - OSFI may apply sanctions, including dismissal, if laws or workplace policies are breached.
  - Section 980 of the Bank Act provides that every person who, without reasonable cause, contravenes any provision of the Bank Act (including section 636) or associated regulations may be punished by monetary fines and/or imprisonment.

### EC6 — Resources, financing, staffing, compensation, expert access, training, IT, and travel
- Legal and funding framework:
  - Section 11 of the OSFI Act provides authority to staff the office in accordance with the Public Service Employment Act with necessary employees.
  - OSFI’s supervisory budget is not dependent on government appropriations; subsection 17(2) and section 23 authorize financing through assessments to federally regulated financial institutions and a user-pay program for certain legislative approvals and selected services.
  - Funding model and budget designed to provide autonomy and independence for effective supervision and oversight.
- Staffing changes:
  - Between fiscal year-end 2008-2009 and 2011-2012, OSFI’s staff complement increased by approximately 120 persons or 24 percent.
- Constraints:
  - The federal government can impose government-wide fiscal restraints such as wage freezes, normally in extraordinary circumstances, which would also be applicable to OSFI; there are no such restraints at this time.
  - OSFI cannot be required to shed staff by the federal government.
- Compensation (EC6(b)):
  - Pursuant to sections 13 and 15 of the OSFI Act, OSFI determines its own compensation regime.
  - OSFI targets the 75th percentile of base salary of the competitive financial services market.
  - OSFI recently reviewed its executive compensation structure to ensure this target is met.
  - OSFI must seek a mandate from the Treasury Board of Canada to adjust non-executive compensation.
  - Non-executive workforce is unionized; terms and conditions of employment, including rates of pay, are subject to collective bargaining.
  - OSFI has maintained a low rate of turnover (in the low single digits).
- External experts (EC6(c)):
  - OSFI has legal authority and necessary budget to commission outside experts for supervisory tasks or special situations and regularly draws on such experts (e.g., specialized credit consultants).
  - Contracting and HR policies ensure external experts have necessary skills and independence; all external experts are subject to the same confidentiality rules as regular OSFI staff.
- Training (EC6(d)):
  - OSFI provides an estimated two percent of its human resources budget towards training ($1.5 million expensed in fiscal 2011-2012).
  - Targets an average of five days of training per year per employee.
  - Additional resources for the Professional Development and Training Division were approved in fiscal year 2011-2012 for new training programs.
  - Training needs are reviewed through HR planning and discussions with senior management; Executive provides direction via quarterly training updates.
  - Individual sectors/divisions have own training budgets; learning plans are required in employees’ annual goal commitment documents.
  - Offers both internal and external training, formal developmental programs for regulatory officers and supervisors, and supports training toward professional designations.
- Information management / Information technology (EC6(e)):
  - OSFI has a designated Chief Information Officer (CIO) and a separate budget for the IM/IT Division managed according to IM/IT best practice portfolio management guidelines.
  - IM/IT strategy, long-term IT renewal program, and life-cycle management policies guide investments.
  - $12.8million, representing approximately 10 percent of OSFI’s overall budget, was allocated to IM/IT in 2011-2012.
  - IT/IM investments include OSFI’s Business Intelligence Tool (BI Tool) consolidating quantitative and qualitative inputs about individual financial institutions and peers, and upgraded document storage and retrieval capabilities.
- Travel budget (EC6(f)):
  - OSFI’s travel budget for the 2010-2011 to 2013–2014 fiscal years ranges between 2.8 and

*Source: _cr1471 — https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr1471.pdf*

### 3.1 percent of its total budget. A travel budget of this nature has been sufficient to meet the

### _cr1471 - 3.1 percent of its total budget. A travel budget of this nature has been sufficient to meet the

### Travel budget and international commitments
- OSFI’s travel budget is described as "3.1 percent of its total budget."
- The travel budget has been sufficient to meet needs for:
  - domestic and international on-site visits,
  - cross-border cooperation,
  - international regulatory commitments.
- OSFI’s international commitments include membership of the G20 nations and support for:
  - the Basel Committee on Banking Supervision,
  - the Financial Stability Board,
  - their subsidiary committees, working groups and task forces.
- OSFI participates in or hosts cross-border commitments such as supervisory colleges and supports continued participation on international rule making bodies, including:
  - the Financial Stability Board,
  - Basel Committee on Banking Supervision,
  - International Association of Insurance Supervisors,
  - Joint Forum.
- When planned supervisory work targets significant activity in a foreign jurisdiction, OSFI conducts on-site reviews of foreign operations and meets with the host country supervisor.

### Human resource planning, training, and staffing (EC7)
- OSFI operates on a three-year planning cycle and reviews its plans at least annually.
- Training needs are reviewed based on human resource planning processes and continuing discussions with senior management.
- OSFI’s Executive provides direction on training priorities via quarterly training updates.
- Individual sectors and divisions have access to individual operational and training budgets to bridge identified gaps.
- Staffing changes related to the global financial crisis and evolving risks:
  - "Between fiscal year-end 2008-2009 and 2011-2012, OSFI’s staff complement increased by approximately 120 persons or 24 percent."
  - Additional staff had specialized knowledge in corporate governance, credit, market and operational risks, and supported development of new and more sophisticated risk-sensitive liquidity and capital rules.
- Staffing challenges and responses:
  - Some specialist areas (e.g., technical specialists for model reviews) have been more difficult to staff due to a scarce skillset.
  - OSFI stated that it has "to date always been able to fill vacancies with appropriately skilled staff."
  - OSFI underwent a conscious program of refreshing skills, including bringing in more staff from the industry, and remained conscious of the need for continued refreshing of skills.
- Industry feedback:
  - Discussions with the industry confirmed a consistent view that OSFI staff had the skills necessary to understand and to challenge the banks.
  - Several banks noted OSFI had some outstanding individuals in its staff.
  - Banks recognized the institutional challenge of embedding a large intake of new hires but judged the process "smooth and successful."
  - Some firms expressed concerns that OSFI might not be able to retain the highest caliber staff given competition from the industry.

### Risk-based supervision and resource allocation (EC8)
- OSFI employs a risk-based approach to supervision embedded in OSFI’s Supervisory Framework, which:
  - describes the principles, concepts, and core process used to assess safety and soundness of financial institutions,
  - aims to identify issues or areas of concern early so timely corrective actions may be taken.
- Planning and strategies:
  - OSFI annually prepares a supervisory strategy outlining supervisory work planned for the next three years to keep a bank’s risk profile current.
  - The general strategy forms the basis for a more detailed plan that guides resource allocation decisions for the upcoming year.
- Intensity and prioritization of supervisory work:
  - Depends on the nature, size, complexity and risk profile of the bank and the banking group.
  - Planned and prioritized around a bank’s significant activities after considering the "net risk" of these activities (i.e., inherent risks after consideration of the quality of risk management), the need to update OSFI’s information on the activities, and the importance of the activities to the bank’s overall risk profile.
  - OSFI adjusts work priorities set out in the supervisory strategy and annual plan when there are shifts in the bank’s risk assessment throughout the year.
- Systemic importance and organisational design:
  - The relative systemic importance of each institution is reflected in OSFI’s supervisory plans and corporate structure.
  - OSFI has established dedicated supervisory teams for conglomerate banks and banking groups, with resources that can be and are adjusted according to changes in the nature, size, and complexity of supervised groups.

### Legal protection for supervisors and staff (EC9)
- Laws provide protection to the supervisor and its staff against lawsuits for actions taken and/or omissions made while discharging their duties "in good faith."
- The supervisor and its staff are adequately protected against the costs of defending their actions and/or omissions made while discharging their duties "in good faith."

*Source: IMF staff summary of OSFI practices as presented in the provided content unit.*

### Section 39 of the OSFI Act provides legal protection to OSFI and its staff against lawsuits for

### _cr1471 - Section 39 of the OSFI Act provides legal protection to OSFI and its staff against lawsuits for

### Section 39 legal protection
- Section 39 of the OSFI Act provides legal protection to OSFI and its staff against lawsuits for actions taken while discharging their duties in good faith.
- The Government of Canada, through Treasury Board of Canada, covers the costs of an employee's defence if the employee acted within the scope of his/her duties.

### Assessment of Principle 2 — operational independence and statutory clarity
- Assessment: Largely Compliant
- Findings:
  - OSFI is a government agency whose formal head is the Minister of Finance but exhibits operational independence in practice, confirmed by stakeholders including the industry.
  - The Bank Act contains numerous instances where approvals are required from the Minister, either alone or in addition to the Superintendent.
  - Under the current Bank Act, just under 40 approvals belong to the Superintendent and just under 60 belong to the Minister.
  - In 2012, only 18 of 116 Bank Act approvals granted were Ministerial approvals.
  - In 2011, 28 of 132 approvals granted were Ministerial approvals.
  - Records indicate OSFI’s opinion has never been disregarded; processes and procedures (not expressly required under the Bank Act) lead to OSFI making the sole prudential determination in matters requiring supervisory decisions.
  - De jure ambiguity exists: at various points in the Act (for example, section 396) matters listed for the consideration of the Minister are prudential in character, implying potential Ministerial reassessment of prudential decisions.
  - The Act permits the Superintendent to take control of a bank, but if this control extends beyond 16 days the Minister may intervene (Section 648(1)(b): control may extend beyond 16 days “unless the Minister advises the Superintendent that the Minister is of the opinion that it is not in the public interest to do so”).
- Recommendations:
  - Amend the Bank Act to ensure clearly separate legal processes for prudential decisions to be made solely by OSFI (the Superintendent).
  - Codify a prudential veto in the Bank Act so the Minister cannot issue an approval that was not recommended by OSFI (while preserving the Minister’s ability to make determinations on non-prudential grounds).
  - Revisit the Bank Act provisions relating to powers to take control of the assets of a bank to ensure an alternative resolution method is promptly put in place if Ministerial intervention becomes possible after 16 days.
  - Consider exempting supervisors from the government’s fiscal controls and administrative guidance to enhance OSFI’s financial autonomy.

### Principle 3 — Cooperation and collaboration (Assessment: Compliant)
- Principle statement: Laws, regulations or other arrangements provide a framework for cooperation and collaboration with relevant domestic authorities and foreign supervisors, reflecting the need to protect confidential information.

#### EC1 — Domestic cooperation arrangements
- Description and findings:
  - Domestic authorities with roles: OSFI (prudential supervisor), Department of Finance (DoF) (overarching responsibility), Bank of Canada (BoC) (emergency lending capability), Canada Deposit Insurance Corporation (CDIC) (resolution preparations).
  - Formal mechanisms and committees:
    - Financial Institutions Supervisory Committee (FISC), chaired by the Superintendent of Financial Institutions; mandated under section 18 of the OSFI Act to facilitate consultation and exchange of information among OSFI, CDIC, BoC, DoF and the Financial Consumer Agency of Canada (FCAC). Every member is entitled to any information on matters relating directly to the supervision of financial institutions that is in the possession or under the control of any other member. Committee architecture includes a sub-FISC and junior committees.
    - Senior Advisory Committee (SAC), chaired by the Deputy Minister of Finance; forum for financial sector policy issues including macro-prudential oversight and financial stability; membership same as FISC with sub-SAC meetings.
    - OSFI representation on the CDIC Board of Directors, which includes ex-officio directors: Governor of the BoC, the Deputy Minister of Finance, OSFI’s Superintendent, an OSFI Deputy Superintendent or another officer of OSFI appointed by the Minister of Finance, and the Commissioner of FCAC.
    - Heads of Agencies committee, chaired by the Governor of the BoC, including senior representatives of DoF, OSFI, four largest provincial securities regulators (Alberta, British Columbia, Ontario and Québec) and the Chair of the Canadian Securities Administrators.
  - OSFI and CDIC Strategic Alliance Agreement: framework to coordinate activities, promote consultation and facilitate exchange of information.
  - Guide to Intervention for Federally Regulated Deposit-Taking Institutions: outlines coordination mechanisms between OSFI and CDIC across supervision stages (normal → early warning → winding-up).
  - Regular interactions: OSFI and DoF conduct monthly (or more frequent) “Case Review” meetings for individual applications requiring Ministerial approval; assessors corroborated well-established relationships and frequent, open contact among federal authorities.
  - Provincial interactions: provincial regulators are not represented on FISC or SAC; provincial securities regulators participate in Heads of Agencies discussions on capital markets; provincial regulators contact OSFI on an ad hoc basis and OSFI provides provincial-level updates (e.g., at CUPSA).
- Recommendation:
  - Put in place more frequent and structured arrangements with provincial authorities, modeled on existing formats, to ensure active and proactive sharing of relevant information for enhanced firm/group supervision and systemic understanding.

#### EC2 — Cooperation with foreign supervisors
- Description and findings:
  - OSFI has entered into formal information-sharing and cooperation arrangements (Memoranda of Understanding – MoUs) with over 30 foreign supervisory authorities.
  - OSFI routinely exchanges information with foreign home and host regulators pursuant to MoUs, sharing information when assured in writing that confidentiality will be maintained.
  - OSFI participates in collaborative onsite reviews; example activities include:
    - Sharing scope and on-site plans (oral);
    - Receiving information from host authority on local business environment and operations;
    - OSFI sharing specialist team knowledge and methodology for file review;
    - Sharing observations, findings and recommendations (oral).
  - OSFI conducts regular (usually quarterly) telephone conferences with foreign regulators; Relationship Managers maintain ad hoc contact with key host regulators for time-sensitive issues.
  - Foreign supervisory counterparts value and trust their supervisory relationship with OSFI.

#### EC3 — Legal and policy safeguards for sharing confidential information
- Description and findings:
  - Subsection 22(1) of the OSFI Act establishes a strict confidentiality regime for information in OSFI’s possession and information prepared from it.
  - OSFI has authority to share confidential information with domestic and foreign supervisory authorities pursuant to subsection 22(2) of the OSFI Act and subsection 636(2) of the Bank Act.
  - OSFI policy: not to exchange written documentation with other authorities until the MoU process and due diligence with respect to confidentiality have been completed.
  - All MoUs require the receiving party to treat information as confidential, take all possible steps to preserve confidentiality, bind employees to confidentiality, and use information exclusively for lawful supervisory practices.
  - MoUs require that if a party is compelled to disclose information (e.g., by a court), that party will advise OSFI of the information compelled to be released and the circumstances.

#### EC4 — Use and protection of confidential information received
- Description and findings:
  - OSFI uses confidential information received from other supervisors only pursuant to the terms of the bilateral MoUs.
  - All bilateral MoUs state OSFI will not pass on confidential information obtained from another regulator without obtaining explicit prior consent.
  - If legally compelled to release confidential information received from another regulator, OSFI’s procedure is to notify the originating regulator promptly and, if consent is not provided, to use every available means to resist or protect the information.
  - To date, there have been no cases where OSFI has been legally compelled to disclose information obtained from a third party.

#### EC5 — Support for recovery and resolution planning and actions
- Description and findings:
  - CDIC is the Canadian resolution authority; OSFI and CDIC maintain a close working relationship and regularly participate in recovery and resolution planning meetings.
  - OSFI participates in the Resolution Planning Working Group (chaired by CDIC) which includes all FISC agencies; individual institutions are discussed at FISC.
  - OSFI participates in direct meetings between CDIC and banks on resolution planning.
  - OSFI and CDIC jointly organize annual Crisis Management panels to discuss recovery and resolution planning with domestic and international stakeholders (most recent Panel referenced: May 2013; a resolution-focused panel planned later in 2013).
  - Guide to Intervention for Federally Regulated Deposit-Taking Institutions: publicly available guidelines describing coordination between OSFI and CDIC during deterioration, distress and resolution stages; classifies institution stages (e.g., “early warning,” “risk to financial viability,” “Non-viability”) and clarifies expected agency actions.
  - Recovery plans: prepared by financial institutions based on direction and administrative guidance provided by OSFI (with FISC input).
  - Resolution plans: CDIC drafts resolution plans; OSFI provides institutions’ recovery plans to CDIC to assist CDIC’s resolution planning; CDIC obtains further information from banks as required.

- Principle 3 overall assessment and comments:
  - Assessment: Compliant
  - Comments:
    - Cohesive cooperation and collaboration characterize OSFI’s relationships with relevant authorities; federal-level cooperation is long-established and effective, including through the financial crisis.
    - Foreign authorities provide favourable comments on interactions with OSFI; other authorities have sought OSFI technical assistance.
    - Weaknesses: federal–provincial relationships are less developed and may represent a potential frailty; recommend more frequent and structured federal–provincial arrangements to ensure full and free flow of information for effective mandate execution.

### Principle 4 — Permissible activities (EC1 and EC2)
- Principle statement: The permissible activities of institutions that are licensed and subject to supervision as banks are clearly defined and the use of the word “bank” in names is controlled.

#### EC1 — Definition of “bank”
- Description and findings:
  - The Bank Act (section 2) defines a bank as: “a bank listed in Schedule I or II”.
  - The legal definition identifies institutions by name in Schedule I (domestic banks) and Schedule II (subsidiaries of foreign banks); it does not provide a descriptive definition of what a bank is.
  - Schedule III lists authorized foreign banks (foreign bank branches), defined in section 2 as “a foreign bank that is the subject of an order under subsection 524(1)”.
  - Section 2 defines a foreign bank as “...an entity incorporated or formed by or under the laws of a country other than Canada......”

#### EC2 — Permissible activities for banks
- Description and findings:
  - The Bank Act, Part VIII (Business and Powers) defines permissible activities of banks.
  - Section 409 lists that engaging in the business of banking includes:
    - (a) providing any financial service;
    - (b) acting as a financial agent;
    - (c) providing investment counselling services and portfolio management services; and
    - (d) issuing payment, credit or charge cards and, in cooperation with others including other financial institutions, operating a payment, credit or charge card plan.
  - Additional activities and restrictions are set out in sections 410 through 437 (including property related activities, bank related data processing and information management services, acting as a custodian or receiver); some additional activities are subject to Ministerial approval.
  - Banks may not “deal in goods, wares or merchandise or engage in any trade or other business.”
  - Foreign bank branches (sections 538-556) have the same powers and restrictions as Schedule I and II banks, except:
    - A foreign bank branch does not have the ability to take a material amount of retail deposits (i.e., deposits of less than $150,000).
    - A “full-service” foreign bank branch is permitted to accept deposits in Canada of $150,000 or greater (section 545).
    - A “lending” foreign bank branch is generally prohibited from accepting deposits (section 540).

*Source: _cr1471 - Section 39 of the OSFI Act provides legal protection to OSFI and its staff against lawsuits for*

### Part IX (Investments) of the Bank Act clearly sets out the permissible investment powers of

### _cr1471 - Part IX (Investments) of the Bank Act clearly sets out the permissible investment powers of

### Permissible investment powers
- Part IX (Investments) of the Bank Act sets out the permissible investment powers of banks.
- The investment regime is an extension of the business and powers regime.

### Prudential standard
- All investments by a bank in an entity are subject to the “reasonable and prudent person” standard (section 465) with a view to ensuring that banks do not expose themselves to undue financial or other risks via their investments.

### Acquisitions of substantial investments and control
- All acquisitions of substantial investments in, and/or control of, a single entity by a bank are subject to specific rules.

### Foreign banks’ permitted investments
- Part XII (Foreign Banks) of the Bank Act sets out permitted investments in Canada for a foreign bank.
- While the foreign bank itself may not be licensed or subject to supervision by OSFI, its permitted investments in Canada generally mirror those investments permitted to a Schedule I or II bank.

### Notes
- 16 Unless otherwise indicated, all references to sections, subsections or paragraphs are in relation to the Bank Act.

*CANADA 48 INTERNATIONAL MONETARY FUND*

### Part XI (Self-Dealing) of the Bank Act sets out limited permissible transactions for banks with

### _cr1471 - Part XI (Self-Dealing) of the Bank Act sets out limited permissible transactions for banks with

### Part XI (Self-Dealing) and OSFI guidance
- Part XI (Self-Dealing) of the Bank Act sets out limited permissible transactions for banks with related parties.
- OSFI Advisory: Business and Powers—Ownership Interests in Commodities clarifies circumstances in which taking an ownership interest in commodities (which would otherwise violate the section 410(2) prohibition on dealing in goods) is permissible and sets prudential standards and parameters/limitations on permissible activities.

### EC3 — Use of the word “bank” in names
- Legal framework and findings:
  - The Bank Act generally restricts the use of the word “bank,” “banker” or “banking” in a name, or to describe a business in Canada, to banks and authorized foreign banks (section 983). This includes equivalents in any language (subsection 983(13)). A subsidiary of a bank may use the name of its parent bank (subsection 983(5)).
  - Exception: use is permitted where the use of the word relates to a business not engaged in financial activities and it is unlikely the general public would be misled (subsection 983(5.1)).
  - Provincial legislation mirrors federal restrictions (example: General Regulation to Ontario`s Business Corporations Act, paragraph 16(1)(c)). Industry Canada refers potentially misleading name registrations to OSFI; OSFI reported a handful of enforcement cases.
- Finding:
  - The use of the word “bank” and its derivations is not wholly limited to banks as defined under the Bank Act, but regulatory and referral mechanisms exist to limit misleading use.

### EC4 — Reservation of deposit-taking
- Legal framework and findings:
  - Deposit-taking from the public is generally undertaken by federally regulated financial institutions (Bank Act, Trust and Loan Companies Act, Cooperative Credit Associations Act) with OSFI approval required to take deposits.
  - Federal incorporating statutes (Canada Business Corporations Act paragraph 3(4)(a); Canada Not-for-profit Corporations Act subsection 3(3); Canada Cooperatives Act subsection 3(5)) prohibit federal corporations from carrying on the business of a bank or other FRFI entities.
  - Provincial entities (e.g., credit unions, Alberta Treasury Branch) may take deposits and are regulated by provincial authorities.
- Key statistics:
  - Approximately 10 percent of all deposits taken in Canada were held outside federally regulated banks as at March 2013.
  - Credit unions reported $126.3 billion in deposits as at March 31, 2012.
  - Deposits held with all Canadian banks amounted to $2.3 trillion as at June 30, 2012 (note: excludes deposits with other federally regulated financial institutions).
- Additional issues:
  - Investment Dealers may use free cash held on behalf of clients; such funds can have the character and quality of a deposit.

### EC5 — Public list of licensed banks
- Description and findings:
  - The OSFI website publishes a current list of all banks, foreign bank branches and foreign bank representative offices operating in Canada.
  - Schedules I, II and III to the Bank Act list all banks and foreign bank branches (sections 14 and 14.1). The Bank Act is publicly accessible.

### Assessment of Principle 4
- Assessment: Compliant
- Comments and findings:
  - Under federal law a bank is an entity incorporated and regulated at the federal level; a bank cannot exist at the provincial level.
  - Federal law does not cover all deposit-taking institutions. In practice, approximately 90 percent of public deposits are taken by the federal banking system; provision of credit is largely at the federal level—ie 75 percent (Bank of Canada, 2012).
  - Province-significant institutions: DesJardins (Québec) and Alberta Treasury Branches (provincial crown incorporation; the 10th largest lender in Canada).
  - Funds with deposit-like characteristics are taken by investment dealers.
  - Recommendation: Canadian authorities should assess and, as necessary, remedy laws and arrangements to ensure the soundness and stability of the financial system within Canada, not merely the federal aspect.

### Principle 5 — Licensing criteria (Assessment: Largely Compliant)
- Overview:
  - Licensing authority has power to set criteria and reject applications. At minimum, process assesses ownership, governance, fit and propriety, strategic and operating plans, internal controls, risk management, projected financial condition, and seeks home supervisor consent for foreign owners.
- EC1 — Authority to grant/withdraw licences
  - Two-step licensing process:
    - Minister of Finance issues letters patent of incorporation (section 22 and subsection 25(1)) upon recommendation of the Superintendent of OSFI.
    - Superintendent issues an order to commence and carry on business (section 49); bank may not commence operations until the order is issued (subsection 48(1)).
  - Practice notes:
    - Applications filed with Superintendent; Minister receives a recommendation but not full application materials.
    - Letters patent lapse if order to commence not obtained within one year.
    - Pre-commencement on-site review by OSFI is mandatory.
  - License revocation:
    - Minister or Superintendent may revoke approvals (section 973.03).
    - Voluntary continuance or liquidation rules set out (sections 39.1–39.2; sections 342–347).
  - Foreign bank branches follow an equivalent two-step process (subsection 524(1); subsection 534(1)); deposit and other conditions apply.
  - OSFI’s prudential veto: OSFI must recommend to Minister; in practice Minister follows OSFI recommendations and OSFI controls commencement via the order to commence.
  - OSFI retains application materials and supplies Minister with relevant information.
  - Prudential conditions/limitations:
    - Minister or Superintendent may impose terms/conditions on approvals (subsection 28(3); subsection 527(3); section 53; subsection 534(5); section 973.02).
    - OSFI obtains commitments and undertakings (support principle letters, capital undertakings, information undertakings).
    - CEO commitment letter: bank must notify OSFI if intending to deviate materially from submitted business plan.
    - Supervisability remedies: designation of related parties, requirement to create a bank holding company, information undertakings, capital ratio undertakings by ultimate controlling shareholder.

- EC2 — Power to set criteria and reject/revoke
  - Bank Act sets criteria and discretionary powers (sections 22, 27, 49).
  - Licensing criteria (non-exhaustive list from section 27):
    - nature and sufficiency of financial resources;
    - soundness and feasibility of business plans;
    - business record and experience;
    - character, integrity and reputation;
    - competence and experience;
    - Superintendent’s opinion on corporate structure’s effect on supervision;
    - best interests of the financial system in Canada.
  - OSFI guidance: Internal Risk Tolerance Framework for New Entrants requires initial base case capital to cover expected losses during first three years or until profitable.
  - Special provisions:
    - Minister may require reciprocal treatment for non-WTO member foreign bank parent (section 24).
    - Applicants must publish notice of intention to apply (section 25).
    - Superintendent must be satisfied before issuing order to commence (section 52).
    - Governments and agencies are prevented from applying to incorporate a bank (section 23).
  - OSFI Instruction Guide for Incorporating Banks and Guide to Foreign Bank Branching prescribe information and procedural requirements.
  - Power to reject:
    - Minister and Superintendent are not obliged to grant approvals (sections 22 and 49).
    - Letters patent or branch orders lapse if order to commence not issued within one year (subsection 52(2); subsection 534(9) and revocation rules).
    - Offences for providing false information (sections 980.1 and 985); immediate revocation possible where licence obtained on false information.

- EC3 — Consistency of licensing criteria with ongoing supervision
  - The criteria for licensing apply on an ongoing basis.
  - OSFI applies a risk-based Supervisory Framework for both new entrants and existing banks; new entrants must prepare draft ICAAP in same format as existing banks.

- EC4 — Structures must not hinder supervision or corrective measures
  - For banks:
    - Minister must consider Superintendent’s opinion on whether corporate structure may affect supervision (paragraph 27(g)).
    - OSFI assesses activities, group’s financial nature, independence of the bank, and regulatory oversight of affiliates.
    - Risks of parallel-banking are considered; OSFI has used designation of related parties, business plan commitments, bank holding company requirement and information undertakings to address supervisability.
    - OSFI receives ownership charts and group details to assess transparency/complexity.
    - Corporate Governance Guideline, Guideline B-10 (outsourcing) and other guidelines apply.
  - For foreign bank branches:
    - OSFI relies on home regulator, memoranda of understanding, BIS/BCBS membership, FSAP reports.
    - Guide to Foreign Bank Branching requires ownership and organizational details; Principal Officer expectations described in Guideline E-4B.
  - Shell banks: OSFI does not license shell banks; operational and residency/record-keeping requirements support supervision (see sections: bank head office in Canada section 237; director residency subsections 159(2), section 183; CEO ordinarily resident in Canada section 196; records in Canada sections 239 and 245; securities register in Canada section 251; branch-specific requirements sections 535, 534(4), 582, 536, 597(2)).

- EC5 — Suitability of major shareholders and owners
  - OSFI determines suitability of major shareholders, identifies ultimate beneficial owners and transparency of ownership; may involve RCMP and CSIS for forensic/security assessments.
  - Approvals:
    - Ministerial approval required to acquire a significant interest/control (see BCP 6 and sections 27 and 396).
    - Instruction Guide & Transaction Instructions set information requirements.
  - Suitability checks: criminal/administrative history, CVs, OSFI Security Information Form, net worth statements or audited financials for corporate shareholders.
  - Support Principle acknowledgement letters and paid-in capital deposit prior to order to commence (section 52).

- EC6 — Minimum initial capital
  - Banks:
    - Initial paid-in capital must be at least $5 million or any greater amount specified by the Minister (paragraph 52(1)(b)).
    - OSFI practice: initial capital must be the greater of: $5 million; capital required to remain above target risk-based capital ratio for the longer of the first three years or until profitable; or capital required to remain below authorized assets to capital multiple for the same period. Paid-in capital must be deposited before order to commence.
  - Foreign bank branches:
    - Must meet BIS minimum risk-based capital ratio and maintain a capital equivalency deposit in Canada equal to at least 5 percent of the branch’s Canadian liabilities or $5 million, whichever is greater, for a full-service branch; a lending branch must maintain $100,000 (section 582). Order to commence conditional on deposit (subsection 534(3)). Guideline A-10 addresses capital equivalency deposits.

- EC7 — Fit and proper evaluation of board and senior management
  - OSFI evaluates proposed board members and senior management for expertise and integrity at licensing.
  - Bank Act considerations: competence and experience (paragraph 27(e)); director residency and disqualification rules (sections 159, 160, 163, 164).
  - OSFI practice:
    - Conducts fit and proper assessment at point of licensing but not routinely thereafter; banks are responsible post-licensing.
    - Guideline on Background Checks on Directors and Senior Management of FREs outlines expectations.
    - OSFI requires CVs, personal details, OSFI Security Information Form for security assessments by RCMP/CSIS.
    - OSFI can remove or suspend a director or senior officer on fit and proper grounds (Section 647.1(1)).
  - For foreign branches: Principal Officer and local management undergo similar vetting; security forms required.

- EC8 — Review of strategic and operating plans, governance, risk management, controls
  - OSFI analyses strategic and operating plans, risk management, internal controls, AML/CFT measures and outsourcing arrangements.
  - Instruction Guide requires business plan content, policy statements, conflict of interest policy, and internal control descriptions.
  - OSFI reviews material outsourcing agreements and expects weaknesses to be remedied before order to commence.

- EC9 — Review of pro forma financials and projections
  - Applicants must provide pro forma financial statements for first three years, contingency plans, capital breakdowns, capital plan and funding policies.
  - ICAAP is required; OSFI reviews principal shareholder financials (audited statements or net worth statements).
  - Foreign bank applicants provide five years of financials, credit-rating reports, material regulatory actions, ICAAP/equivalent and pro forma statements.

- EC10 — Home supervisor non-objection and consolidated supervision assessment
  - OSFI establishes home supervisor non-objection/consent and assesses whether home supervisor practices comprehensive consolidated supervision.
  - For foreign-owned Schedule II banks and branches, home regulator contact details and confirmation are required; OSFI may use questionnaires, internal home country reports, open-source research and discussions with other host regulators.

- EC11 — Monitoring new entrants post-authorisation
  - Pre-commencement on-site review and tailored supervisory program are used.
  - Monitoring includes performance against business plans, quarterly sector monitoring, analytical review against metrics, discussions with senior management and internal audit/compliance regarding commitments/undertakings.
  - New banks must provide advance notice of material proposed business plan changes.

- Assessment summary and key recommendation:
  - Assessment: Largely Compliant
  - Findings:
    - Entry is carefully vetted; OSFI’s risk tolerance for new entrants is low.
    - Fifteen new entrants in the last five years.
    - Licensing criteria are established in law and OSFI guidelines; two-step process ensures OSFI prudential control.
    - OSFI does not, post-licensing, carry out ongoing fit and proper assessments of new directors and senior management — the continuing “gatekeeping” role is not fully exercised.
  - Recommendation:
    - OSFI should change policy and practice to assess fit and proper individuals as and when they join the regulated firm.

### Principle 6 — Transfer of significant ownership (Overview and Findings)
- EC1 — Definitions of significant ownership and control
  - Significant interest:
    - A person has a significant interest in a class of shares if shares beneficially owned by that person and entities controlled by that person exceed 10 percent of outstanding shares of that class (section 8).
    - Threshold to be a major shareholder: 20 percent of voting shares or 30 percent of non voting shares (section 2.2).
  - Control:
    - Control defined by beneficial ownership thresholds (greater than 50 percent) or ability to direct business and affairs; control in fact includes direct or indirect influence that would result in control (subsection 3(1) and 3(2)).
    - OSFI guidance and Rulings address “control in fact”; Guidelines Respecting Control in Fact for subsection 377(1) covers treatment for widely-held banks (equity greater than twelve billion dollars).
  - Acting in concert:
    - Persons acting jointly or in concert are deemed a single person for ownership aggregation (section 9).
  - Ownership restrictions:
    - No person may be a major shareholder of a bank with equity of $12 billion or more (section 374) with limited exceptions.
    - No person can “control in fact” a bank with equity of $12 billion or more (section 377).
    - Public holding requirement applies to banks with equity of $2 billion or more but less than $12 billion: at least 35 percent of voting shares listed and posted for trading on a recognized Canadian exchange and not owned by a major shareholder (section 385); Ministerial exemption available (section 388).
    - Section 377.1(1) permits control of a bank with equity of less than twelve billion dollars subject to Minister approval.

- EC2 — Approval/notification requirements for ownership changes
  - Ministerial approval required to acquire or increase by at least 5 percent (in most cases) a significant interest or to acquire control (sections 373, 377.1, 382 and 396).
  - Transaction Instruction A No. 23 sets out information and administrative guidance.
  - Absent approval, a bank cannot register transfers triggering a significant interest (section 379).
  - Minister may direct disposal of shares where required approval not sought (section 402).
  - Minister may impose terms and conditions on ownership approvals (section 397; section 973.02).
  - Applications must be filed with Superintendent first (section 395); OSFI’s negative recommendation effectively blocks an application.

- EC3 — Power to reject, modify, reverse ownership changes and address false information
  - Minister has broad discretionary power to approve or reject acquisitions (section 396). OSFI evaluates and recommends; negative recommendations are not forwarded to the Minister (practical prudential veto).
  - Revocation, suspension or amendment of approvals is available where based on false information (section 973.03); offences and penalties for providing false information (sections 980.1 and 985).
  - In practice OSFI’s role in initial assessment and its control over information and recommendations ensures robust scrutiny.

*Source: IMF staff extract from the provided Canada BCP assessment chapter/section.*

### section 27 (licensing). Please see CP 5, EC2.

### _cr1471 - section 27 (licensing). Please see CP 5, EC2.

### Licensing, false information and remedial powers
- Where a change in significant ownership was based on false information, section 973.03 applies: "the Minister may revoke, suspend or amend any approval granted by the Minister if he or she considers it appropriate to do so."
- It is an offence under the Bank Act to knowingly provide false information in relation to any matter under the Bank Act or Regulations; punishment (fines, imprisonment) is set out in sections 980.1 and 985.
- OSFI noted that a licence obtained on the basis of false information would enable OSFI to act to remove or suspend the bank’s authorization or cease its business very quickly and that OSFI has a range of remedies (see CP1 EC6 and CP11 referenced for wider discussion).

### EC4 — Supervisor obtains names and holdings of significant shareholders (description and findings)
- All domestic banks must submit an annual report of shareholders to OSFI, within 60 days of the annual general meeting of shareholders.
- The format of the report is not prescribed by OSFI and the supervisor does not look through to identify ultimate beneficiary holdings.
- Major banks: significant holdings are prohibited under law as banks with equity of $12 billion or more must be widely held and no person shall control in fact such a bank (subject to certain exemptions).
- Ownership thresholds under the Bank Act are tightly drawn and prior approval is necessary for any acquisition of significant interest/control.
- Legislative definition of significant interest refers to beneficial ownership of shares by that person as well as by entities controlled by that person; control includes control in fact.
- OSFI places reliance on the bank to identify and seek approval where a proposed ownership change requires approval.
- In specific circumstances (e.g., supervisory concerns with a bank’s legislative compliance management system), OSFI obtains information regarding significant ownership/control from the bank or other sources (for example, may consult with the RCMP).
- OSFI monitoring practices include reviewing board minutes and monitoring press/news articles; OSFI prioritizes additional verifications when elements of dependency (capital, managerial or other support) are observed.

### EC5 — Power to address change of control without required notification/approval (description and findings)
- The Bank Act provides power to address a change in control that has taken place without the necessary approval.
- If a person does not seek required significant interest or control approval, the Minister may, if in the public interest, direct the person to dispose of its shares (section 402), acting on OSFI’s recommendation.
- The Bank Act prohibits exercise of voting rights attached to shares where requisite approval was not sought (section 392).
- It is possible to process an approval after the fact per EC2.
- Acquisition of a significant interest/control without approval is an offence under the Bank Act (section 980); sanctions and court-ordered compliance or restraining orders are set out (section 646, subsection 985(2) and section 989).  

### EC6 — Notification of material adverse changes affecting suitability of major shareholder/controller (description and findings)
- Due to the widely held regime governing banks with equity of over twelve billion dollars, this notification is not relevant for the majority of the banking system, but is pertinent for banks with equity under the threshold.
- There is no specific statutory requirement for banks to notify the supervisor of a material adverse change in a major shareholder or controller.
- OSFI manages this risk through its relationship management approach; firms understand OSFI expects to be informed of material issues that might impact the bank.
- Discussions with major banks indicated a strong understanding of the need to inform OSFI; scope for weaker understanding exists among smaller banks.

### Assessment of Principle 6 — Largely Compliant (comments and recommendations)
- Grading reflects two issues: absence of periodic checking of ultimate beneficial ownership and lack of a formal notification requirement for material adverse changes affecting suitability of a major shareholder.
- OSFI maintains close relationships with regulated entities; all domestic banks must file an annual "Return of Shareholders" showing registered shareholders (does not always identify beneficial shareholders).
- Risk is significantly mitigated for major banks because the widely held regime prohibits certain holdings/control and approvals are needed for changes increasing control; the issue is more meaningful for smaller institutions.
- Small reductions in shareholdings (diminishing control) may not trigger automatic notification; supervisory relationship likely to lead to notification but not guaranteed.
- Recommendations:
  - Consider introducing a standard format for the annual shareholder reporting requirement.
  - OSFI should "look through" shareholding structures to identify ultimate beneficial ownership to detect disguised holdings and to ensure notification of indirect holdings or changes in ownership/control (increasing or decreasing).
  - Reinforce discipline via an explicit reporting requirement or supervisory guideline for notification of material adverse changes affecting suitability of major shareholders/controllers.
  - Alternatively, include the reporting requirement in the next revision of the Bank Act.
- Notes on prudential veto:
  - Approval for change of ownership rests with the Minister, not the Superintendent; Basel Core Principles require the supervisor to be able to prevent change of control for prudential reasons.
  - In practice, OSFI exercises a de facto prudential veto: applications are presented to the Minister only when the Superintendent is prepared to recommend them; OSFI generally does not make a "negative recommendation."
  - The law (section 396(1) of the Bank Act) lists matters for the Minister’s consideration and requires the Superintendent’s opinion in one specific respect; other prudential considerations remain open to the Minister.
  - Assessors recommend clearer legal separation so prudential determinations are made by OSFI and final determination by the Minister is limited to non-prudential matters (for example, codify OSFI practice of presenting applications to the Minister only when satisfied on prudential grounds).

### Principle 7 — Major acquisitions (overview)
- Principle: Supervisor has power to approve/reject and impose prudential conditions on major acquisitions/investments by a bank, including establishment of cross-border operations, and to ensure affiliations/structures do not expose bank to undue risks or hinder effective supervision.

### EC1(a) — Definition of types/amounts requiring prior supervisory approval (description and findings)
- Canadian law aims to avoid dual approvals for same transaction; exemptions permit avoiding Superintendent approval if another section requires Minister/Superintendent approval.
- Under the Bank Act, acquisition/investment regime is not a "dual key" Minister/Superintendent system: acquisitions are subject to (i) Minister’s approval only, (ii) Superintendent’s approval only, or (iii) no approval.
- Minister’s approval is required for acquisitions of substantial investments in, or control of:
  - regulated and unregulated financial institutions (Canadian or foreign) acquired from federally regulated financial institutions (FRFIs) that are not members of the acquirer’s group (to avoid "backdoor mergers");
  - large foreign financial institutions (where the bank has equity of over two billion dollars);
  - entities that engage in information technology or processing services (except as provided by the Information Processing Activities Regulations);
  - entities that are not financial services entities but engage in the marketing of financial products or services.
- Minister’s approval is always required to acquire a significant interest in, or control of, a federally regulated financial institution (ownership regime).
- Acquisition of a "specialized financing entity" is subject to the Superintendent’s approval.
- Two main regulatory areas: Material Asset Transactions and Substantial Investments.
  - Material Asset Transactions: Superintendent approval required whenever acquisition would exceed 10 percent of total value of the assets of the bank.
  - Substantial Investments: defined as acquisition over 10 percent of voting shares of an incorporated entity or over 25 percent of ownership interests of an incorporated or non-incorporated entity (section 10).
- Act designed so approval is required from Minister or Superintendent but not both; Ministerial approvals generally involve public policy considerations, Superintendent approvals generally involve prudential considerations.
- Advisory on substantial investments provides overview of OSFI administration and interpretation.
- Prudential Conditions: Minister or Superintendent may impose any terms, conditions, or undertakings considered appropriate (section 973.02).
- All investments by a bank are subject to the "reasonable and prudent person" standard (section 465).

### EC1(b) — Cases where notification after acquisition is sufficient (description and findings)
- The Bank Act defines cases for which prior supervisory approval is required and those for which no approval is required.
- Substantial investments that do not require prior supervisory approval fit into four categories:
  1. a permitted entity for which no approval is required;
  2. an entity held via a provincial or foreign financial institution (PFFI) controlled by the bank;
  3. an entity to be held for a limited period of time (sections 471-473) — approval required to extend a temporary investment;
  4. an entity held in accordance with the Specialized Financing Regulations (limits: $250 million per investment, 13-year limit, 10 percent and 25 percent of regulatory capital limits).
- Direct specialized investments are not subject to approval, but acquisition of control of, or a substantial investment in, a specialized financing entity is subject to approval.
- While law/regulations do not specify notification requirements for the above, the Advisory on substantial investments notes OSFI may review investments during ongoing supervision and require detailed information; OSFI would require corrective measures if prudential issues are identified.
- In practice, there is open communication and advance notice of all material acquisitions as OSFI assesses potential impacts on the bank’s risk profile.
- Material Asset Transactions act as a backstop: approval required when assets acquired exceed 10 percent of the bank’s assets (section 482), even if investment otherwise exempt.

### EC2 — Criteria to judge individual proposals (description and findings)
- Law is broadly drawn; Minister may consider matters relevant to granting approval, including stability and best interests of the financial system in Canada for large foreign financial institution acquisitions.
- Law does not provide explicit criteria for acquisitions requiring the Superintendent’s approval.
- The Regulatory and legislative Advisory on substantial investments sets out primary criteria to ensure proposed investment would not expose the bank to undue risk or hinder OSFI’s ability to supervise the bank; the advisory provides guidance and emphasizes notifying OSFI when considering trigger transactions.

### EC3 — Objective criteria consistent with licensing; consolidated supervision and information flows (description and findings)
- Advisory on substantial investments permits OSFI to ensure a proposed investment would not expose the bank to undue risk or hinder OSFI’s ability to supervise.
- Transaction instructions for requests (DA No. 13, A No. 8, DA no. 18) specify OSFI may request information to satisfy itself that effective implementation of corrective measures in the future will not be hindered (could include recovery and/or resolution information).
- Superintendent and Minister have discretion to refuse approval where criteria not met, including inability to exercise adequate consolidated supervision.
- Banks must obtain approval to directly acquire control of, or acquire/increase a substantial investment in, a PFFI; OSFI assesses regulatory framework applicable to the PFFI, may enter agreements with the host regulator, and can require undertakings addressing access to information and investment activities (subsection 470(3); subsection 470(4) requires undertaking to permit access to records).

### EC4 — Supervisor determines adequacy of bank’s financial, managerial and organisational resources (description and findings)
- Information requirements for substantial investments include:
  - detailed description of the business to be acquired;
  - a business case (rationale, amount/type of consideration, anticipated impact on capital adequacy);
  - a business plan with three years financial projections;
  - most recent financial statements of the entity;
  - identity of the primary regulator other than OSFI, regulatory contact, and details of required regulatory approvals (if applicable).
- Financial resources: OSFI considers amount/type of consideration, impact on capital adequacy (present/future), business plan with three years projections, capital support expectations, and contingency plans if bank would be close to supervisory/internal minimum capital targets.
- Managerial/Organisational resources: OSFI considers business activities of proposed acquisition, bank’s rationale, business strategy, and familiarity with bank’s managerial and operational strengths/weaknesses.
- OSFI applies a pre-emptive approach; transaction instructions (DA No. 13, A No. 8, DA No. 15-18, A No. 16-18) set information requirements and administrative guidance.

### EC5 — Risks from non-banking activities and supervisory mitigation (description and findings)
- Bank Act: a bank must not engage in business other than banking and related activities (section 409); investment regime restricts investments to financial service entities subject to exceptions permitting limited non-banking investments.
- Exceptions permitting limited non-banking investments include PFFI investments, temporary investments, specialized financing investments, and investments in entities engaging in information technology services or services to group members.
- Specialized Financing Regime: OSFI surveyed largest banks and concluded these investments do not pose material non-banking risks; they are relatively small and often financial in nature.
- Banks may invest in non-permitted activities indirectly through a regulated provincial or foreign subsidiary, not just through a SFV.

*Source: _cr1471 - section 27 (licensing). Please see CP 5, EC2.*

### section 466 (2)). They may also hold non-permitted investments on a temporary basis subject to

### Corporate structure, major acquisitions, and supervisory approach (AC1, Principle 7 and Principle 8)

### Corporate structure and supervisory scope
- The corporate structures for Canada’s largest banks (as at November 30, 2012, the five largest Canadian banks held 88 percent of market assets) all have the bank as the ultimate parent (i.e., there is no holding/parent company).
- Some smaller Canadian banks are commercially owned (i.e., unregulated parent companies); the parent company and its investments (i.e., sister companies of the bank) are not subject to OSFI supervision and consequently OSFI has no direct legislative powers in relation to the activities/investments of these entities.
- At licensing, OSFI considers the group’s activities in the context of supervisability (paragraph 27(g) of the Bank Act) and may obtain undertakings from the ultimate controlling shareholder to address supervisability concerns; assessors saw numerous examples of undertakings.
- OSFI can use prudential agreements (section 644.1), directions of compliance (section 645), staging, divestment orders (section 480), or moral suasion to remedy/mitigate prudential risks arising from investments where no pre-approval is required.

### Legislative/regulatory regime for substantial investments and approvals (AC1 findings)
- Pursuant to the Bank Act definition of substantial investment, a substantial investment by a controlled subsidiary of the bank would be considered a substantial investment for the bank and is generally subject to approval (section 10).
- Exception: investments made by a provincially/foreign regulated financial subsidiary are not treated as substantial investments for the bank for purposes of approval; OSFI nonetheless expects to be advised by the bank of material acquisitions/investments by such provincially/foreign regulated entities and reviews as necessary.
- Investments that are not subject to approval under the substantial investments regime remain subject to approval if the investment involves acquiring assets that represent more than 10 percent of the bank’s consolidated (pre-acquisition) assets.
- Where no approval is required, OSFI can address downstream acquisition/investment risks ex ante via prudential agreements (section 644.1), divestment orders (section 480) where prudent person standards are not met, “staging” (see CPs 8, 9 and 11), or moral suasion.
- For acquisitions or investments subject to approval, OSFI’s approach includes assessing the regulatory framework that applies to a PRFI being acquired and determining implications for future corrective measures.

### Assessment of Principle 7 (acquisitions and investments)
- Assessment: Compliant.
- Key findings:
  - The Bank Act sets clear limits upon and requirements for Ministerial approval of major acquisitions carried out by banks; OSFI performs the preparation work for approval on prudential grounds and only recommends approval to the Minister if OSFI is satisfied.
  - There is no approval required for acquisitions made through a foreign or provincially regulated subsidiary; this exemption exposes OSFI and the bank to the risk that acquisitions are approved by foreign regulators with differing standards or powers.
  - In practice, banks are likely to seek informal OSFI endorsement; OSFI would, at the consolidated level, have powers to put pressure on the bank (see CP11) to require tighter management standards around the indirect subsidiary, or in extremis, to divest.
  - Recommendation noted: it would be preferable to remove the exemption from the Bank Act so that OSFI holds a clearly defined “gatekeeper” role to review the entire group structure for the federally regulated entities.
  - The existence of a “prudential veto” where Ministerial approvals are required is unclear and should be read alongside recommendations in CP2 and CP6.
  - The OSFI Regulatory and Legislative Advisory on substantial investments is dated 2003; authorities may wish to review and refresh the document to ensure prudential criteria are as clear as possible.

### Supervisory approach overview (Principle 8)
- Principle 8 summary: supervisor must develop and maintain a forward-looking assessment of bank and group risk profiles; identify, assess and address risks; have a framework for early intervention; and have plans for resolution in partnership with other authorities.
- OSFI’s Supervisory Framework (revision date December 2010) provides the overall supervisory approach and is designed to meet statutory obligations set out in section 4 of the Office of the Superintendent of Financial Institutions Act (OSFI Act).
- OSFI’s supervisory approach is founded on seven principles:
  - focus on material risk
  - forward-looking, early intervention
  - sound predictive judgment (judgments must have a clear supported rationale)
  - understanding the drivers of risk
  - differentiate inherent risks and risk management
  - dynamic adjustment
  - assessment of the whole institution

### Risk identification and assessment methodology (EC1)
- The composite risk assessment combines assessment of earnings and capital in relation to overall net risk from significant activities, and an assessment of the bank’s liquidity.
- Significant Activities are identified using both qualitative and quantitative factors (organization charts, strategic business plan, capital allocations, internal and external reporting). Quantitative reasons include percentage of total bank assets, revenue, premiums written, net income, allocated capital, or potential for material losses. Qualitative reasons include strategic importance, planned growth, risk, effect on brand value or reputation, or criticality of an enterprise-wide process.
- For each Significant Activity, OSFI identifies and assesses key risks using six categories of inherent risk:
  - credit risk
  - market risk
  - insurance risk
  - operational risk
  - regulatory compliance risk
  - strategic risk
- Reputational risk is not treated as a separate inherent risk category but as a factor within each inherent risk category.
- Quality of Risk Management is evaluated by reviewing Operational Management and independent Oversight Functions: Financial; Compliance; Actuarial; Risk Management; Internal Audit; Senior Management; and the Board.
- Net Risk classification: low, medium, above average and high.
- Direction of Risk classification: decreasing, stable, or increasing.
- Overall Net Risk is a weighted aggregation of Net Risks across Significant Activities; Earnings, Capital and Liquidity are rated strong, acceptable, needs improvement, or weak, and their direction is assessed as improving, stable, or deteriorating.
- Composite risk rating is derived from Overall Net Risk, Earnings, Capital and Liquidity and relates to the “intervention rating” (0–4), which determines supervisory intensity. Supervisory intensity, restrictions and more onerous requirements apply when an institution is “staged” at level 1 or above.
- OSFI has a Risk Tolerance Framework to prioritize resource allocation by considering risk of loss to primary stakeholders (depositors, policyholders, pension plan members) and risk to OSFI’s reputation and credibility.
- Emerging risks are identified via an Emerging Risk Committee (ERC) with representation from all divisions; both bank-specific and system-wide concerns are considered.
- Resolvability is considered within the Risk Matrix analysis as a “significant activity.”

### Supervisory processes and forward-looking view (EC2)
- OSFI’s supervisory processes are dynamic, iterative and continuous; key documents and tools include the Supervisory Framework, Assessment Criteria and Corporate Governance Guideline.
- An annual supervisory strategy is prepared for each bank with a three year horizon and fuller description for the upcoming year; the intensity of the work plan reflects the nature, size, complexity and risk profile of the bank, including potential consequences of failure.
- OSFI supervisory year: April to end March.
- Main planning season: September, with a refresh towards the end of the supervisory year in February.
- Planning and prioritization for each Significant Activity and oversight function is based on the net risk assessment, information decay risk, and importance of the activity; OSFI does not set formal, dated cycles for supervisory activity to avoid a mechanical approach.
- Supervisory activity components:
  - monitoring (bank-specific and external)
  - limited off-site reviews
  - extensive on-site reviews (may include testing or sampling)
- OSFI periodically requires banks to perform specific stress tests to assess potential impacts of operating environment changes.
- Capital assessment considers level and quality of capital at present and prospectively, under normal and stressed conditions, and the effectiveness of capital management processes across all Significant Activities. For foreign branches, OSFI considers adequacy of capital equivalency deposits.
- Liquidity expectations: banks must maintain prudent levels of liquidity risk and liquidity management processes at present and prospectively, under normal and stressed conditions.
- Relationship Manager updates the overall risk profile as supervisory work is conducted and OSFI adjusts priorities in the supervisory strategy accordingly.
- Key documents maintained in OSFI’s supervisory process:
  1. Risk Assessment Document (RAD)
  2. Risk Matrix
  3. Supervisory Strategy (annual preparation with revisions as necessary)
  4. Interim Supervisory Letter (issued at completion of specific supervisory work)
  5. Annual Supervisory Letter (highlighting the key supervisory priorities)

*Source: IMF staff report excerpt (sections on corporate structure, AC1, Principle 7 and Principle 8).*

### 6. Follow Up Document (FUD)

### 6. Follow Up Document (FUD)

### EC3 — Compliance with prudential regulations and legal requirements
- OSFI supervisors assess compliance as part of normal supervisory work using Superintendent’s powers under sections 628, 643 and 644 of the Bank Act.
- Supervisors receive supervisory guides and assessment criteria to assess inherent risk, controls, and oversight.
- Regulatory compliance inherent risk is assessed for each bank’s significant activities and the quality of oversight functions.
- Assessments are recorded in supervisory documents: significant activity section notes, Compliance/Senior Management/Board section notes, and the Risk Assessment Document (RAD).
- Supervisors make recommendations to banks to address concerns regarding risk, controls or oversight of regulatory compliance.
- Assessors observed examples of detailed OSFI recommendations to firms on how to achieve compliance.
- OSFI issues Corporate Governance Guideline and Legislative Compliance Management requirements for banks to demonstrate compliance management across jurisdictions.

### EC4 — Macroeconomic and cross‑sectoral environment in risk assessment
- The Emerging Risk Committee (ERC) assesses macroeconomic environment, financial system and industry trends (including cross-sectoral developments and institution-specific emerging risks) regularly; ERC meets at least monthly.
- Risks, Surveillance and Analytics Division coordinates day-to-day environmental scanning and ERC meetings.
- ERC outputs have triggered changes to supervisory plans and specific projects (example: brokered deposits assessment).
- Supervisors must include an Operating Environment assessment in the RAD identifying environmental/industry issues, impacted Significant Activities, degree of impact, and follow-up actions.
- Ongoing market surveillance captures emerging risks such as those related to residential lending (RESL); focused work undertaken when appropriate.
- RESL analysis may include housing market performance (including condos and regional distribution), condo construction, condo mortgage profiles, mortgage origination and portfolio analysis (insured, uninsured, bulk insured), IRB models, capital allocation, and bank exposure to condo construction financing.
- Regular meetings with provincial regulators occur based on current risk assessment frequency to enhance understanding of RESL issues outside banks.
- Heads of Agency meetings inform OSFI’s view of the non-bank financial sector; many non-bank entities are owned/controlled by large Canadian banks, so consolidated supervision covers much of the non-bank sector.
- Assessors confirmed contact with non-bank supervisors is maintained but not necessarily consistent—more ad hoc and sporadic.

### EC5 — System‑wide risk identification, monitoring, assessment, and communication
- The Financial Institutions Supervisory Committee (FISC) meets quarterly and focuses on supervision matters.
- OSFI works closely with FINTRAC on anti-money‑laundering and anti‑terrorist financing; OSFI’s Anti-Money Laundering and Compliance Division conducts assessments and shares results with FINTRAC.
- The Superintendent meets at least quarterly with Relationship Managers (RMs) for large banks and the ERC; specialist groups report on trends.
- RMs incorporate Superintendent, FISC, and ERC analysis into bank risk assessments; ERC and RMs share information with FISC.
- ERC can recommend/co-ordinate supervisory actions (information requests, guidance, advisories) to address systemic threats; assessors saw examples of ERC risk identification and actions.

### EC6 — Resolvability and recovery assessments
- CDIC leads preparation and assessment of banks’ Resolution Plans; OSFI leads on recovery plans and incorporates resolvability into risk analysis as a “significant activity.”
- Resolvability analysis is performed by line supervisors to integrate into core bank/banking group assessments.
- First iteration of Resolvability Plans was completed in 2012; resolvability assessments remain at an “early stage.”
- CDIC coordinates discussion of Plans with OSFI and others.
- OSFI assesses an “Intervention Stage” for each bank with specific supervisory/regulatory measures attached to each stage; measures are coordinated with CDIC. The Guide to Intervention clarifies agency interaction at each phase.
- A dedicated crisis management team supports supervisors, including liaison with banks, CDIC, host supervisors, and domestic agencies.
- Large Canadian banks submitted revised Recovery Plans in 2012; OSFI conducted comparative assessments and facilitated discussions with CDIC, Bank of Canada, Department of Finance, US and UK authorities.
- OSFI lacks direct power to require a bank restructure but uses “staging,” prudential agreements, undertakings, and supervisability assessments to apply pressure.
- Assessors observed feedback to banks after Recovery Plan submissions including specific recommendations and areas for future OSFI guidance refinement.

### EC7 — Framework for handling banks in stress
- OSFI has the Guide to Intervention and a “Problem Situation Binder” (crisis checklists, communication plans, information gathering, resolution options, holding company issues, lender of last resort and payment systems).
- Guide to Intervention stages: level 0 to 4 — No significant problem; early warning, risk to financial viability; financial viability in serious doubt; and non-viability/insolvency is imminent.
- Staged firms receive intensified supervision and measures that may include higher capital requirements, limitations on business activities, and assessment fees. Guide describes CDIC involvement at each stage.
- FISC and subcommittees function as system‑wide coordination mechanisms. The crisis experience demonstrated relationships could be intensified rapidly when needed.

### EC8 — Activities outside the regulatory perimeter and regulatory arbitrage
- OSFI monitors the regulatory perimeter established in the Bank Act; banking is federal but deposit taking and lending can occur under provincial law.
- Many approvals/notifications under the Bank Act require OSFI involvement; Minister or Superintendent can require undertakings when approval is required.
- To date, OSFI has not observed restructurings intended to avoid the perimeter. Potential perimeter issues noted: large asset transactions (CP7) and related party transactions in restructurings (CP20).
- OSFI Advisory: Business and Powers – Ownership Interests in Commodities clarifies permissible commodity ownership interests and prudential standards.
- The Superintendent participates in the Heads of Agencies Committee chaired by the Governor of the Bank of Canada with Department of Finance and four provincial securities regulators (OSC, AMF, ASC, BCSC) to exchange information and coordinate on issues including hedge funds, ABCP, OTC derivatives, shadow banking and perimeter issues.
- OSFI raises system‑wide issues related to bank-like activities outside the perimeter (e.g., SPEs and ABCP growth) with responsible authorities at HoA, FSIC, or SAC.

### Assessment of Principle 8
- Assessment: Compliant
- Comment summary:
  - OSFI has an excellent supervisory approach combining multi-perspective risk analysis with forward-looking dimensions and a clear supervisory outcome via intervention ratings and “stages.”
  - Recommendations for further attention:
    - Intensify group analysis from a legal-entity perspective for conglomerate groups to complement significant-activities examination, especially after designating six banks as domestically systemically important.
    - Review communication and coordination with non-bank regulators for entities within consolidated groups.

### Principle 9 — Supervisory techniques and tools (overview)
- Principle: The supervisor uses an appropriate range of techniques and tools and deploys resources proportionately to risk and systemic importance.
- Assessment: Compliant

### EC1 — Mix of on-site and off-site supervision
- All supervisory work uses Superintendent’s examination powers in sections 643 and 644 of the Bank Act.
- No separation between on-site and off-site functions: line supervisors dedicated to banks and specialist teams (credit, models, market risk, etc.) both perform work; specialist on-site teams include at least one line supervisory staff member.
- Supervisory guides and tools support assessment quality and effectiveness.
- Staffing: a team of approximately seven staff is dedicated specifically for each of the six major Canadian banks. Supervisory staff are supported by risk specialist teams.
- Same supervisory staff perform the full range of supervisory work for a specific bank.
- Supervisory Strategy prepared annually for each bank; assessors reviewed strategies for major banks.
- Examples of on-site review frequency:
  - Major firm: 15 significant reviews over a two year period.
  - Smaller institutions: between three to six on-site reviews and follow-up visits over a year.
- OSFI uses scoping visits to determine need for resource‑intensive programs; supervisory strategy flexibility aids rapid mobilization.

### EC2 — Planning and execution process
- Planning and execution are supported by extensive supervisory guidance and tools.
- Supervisory strategies developed at institution and sector levels; internal guidance on completing Supervisory Strategy documents.
- Supervisory planning season: September with refresh in February; work year runs April to March.
- Off-site and on-site supervision executed by same supervisory staff; Relationship Managers (RMs) coordinate and approve communications to banks.
- Assessors saw examples of quarterly monitoring documents incorporating on-site and off-site outputs.

### EC3 — Use of information sources and verification
- OSFI uses prudential returns and internal firm documents (risk policies, limit structures, audit and compliance reports, capital planning reports including economic capital, organization and operational structure data, resources, staffing and training, compensation policies).
- Information verification through multiple-source comparison, selective control testing and management interviews.

### EC4 — Analytical tools and communication of findings
- OSFI analysis types feeding into RAD and Risk Matrix:
  - Analysis of financial statements and accounts: output feeds quarterly monitoring.
  - Business model analysis under headings: Business Overview; Business Model and Assessment; Business Activities; Business Objectives and Strategies; Risk Appetite.
  - Horizontal peer reviews: cross-sectoral and peer reviews provide valuable feedback.
  - Outcomes of stress tests: supervisors review bank-conducted and OSFI-required stress tests; OSFI issued a guideline on Stress Testing.
  - Corporate governance, risk management and internal control analysis: ongoing assessments of Board, senior management and independent oversight functions; assessments performed for individual businesses or as peer reviews.
- Communication tools:
  - Annual Supervisory Letter summarizing key findings, recommendations/requirements, and disclosing/affirming Composite Risk Rating.
  - Interim Letters for timely feedback on specific work.
  - Follow Up Document (FUD) records findings, recommendations and requirements and evidences regular follow-up.

### EC5 — Systemic emerging risks and stress testing
- ERC has tools and reports for systemic emerging risk review; ERC assesses macro environment, financial system, industry and institution-specific risks regularly.
- ERC findings have led to significant supervisory actions (example: liquidity reporting requirements developed from ERC findings).
- OSFI regularly requires banks to complete system-wide stress tests (macro stress tests, retail, recession, etc.).
- ERC and stress-test findings are fed back into normal supervisory processes and FUD follow-ups; assessors noted OSFI sharing forward-looking analysis with firms.

### EC6 — Use and assessment of internal audit work
- OSFI “uses” (not “relies” on) internal audit and external auditor work to reduce supervisory scope and duplication.
- Assessment of Internal Audit described in Corporate Governance Guideline and Assessment Criteria for Internal Audit; assessment is a regular part of supervisory work using on-site and off-site methods.
- OSFI maintains regular contact with Audit Committees as a conduit for assessing internal audit quality.

### EC7 — Contacts with Board and management
- OSFI expectations set out in Corporate Governance Guideline and Assessment Criteria for the Board and Senior Management.
- For larger institutions: OSFI meets senior management and audit and risk committees at least semi-annually; in-camera meetings with committee members possible. OSFI executives including the Superintendent participate.
- For larger institutions: quarterly meetings with Chairs of audit and risk committees and additional meetings after significant activity reviews.
- OSFI typically meets quarterly with senior/middle management (Chief Audit Executive, Chief Risk Executive, Chief Compliance Executive, Business Unit Heads).
- Frequency rises where material prudential concerns exist.
- OSFI can escalate to the Board if remedial progress is inadequate; assessors observed escalation and effective outcomes.
- Firms reported regular, close contact including planned telephone contact (e.g., weekly calls with CROs of larger firms, regular contact with smaller institutions).

### EC8 — Timely communication of supervisory analyses
- Supervisory guides and letter templates exist for timely documentation and communication.
- Management Reports issued after significant activity reviews or annually, addressed to CEO and copied to audit committee chair; preceded by meetings with top management and followed by board meetings for larger institutions.
- OSFI holds in-camera sessions with non-executive members as needed.
- Firms noted improvement in aligning closing session messaging with formal written documents.

### EC9 — Follow-up and escalation
- Standard template used for follow-up of bank actions addressing supervisory concerns.
- RM has overall responsibility for follow-up, typically quarterly though frequency varies by issue; specialist teams must confirm “closure” when applicable.
- Items remain on the FUD until OSFI verifies outcomes meet requirements; firms confirmed this practice.
- Follow-up includes escalation to senior supervisory staff and/or bank management, including escalation to the Board for significant matters; assessors observed such escalations.

### EC10 — Notification of substantive changes or material adverse developments
- Bank Act provisions require prior notice/approval for many significant transactions; however, there is no specific statutory requirement to notify OSFI of a material adverse development.
- The Schedule to the Administrative Monetary Penalties (OSFI) Regulations lists over seventy potential infringements related to failures to notify OSFI/the Superintendent as required.
- Sections cited: duty to manage and duty of care for directors and officers (sections 157 and 158); auditors’ reporting duty to CEO and CFO and Superintendent receipt of such report (section 328).
- OSFI expects senior management to proactively notify OSFI of significant or material developments in advance; if not, advance notification can be made a requirement of the bank.

### EC11 — Use of independent third parties
- OSFI’s supervisory methodology describes use of third-party work; OSFI “makes use” rather than “relies” on third-party outputs.
- OSFI rarely commissions third-party work at its expense; often requires firms to commission work and may participate in scoping.
- OSFI is cautious: has identified instances of incorrect external consultant advice.

### EC12 — Information systems and monitoring tools
- OSFI’s Business Intelligence (BI) tool: sixty standardized reports and capability for ad-hoc reports and bespoke peer groups and tailored time horizons.
- Electronic Data Management System (EDMS) stores and manages electronic information from banks (management information, audit reports).
- Key Performance Indicator reports automatically highlight outliers, notable movements and threshold breaches for supervisory follow up.

### AC1 — Periodic independent review framework
- OSFI has a Quality Assurance (QA) framework performing Supervisory Process Reviews and Specific Reviews covering planning, execution, risk profile updates, reporting and intervention.
- Internal Audit (IA) complements QA by auditing supervisory work for consistent methodology application and effectiveness; IA reports to line management, Superintendent and OSFI’s Audit Committee and publishes results on OSFI’s website.
- Action plans address identified weaknesses in methodology and execution.
- In practice, IA has done only one review of a specialist area (CMRAS) in last three years and no broader reviews of deposit-taking supervision in that period.
- Practices Division monitors other regulators’ practices to enhance OSFI practices.

### Assessment of Principle 9
- Assessment: Compliant
- Comment summary:
  - OSFI demonstrates high standards, a consistent “close touch” supervisory style, accessibility to industry, and effective supervisory authority.
  - Risks to manage: potential loss of direction from close relationships; some tracking systems (e.g., FUD) may not support prioritization or re-prioritization and might be enhanced for an overarching risk-focused view and to maintain supervisory pressure.
  - Recommend considering enforcement of advance notification discipline through amendment to the Bank Act to remove doubt about firms’ obligations.
  - OSFI actively develops capacities over time (processes, IT, staff skills).

### Principle 10 — Supervisory reporting (EC1 excerpt)
- OSFI has strong information-gathering powers enabling requests for consolidated or solo data as necessary.
- In practice, OSFI collects consolidated data for all banking groups, consolidated data for all sub-groups of regulated entities, and solo data for parent entities of banking groups.
- Legal powers for information gathering are noted (referenced in the text).

*Source: _cr1471 - 6. Follow Up Document (FUD), IMF staff report content provided.*

### Section 628 of the Bank Act specifies that a bank shall provide the Superintendent with such

### _cr1471 - Section 628 of the Bank Act specifies that a bank shall provide the Superintendent with such

### Legal reporting powers and access (Bank Act provisions)
- Section 628: a bank shall provide the Superintendent with such information, at such times and in such form as the Superintendent may require.
- Subsection 643(2): the Superintendent or a person acting under the Superintendent’s direction
  - has a right of access to any records, cash, assets and security held by a bank; and
  - may require the directors, officers and the auditor or auditors of a bank to provide information and explanations, to the extent that they are reasonable able to do so, in respect of the condition and affairs of the bank or any entity in which the bank has a substantial investment.
- OSFI can impose penalties (under sections 24 to 37) for the failure to provide information as required by the supervisor.
- Example of additional Bank Act reporting specificity: requirement to file a copy of its annual statement with the Superintendent (Section 312).

### Scope of OSFI’s consolidated supervision and data sources
- OSFI is a consolidated supervisor with access to all records within the legal structure of any financial institution over which it has regulatory authority, including domestic and foreign subsidiaries, branches, trust companies and other legal entities.
- Standardized schedules of regulatory returns (financial or non-financial) completed by all banks cover:
  - Capital adequacy
  - Balance sheet
  - Profitability
  - Liquidity
  - Market risk
  - Asset quality
- Related party transactions and large exposures are not in the suite of standard information requirements from OSFI.
- OSFI obtains direct management information from firms, including standing requests for information packages provided to the board and senior management reports, and undertakes targeted ad-hoc data calls as supervisory need arises.
- Additional information is obtained using FIC data, a shared database of banking information of common interest that is shared with peer agencies (Bank of Canada and CDIC).
- OSFI maintains many of the regulatory returns; the Bank of Canada maintains those returns for which they are the primary user of the data.
- For data on large exposures, OSFI monitors exposures through management information submitted by the banks. Formal regular reporting on related parties is not required from all firms.

### Reporting instructions and accounting standards (EC2)
- Subsection 308(4) of the Bank Act: a bank’s financial statements shall, except as otherwise specified by the Superintendent, be prepared in accordance with Generally Accepted Accounting Principles (GAAP), the primary source of which is the Handbook of the Canadian Institute of Chartered Accountants.
- The Canadian Accounting Standards Board adopted International Financial Reporting Standards (IFRS) for publicly accountable enterprises commencing 2011.
- All banks reporting to OSFI are required to use IFRS, as communicated in April 2008.
- Subsection 308(4) provides the Superintendent authority to specify accounting treatment other than that required by GAAP; OSFI has not specified accounting requirements that are contrary to IFRS.
- OSFI has issued a Manual of Reporting Forms and Instructions for Deposit-Taking Institutions:
  - The Manual is the primary source for instructions for completing many of OSFI’s regulatory returns.
  - Instructions posted on OSFI’s website are approved by the Financial Information Committee (FIC) and by OSFI’s subject matter experts.
  - Instructions are administered by the FRFI Data Management Division, within OSFI’s Corporate Services sector.
  - DTI instructions are updated on an annual basis at minimum through the Annual Housekeeping Exercise.
  - The instructions refer each return to the applicable accounting standard within the IFRS manual and provide additional clarification; they do not restate IFRS wording.
  - Banks and their chartered accountants are ultimately responsible for researching and understanding each applicable accounting standard; OSFI provides guidance as necessary.
- OSFI has issued guidance on existing accounting practices that are consistent with IFRS and aim to ensure prudential soundness and encourage adoption of BCBS international best practices.

### Valuation governance, fair value practices and supervisory guidance (EC3)
- IFRS is the basis for both external and regulatory reporting for banks, supplemented by OSFI guidelines where required.
- OSFI has asked banks to follow two specific valuation guidance documents:
  1. 2009 BCBS - Supervisory guidance for assessing banks’ financial instruments fair value practices
     - OSFI communicated expectations for all banks to follow the April 2009 BCBS guidance, which sets out principles on governance and controls, alignment of risk management and reporting, and the assessment of valuation practices.
     - Banks were required to submit self-assessments to OSFI against the BCBS principles for the years ending 2009 and 2010.
  2. Fair Value Option (FVO)
     - OSFI issued the Accounting for Financial Instruments Designated as Fair Value Option Guideline in June 2006 and amended it in July 2010 to reflect the adoption of IFRS.
     - The Guideline provides application guidance to banks applying the fair value option in IAS 39 Financial Instruments: Recognition and Measurement.
     - The Guideline addresses:
       1) the reliability of fair values when observable market prices are not available thereby decreasing the potential need for separate reporting of financial results for regulatory purposes; and,
       2) the need for a documented risk management strategy as a prerequisite to using the FVO.
     - The Fair Value Option Guideline communicates OSFI’s expectation that use of the FVO should meet the supervisory expectations set out in Principles 1-4 of the BCBS Supervisory guidance on the use of the fair value option for financial instruments.
     - The Guideline further stipulates OSFI`s intent to follow BCBS principles 5-7 in the assessment of risk management, controls and capital adequacy related to the use of the FVO.

*Source: _cr1471 - Section 628 of the Bank Act specifies that a bank shall provide the Superintendent with such*

### Section 8.8 of OSFI’s CAR A-1 Guideline requires banks to have documented policies and

### _cr1471 - Section 8.8 of OSFI’s CAR A-1 Guideline requires banks to have documented policies and

### Valuation policies and model governance (OSFI CAR A-1 Guideline)
- Section 8.8 requires banks to have documented policies and procedures for the process of valuation that include:
  - a clear definition of roles and responsibilities,
  - sources of market prices,
  - frequency of independent valuation,
  - procedures for any necessary valuation adjustments.
- OSFI examines such policies and procedures and will make checks when on site.
- Where models are relied upon for valuations, additional requirements apply:
  - Sections 8.11.2 and 8.11.8 of the Guideline and the Implementation Note - Approval of Regulatory Capital Models for Deposit-Taking Institutions (2009) require a bank to have an independent unit responsible for initial and ongoing validation of all internal models, including valuation models.
- When marking to model or using third-party valuations, procedures must be in place to consider valuation adjustments. OSFI expects the following adjustments/reserves to be formally considered at a minimum:
  - unearned credit spreads (i.e., credit valuation adjustments),
  - close-out costs,
  - operational risks,
  - early termination,
  - investing and funding costs,
  - future administrative costs,
  - and, where appropriate, model risk.
- For regulatory capital purposes, valuation adjustments must also be considered for less liquid positions.

### Reliance on external work and auditors
- OSFI’s risk-based Supervisory Framework supports use of the work of others to reduce supervisory scope, minimize duplication, and enhance efficiency and effectiveness.
- This includes reliance on the work of External Auditors with respect to the fairness of audited financial statements which include fair value estimates prepared in accordance with IFRSs.
- OSFI communicates its intent to rely on the opinion of the appointed auditor each year through OSFI’s reliance letter.
- Use of external experts:
  - It is unusual for the Superintendent to appoint a person to access bank information and carry out supervisory work; external experts are typically engaged in unusual or difficult situations (e.g., forensic work).
  - External parties are commonly used to review and assess bank operations when recommended by OSFI; OSFI sets expectations (scope, competencies) and receives copies of reports.
  - OSFI may conduct in camera sessions with selected external consultants to check for conflicts of interest and to review terms of reference and credentials.
  - Progress reports and meetings are regular parts of engagement letters; material shortcomings must be brought to OSFI’s attention promptly.
- Section 328 of the Bank Act requires the auditor of a bank to report in writing to the CEO and CFO any transactions or conditions affecting the well-being of the bank that are not satisfactory; the auditor must provide the Superintendent with a copy of this report.

### Supervisory information collection and frequency (EC4, EC5)
- Key supervisory information is collected at least quarterly and includes:
  - on- and off-balance sheet assets and liabilities,
  - profit and loss,
  - capital adequacy,
  - liquidity,
  - risk concentrations,
  - asset quality,
  - loan loss provisioning,
  - interest rate risk,
  - and market risk.
- OSFI requires significant management information from banks, particularly systemic firms.
- In more stressful situations the frequency of collection is tailored to risk to avoid information decay; assessors saw evidence of enhanced monitoring during stressed periods.
- Regulatory data submission:
  - Submitted per definitions and timelines documented in the Financial Returns and Instructions available on OSFI’s web site.
  - Frequency can vary by calendar dates or banks’ fiscal time periods.
  - The six systemically important banks have the same year end dates; most other banks also share the same fiscal year-end dates.
- Quarterly interim financial (stock and flow) information is received, reviewed and analysed by OSFI supervisors; quarterly meetings are held with the Superintendent and Assistant Superintendent, Supervision Sector for the large conglomerate banks.

### Data systems, stewardship and governance (EC5, EC9, EC12)
- Regulatory return processing system: Tri-Agency Database System (TDS) — shared with FIC partners (Bank of Canada and CDIC) and physically housed at the Bank of Canada.
- Data flows:
  - Data is transferred to OSFI and loaded into a data warehouse accessed by Supervisory and Regulatory Sectors using a Business Intelligence (BI) tool.
- Organizational roles:
  - Regulatory returns primarily maintained by the Regulatory Information Division under the FRFI Data Management Division.
  - IM/IT supports technical requirements (databases and data warehouses).
  - Defined “Information Steward” roles within Supervision and Regulation Sectors provide data-specific subject matter expertise.
  - Executive-level resources (Director and up) provide input into and guidance on data governance.
- Validation and verification:
  - FRFI Data Management Division has validation rules within the TDS application to check regulatory return data prior to acceptance and loading; validation rules are posted to the Automated Data Transfer (ADT) site (restricted access).
  - Validation rules include cross-return checks; there are additional validation routines in the OSFI Business Intelligence data warehouse.
  - Relationship Managers (RMs) and Regulatory Information Division personnel periodically check and verify supervisory returns; verification is risk-based and commensurate with systemic importance.
  - OSFI expects accuracy of financial reporting to be addressed through management and financial controls including internal and external audit.
- Data governance processes:
  - Financial Information Committee (FIC) reviews scope and utility of data; meets quarterly; chaired by the OSFI Director of Data Management.
  - “Housekeeping”: annual review of regulatory returns coordinated by FIC to ensure only data relevant to business need is collected and to avoid duplication; Canadian Banker’s Association consulted.
  - A Financial Information Management Policy was written in 2010-2011; centralized Director, Data Management role created.
  - Supervision Sector Data Governance Committee provides ongoing challenge and assessment of Supervision data needs.
  - FRFI Data Management Division manages the housekeeping process and plans to further enhance data quality beginning in 2014.

### Legal powers to access information and records (EC6, EC7)
- OSFI’s information access powers are specified in Bank Act sections 628 and 643 and apply on a consolidated basis across geographies, product lines, legal entities, outsourced operations, and global assets.
- The information power extends to parent entities when material to the condition of the bank or banking group.
- Section 187 of the Bank Act permits the Superintendent, by written notice, to require a bank to hold a meeting of directors to consider matters set out in the notice; the Superintendent may attend and be heard at such a meeting.
- Assessors confirmed that OSFI is ready to request information, records, and access to firms as an expected and frequent component of the supervisory relationship.

### Enforcement, timeliness and penalties for returns (EC8)
- OSFI enforces compliance with regulatory return schedules using the Late and Erroneous Filing Penalties (LEFP) Framework, based on authorities under sections 24 through 37 of the OSFI Act and the Administrative Monetary Penalties (OSFI) Regulations.
- The Superintendent has authority to impose penalties for violations set forth in the Regulations.
- Section 5 of the Regulations sets out the monetary penalties applicable to minor violations covered by the LEFP Framework.
- Under the Regulations, banks are assessed penalties for each day a bank has not submitted an error free return after the due date.
- Penalty process:
  - OSFI provides a Notice of Violation setting out late and/or erroneous filings recorded in that quarter.
  - If the bank disputes the charge it can file a request for an administrative review; if none is received, an invoice is issued 40 days after the date of the Notice of Violation.
  - Penalties are tiered according to a bank’s total assets as at December 31 of the year preceding the date of the Notice.
  - Penalties are per diem charges of $100, $250, or $500, depending upon bank size, as prescribed by the Regulations.
  - Penalties are calculated from the due date to the date OSFI receives an error-free return.
- Every bank can run OSFI’s validation rules against the information reported in its financial returns.
- In setting due dates for regulatory returns, OSFI considers timeliness of the data in consultation with industry associations and FIC partners.

### Verification, use of external experts and reporting (EC9–EC11)
- Verification programme:
  - Validation rules and data steward oversight are used to determine validity and integrity of supervisory information.
  - Periodic verification is performed by RMs and Regulatory Information Division staff; the extent is risk-based.
- External experts:
  - OSFI defines and documents roles and responsibilities, scope, assesses suitability, and considers conflicts of interest when external experts are used.
  - OSFI provides input on competencies and scope for independent consultant reviews and may raise objections to candidate selections.
  - Opening, progress, and closing in camera sessions may be used to ensure no conflicts and to discuss results.
  - OSFI internally assesses the quality of external reviews and may discuss concerns with consultants and banks.
- Reporting obligations:
  - External experts are required to promptly bring material shortcomings to OSFI’s attention during supervisory engagements.
  - Auditors must report under Section 328 to CEO and CFO and provide a copy to the Superintendent of adverse matters affecting the bank’s well-being.

### Supervisory corrective and sanctioning framework (Principle 11, EC1)
- Statutory mandate:
  - Section 4 of the OSFI Act requires OSFI to promptly advise management and board where the institution is not in sound financial condition or not complying with governing statute and to take or require corrective measures.
  - Section 4 also requires promotion of policies and procedures to manage and control risk.
- Supervisory process:
  - OSFI issues a Supervisory Letter within 45 calendar days of completion of supervisory work; a response is required within 30 calendar days of the letter.
  - Supervisory Letters for Canadian-incorporated banks are addressed to the CEO and copied to the Chair of the Audit Committee (and Risk Committee where applicable).
  - For foreign bank subsidiaries and branches, remedial actions may also be discussed with parent company CEO/Chair or branch home office CEO/Chair.
  - OSFI analyzes and follows up on bank responses until issues are resolved; material long-term issues may require quarterly progress reports.
- Guide to Intervention and staging:
  - OSFI’s Guide to Intervention sets out “stages” from early action to potential “taking control” and applying for winding up.
  - Stage 1 notification requires the institution to take measures; OSFI may meet with management, board (or committee), and external auditor.
  - During staging OSFI increases frequency and intensity of monitoring, may conduct enhanced reviews, transfer responsibility to Enhanced Assessment Team, establish on-going presence at the bank, and direct external specialists (at the bank’s expense).
  - An item cannot be removed from OSFI’s tracking report until OSFI has satisfied itself—usually by revisiting the institution—that changes have been made and are delivering the expected outcome.
  - The process of exiting from “staging” is lengthy and can be expected to last more than a year.

### Assessment conclusions and recommendations (Principle 10 and general)
- Assessment for Principle 10: Compliant.
- Observations and suggested focus areas:
  - OSFI receives a wealth of information from supervised banks and has a standard suite of prudential returns, though some gaps remain (large exposures and related party lending referenced elsewhere).
  - OSFI places considerable emphasis on management information; management/ad hoc data is less standardized and may be less amenable to peer group analysis.
  - OSFI has conducted on-site investigations of data processes and controls for key metrics (notably capital data).
  - Recommendation: greater emphasis on determining ongoing supervisory data needs and incorporating them into standardized returns, particularly given increased focus on recovery and resolution planning and attention to individual legal entities.

*Source: _cr1471 - Section 8.8 of OSFI’s CAR A-1 Guideline requires banks to have documented policies and*

### section 4 also provides that OSFI’s is to strive to protect the interests of depositors.

### _cr1471 - section 4 also provides that OSFI’s is to strive to protect the interests of depositors.

### OSFI’s statutory and administrative supervisory tools
- OSFI’s obligation under section 4 of the OSFI Act to “strive to protect the interests of depositors” is supported by a broad range of discretionary tools in the Bank Act and by administrative tools described in the Supervisory Framework and Guide to Intervention.
- Supervisory outputs used to measure and communicate safety and soundness:
  - Composite Risk Rating (footnote 18): an assessment of an institution’s risk profile after considering the risk inherent in significant activities, the quality of risk management, and earnings, capital and liquidity.
  - Stage Rating.
- Examples of statutory tools (with exact Bank Act references preserved):
  - Examination and Access to Books and Records — section 643.
  - Request Information — section 628.
  - Request Information from Parents and Affiliates — section 635.
  - Order regarding Security Interests — section 419.
  - Limit on Assets — section 54.1 (recommendation to Minister).
  - Designation of Related Parties — section 486.
  - Repatriate Management Functions — section 495.
  - Revoke Auditor’s Appointment — section 317.
  - Require Board Meeting — section 187 (Superintendent may attend and be heard).
  - Veto over Appointment of a Director or Senior Officer of a “problem” bank — section 647.
  - Removal of Director or Senior Officer — section 647.1.
  - Valuation of Assets — section 485.
  - Expand Audits and Special Audits — section 325.
  - Deny Approvals — section 973.01.
  - Revoke, Suspend, or Amend an Approval — section 973.03.
  - Non-compliance with Term, Condition, or an Undertaking Related to an Approval — section 973.04.
  - Taking Control — section 648 (subject to Ministerial override in cases of public interest).
  - Request a Winding-up Order — section 651 (after taking control).
- Additional court remedies and sanctions:
  - Sections 646 and 989: power to apply to a court for orders to cease contraventions or comply with Directions of Compliance or Prudential Agreements.
  - Non-compliance with the Bank Act may be a criminal offence; civil monetary penalties may be imposed under the Administrative Monetary Penalties (OSFI) Regulations.
- Operational practice note:
  - OSFI has not yet used its formal power to remove a director; indicating willingness to use such powers has sometimes produced compliance. OSFI prefers not to use legal powers as a first resort.

### Powers to act where prudential thresholds are breached (EC3)
- Legal scope:
  - The Superintendent may act where a bank exceeds or falls below prudential thresholds regardless of how the threshold is established (legislation, regulations, or administrative guidelines).
- Specific remedial tools to ensure thresholds are met:
  - Direction of Compliance — section 645.
  - Prudential Agreement — section 644.1.
  - Limitations/Conditions on Order to Commence and Carry on Business — sections 53 and 54.
  - Capital / Liquidity Order — subsection 485(3).
  - Divestment Order — section 480.
  - Undertaking Approvals — section 973.02 (Minister and Superintendent may impose terms/conditions/undertakings).
  - Undertaking Investments — section 470.
  - Restructuring or Bridge Institution — sections 39.1 through 39.3723 of the Canada Deposit Insurance Corporation Act (CDIC Act); Superintendent’s determination of non-viability is a prerequisite trigger for restructuring or bridge institution by CDIC.
- Enforcement and penalties:
  - Sections 646 and 989 (court orders) reiterated.
  - Administrative monetary penalties may be imposed for non-compliance with prudential requirements under the Administrative Monetary Penalties (OSFI) Regulations.
- Mandate for early intervention:
  - Subsection 4(2) of the OSFI Act requires prompt advice to management and the board if an institution is not in sound financial condition or not complying with statute/supervisory requirements, and to take or require corrective measures expeditiously.
  - Banks interviewed were conscious of OSFI’s mandate for “early intervention” and considered that OSFI acted on it.
- Examples of supervisory actions used to ensure compliance with prudential thresholds:
  - Supervisory Letters that stage the institution, articulate grounds for concern, and outline required actions (e.g., additional capital above regulatory target levels; plans to reduce specific portfolios; alternative business strategies; strengthen risk management).
  - Preventing repatriation of capital (e.g., dividends) until issues are addressed.
- Judicial review:
  - OSFI decisions can be challenged by judicial review on whether OSFI acted within its legal authority (the correctness of execution), not on the prudential judgment itself.

### Range of early-stage measures and escalation (EC4)
- EC4 lists types of measures available; OSFI applies measures according to the gravity of the situation, guided by the Supervisory Framework and Guide to Intervention.
- Measures and corresponding legal bases (exact citations preserved):
  - Restricting the current activities of the bank:
    - Vary Order to Commence and Carry on Business — section 54.
    - Issue a Direction of Compliance — section 645.
    - Require an Undertaking related to an approval — section 973.02 or an investment — section 470.
    - Enter into a Prudential Agreement — section 644.1.
  - Imposing more stringent prudential limits and requirements:
    - Capital/Liquidity Order — section 485.
    - Direction of Compliance — section 645.
    - Undertakings related to approvals/investments — sections 973.02 and 470.
    - Prudential Agreement — section 644.1.
    - Limit on assets held by a bank — section 54.1.
  - Withholding approval of new activities or acquisitions:
    - Amending bank’s license requiring approval — section 54.
    - Unsafe or unsound practice — section 645.
    - Deny approval of acquisitions constituting substantial investments — section 468.
    - Deny approval for asset transactions > 10 percent of bank’s total assets — section 482.
  - Restricting or suspending payments to shareholders or share repurchases:
    - Capital Order — subsections 79(4) and 485(4).
    - Direction of Compliance — section 645.
  - Restricting asset transfers:
    - Deny approval for transfers > 10 percent of total assets — section 482.
    - Direction of Compliance — section 645.
    - Prudential Agreement — section 644.1.
    - Undertakings related to approvals or investments — sections 973.02 and 470.
  - Barring individuals from the banking sector:
    - Remove director or senior officer if not qualified — section 647.1.
    - Veto appointment of director or senior officer of a “problem” bank if not qualified — section 647.
  - Replacing or restricting powers of managers, Board members or controlling owners:
    - Use of statutory tools (Directions of Compliance, Orders, Undertakings, Prudential Agreements) may require or prevent actions normally taken by managers/board/owners.
    - Revoke, suspend, or amend approvals — section 973.03 (may constrain owners if related to significant interest/control).
    - Taking control of the bank — section 649 suspends directors’ and officers’ powers; Superintendent assumes those powers.
    - Restrictions on shareholder voting rights and disposal orders for contraventions related to acquiring significant interest, control, or limits on shareholdings — section 392 and section 402 (Minister may order disposal in public interest).
  - Facilitating takeover or merger by a healthier institution:
    - Superintendent may encourage failing bank to seek a substitute bank (typically stage 3 or 4).
    - If Superintendent takes control under section 648, section 649 mandates managing the business to “protect the rights and interests of the depositors,” which may include transfer of obligations to a healthier institution.
    - CDIC powers under sections 39.1 through 39.3723 of the CDIC Act to restructure or transfer business to a bridge institution to preserve critical functions and maintain financial stability.
  - Providing for interim management of the bank:
    - (Measures and legal bases outlined above may be used to provide interim management arrangements.)

*Source: _cr1471 - section 4 also provides that OSFI’s is to strive to protect the interests of depositors. — https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr1471.pdf*

### Section 649 provides that:

### _cr1471 - Section 649 provides that:

### Section 649 powers and immediate supervisory actions
- Where the Superintendent takes control of the bank itself, the powers, duties, functions, rights, and privileges of directors and officers are suspended.
- The Superintendent assumes those powers, duties, functions, rights, and privileges of the directors and officers, and is now responsible for managing the business and affairs of the company.
- The Superintendent may elect to appoint one or more persons to assist in the management of the company.

### Revoking the banking licence
- Pursuant to section 54, the Superintendent may revoke a bank’s Order to Commence and Carry on Business (i.e., a bank’s license).

### EC5 — Sanctions applied to banks and individuals: description and findings
- Section 980: every person who, without reasonable cause, contravenes any provision of the Act or the regulations is guilty of an offence.
- Such contraventions may be subject to punishment under section 985 of the Act, which can include monetary fines and/or imprisonment.
- The term “person” refers to both natural persons and legal entities; criminal sanctions may be applied to the bank, the Board, management or individuals therein.
- Sections 647 and 647.1: Superintendent may disqualify or remove senior officers and directors; in finding a person unsuitable the Superintendent may consider competence, business record, experience, conduct or character, and whether the person has contravened or, by action or negligence, has contributed to the contravention of the Bank Act, a direction, an order, or term or condition.
- OSFI’s Guideline on Background Checks on Directors and Senior Management of Federally Regulated Entities: published “fit and proper” standards for directors and senior management; banks expected to adopt and apply these standards when establishing policies and procedures regarding the conduct of responsible persons.
- Administrative Monetary Penalties (OSFI) Regulations: Superintendent may impose civil monetary penalties on a bank for statutory violations such as failure to seek necessary transaction approvals; comply with terms and conditions, directions of compliance, orders, or prudential agreements.
- There are no examples of OSFI having needed to proceed to formal exercise of its power (see EC 2).

### EC6 — Ring-fencing powers: description and findings
- OSFI definition: “ring-fencing” as the concurrent or sequential application of supervisory powers, tools, and measures to address perceived contagion risks to the bank from actions/activities of others in the corporate structure.
- Ring-fencing typically preceded by staging of the bank (per Supervisory Framework and Guide to Intervention); measures intensify as concerns escalate.
- Typical measures used to support ring-fencing:
  - enhancing supervisory reporting requirements;
  - targeting information requests at parent and/or affiliates and/or more frequent meetings with management of the bank and/or parent;
  - monitoring of press reports, financial statements and other publicly available information on the parent and affiliates;
  - monitoring of related party transactions;
  - monitoring of dividend payments by the bank (if OSFI has not already recommended that they be suspended);
  - designating a person as a related-party;
  - increasing capital requirements for the bank and other federally regulated financial institutions in the group and/or securing capital commitments from upstream entities;
  - entering into Prudential Agreements or issuing Directions of Compliance to require the bank to take certain actions to further isolate it from affiliates;
  - securing an Undertaking from a controlling entity in connection with a bank-related approval or use of an existing Undertaking from a controlling entity as well as moral suasion to compel corrective or preventative action;
  - issuing a Divestment Order;
  - if a bank’s viability is at risk, taking control of the bank.
- Use of undertakings: frequently placed on a new entrant to the banking system; assessors’ review of files confirmed this fact.

### EC7 — Cooperation on orderly resolution: description and findings
- OSFI would coordinate and collaborate with relevant domestic and, where applicable, international authorities in deciding when and how to effect the orderly resolution of a problem bank.
- Domestic forum: Financial Institutions Supervisory Committee (FISC) — legislated federal-level forum to facilitate consultations and exchange of information among members on matters relating directly to supervision of institutions; role includes discussing confidential prudential concerns with problem institutions and considering when and how to effect orderly resolution.
- Staging and trigger for resolution:
  - OSFI’s Guide to Intervention stages involvement; Stage 4: Non-viability/Insolvency Imminent indicates severe financial difficulties where:
    - the bank failed to meet regulatory capital requirements in conjunction with an inability to rectify the situation on an immediate basis;
    - the statutory conditions for taking control will have been met; and/or
    - the bank failed to develop and implement an acceptable business plan, resulting in either of the two preceding circumstances becoming inevitable within a short period of time.
- Sections 648 to 656: grant the Superintendent authority to determine when and how to trigger orderly resolution of a problem bank.
- Subsection 648(1.1) circumstances allowing Superintendent to take control include:
  - the bank has failed to pay its liabilities or, in the opinion of the Superintendent, will not be able to pay its liabilities as they become due and payable;
  - the assets of the bank are not, in the opinion of the Superintendent, sufficient to give adequate protection to the bank’s depositors and creditors;
  - any asset appearing on the books or records of the bank or held under its administration is not, in the opinion of the Superintendent, satisfactorily accounted for;
  - the regulatory capital of the bank has, in the opinion of the Superintendent, reached a level or is eroding in a manner that may detrimentally affect its depositors or creditors;
  - the bank has failed to comply with an order to increase its capital;
  - the bank’s deposit insurance has been terminated by CDIC;
  - in the opinion of the Superintendent, any or other state of affairs exists in respect of the bank that may be materially prejudicial to the interests of the bank’s depositors or creditors or the owners of any assets under the bank’s administration, including where proceedings under a law relating to bankruptcy or insolvency have been commenced in Canada or elsewhere in respect of the holding body corporate of the bank.
- Ministerial override: under section 648(1)(b) the Minister may prevent supervisory intervention if deemed necessary in the public interest.
- When taking control the Superintendent may:
  - assume temporary control of the assets of the bank and the assets under its administration;
  - take control of bank’s assets, or taking control of the bank; or
  - take control of the bank’s assets, or taking control of the and request that the Attorney General of Canada apply for a Winding-up Order under the Winding-up and Restructuring Act.
- Prudential determination of “non-viability” is prerequisite trigger for CDIC to restructure a financial institution or establish a bridge bank; such determination preceded by discussions at FISC and staging.
- Resolution planning and recovery plans:
  - Canada’s large banks are required to prepare recovery plans based on OSFI’s direction and guidance (with input from FISC members).
  - OSFI provides banks’ plans to CDIC for resolution planning.
  - The major banks are entering their third or fourth iteration of recovery plans though resolution plans are still first generation.
  - There are plans to extend recovery and resolution planning to the smaller institutions later in 2013.
- International cooperation: OSFI has Memoranda of Understanding with over 30 foreign supervisory authorities and routinely exchanges information with foreign home and host regulators.
- Experience: OSFI has not had any experience in the resolution of a bank since OSFI was established in 1987.

### Additional criteria — AC1 and AC2: description and findings
- AC1: OSFI’s statutory mandate (section 4 of the OSFI Act) requires that it promptly advise management and board if institution is not in sound financial condition or not complying with governing statute law or supervisory requirements, and to take or require necessary corrective measures in an expeditious manner.
- AC2: OSFI and the Bank Act grant discretionary authority to inform other domestic and foreign regulators of its actions and to coordinate actions when appropriate.
  - Section 22 of the OSFI Act and section 636 of the Bank Act: information obtained by OSFI is confidential and may only be used for lawful supervisory purposes, with permitted exceptions allowing sharing with other government agencies or bodies that regulate or supervise financial institutions for related purposes.
  - Subject to MOUs, OSFI may share information with domestic provincial insurance regulators and foreign regulators; information sharing may also occur in supervisory colleges or crisis management groups.

### Assessment of Principle 11 — corrective powers and staging: summary and recommendations
- Assessment: Compliant.
- Key observations:
  - OSFI has a wide range of corrective and sanctioning powers under the Bank Act (powers do not extend to AML/CTF issues governed by separate legislation noted under CP29).
  - OSFI’s mandate requires early intervention; OSFI designed a structured approach for progressively more intensive supervisory intervention in collaboration with CDIC.
  - Staging process allows OSFI to intensify restrictions and requires chief executives to report staging to their boards; staging can be an effective discipline though may be less effective in smaller institutions.
  - Institutions may remain “staged” for extended periods due to time needed for remedial actions to take effect; OSFI has employed escalation where issues became too protracted.
- Recommendation:
  - OSFI should institute post facto reviews of staging cases in addition to interim reviews to identify how best to ensure appropriate momentum through the staging phase.
  - Authorities should consider whether further legal authority or powers are required to enable more prompt action to address banks whose business model is non-viable over a period of time, given OSFI lacks power to insist on market exit if prudential thresholds are met and depositors are not at immediate risk.

### Principle 12 — Consolidated supervision: EC1, EC2, EC3 (description and findings)
- EC1:
  - OSFI has broad powers under the Bank Act to supervise significant Canadian banking groups on a consolidated basis when a regulated bank or regulated bank holding company is the ultimate parent.
  - Consolidated assessment includes all of a bank’s material domestic and foreign entities and activities.
  - OSFI identifies a bank’s “significant activities” (a line of business, unit or process fundamental to the bank’s business model) and plans supervisory work at the significant activity level.
  - Supervisory assessment: understand nature of activity, identify key inherent risks, determine quality of risk management.
  - OSFI maintains up-to-date records of group structure (annex to the risk assessment document) and pays particular attention to significant subsidiaries.
  - Recovery and resolution planning has catalyzed more investigation and supervisory follow up.
  - OSFI has acted when risks emerged in non-domestic jurisdictions and has conducted cross-sectoral examinations into banks’ handling of reputation and contagion risk.
- EC2:
  - OSFI imposes prudential standards on a consolidated basis and receives and analyzes consolidated, audited financial statements to assess overall financial performance.
  - Supervisory analysis also considers financial performance by significant activity, domestic or cross-border.
  - Superintendent powers to obtain information and review overall activities of a banking group, both domestic and cross-border:
    - Section 643: power to examine business and affairs of a bank and access any books or records necessary for this purpose;
    - Section 628: requires a bank to provide the Superintendent with such information, at such times and in such forms the Superintendent may require;
    - Section 470: requires a bank, as requested by the Superintendent, to provide Undertakings to provide access to records of controlled domestic and foreign subsidiaries and authorizes Superintendent to enter into agreements with foreign regulators in that regard.
- EC3:
  - Supervisory work (on and off site) is conducted using the Superintendent’s powers outlined in (content ends).

*Source: _cr1471 - Section 649 provides that:*

### Part XIII of the Bank Act.  In particular, examination powers are defined in sections 643 and 644.

### _cr1471 - Part XIII of the Bank Act.  In particular, examination powers are defined in sections 643 and 644.

### Supervisory framework and consolidated supervision
- Supervision of Canadian banks is conducted on a consolidated basis in accordance with OSFI’s Supervisory Framework, assessing all of a bank’s material domestic and foreign entities and activities.
- OSFI identifies material host jurisdictions as part of identifying significant activities within a banking group.
- OSFI assesses the quality of operational management and independent oversight for all significant activities, including cross-border or foreign operations.
- Assessment of operational management of a cross-border or foreign operation includes determining that it has the necessary expertise and capabilities to manage the operation in a safe and sound manner and in compliance with Canadian regulatory and supervisory requirements.
- Bank management must follow OSFI’s governance expectations as set out in OSFI’s Corporate Governance Guideline.
- OSFI regularly liaises with domestic and foreign counterparts as part of ongoing monitoring and conducts on-site work in other countries as deemed necessary.
- OSFI has established Memoranda of Understanding with a large number of foreign supervisors to provide a framework for cooperation and information sharing; these facilitate OSFI receiving information on Canadian banks’ operations outside Canada and allow OSFI, as host regulator, to share confidential information about foreign banks’ cross-border establishments in Canada.
- Although OSFI does not have explicit criteria or processes for assessing the quality of supervision in a host country, such assessments are undertaken when a bank’s activities extend to an unfamiliar jurisdiction. In countries with material operations, OSFI will periodically meet the host regulator in their offices to determine standards of practice and review documentation and findings related to the bank’s local operations.

### EC4 — On-site reviews and interaction with host supervisors
- The home supervisor visits foreign offices periodically; location and frequency are determined by the risk profile and systemic importance of the foreign operation.
- The supervisor meets host supervisors during visits and has a policy for assessing the need for on-site examinations or additional reporting, and has the power and resources to take those steps.
- Frequency and scope of on-site reviews of foreign locations are based on the bank’s risk profile and reviewed at a minimum during the annual planning of supervisory strategy.
- Supervisory work (on and off site) is conducted using the Superintendent’s powers outlined in Part XIII of the Bank Act; examination powers are defined in sections 643 and 644.
- OSFI develops an annual supervisory strategy and plan for the banking group, including foreign operations, and adjusts it throughout the year as needed. Planned supervisory work for each significant activity considers:
  - the net risk assessment of the activity;
  - the need to update OSFI’s information on the activity;
  - the importance of the activity to the bank’s overall risk profile.
- Supervisory work may range from basic monitoring, to limited off-site reviews, to extensive on-site reviews.
- On-site reviews of material foreign operations take place periodically; OSFI would normally plan to meet the host country supervisor during these reviews to discuss the bank’s foreign operation and review the host country supervisor’s documentation.
- Contact with the host country supervisor is maintained between visits as necessary.
- On an annual basis, OSFI typically performs one to three major cross border onsite inspections in respect of its conglomerate deposit taking institutions. The number of reviews is determined in accordance with OSFI’s risk-based approach.
- Relationship management teams hold quarterly teleconference calls with key host supervisors to share views, opinions and concerns.

### EC5 — Review of parent and affiliated companies
- OSFI has powers to obtain information and therefore review the parent entity and related affiliates of some but not all banks.
- OSFI’s powers cover systemically important banks; for smaller banks for which private ownership is permitted (i.e., there is no regulated bank holding company in place), OSFI does not have the power to review the activities of a bank’s parent company and companies affiliated with the parent company on an on-going basis.
- By virtue of section 635 of the Bank Act, OSFI has the power to direct a controller or affiliate of the bank to provide information that OSFI might need.
- At the licensing phase, OSFI assesses its future information needs and, if necessary, puts in place information undertakings to ensure the supervisability of the entity within its corporate structure.
- OSFI’s regulatory and supervisory frameworks apply to the federally regulated financial institution (the bank) and, through consolidated supervision, its subsidiaries. OSFI’s ability to review unregulated entities and assess their impact on the bank is limited to information that:
  - (a) is publicly available;
  - (b) can be leveraged through consideration of transactions (e.g., at incorporation or acquisitions of significant interest);
  - (c) might be gathered pursuant to a Letter of Undertaking with a controlling parent where arranged with OSFI.
- Summarized parent company information and assessment is included in the Risk Assessment Document for the bank.
- Assessors noted supervisory scoping of an onsite review where OSFI had identified significant concerns about risk to the bank stemming from some of the parent’s activities.

### EC6 — Powers to limit activities and locations
- OSFI has powers to limit the range of activities and locations of the consolidated group.
- The Bank Act provides the Superintendent with extensive remedial powers to impose regulatory limits on the activities of a bank or banking group, including powers to:
  - issue a Direction of Compliance;
  - issue a divestment order;
  - restrict the bank’s activities;
  each of which can target the bank’s foreign operations.
- Relevant statutory references include sections 644.1 to 656 for domestic and subsidiary banks, and sections 614.1 to 627 for authorized foreign banks.
- Information gathering powers rest particularly in sections 628 and 643 of the Bank Act.

*Source: _cr1471 - Part XIII of the Bank Act.  In particular, examination powers are defined in sections 643 and 644.*

### section 470 requires a bank to enter into Undertakings as required by the Superintendent to

### _cr1471 - section 470 requires a bank to enter into Undertakings as required by the Superintendent to

### Section 470 and OSFI’s cross-border supervisory powers
- Section 470 requires a bank to enter into Undertakings as required by the Superintendent to provide access to records of controlled domestic and foreign subsidiaries and authorizes the Superintendent to enter into agreements with foreign regulators.
- OSFI may require a higher standard of controls and oversight by a bank when it is not comfortable with the supervisory regime in a foreign jurisdiction.
- OSFI has conducted reviews on foreign group entities and works in partnership with local supervisors; it focuses on how the bank manages systems and raises the bank’s own management oversight standards, including engagement with head office on group governance and oversight.

### EC7 — Supervising individual banks within a group (Description and findings)
- OSFI supervises individual banks within a group either alone or with host supervisors and seeks to understand interrelationships among group members.
- For major banks where the corporate structure is headed by the bank itself, OSFI obtains solo data in addition to consolidated data.
- Major banking subsidiaries are identified and OSFI applies the Basel framework by applying supervision at lower levels to all internationally active banks on a consolidated basis.
- OSFI does not routinely obtain solo information for every individual bank within a group.
- Primary supervisory processes provide intra-group transaction information: liquidity reporting by currency and major entity, capital reporting and solo capital reporting and analysis, Crisis Management submissions and discussion of material individual transactions.
- Host supervisors often examine flows between local branches and subsidiaries and discuss these with Canada as home supervisor.

### AC1 — Fit and proper standards for owners and senior management of parent companies (Description and findings)
- Any person seeking a significant interest in/control of a bank must receive approval from the Minister (sections 27 and 396 of the Bank Act).
- The Minister considers business record, experience, character and integrity among other considerations.
- OSFI’s recommendation on acquisition of significant interest/control considers legislative factors and uses the Instruction Guide for Incorporating Banks and Transaction Instruction A No. 23 for information requirements.
- OSFI requires disclosure of criminal proceedings or administrative sanctions for persons with significant interest/control.
- For corporate entities seeking significant interest/control, OSFI engages the Canadian Security Intelligence Service (CSIS) for a security assessment.
- For individual applicants, OSFI obtains curriculum vitae and a completed OSFI Security Information Form so that RCMP and CSIS can conduct security assessments.

### Assessment and recommendations related to Principle 12 (consolidated and solo supervision)
- Assessment: Compliant.
- Findings:
  - OSFI has a strong legal and regulatory framework for consolidated supervision and applies it consistently.
  - OSFI requires solo entity information on the parent banks for the systemic banking groups in Canada, going beyond the Basel framework.
  - Generally, OSFI places less emphasis on individual banks within groups, structuring work around “significant activity”.
  - Recovery and resolution planning has required greater legal-entity scrutiny and highlighted issues needing prudential assessment.
- Recommendations:
  - OSFI is recommended to receive solo data for all regulated banks within banking groups, irrespective of whether the parent entity is a bank.
  - OSFI is recommended to look more closely and systematically at intra-group exposures, perhaps by introducing new prudential returns (as part of the review suggested in CP10).
  - Given the D-SIB designation of the six systemic banks, OSFI is recommended to consider non-domestic entities and whether its cycle of visits is sufficient, possibly increasing frequency of attention to remote parts of groups.
  - For smaller banks owned by commercial parent companies, it is recommended that OSFI always make parental data access and notification of material parental business and governance changes a condition of licensing and emphasize this in the Guidelines for Incorporation.

### Principle 13 — Home-host relationships (assessment and key EC findings)
- Assessment: Compliant.
- EC1 (supervisory colleges):
  - OSFI has established bank-specific colleges for all internationally active banks, inviting material host supervisors and tailoring college structure (Crisis Management Panels, Core Colleges, Universal Colleges, Regional Colleges, AML Colleges).
  - Colleges have produced papers and follow-up actions; OSFI noted exchanges have become richer over time.
- EC2 (information sharing):
  - OSFI has entered into formal MoUs with over 30 foreign supervisory authorities covering material risks, risk management practices and supervisors’ assessments.
  - OSFI conducts regular (usually quarterly) telephone conferences with foreign regulators and maintains Relationship Managers for ongoing contact.
  - Host regulators often conduct yearly visits to Canada.
- EC3 (coordination of supervisory activities):
  - OSFI coordinates and plans supervisory activities with host supervisors, consulting them prior to on-site reviews and performing joint on-site reviews where appropriate.
- EC4 (communication strategy):
  - OSFI develops agreed communication strategies with host supervisors prior to and after reviews, tailored to risk profile and cross-border operations; banks reported consistent and well-articulated supervisory positions.
- EC5 (cross-border crisis cooperation):
  - OSFI Act enables OSFI to collaborate and share information with foreign supervisory and resolution counterparts.
  - OSFI, with CDIC, established bank-specific Crisis Management Panels and has participated in formalizing cross-border collaboration agreements consistent with FSB expectations for G-SIBs.
  - Domestic coordination occurs through the Financial Institutions Supervisory Committee (FISC) chaired by the Superintendent; OSFI/CDIC Strategic Alliance Agreement and Guide to Intervention coordinate recovery and resolution roles.
- EC6 (group resolution plans):
  - CDIC is responsible for resolution plans; OSFI responsible for recovery plans.
  - CDIC, with OSFI and FISC partners, developed first generation resolution plans for the big six banks in December 2012.
  - Large banks’ third (and in some instances fourth) iteration of recovery plans were received in Q1 2013; an iteration prepared in accordance with OSFI directions is due in March 2013.
  - CDIC obtained legislative authority to share member institution-specific information with relevant foreign authorities subject to Superintendent and CDIC board agreement; CDIC is working with the FDIC to develop a resolution-focused MOU.
  - OSFI is working on an addendum to its MoU with the FDIC addressing recovery planning; paragraph 22(2)(a) of the OSFI Act permits OSFI to share information with the FDIC when they act as a resolution authority.
- EC7 (prudential treatment of foreign operations):
  - The Bank Act covers domestic and foreign banks in Canada; foreign subsidiaries and branches are subject to prudential oversight, on-site inspections and regulatory reporting, though branches (not separate legal entities) differ in governance and are not required to maintain a Canadian board.
  - Branches must name a principal officer (s.536 BA) accountable for operations; OSFI can remove principal officers (s.617.2 BA).
  - Branches use Capital Equivalency Deposit in Canada instead of risk-based capital and undergo formal assessment of “Out of Canada Support” considering: Foreign Bank Support; Home Office Account; Home Country Supervision; Sovereign Risk; and a “Liquidation Perspective” assessment.
  - Branches are excluded from the CAR Guideline and many risk management expectations; branches are not permitted to take retail deposits (deposits under $150,000) (s.545 BA).
- EC8 (home supervisor access to local offices and subsidiaries):
  - Under section 643 of the Bank Act, OSFI may examine on-site and access bank records; OSFI notifies host regulator before on-site examinations via MoUs.
- EC9 (booking offices and shell banks):
  - Not applicable — no booking offices operate in Canada; OSFI does not permit shell banks.
- EC10 (consultation before consequential action):
  - OSFI will not act on information from another supervisor without consultation; assessors confirmed instances of such consultation.
- Comment and recommendation:
  - Home and host relationships function smoothly for significant overseas relationships. OSFI is encouraged to consider potential crisis needs of supervisors in jurisdictions where the Canadian company is material and anticipate these needs as far as possible.

### Key supervisory themes across corporate governance and risk management (Principles 14–16, 15 highlights)
- Principle 14 (Corporate governance): Assessment Compliant.
  - Legislative duties set out in Part VI of the Bank Act; OSFI’s Corporate Governance Guideline (revised 2013) covers board responsibilities, risk appetite, internal control framework, succession planning, CEO performance review and includes internal assessment criteria.
  - OSFI established a Corporate Governance Division in 2010 to provide technical expertise; supervisors regularly review board/committee packages and meet annually with full boards and semi-annually with committee chairs for large banks.
- Principle 15 (Risk management): Assessment Largely Compliant.
  - OSFI assesses quality of risk management using detailed criteria and specialist teams; supervisory reviews of significant activities assess mandate, organization, policies and performance.
  - OSFI has issued Stress Testing Guideline, ICAAP Guideline and other guidance; requires banks to embed stress testing into capital and liquidity management.
  - OSFI emphasizes risk culture and has conducted cross-system reviews (e.g., 2011–2012 stress testing assessments).
  - Recommendation: OSFI could provide a more comprehensive and consistent set of written guidance across all risk areas (credit risk, operational risk, problem asset management, concentrations and country risk) to clarify expectations.
- Principle 16 (Capital adequacy): Assessment Compliant.
  - OSFI’s CAR Guideline covers Basel II, 2.5 and III; Basel III capital requirements became effective 1 January 2013 and OSFI expects banks to meet fully phased-in capital ratios effective at the start of 2013.
  - OSFI expects all institutions to attain “all-in” target capital ratios of 8.5 percent for total tier 1 and 10.5 percent for total capital by the first quarter of 2014.
  - Assets to capital multiple (ACM) test: total assets must be no greater than 20 times capital, but may be exceeded to no greater than 23 times with Superintendent's prior approval; ACM is privately communicated and can be lower for higher-risk institutions.
  - OSFI has authority to require increased capital, impose higher capital requirements, impose higher regulatory capital ratios or lower ACM for particular institutions; supervisory action for breaches follows the OSFI Guide to Intervention.
  - OSFI applies both risk-based ratios and a leverage ratio (ACM) and has accelerated Basel III implementation; Canada announced a 1 percent D-SIB surcharge by 2016 for the six systemic banks.
  - Model approvals: OSFI has approved seven banks for internal market risk models and 10 banks for advanced credit risk models; one bank approved for AMA operational risk; internal models are subject to rigorous OSFI review and conditions; OSFI enforces transitional floors (generally 90%).
  - Recommendation: OSFI should seek a formal BCBS FAQ regarding permissibility of ‘purchase for cancellation’ under Basel III definition of capital rules.

### Supervisory findings and operational recommendations (selected, across sections)
- OSFI should receive solo data for all regulated banks within banking groups and systematically monitor intra-group exposures, potentially via new prudential returns (CP12/CP10 recommendation).
- OSFI should consider increasing frequency of supervisory visits and attention to non-domestic entities of D-SIBs given systemic nature.
- Make parental data access and notification of material parental business/governance changes a standard licensing condition for banks owned by commercial parent companies and highlight this in the Guidelines for Incorporation.
- Provide a more comprehensive, consistent suite of written guidance on risk management areas (credit risk, operational risk, problem asset management, concentrations, country risk) even if high-level or BCBS-based (Principle 15 recommendation).
- Seek formal BCBS clarification (FAQ) on the permissibility of ‘purchase for cancellation’ for capital instruments under Basel III (Principle 16 recommendation).
- Strengthen large exposure reporting/monitoring: consider regular regulatory reporting and notification of exposures greater than a specified level (for example, 10 percent of capital) and update the Large Exposure guidance (Principle 19 recommendation).

*Source: _cr1471 - section 470 requires a bank to enter into Undertakings as required by the Superintendent to (IMF PDF)*

### Section 486 of the Bank Act defines the term “related party” for the purposes of Part XI (self-

### _cr1471 - Section 486 of the Bank Act defines the term “related party” for the purposes of Part XI (self-

### Definition and scope of "related party"
- Section 486 of the Bank Act defines the term “related party” for the purposes of Part XI (self-dealing).
- The definition is tailored specifically to achieve the objective of identifying persons considered to be in positions of influence over the bank.
- The Bank Act provides that the parent or sister company of a bank is a related party of the bank.
- Directors and senior officers of the bank or the bank’s parent are related parties of the bank.
- Subsidiaries of the bank are not included in the definition of related parties.

### Supervisory discretion
- The Superintendent may designate a person a related party where they would not otherwise be considered to be related, thus providing discretion in the application of the self-dealing regime on a case-by-case basis where prudential concerns arise (subsection 486(3)).

### Transaction treatment and prudential requirement
- EC2
- Laws, regulations or the supervisor require that transactions with related parties are not undertaken on more favorable terms (e.g., in credit assessment, tenor, interest rates, fees, amortization schedules, requirement for collateral) than corresponding transactions with non-related counterparties.
- 46

*Source: _cr1471 - Section 486 of the Bank Act defines the term “related party” for the purposes of Part XI (self-*

### Part XI (self-dealing) of the Bank Act sets out the related party regime to which banks are subject.

### _cr1471 - Part XI (self-dealing) of the Bank Act sets out the related party regime to which banks are subject.

### Related parties and related party transactions (Principle 20 — EC1)
- Related parties include: the bank’s subsidiaries, affiliates, any party (including their subsidiaries, affiliates and special purpose entities) that the bank exerts control over or that exerts control over the bank, the bank’s major shareholders, Board members, senior management and key staff, their direct and related interests, and their close family members as well as corresponding persons in affiliated companies.
- Related party transactions include: on-balance sheet and off-balance sheet credit exposures and claims; service contracts; asset purchases and sales; construction contracts; lease agreements; derivative transactions; borrowings; write-offs.
- Transaction term interpretation: broadly interpreted to include situations where an unrelated party with an existing exposure subsequently becomes a related party.
- Exception noted: beneficial terms that are part of overall remuneration packages (e.g., staff receiving credit at favorable rates) may be appropriate.

### General prohibition, scope and explicit examples (findings re EC2)
- General premise: related party transactions are prohibited, subject to certain exceptions.
- Any type of contract, arrangement or undertaking, written or verbal, between a bank and a related party constitutes a transaction; examples include:
  - making a guarantee on behalf of a related party;
  - making an investment in any securities of a related party;
  - taking an assignment of, or otherwise acquiring, a loan made to, a related party;
  - taking a security interest in the securities of a related party.
- Exceptions are grouped into six categories:
  - immaterial or nominal transactions (OSFI’s Materiality Criteria for Related Party Transactions Guideline establishes criteria);
  - transactions that do not expose the bank to significant credit risks (e.g., cash settled transactions or transactions involving government secured assets or securities);
  - transactions for which an established market exists (conducted on terms and conditions comparable to similar transactions);
  - transactions in the company’s ordinary course of business;
  - transactions listed in the Related Party Transactions Regulations;
  - transactions requiring the approval of the Superintendent as set out in the Bank Act.
- Exemption for remuneration: payment of salaries, fees, stock options, pension benefits, incentive benefits or other benefits to directors, officers or employees are exempt (paragraph 487(2)(c)).
- Bank Act requirement: related party transactions must not be undertaken on more favorable terms than with non-related counterparties.
- Specific permitted items with approval: loans to officers and their spouses, and terms on financial services more beneficial than market terms and conditions, permitted if approved by the bank’s Conduct Review Committee (subsections 496(4 to 6)).

### Board approval, Conduct Review Committee (CRC), conflict of interest rules (Principle 20 — EC3, EC4)
- Board/CRC involvement:
  - Board approval required where permitted related party transactions exceed specified amounts or pose special risks; Board involvement required in determining materiality (section 490).
  - CRC must establish bank’s materiality criteria and these must be approved by the Superintendent.
- Prior board approval required in specific circumstances:
  - related party transaction with another financial institution or as part of a restructuring requires Superintendent approval and CRC sign-off that market terms and conditions are satisfied (subsection 494(3), subsection 494(4); Transaction Instructions DA Nos. 22 & 23);
  - offering loans or more favorable financial services to senior officers, their spouses and minor children requires CRC approval (section 496);
  - loans, guarantees and investments with directors, officers and their interests require Board approval if aggregate value to that related party would exceed 2 percent of the bank’s regulatory capital (subsection 497(1)); transactions with all such related parties are limited to 50% of the bank’s regulatory capital (subsection 497(2)).
- Conflict of interest exclusions:
  - directors with conflicts must disclose the nature and extent of any interest in a material contract or transaction (subsections 202(1) and 203(1));
  - a director making such disclosure shall not be present at meetings or vote on the resolution, subject to limited exceptions (e.g., remuneration).

- CRC duties (EC4):
  - require management to establish procedures for complying with Part XI (self-dealing);
  - review these procedures and their effectiveness;
  - review practices to identify transactions that may have a material effect on stability or solvency;
  - banks must report to the Superintendent on the CRC’s mandate and procedures; directors must report yearly to the Superintendent on CRC activities (section 195).
- Supervisor requirement: banks must have policies and processes to prevent persons benefiting from a transaction (and related persons) from being part of the process of granting/managing the transaction.

### Limits, collateralization, capital treatment (Principle 20 — EC5)
- Credit exposures to related parties: generally prohibited with specified exceptions.
- For exceptions, OSFI’s large exposure limit of 25 percent of capital applies for an individual counterparty.
- Bank Act provides aggregate limit: 50 percent of capital for aggregate exposures to directors, officers and their interests (subsection 497(2)), i.e., permissible aggregate exposure to these related parties is twice the allowable large exposure limit for a single counterparty.
- Collateralization: a bank may make a loan to or guarantee on behalf of a related party, or acquire a loan to a related party, if the loan or guarantee is fully secured by securities of or guaranteed by the Government of Canada or the government of a province (section 491).
- Capital deductions: no general requirements to deduct related party exposures from capital. However, substantial investments in unconsolidated entities and deconsolidated subsidiaries are deducted from capital.
- Supervisory recommendation: OSFI should consider whether the Bank Act limit of 50 percent of capital for aggregate exposures to directors, officers and their interests should be lowered to a level more consistent with the large exposures limits.

### Monitoring, reporting, supervisory practices and assessments (Principle 20 — EC6, EC7; Assessment)
- Reporting and monitoring:
  - Normal supervisory work includes review of the report on related party transactions prepared for the bank’s CRC.
  - Reporting includes attestations from senior management regarding compliance with related party/conflict of interest policies and legislative limits.
  - Example: Chief Risk Officer attests quarterly to the corporate governance committee on compliance and aggregate value of relevant exposures for a large bank.
- Regulatory reporting:
  - Reporting to banks’ compliance committees must include assessment of related party limits under the Bank Act (including the 50 percent limit).
  - Annual compliance report is provided to OSFI.
  - There is no regulatory return covering related party exposures for more frequent reporting to OSFI.
- Supervisory exclusions and voting: board members with conflicts are excluded from approval processes.
- Assessment of Principle 20: Largely Compliant.
- Supervisory recommendation: OSFI should establish a more formalized regime, including regular regulatory reporting of exposures, for monitoring related party transactions.

### Country and transfer risk (Principle 21) — summary of findings and supervisory expectations
- EC1–EC6 highlights:
  - OSFI’s Large Exposure Limits Guideline and Prudent Person guidance require banks to set internal policies on large exposures, including exposures to countries.
  - ICAAP Guideline: institutions engaged in cross-border lending must reflect country risk, concentration risk, foreign currency risk, regulatory/legal/compliance/operational risks in the ICAAP; additional capital may be required where these are not considered elsewhere.
  - For large banks using internal models, the CAR Guideline (Internal Ratings Based Approach) requires incorporation of country and transfer risk into internal rating grades; rating models are reviewed regularly.
  - Supervisory practice: monitor country risks of large banks as part of routine supervision; supervisors review country-specific loan portfolios and quarterly Board risk reports; ad hoc information requests for specific geographic exposures (e.g., Eurozone) compiled into regular reports to the Superintendent.
  - OSFI does not set provisioning for country risks; banks follow accounting standards for impairment and collective provisions; OSFI Guidelines on asset impairment and collective allowances address expectations for provisioning; provisioning sufficiency reviewed on-site and by external auditors.
  - Stress testing: scenarios involving offshore disruptions are included in stress testing programs (e.g., Asian deflationary scenario, further escalation in the euro crisis).
  - Regulatory returns include exposures by country; supervisors can request more detailed exposure information as needed.
- Assessment of Principle 21: Compliant.
- Supervisory recommendation: OSFI should consider issuing more explicit published guidance specifically addressing the management of country and transfer risks.

### Market risk (Principle 22) — summary of findings and supervisory expectations
- EC1–EC5 highlights:
  - OSFI’s supervision framework and risk management assessment criteria include enterprise-wide expectations for market risk consistent with BCBS standards and CAR Guideline Chapter 9.
  - Market Risk Capital Adequacy Guideline applies to banks with a trading book of greater than 10 percent of total assets or $1 billion; does not apply to foreign bank branches.
  - Supervisory tools: significant activity reviews, regular monitoring, supervisory letters, and use of higher market risk capital requirements or multipliers where risk management gaps exist.
  - OSFI’s Capital Markets Risk Assessment Services Division conducts regular on-site reviews, including reviews in major trading centers.
  - Board oversight: supervisors review board approval of strategies, policies and implementation for market risk.
  - Controls and systems: CAR Guideline requires timely identification and aggregation of data, independent risk control unit for reporting/monitoring/limits, and detailed requirements for models.
  - Valuation practices: documented policies and procedures; independent unit for validation of internal models; Independent Price Verification (IPV) assessed in reviews; IPV cross-sector review in 2009 led to recommended enhancements; banks required to have data governance policies for Internal Models Approach approval.
- Assessment of Principle 22: (findings continue beyond provided excerpt).

*Source: _cr1471 - Part XI (self-dealing) of the Bank Act sets out the related party regime to which banks are subject.*

### Chapter 9 of OSFI’s CAR Guideline defines OSFI’s expectations with respect to valuation

### Chapter 9 of OSFI’s CAR Guideline defines OSFI’s expectations with respect to valuation

### Valuation adjustments and market risk (Principle 22 / EC6)
- OSFI expects institutions, as part of marking-to-market procedures, to establish and maintain procedures for considering valuation adjustments consistent with BCBS standards.
- The guideline details circumstances under which valuation uncertainties may occur.
- In determining internal capital targets, banks are expected to consider potential unexpected losses identified through back-testing breaches for market risk.
- OSFI may require capital multipliers for risks not identified in the market risk framework or for back-testing breaches.
- EC6: The supervisor requires banks to include market risk exposure into their stress testing programmes for risk management purposes.
- OSFI’s Stress Testing Guideline requires inclusion of relevant and material market risks, including:
  - general market
  - specific
  - cash flow mismatch
  - interest rate
  - foreign exchange
  - commodity
- Market risk price shocks are included in both OSFI-mandated stress tests and bank-run tests.
- Assessment of Principle 22: Compliant.
- Comment: OSFI’s market risk supervision program for large banks includes on-site review and detailed model review. OSFI should consider clarifying expectations for foreign bank branches and banks with small or no trading books not subject to the Capital Adequacy Requirement Guideline on Market Risk.

### Interest rate risk in the banking book (Principle 23)
- Principle: Supervisor determines banks have adequate systems to identify, measure, evaluate, monitor, report and control or mitigate interest rate risk in the banking book.
- EC1: OSFI’s Interest Rate Risk Management (IRRM) Guideline provides formal guidance supporting BCBS 2004 guidance and covers:
  - Board oversight
  - Senior management oversight
  - Measurement of interest rate risk
  - Disclosure of interest rate risk
  - Limit setting
- OSFI conducted a Structural Interest Rate Risk (SIRR) cross-sector review in 2011 at 9 financial institutions to assess inherent interest rate risk and control frameworks, evaluating:
  - Breadth and complexity of product offerings
  - Pension obligation risk
  - Price discovery, liquidity and arbitrage opportunities
  - Understanding of risks by senior management
  - Effectiveness of asset liability management strategy
  - Alignment of limit structure and risk appetite
  - Funds transfer pricing
  - Limits setting, and escalation of limit breaches
  - Comprehensiveness of IT infrastructure
  - Effectiveness of independent control functions
  - Vetting and regular review of models
  - Capital adequacy
- Smaller institutions are monitored on a portfolio basis using management reports, board policies, minutes and presentations.
- EC2: IRRM Guideline states Board is ultimately responsible for risk appetite; complex institutions should have ALCO. Supervisors review strategies, policies, tolerances and implementation (policy documentation, ALCO papers).
- EC3: Expectations include:
  - (a) measurement systems commensurate with degree of interest rate risk;
  - (b) regular review and independent validation of models;
  - (c) board-approved limits reflecting risk appetite and capital strength, set to allow breaches under volatility;
  - (d) effective exception tracking and escalation for breaches;
  - (e) effective information systems for timely identification, aggregation, monitoring and reporting.
- EC4: IRRM Guideline requires sensitivity and stress testing, specifying standard measures (e.g., parallel shifts of the yield curve). The SIRR review assessed comprehensiveness of stress testing including key risk factors, breakdown of assumptions, illiquid positions, and “worst case” scenarios.
- AC1: Supervisor obtains internal interest rate risk measurement results expressed in terms of threat to economic value, including standardized interest rate shock on the banking book. Banks are required to disclose sensitivity (pre-tax) of net interest income and economic value to parallel shifts in the yield curve of 10, 25, 100 and 200 basis points, the latter metric additionally as a percentage of capital; sensitivity to three non-parallel shifts; and sensitivity to key rates. Results reviewed through OSFI’s quarterly monitoring process.
- AC2: OSFI’s ICAAP Guideline addresses adequacy of internal capital measurement systems for interest rate risk; supervisors review ICAAP and resulting capital targets.
- Assessment of Principle 23: Compliant.
- Comment: OSFI has issued IRRM guidance; supervisors conduct regular off-site monitoring through standard reporting of interest rate shock impacts on earnings and capital. A proactive approach is critical in a rising interest rate environment.

### Liquidity risk (Principle 24)
- Principle: Supervisor sets prudent liquidity requirements reflecting banks’ liquidity needs; at least for internationally active banks, requirements are not lower than applicable Basel standards.
- EC1: Liquidity Principles Guideline specifies OSFI expectations, maps to BCBS 2008 guidance, and is being updated to include Basel III. OSFI expects banks to achieve 100% LCR by the end of 2013.
- OSFI’s key metric: Net Cumulative Cash Flow (NCCF) — a survival horizon metric based on stressed contractual cash inflows and outflows and stock of available liquid assets.
- NCCF stress scenario assumptions encompass a combination of idiosyncratic and systemic stresses over a one year liquidity horizon, resulting in:
  - (a) cash inflows from eligible unencumbered liquid assets, other securities and assets;
  - (b) partial run-off of retail and small business customer deposits;
  - (c) partial run-off of wholesale funding;
  - (d) drawdowns on committed credit lines and liquidity facilities.
- NCCF history:
  - OSFI began requiring NCCF during 2007-2008 crisis, setting target levels of around several weeks.
  - Minimum survival horizon subsequently extended to 13 weeks.
  - More recently extended to 20 weeks given market turmoil in Europe.
- NCCF applied on consolidated and major currency basis; introduced at select smaller institutions with thresholds by complexity.
- Supervisory resources: Capital Markets Risk Assessment Services (CMRAS) has a staff complement of 16.
- In 2012, 8 large banks completed a self-assessment of compliance with revised Liquidity Principles Guideline.
- OSFI has not conducted full-scope on-site liquidity reviews of large banks since 2008 due to extensive off-site monitoring; monitoring includes NCCF, Basel III measures, liquidity policies, contingency plans and internal audit.
- EC2: NCCF reflects liquidity risk profile; applied selectively to smaller banks. For largest banks, NCCF threshold was initially set at six weeks and has been progressively increased and now stands at 20 weeks for the consolidated balance sheet. Liquidity Principles require banks to set liquidity risk appetite consistent with business strategy.
- EC3: Liquidity Principles require robust frameworks; supervisors prepare documented analyses covering liquidity risk tolerance, strategies, goals, metrics such as NCCF, LCR and NSFR, available unencumbered liquid assets, contractual maturity mismatch, funding concentrations, contingent liquidity and stress testing.
- EC4: Expectations (board-approved appetite, day-to-day/intraday practices, information systems, board oversight, regular board review at least annually) are covered in the Liquidity Principles Guideline.
- EC5: Supervisor requires banks to establish and regularly review funding strategies and processes including:
  - (a) analysis of funding requirements under alternative scenarios;
  - (b) maintenance of a cushion of high quality, unencumbered, liquid assets;
  - (c) diversification of sources and tenor of funding and concentration limits;
  - (d) regular efforts to maintain relationships with liability holders;
  - (e) regular assessment of capacity to sell assets.
- OSFI reviews funding strategies and has focused on higher risk funding strategies such as reliance on brokered deposits.
- EC6: Supervisor determines banks have robust Contingency Funding Plans (CFP) that are formal, documented, set strategies for addressing shortfalls without reliance on lender of last resort, establish responsibilities and communications, and are regularly tested. OSFI reviewed large banks’ CFPs and included them in resolution and recovery plan assessments.
- EC7: Supervisor requires a variety of short-term and protracted, bank-specific and market-wide liquidity stress scenarios (systemic and idiosyncratic) with conservative and regularly reviewed assumptions. Liquidity Principles Guideline Principle 6 provides details; the self-assessment covered scenario design, types run, consistency with limits and links to funding plan.
- EC8: Supervisor identifies banks with significant foreign currency liquidity transformation; institutions with international operations comprising more than 10 percent of total funding or total assets in foreign currencies should measure and report NCCF separately by significant currencies (e.g., CAD, US and Euro). Guideline expects documentation of foreign currency position management, limits, internal support arrangements and transferability concerns.
- AC1: OSFI has a Guideline on the Pledging of Assets requiring banks to set limits on encumbrance; amounts pledged reported quarterly and included in public disclosures. Pledging was reviewed in 2009-10 cross-industry review.
- Assessment of Principle 24: Compliant.
- Comments:
  - OSFI has maintained strong focus on liquidity since the crisis; banks increased liquidity reserves and prudent funding profiles.
  - OSFI developed its own liquidity measure (NCCF) and raised expectations toward Basel III measures, reducing reliance on short-term wholesale funding.
  - Much liquidity supervision for large banks has been off-site; OSFI should ensure supervisors maintain regular on-site coverage to verify effective application of policies and controls.

### Operational risk (Principle 25)
- Principle: Supervisor determines banks have adequate operational risk management frameworks taking into account risk appetite, profile and market/macro conditions.
- EC1: OSFI’s Capital Adequacy Requirements Guideline encourages compliance with BCBS Principles for the Sound Management of Operational Risk. Reinforced by a Superintendent letter in August 2011. OSFI provides an Operational Risk Self-Assessment Program template.
- OSFI’s Operational Risk Division consists of 16 staff, of which 12 typically focus on banks.
- Verification methods include:
  - Significant Activity Reviews (cross-sector reviews)
  - Operational Risk Management Function Reviews
  - Quarterly reviews for larger banks as part of institution-specific packages
- EC2: Board review and approval of strategy, policies and processes for operational risk expected; OSFI has recommended strengthening board review in some cases.
- EC3: Supervisor determines approved strategies/policies are implemented effectively and integrated into overall risk management; reviews assess organization, resourcing, compensation policies, documented controls, outsourcing management, and other operational policies.
- EC4: Supervisor reviews disaster recovery and business continuity plans for feasibility in severe disruption. Example: 2011 review of the six largest deposit-taking institutions to assess business continuity management programs.
- EC5: Supervisor determines banks have appropriate IT policies and infrastructure. OSFI conducts IT-focused, risk-based examinations and has standardized templates and specialist staff; has used external consultants where needed.
- Notable IT work:
  - 2009-2010 assessment of legacy IT systems with the six largest banks concluded core legacy systems were inherently stable but highlighted knowledge management, business continuity, incident management, and information security.
  - Reviews of information security practices at the six conglomerate banks in 2008 and 2010.
- EC6: Supervisor determines banks have effective information systems to monitor operational risk, compile and analyze data, and support reporting to Board and senior management. OSFI reviewed risk management reporting capabilities of the six largest banks in 2011 and requested self-assessments and enhancement plans.
- EC7: Supervisor requires reporting mechanisms to keep supervisor apprised of operational risk developments. Formal mechanisms include escalation processes, quarterly monitoring meetings, ongoing discussions with senior risk officers, and reviews of risk dashboards & audit findings.
- EC8: OSFI’s Outsourcing Guideline requires comprehensive outsourcing risk management policies, due diligence, contractual protections and contingency planning. 2007 review of outsourcing practices at six largest banks focused on governance, contractual protections, management and business continuity.
- AC1: OSFI regularly identifies common points of exposure (e.g., cyber risks) and reviews critical third party providers. OSFI has information-sharing agreement with the Bank of Canada for payment systems matters and outage reports.
- Assessment of Principle 25: Compliant.
- Comments: OSFI has a strong operational risk assessment program, dedicated operational risk team including technology experts, regular cross-industry reviews, and targeted guidance (e.g., outsourcing). OSFI has relied on BCBS Sound Practices but should consider issuing more comprehensive guidance on operational risk management and business continuity expectations.

### Internal control and audit (Principle 26)
- Principle: Supervisor determines banks have adequate internal control frameworks covering delegation of authority, separation of functions, reconciliation, asset safeguarding, and independent internal audit and compliance.
- EC1: OSFI’s Corporate Governance Guideline and other guidelines (ICAAP, operational risk) describe requirements for board and senior management to establish adequate control environments. Supervisory assessments use on-site significant activity and control area reviews supported by internal supervisory guides.
- EC2: Supervisor determines balance in skills/resources of back office, control functions and operational management; evidence from on-site/off-site reviews shows adequacy of control functions is regularly reviewed and issues reported to the board. Operational Risk Division supports Relationship Managers in assessments.
- EC3: Legislative Compliance Management Guideline sets requirements for compliance function; supervisors use assessment criteria and templates. OSFI noted strong compliance functions including at smaller banks and conducts on-site reviews.
- EC4: Internal audit expectations described in Corporate Governance Guideline and Assessment Criteria for Internal Audit. Supervisory assessment includes on-site and off-site reviews, significant activity reviews and overall reviews that assess independence, mandate and effectiveness.
- EC5: Internal audit should have sufficient resources and experience, independence with reporting lines to board/audit committee, timely awareness of material changes, full access to records and staff, risk-based methodology and planning, and authority to assess outsourced functions. OSFI assesses these areas using published criteria and supervisory guides.
- OSFI’s Outsourcing Guideline requires audit rights in outsourcing agreements.
- Supervisors regularly meet with Chief Internal Auditors and review audit plans and findings.
- Assessment of Principle 26: Compliant.
- Comments: OSFI interacts closely with internal audit functions and balances oversight and use of internal audit work without undue reliance.

### Financial reporting and external audit (Principle 27) — (excerpt)
- Principle: Supervisor determines banks maintain adequate and reliable records, prepare financial statements in accordance with accounting policies widely accepted internationally, publish information that fairly reflects condition and performance, and bear an independent external auditor’s opinion. Supervisor also determines adequate governance and oversight of external audit.
- EC1: The supervisor holds the Board and management responsible for ensuring financial statements are prepared in accordance with widely accepted international accounting policies and supported by recordkeeping systems.
- Description begins: The Canadian Accounting Standards Board adopted International Financial Reporting Standards (IFRS) for publically accountable enterprises for annual periods beginning on or after January 1, (text truncated in source).

*Source: Chapter 9 of OSFI’s CAR Guideline and related principles and findings as provided in the supplied IMF document excerpt.*

### 2011. All OSFI federally regulated financial institutions are publically accountable enterprises and

### _cr1471 - 2011. All OSFI federally regulated financial institutions are publically accountable enterprises and 

### External audit framework and legal responsibilities
- All OSFI federally regulated financial institutions prepare financial statements in accordance with IFRS.
- The Canadian audit profession is governed by the International Standards on Auditing (ISAs), set by the International Auditing and Assurance Standards Board (IAASB).
- Unless material weaknesses have been identified in the independent audit function, OSFI relies upon banks’ external auditors to conduct an audit in accordance with Canadian Generally Accepted Auditing Standards and to provide an opinion on whether the audited financial statements present fairly in all material respects in accordance with IFRSs.
- The Bank Act and OSFI’s Corporate Governance Guideline place clear responsibility on the board for the production of accurate financial statements.
- The Bank Act requires directors to place before shareholders at every annual meeting the report of the auditor or auditors of the bank.
- The Bank Act requires each financial institution to establish an audit committee comprised of non-employee directors, a majority of whom are not affiliated with the institution.
- Statutory duties of the audit committee include:
  - reviewing the annual statements of the institution;
  - evaluating and approving internal control procedures for the institution;
  - meeting with independent oversight providers to review their functions and discuss the effectiveness of the institution’s internal controls and reporting practices.
- The Corporate Governance Guideline requires audit committees to probe, question and hold regular in camera meetings with the external auditor and to discuss:
  - the overall result of the audit;
  - the annual and quarterly financial statements and related documents in the audit report;
  - the quality of the financial statements and any related concerns.
- OSFI supervisors meet regularly (typically quarterly for the large Canadian banks) with the internal auditor, external auditor and chair of the board risk committee to discuss any financial reporting matters.

### EC2 — External auditor opinion and oversight (Description and findings)
- The Canadian Public Accountability Board (CPAB) oversees the quality of the work of external audit firms; CPAB is a Federal not-for-profit corporation created by the Canadian Securities Administrators, OSFI and the Canadian Institute of Chartered Accountants.
- OSFI has an MOU with CPAB allowing CPAB to share findings with OSFI on a high level (i.e., non institution-specific) basis.
- OSFI’s Accounting Policy Division meets with CPAB on a biannual basis for this purpose.
- OSFI’s Accounting Policy Division reviews the financial statements and the independent auditor’s report to the audit committee on a quarterly basis for Canada`s conglomerate banks.
- OSFI meets with the external auditors of the conglomerate banks quarterly to probe and question areas of significant auditor and management judgment affecting accounting policies, accounting estimates and financial statement disclosures.
- For smaller banks, the Accounting Policy Division works on accounting and auditing matters as issues arise.

### EC3 — Valuation practices (Description and findings)
- IFRS is the basis for both external and regulatory reporting for banks, supplemented by OSFI guidelines where required.
- OSFI issued guidance relating to valuation practices where needed to clarify expectations under IFRS:
  - (1) 2009 BCBS Supervisory guidance for assessing banks’ financial instruments fair value practices: OSFI communicated expectations for all banks to follow the April 2009 BCBS Supervisory guidance. Banks were required to submit self-assessments to OSFI against the BCBS principles for the years ending 2009 and 2010.
  - (2) Fair Value Option: OSFI issued the Accounting for Financial Instruments Designated as Fair Value Option (FVO) Guideline in June, 2006 and amended it in July 2010 to reflect the adoption of IFRS. The Guideline provides OSFI guidance on applying the fair value option in IAS 39 Financial Instruments: Recognition and Measurement as issued by the IASB, and was issued to address:
    - 1) the reliability of fair values when observable market prices are not available thereby decreasing the potential need for separate reporting of financial results for regulatory purposes; and
    - 2) the need for a documented risk management strategy as a prerequisite to using the FVO.

### EC4 — Scope and standards of external audits (Description and findings)
- Subsection 323(2) of the Bank Act requires banks to be audited in accordance with generally accepted auditing standards, the primary source being the Canadian Auditing Standards contained in the Handbook of the Canadian Institute of Chartered Accountants.
- Canadian Auditing Standard (CAS) 320 requires the auditor, in conducting an audit of financial statements, to obtain reasonable assurance that the financial statements as a whole are free from material misstatement, whether due to fraud or error, by obtaining sufficient appropriate audit evidence to reduce audit risk to an acceptably low level.
- CAS 320 further requires the auditor to determine materiality for the financial statements as a whole and, where appropriate, materiality levels for particular classes of transactions, account balances or disclosures.

### EC5 — Audit scope coverage (Description and findings)
- As audits are conducted under ISAs, audit scopes cover:
  - loan portfolio;
  - loan loss provisions;
  - non-performing assets;
  - asset valuations;
  - trading and other securities activities;
  - derivatives;
  - asset securitizations;
  - consolidation of and other involvement with off-balance sheet vehicles;
  - the adequacy of internal controls over financial reporting.

### EC6 — Power to reject/rescind external auditors (Description and findings)
- OSFI may revoke the appointment of an external auditor deemed to have inadequate expertise or independence, or not subject to or not adhering to established professional standards under subsection 317(2) of the Bank Act.

### EC7 — Auditor rotation (Description and findings)
- The Canadian Chartered Accounting profession is a member of IFAC which follows the Canadian profession’s Rules of Professional Conduct.
- The Rules of Professional Conduct require audit partner rotation every seven years with a minimum of five years off thereafter.

### EC8 — Supervisor meetings with external audit firms (Description and findings)
- OSFI’s supervision approach includes regular industry-level meetings with external audit firms and bilateral meetings between supervisors and the external auditor of each bank, generally quarterly.
- Banks and supervisors find these regular discussions and exchange of information very effective and an important supervisory tool.
- The Accounting Policy Division meets periodically (at least twice a year) with the Auditor Advisory Committee (AAC) of the Auditing Firms to address issues relating to bank accounting and auditing. The AAC is comprised of the lead audit and technical partners of the big four firms.

### EC9 — Auditor reporting to supervisor (Description and findings)
- Under the Bank Act, auditors must report in writing to the bank and OSFI any transactions or conditions affecting the ‘well being’ of the bank that, in the auditor’s opinion, are not satisfactory.
- Canadian Audit and Assurance Standard Board’s Audit Guidance 17 provides further details on reportable transactions under the ‘well being’ letter requirement (e.g., jeopardizing going concern or contravention of legislated capital or liquidity requirements).
- Section 325 of the Bank Act allows the Superintendent to require auditors to report directly to the Superintendent on procedures performed and to enlarge or extend the scope of the examination.
- Auditors do not have an ongoing legal obligation to report to OSFI instances of compliance breaches or potential prudential concerns, although auditors generally view reporting significant concerns to OSFI as their responsibility.
- OSFI was actively involved in developing the new BCBS guidance on the External Audit of Banks (released in draft form for consultation and expected to be finalised shortly). The draft guidance contains a requirement for timely reporting of prudential concerns. OSFI will require banks to adhere to this guidance.
- Section 333 of the Bank Act provides that any oral or written statement or report made by the auditor has qualified privilege.

### Additional criteria — AC1 (Description and findings)
- Section 643 of the Bank Act provides the Superintendent with authority to review the auditor’s working papers. Supervisors indicated that this is done periodically.

### Assessment of Principle 27
- Assessment: Compliant
- Comments:
  - OSFI supervisors have established strong ongoing communication channels with external auditors and can leverage their resources and expertise when needed.
  - While auditors have a statutory duty to report to the bank and OSFI issues affecting the well being of the bank, the ‘well being letter’ requirements may not cover all matters of prudential interest to OSFI.
  - The formal statutory nature of the requirement may hinder timely and open communication of matters of potential prudential concern that do not rise to the level of immediacy or severity set out in the Bank Act or associated audit guidance.
  - OSFI expects to require banks to adhere to forthcoming BCBS guidance on external audit, which will include a more generalised reporting requirement on matters of prudential concern to supplement the Bank Act reporting expectations.

### Principle 28 — Disclosure and transparency (Essential criteria and findings)
- EC1:
  - Banks are required to prepare annual consolidated financial statements in compliance with IFRS as adopted in Canada.
  - Subsection 308(1) of the Bank Act requires every bank to have a report from an auditor on the annual financial statements.
  - Financial statements shall, except as otherwise specified by the Superintendent, be prepared in accordance with generally accepted accounting principles (primary source: Handbook of the Canadian Institute of Chartered Accountants).
  - OSFI has authority to specify additional accounting guidance or additional disclosure or require that a specific accounting option be followed; OSFI makes such specifications in rare situations (e.g., detailed guidance on transitional aspects of IFRS in 2010).
  - Timeliness and content of financial statements for publicly listed banks are also dictated by securities regulations.
  - Banks with subsidiaries, including the largest Canadian banks, do not currently publicly disclose solo financial statements and there are no requirements to do so.
  - OSFI requires all banks and federally regulated trust and loan companies to follow BCBS Pillar 3 standards; OSFI issued an Advisory in November 2007 with the implementation of Basel II and subsequent Advisories for Basel 2.5 in 2012 and Basel III and remuneration disclosure requirements in 2011.
  - OSFI issued final guidance on Basel III Pillar 3 capital disclosures in July 2013.
  - OSFI has issued additional disclosure requirements including guidelines on Annual Disclosures and Derivatives Disclosures and disclosure aspects of the Guidelines on Mortgage Underwriting Practices and Liquidity Principles.
- EC2:
  - IFRS and Basel Pillar 3 disclosure requirements address qualitative and quantitative information on financial performance, financial position, risk management strategies and practices, risk exposures, and basic business, management, governance and remuneration.
  - OSFI’s additional disclosures cover other risk information useful for assessing bank risk profiles and risk management (example: OSFI required additional disclosures regarding exposures to certain sovereigns in Q1 2012).
  - OSFI’s new requirements for banks designated as D-SIBs include an expectation to adopt recommendations of the Financial Stability Board’s Enhanced Disclosure Task Force and future disclosure recommendations endorsed by international standard setters and evolving best practices.
- EC3:
  - Paragraph 308(3)(a) of the Bank Act requires disclosure of all material entities in the group structure in the bank’s annual statement.
- EC4:
  - Disclosures in annual financial statements are reviewed by external auditors as per IAS 720 “The auditor's responsibilities relating to other information in documents containing audited financial statements”.
  - Financial statements are also submitted to securities regulators.
  - OSFI’s Accounting Policy Division reviews financial statements of major banking organizations quarterly and annually and follows up on potential accounting issues of concern.
  - OSFI proactively enforces compliance with disclosure requirements (example: provided a ‘roadmap’ template in 2006 for Pillar 3 compliance and has performed periodic reviews of Pillar 3 disclosures and other specific disclosure requirements such as the 2012 mortgage lending Guideline).

*Source: _cr1471 - 2011. All OSFI federally regulated financial institutions are publically accountable enterprises and (PDF).*

### Section 642 of the Bank Act requires the Superintendent to prepare a report annually to

### _cr1471 - Section 642 of the Bank Act requires the Superintendent to prepare a report annually to

### EC5 — Public aggregate information on the banking system
- Requirement: Section 642 of the Bank Act requires the Superintendent to prepare a report annually to Parliament respecting the disclosure of information by banks and describing the state of progress made in enhancing disclosure of information in the financial services industry.
- Expected public information: Aggregate data on balance sheet indicators and statistical parameters reflecting principal aspects of banks’ operations (balance sheet structure, capital ratios, income earning capacity, and risk profiles).
- Description and findings:
  - OSFI makes available consolidated data for all banks on its website on a quarterly and monthly basis.
  - For each bank, users can generate a report showing the consolidated statement of financial position, income statement, impaired assets, capital adequacy components and derivative contracts.
  - The Bank of Canada publishes aggregate banking system statistics with a reasonable level of detail on a monthly basis.
  - The Bank of Canada’s monthly aggregate statistics do not include risk indicators (for example, arrears or impairments), information on liquidity and funding, exposure concentrations or performance indicators.

### AC1 — Disclosure of exposures during reporting period
- Criterion: Disclosure requirements should promote information that helps understand a bank’s risk exposures during a financial reporting period (for example on average exposures or turnover during the reporting period).
- Description and findings:
  - OSFI has issued additional disclosure requirements for banks in response to specific risk issues.
  - OSFI’s B20-Residential Mortgage Underwriting Practices and Procedures requires additional disclosure to provide greater transparency, clarity and public confidence in residential mortgage underwriting.
  - The guideline indicates that, as a matter of principle, banks should publicly disclose sufficient information related to their residential mortgage portfolios for market participants to be able to conduct an adequate evaluation of the soundness and condition of their residential mortgage operations.
  - Example disclosures required include:
    - The amount and percentage of the total residential mortgage loans and HELOCs that are insured versus uninsured;
    - The percentage of residential mortgages that fall within various amortization period ranges;
    - The average LTV ratio for the newly originated and acquired uninsured residential mortgages and HELOCs at the end of each period.
  - OSFI required institutions to provide additional liquidity and funding risk disclosures for Q1 2013 including contractual maturities table of financial assets and liabilities and liquid assets.
  - OSFI issued a letter outlining disclosure requirements for the interim period before the formal implementation date of the Basel III Pillar 3, Composition of Capital disclosure requirements.

### Assessment of Principle 28
- Assessment: Compliant
- Comments and findings:
  - OSFI has implemented all Pillar 3 requirements and has been proactive in including enhanced disclosure expectations for Canadian banks.
  - Canadian D-SIBs will be expected to adopt the recommendations of the Financial Stability Board’s Enhanced Disclosure Task.
  - Pillar 3 requirements have been issued in Advisories rather than a Guideline. Advisories provide OSFI with the flexibility to address issues quickly.
  - OSFI plans to issue a Guideline once the BCBS Working Group on disclosures issues its final report on findings and recommendations.
  - Recommendation: As OSFI and the banks view Pillar 3 requirements, which have been in effect since 2008, as minimum required standards, we recommend that OSFI consider issuing a Guideline on disclosure.
  - Recommendation: OSFI could provide greater financial and risk data in a more useable format for analysis by the public. The OSFI data access tool on its web site:
    - is not particularly user friendly;
    - does not facilitate analysis (for example, over time or across peers) or flexible access (for example, via spreadsheet).
  - Observation: Some other regulators publish substantially more information in time series format on bank performance and risk indicators at the aggregate and individual institution level.
  - Recommendation: OSFI may wish to review best practices in other countries and consider publication of time series data sourced from its regulatory returns that would enhance the public understanding of banks’ operations and risk profile.

### Principle 29 — Abuse of financial services (introductory line)
- Principle statement: The supervisor determines that banks have adequate policies and processes, including strict customer due diligence (CDD) rules to promote high ethical and professional standards in the financial sector and prevent the bank from being used, intentionally or unintentionally, for criminal activities.
- Essential criteria EC1:
  - EC1: Laws or regulations establish the duties, responsibilities and powers of the supervisor related to the supervision of banks’ internal controls and enforcement of the relevant laws and regulations regarding criminal activities.
  - (Description and findings regarding EC1 begin in the source but are not fully included in the provided excerpt.)

*International Monetary Fund — Excerpt from source document*

### Section 4 of the Office of the Superintendent of Financial Institutions Act states that OSFI shall

### _cr1471 - Section 4 of the Office of the Superintendent of Financial Institutions Act states that OSFI shall

### Legal mandate and supervisory powers
- Section 4: OSFI shall “supervise financial institutions in order to determine whether they are in sound financial condition and are complying with their governing statute law and supervisory requirements under that law”.
- Bank Act powers:
  - Sections 628 to 644 provide the Superintendent with general powers to examine banks.
  - Sections 645 to 655 provide broad and specific powers to take remedial actions, including up to taking control of a bank in order to do “all things necessary to or expedient to protect the rights and interests of depositors and other creditors of the bank”.

### AML/ATF regulatory framework and responsible authorities
- Primary statute: Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and associated regulations apply to the banking sector.
- Enforcement authority: Financial Transactions and Analysis Centre of Canada (FINTRAC).
- OSFI’s supervisory instruments:
  - Deterring and Detecting Money Laundering and Terrorist Financing (AML/ATF) Guideline (sets OSFI expectations on risk management and controls).
  - Background Checks on Directors and Senior Management of FREs (Responsible Persons) Guideline (expectations on screening “Responsible Persons”).

### OSFI–FINTRAC cooperation and information sharing
- Memorandum of Understanding (MoU) on information sharing signed in 2004 covering federally regulated financial institutions.
- Operational coordination:
  - Relationship described as “relatively mature”.
  - Quarterly working-level meetings; executive-level meetings occur as needed.
  - FINTRAC no longer conducts separate assessments of banks but works alongside OSFI; two assessments under the joint procedure have been carried out so far.
  - Joint assessments aim to reduce overlap and duplication; OSFI focuses on risk management and FINTRAC on compliance elements.
- Information exchange and consultation:
  - OSFI requests and receives interpretative issues from FINTRAC.
  - FINTRAC and the Department of Finance consult OSFI on risk management issues.
  - OSFI can see file copies of FINTRAC reports pursuant to governing legislation.

### OSFI AML/ATF assessment program — methodology and cadence
- Responsible unit: Anti-Money Laundering and Compliance Division (AMLC).
- Approach: Risk-based, enterprise-wide including branches and subsidiaries outside Canada.
- Bank categorization into three broad groups based on observed ML and TF risk; criteria include size, geographic operations, product types, delivery channels.
- Assessment frequencies:
  - Banks with highest overall risk profile: joint OSFI-FINTRAC AML/ATF assessment approximately every three years.
  - Other banks: approximately every four to five years depending on risk level.
  - For banks rated low risk by OSFI: assessed solely by FINTRAC.
- Program design notes:
  - Joint assessment does not preclude separate on-site assessments; separate assessments became the exception starting in 2013.
  - Timing of assessments may vary with workloads and supervisory priorities.
  - AML risk management is a critical component in OSFI’s institution-level risk assessment.

### EC2 — Ethical/professional standards and prevention of criminal use
- Regulatory baseline:
  - PCMLTFA regulations require banks to develop and apply written policies and procedures approved by a senior officer to comply with subsection 9.6(1) (programs to ensure compliance with Part 1 of the PCMLTFA).
  - OSFI’s AML/ATF Guideline sets expectations for risk management and controls to detect and deter ML and enable compliance.
- OSFI practices:
  - AMLC uses a risk-based prioritization for assessment frequency and depth.
  - Each AML/ATF assessment includes evaluation of Responsible Person screening processes; only banks subject to AML/ATF assessments receive an evaluation of compliance with the Responsible Persons Guideline.
  - OSFI evaluates systems to flag unusual transactions and processes to report large cash transactions and electronic funds transfers.
- Role regarding detection vs. reporting:
  - PCMLTFA requires banks to report where there are reasonable grounds to suspect a transaction is related to ML or TF (section 7); banks are not required to “detect” with certainty that a transaction is proceeds of crime.

### EC3 — Reporting suspicious activities to supervisor and FIU
- PCMLTFA: banks must report suspicious transactions to FINTRAC; obligation applies to any suspicious activity and is not limited to matters material to safety, soundness or reputation.
- OSFI access and supervisory reporting channels:
  - OSFI can access file copies of FINTRAC reports under governing legislation.
  - Formal mechanisms to notify OSFI of material fraud/suspicious incidents include:
    - Escalation processes within institutions to senior management and the Board, with expectation OSFI is part of communications.
    - Quarterly monitoring meetings with key institutions and operations executives, including review of risk management reports, internal audit reports, and Board minutes.
    - Ongoing discussions with Head of Operational Risk, Chief Risk Officer, and Chair of the Risk Committee.
    - Reviews of risk dashboards and IT/internal audit findings.
  - In practice OSFI receives reporting statistics at quarterly meetings and copies of policy interpretation requests from banks.
  - FINTRAC has flagged systemic reporting issues; FINTRAC rarely raises an alert unknown to OSFI through its relationship management.

### EC4 — Supervisor informing FIU of additional suspicious transactions and sharing criminal information
- If OSFI becomes aware of suspicious transactions during an assessment, it:
  - Asks the bank whether such transactions were reported to FINTRAC and, if not, requests the bank to consider reporting.
  - Does not generally second-guess a bank’s reporting decision except in egregious/obvious cases.
- OSFI focus during assessments:
  - Bank processes to determine suspiciousness, investigation procedures, timeliness of notification and approvals to report to FINTRAC, and quality of information supplied to FINTRAC.
  - Documentation of process gaps in the “FUD” with follow-up, sign-off and closure procedures.
  - Distinction between “requirements” (legislative) and “recommendations” (non-statutory), but OSFI expects timely remedial action for recommendations and may initiate intervention processes for failure to act.

### EC5 — Customer due diligence (CDD) programme elements and findings
- Regulatory requirements and upcoming changes:
  - PCMLTFR (paragraph 71(1)(c)) requires banks to assess and document ML/TF risk and prescribes criteria for high-risk clients; section 71.1 sets out additional measures where high risks are identified.
  - Beneficial ownership threshold: banks must determine beneficial owner(s) who own at least 25 percent of shares of corporate clients.
  - Standard change effective February 1, 2014: from using “reasonable measures” to determine beneficial owners to a clear requirement to identify beneficial owners and take reasonable measures to confirm accuracy.
  - After February 1, 2014, PCMLTFR amendments require enhanced measures for high risk customers (ascertain identity, enhanced measures to mitigate risk, enhanced ongoing monitoring) and ongoing monitoring of all business relationships in accordance with risk assessment.
- OSFI expectations and assessment focus by EC5 subsection:
  - (a) Customer acceptance policy:
    - No ex ante prohibitions on business relationships (other than prohibited transactions e.g., terrorist financing).
    - OSFI expects clarity on banks’ risk appetite and conformity between policy and practice; expects “demarketing” or higher controls if peers withdraw from certain counterparties.
  - (b) Customer identification, verification and ongoing due diligence:
    - PCMLTFA/PCMLTFR obligations to ascertain identity of prescribed customers, beneficial owners at 25 percent threshold, other parties with account access, and record-keeping.
    - OSFI’s assessment evaluates compliance via policy review and sampling of customer records.
  - (c) Monitoring and recognising unusual/suspicious transactions:
    - PCMLTFA requires identification and reporting of suspicious transactions to FINTRAC.
    - OSFI assesses detection policies, case management systems, and reporting processes; policies obtained prior to onsite visits and evaluated against operational practice.
  - (d) Enhanced due diligence on high-risk accounts:
    - PCMLTFR requires measures to keep client information up to date, ongoing monitoring, and mitigation of identified risks.
    - OSFI expects escalation and exit processes for elevated risk relationships and evaluates file-level execution of enhanced due diligence.
  - (e) Enhanced due diligence on politically exposed persons (PEPs):
    - PCMLTFA/PCMLTFR require banks to determine under prescribed circumstances whether clients are Politically Exposed Foreign Persons (PEFPs) and apply prescribed measures (establish source of funds, senior management approval to keep account open or review transaction, enhanced monitoring within timelines).
    - OSFI’s Guideline expects banks to factor domestic PEPs into risk assessments despite domestic PEPs not being explicitly defined in PCMLTFA.
    - OSFI reported “mixed results” from banks and noted ongoing consultation by Finance; legislation could help.
  - (f) Record keeping and retention:
    - PCMLTFA/PCMLTFR prescribe records to be kept due to CDD measures.
    - Records retention expectation noted: records have at least a five year retention period (EC5 description refers to this as a standard element).

### EC6 — Correspondent banking controls
- PCMLTFA/PCMLTFR apply prescribed measures to correspondent banking relationships; such relationships are not prohibited.
- Specific rules and OSFI evaluation:
  - (a) Banks must gather sufficient information about respondent banks to understand nature of business, customer base, and supervision; OSFI evaluates policies/processes where correspondent relationships are high risk.
  - (b) PCMLTFA prohibits correspondent relationships with shell banks; regulations prescribe measures to ascertain whether foreign respondent banks have adequate controls and effective supervision. OSFI’s assessment program evaluates compliance with these requirements.

### EC7 — Controls and systems to prevent, identify and report abuses including ML/TF
- OSFI gathers information on controls and systems designed to detect and deter money laundering and terrorist financing as part of its supervisory assessments.

*Source: _cr1471 - Section 4 of the Office of the Superintendent of Financial Institutions Act states that OSFI shall*

### 1. Customer Identification. OSFI examines samples of customer files to assess the quality of

### 1. Customer Identification. OSFI examines samples of customer files to assess the quality of

### Customer Identification
- OSFI examines samples of customer files to assess the quality of the systems used by banks so they ensure that prescribed customers’ identities are ascertained in accordance with prescribed measures.

### Risk Assessment
- OSFI analyses the risk assessment methodology of banks to assess how it identifies high risk customers, according to prescribed criteria.
- OSFI examines samples of high risk customers’ files to assess the quality of the enhanced measures required to be applied to such customers.

### Reporting to FINTRAC and Operational Risk Oversight
- OSFI assesses the process used by banks to flag potentially suspicious transactions and determine if they should be reported to FINTRAC.
- A similar assessment is made with respect to other transactions to be reported to FINTRAC (large cash transactions, electronic funds transfers, terrorist property).
- OSFI’s supervisory assessment also requires institutions to demonstrate that, on an on-going basis, their risk management (control) practices related to operational risk (which includes fraud risk) are commensurate with the nature, scope, complexity and risk profile of the institution.
- These assessments occur through significant activity reviews, as well as through regular monitoring processes, and include fraud such as rogue/unauthorized trading, credit card fraud, mortgage fraud, cyber-crime, etc.
- Supervisory assessments are conducted by Relationship Management teams and associated support groups (i.e., operational risk, credit risk, etc.).
- Where OSFI has concerns regarding the sufficiency of the controls and systems that are in place it will issue recommendations to the institution which will be monitored and followed up according to OSFI’s processes, including documentation in the “FUD” (see CPs 8 and 9).

### EC8 — Supervisor powers to take action (findings)
- OSFI does not administer the PCMLTFA.
- Sanctions fall into two categories:
  - supervisory sanctions under the Bank Act (including “staging” and intervention and which can lead to agreements or orders of compliance as necessary); and
  - financial penalties which cannot be levied by OSFI but by FINTRAC pursuant to PCMLTFA.
- It is OSFI practice to ensure FINTRAC is copied in on all correspondence (recommendations/staging etc) to the banks and if compliance is not forthcoming then FINTRAC has the option of acting itself and banks are warned that FINTRAC may act.
- OSFI considers that this strategy has been extremely successful to date.

### EC9 — Internal audit, compliance officers, screening and training (findings)
- Under the PCMLTFA, banks are required to audit (test for effectiveness) at least every two years:
  - AML/ATF policies and procedures;
  - The risk assessment referred to above; and
  - The AML training program.
- OSFI expects banks to apply testing to all elements of the AML/ATF program as set out in the AML/ATF Guideline.
- OSFI assesses the content of Internal Audit reports to determine whether banks are testing policies, processes and controls adequately and in accordance with prescribed timelines.
- Consistent with Basel Committee’s Sound Practices and OSFI’s Supervisory Framework, OSFI expects internal audit and/or external experts to independently evaluate relevant operational risk (including fraud) management policies, processes and controls.
- Banks are required by the PCMLTFA to appoint a compliance officer responsible for the implementation of the bank’s compliance program; OSFI refers to this person as the Chief Anti- Money Laundering Officer (CAMLO).
- OSFI assesses the mandate, resources and operations of the CAMLO and his/her staff to determine whether the CAMLO appears to have adequate control over the AML/ATF program.
- OSFI’s expectation is that the CAMLO will be of management status but this is not required; OSFI is more interested in ensuring that there is substance and the individual has the authority to get the job done.
- OSFI has set out expectations in its Responsible Persons Guideline for screening new Directors and Senior officers (“Responsible Persons”).
- OSFI’s Guideline Outsourcing of Business Activities, Functions and Processes sets out expectations regarding outsourcing relationships.
- OSFI analyzes processes used by banks to comply with the Guideline by assessing employee files and evaluating background check processes and reporting to management and the Board on the results.
- For training, see EC9(a) which captures AML/ATF training programs.

### EC10 — Reporting lines and management information (findings)
- OSFI’s AML/ATF Guideline sets out expectations that banks report regularly to the Board on the overall program, as well as its effectiveness. OSFI examines reports to the Board as part of AML/ATF controls assessment.
- Other formal reporting mechanisms include:
  - Escalation processes within the financial institution to communicate operational risk issues to their senior management and the Board, with an expectation that OSFI be part of the communication process.
  - Quarterly monitoring meetings with key institutions and operations executives to help identify leading initiatives and commensurate risks, including review of risk management reports, internal audit reports, and Board minutes.
  - Ongoing discussions with OSFI by the Head of Operational Risk, the Chief Risk Officer, and the Chair of the Risk Committee of the Board.
  - Reviews of Risk dashboards and IT (and other internal) audit findings.
- OSFI observed frequent commonality between weaknesses in AML and weaknesses identified in other risk management areas by line supervisors, with occasional exceptions (e.g., advanced IT in AML but remedial action required elsewhere).

### EC11 — Protection for good faith reporters (findings)
- Section 10 of the PCMLTFA provides: “No criminal or civil proceedings lie against a person or an entity for making a report in good faith under section 7, 7.1 or 9, or for providing [FINTRAC] with information about suspicions of money laundering or of the financing of terrorist activities.”

### EC12 — Cooperation with domestic and foreign supervisors (findings)
- OSFI is one of several federal government agencies and departments that form the Illicit Financing Committee, under the leadership of the Department of Finance, which has overall responsibility for Canada’s AML/ATF regime. This committee meets regularly to discuss issues of policy addressing the risk of ML and TF in Canada.
- FINTRAC is responsible for ensuring compliance with the PCMLTFA.
- In 2004, OSFI and FINTRAC signed an MOU which allows OSFI to share information with FINTRAC about banks’ compliance with the PCMLTFA and its regulations.
- In the course of its AML/ATF assessment program OSFI does not normally identify actual or suspected criminal activity, but on the limited number of occasions when it does it requests the bank in question to make appropriate reporting disclosures to FINTRAC.
- OSFI has MOUs with other regulators globally through which general supervisory information may be exchanged.
- OSFI has held supervisory colleges focused on AML (for five of its six systemic banks). There has been particular follow up on some of these banks and some regional regulators have participated particularly actively.

### EC13 — In-house specialist expertise and information sharing (findings)
- OSFI is not a criminal investigative agency and does not have internal expertise to directly address criminal activities; OSFI would look to FINTRAC or the RCMP to provide this information to banks.
- OSFI has supervisory expertise to review the impact of fraud on banks.
- When additional technical or forensic expertise is required, independent third parties have been engaged to conduct technical reviews.

### Assessment of Principle 29 — Overall findings and recommendations
- Assessment of Principle 29: Largely Compliant.
- FATF context:
  - Canada is a member of the Financial Action Task Force (FATF).
  - Third mutual evaluation undertaken in June 2007 and the mutual evaluation report (MER) was adopted in February 2008.
  - Canada was placed in the FATF’s regular follow-up process and has reported back to the FATF in February 2009, February 2011, October 2011, October 2012 and February 2013.
  - In order to exit the follow-up process Canada needs to demonstrate that three core and key recommendations that were rated PC or NC have improved to a level of C or LC.
  - The recommendations relate to customer due diligence, supervisory standards and the financial investigation unit.
  - In February 2013, the FATF determined that Canada will have improved all the core and key recommendations rated PC or NC to a level essentially equivalent to C or LC when Canada’s new CDD regulations come into force on February 1, 2014. Accordingly, Canada will come out of regular follow-up in February 2014.
- Recommendations from the assessment:
  - Explicitly state OSFI’s expectation that banks’ compliance officer (CAMLO) is appointed at the management level.
  - Clarify Guideline (B-10) on Outsourcing of Business Activities, Functions and Processes to more clearly require that screening processes for outsourcing relationships ensure high ethical and professional standards.
  - Revise the Bank Act to provide OSFI with powers to apply penalties (financial fines). Current practice relies on cooperation with FINTRAC, which administers sanctioning powers under the PCMLTFA; OSFI cannot compel FINTRAC to act.

### Summary compliance with the Basel Core Principles (selected excerpts)
- Core Principle 1 — Grade: C. OSFI has the sole legal mandate for the supervision of banks in Canada; Bank Act provides wide range of powers.
- Core Principle 2 — Grade: LC. OSFI is a government agency with the Minister of Finance as formal head; operational independence is evident but Bank Act could better distinguish responsibilities and secure a prudential veto for the Superintendent.
- Core Principle 3 — Grade: C. Cohesive cooperation and collaboration domestically and with foreign authorities; weaker touch points with provincial regulators noted.
- Core Principle 4 — Grade: C. Federal law defines banks; federal system does not include all deposit-taking entities of significance at the provincial level.
- Core Principle 5 — Grade: LC. Licensing is a carefully vetted two-step process; OSFI does not carry out fit and proper assessments of new directors and senior management on an ongoing basis after licensing.
- Core Principle 6 — Grade: LC. Annual “Return of Shareholders” does not always identify ultimate beneficial shareholders; no specific requirement to notify OSFI of material adverse changes affecting the suitability of a major shareholder or controller.

*Source: CANADA; INTERNATIONAL MONETARY FUND.*

### 7. Major acquisitions  C

### 7. Major acquisitions  C

### Major acquisitions
- The Bank Act sets clear limits upon and requirements for Ministerial approval of major acquisitions carried out by banks.
- Where an acquisition is subject to Ministerial approval, the regime is implemented through OSFI and the Minister.
- OSFI prepares prudential assessments and only recommends approval to the Minister if OSFI is satisfied it is suitable to do so.
- OSFI’s assessment considers all requirements of prudential soundness, including the future supervisability of the group following the acquisition.
- There is uncertainty whether a “prudential veto” is securely in place; this issue is reflected in the grading of CP2.
- No approval is required for acquisitions made through a foreign or provincially regulated subsidiary, which exposes OSFI and the bank to the risk that acquisitions are approved by foreign regulators with differing standards or powers.

### Supervisory approach  C
- OSFI has developed an excellent supervisory approach supporting multi-perspective risk analysis, particularly identifying significant activities within the firm.
- The risk approach incorporates a forward-looking time dimension.
- OSFI links risk analysis to a supervisory outcome communicated via the intervention rating and “stages” of supervisory intensity.

### Supervisory techniques and tools  C
- OSFI applies high standards of supervisory practice and a “close touch” supervisory style and structure consistently.
- The approach enables OSFI to articulate and reinforce supervisory expectations and is perceived as accessible and willing to listen.
- Close understanding of counterparts can risk loss of direction and momentum; OSFI must guard against being slow to be assertive.

### Supervisory reporting  C
- OSFI receives standard prudential data, management information, and ad hoc data from firms.
- Gaps in prudential data relate to large exposures and related party lending (see CPs 19 and 20).
- OSFI publishes financial data on banks on its website.
- Management information supports focus on significant activities but is less amenable to peer group analysis due to lack of standardization.
- OSFI has an established process for regular review of reporting requirements and should ensure the process keeps pace with needs.

### Corrective and sanctioning powers of supervisors  C
- OSFI has a wide range of corrective and sanctioning powers under the Bank Act and a mandate requiring early intervention.
- OSFI and the CDIC designed a structured approach for progressively more intensive supervisory intervention.
- The intervention approach is predicated on OSFI’s direct powers; OSFI prefers voluntary traction with firms while underpinned by legal powers.
- OSFI builds legal cases at each intervention stage and uses “staging” to intensify restrictions (limitation on business, higher capital etc).
- Staging requires chief executives to report to boards, exerting transparency discipline; financial consequences of restrictions are likely to be felt especially in larger institutions.
- An institution might remain “staged” for a period while remedial action is taken; OSFI must maintain credible, situation-specific timelines to avoid relapse.

### Consolidated supervision  C
- OSFI has a strong legal and regulatory framework for consolidated supervision applied consistently.
- OSFI is mindful of risk distribution in groups and the need for strong risk management, internal controls, and information flow.
- OSFI requires solo entity information on parent banks for systemic banking groups in Canada while generally placing less emphasis on individual banks within groups, structuring work around “significant activity.”
- Recovery and resolution planning work requires scrutiny on a legal entity basis and has highlighted issues needing prudential assessment.

### Home-host relationships  C
- OSFI plays a more significant role as a home supervisor than a host supervisor; major Canadian banks are systemic in some foreign regions.
- OSFI monitors banks’ evolution in foreign territories and allocates supervisory resources accordingly.
- Home-host relationships are strong for significant overseas relationships, functioning smoothly where Canadian presence is strong locally but minor relative to group activities.
- Collegiate relationships are growing in confidence and effectiveness; work on crisis management, resolution, and recovery progresses in coordination with the CDIC.

### Corporate governance  C
- OSFI has a comprehensive supervision program for corporate governance at large and smaller banks.
- Notable features: very regular contact with directors (formal and informal) and a centralized unit responsible for corporate governance supervision.

### Risk management process  LC
- OSFI’s practical implementation of risk management supervision is of very high standard in scope, depth, and quality of analysis.
- Supervisors rigorously assess and rate inherent risk, the quality of risk management, and act on deficiencies.
- Specialist teams provide risk-based review and peer comparison.
- OSFI operates at a principles-based level and does not issue extensive detailed risk management guidance.
- The existing set of standards is inconsistent in format and application (guidelines vs. advisories), does not comprehensively cover all risk areas (credit risk, operational risk, problem asset management, concentrations and country risk), or is limited in application (market risk).
- Recommendation/observation: OSFI could provide a more comprehensive and consistent set of written guidance across all risk areas, potentially at a high level or based on BCBS guidance.

### Capital adequacy  C
- OSFI takes a proactive and conservative approach to capital adequacy; supervisors regularly assess capital management and planning and use stress testing.
- OSFI has fully adopted Basel II and Basel III and has accelerated the timeline for banks to implement fully phased-in requirements.
- OSFI retains its own leverage ratio requirement in addition to Basel risk-based ratios.
- Canada established a regime for domestically systemically important banks (D-SIBs) consistent with the BCBS standard and announced it will impose a 1 percent capital surcharge, effective in 2016.
- OSFI implements a rigorous program to review and approve banks’ internal models; recent credit risk IRB modeling reviews found deficiencies in some lending segments.
- OSFI communicates that there will be no capital reductions from modeling without associated improvements in risk measurement and management; continued vigilance is required.

### Credit risk  C
- OSFI’s credit risk supervision is effective and forward-looking with regular detailed on-site reviews of significant and higher risk portfolios.
- Emerging concerns are investigated and rectified; stress testing is actively used by OSFI and banks.
- OSFI has issued guidance on specific areas (residential mortgages, valuations, capital requirements for credit risk) but lacks an overarching credit risk management guideline.

### Problem assets, provisions, and reserves  C
- Supervisors review loan classification appropriateness and recognition speed during on-site credit reviews.
- Credit quality indicators for the industry and individual banks are closely monitored and reported internally.
- Levels of problem assets in most lending segments remain low, but attention to problem asset management processes is critical to detect early negative trends.
- Problem asset management is well covered in on-site reviews, but OSFI provides little published guidance.

### Concentration risk and large exposure limits  LC
- Concentration risk management is mentioned at a high level in guidance on stress testing and ICAAPs; supervisors monitor concentrations and take action when excessive.
- OSFI’s risk surveillance, specialist teams, and Emerging Risk Committee identify and monitor concentrations industry-wide through stress testing and cross-industry reviews.
- OSFI imposes a 25 percent of capital limit on large exposures.
- OSFI maintains a database of larger banks’ exposures above $10 million, but there is no formal regulatory return for large exposure limit compliance reporting covering all banks or a clear notification threshold for action or closer monitoring.
- The limit for subsidiary banks is substantially higher: 100 percent of capital.

### Transactions with related parties  LC
- By law, transactions with related parties are prohibited with certain key exceptions.
- The Bank Act sets explicit board reporting and oversight requirements for related party transactions.
- OSFI supervisors typically review banks’ oversight of compliance obligations generally on an annual basis.
- There is no formal regulatory return for reporting related party exposures more frequently to OSFI.
- The Bank Act limit on aggregate related party exposures to directors and officers is 50 percent of capital, which is very high relative to large exposure limits and international expectations.

### Country and transfer risks  C
- OSFI supervisors monitor and ensure appropriate management of key country exposures of concern (examples: Eurozone, U.S., and Caribbean loan books).
- Supervisors of the large banks regularly obtain reports on banks’ largest foreign exposure concentrations.
- OSFI has not issued specific guidance on management of country and transfer risks that clarify OSFI’s expectations, though country risk is covered at a high level under other guidance.

### Market risk  C
- OSFI’s market risk supervision program for large banks appears comprehensive, including on-site practice reviews and detailed model review.

### Interest rate risk in the banking book  C
- OSFI has issued guidance on interest rate risk management; banks are expected to reflect interest rate risk in their ICAAPs.
- Supervisors conduct regular off-site monitoring through standard reporting of interest rate shock impacts on earnings and capital.
- A proactive approach to interest rate risk management is critical in a rising interest rate environment.

### Liquidity risk  C
- OSFI has maintained a strong focus on liquidity management since the financial crisis.
- Banks have significantly increased liquidity reserves and adopted more prudent funding profiles relative to the start of the crisis.
- OSFI developed its own liquidity measure and has progressively raised expectations for prudent liquid assets, moving toward compliance with the new Basel III measures and reducing reliance on short-term wholesale funding.
- Much recent liquidity supervision for large banks has been conducted through off-site monitoring.

### Operational risk  C
- OSFI has a strong program for assessing operational risk and employs a dedicated operational risk team including technology risk experts.
- Reviews promote best practice and regular cross-industry reviews highlight concerns (legacy systems, cyber risks).
- OSFI has relied on BCBS Sound Practice guidance for expectations but has not issued its own overall operational risk guidance; targeted guidance (outsourcing) has been issued.

### Internal control and audit  C
- OSFI’s supervision includes high interaction with banks’ internal audit functions and their reporting to audit committees.
- Supervisors balance oversight and use of internal audit work without placing undue reliance on it.

### Financial reporting and external audit  C
- OSFI maintains strong ongoing communication channels with external auditors and can leverage their resources when needed.
- Auditors have a statutory duty to report to the bank and OSFI on matters affecting the “well being” of the bank, but the ‘well being letter’ requirements may not cover all prudential interests.
- The statutory nature of this requirement may hinder timely and open communication of potential prudential concerns.
- OSFI expects to require banks to adhere to new BCBS guidance on external audit, which will include a more generalized reporting requirement on matters of prudential concern.

### Disclosure and transparency  C
- OSFI has implemented all Pillar 3 requirements and has been proactive in enhanced disclosure expectations for Canadian banks.
- Canadian D-SIBs will be expected to adopt the Financial Stability Board’s Enhanced Disclosure Task recommendations.
- Pillar 3 requirements have been issued as Advisories rather than a Guideline, providing OSFI greater flexibility for technical or changing policy matters.
- Observation: OSFI could provide greater financial and risk data in a more usable format for public analysis.
- The OSFI data access tool on its website is not particularly user friendly, does not facilitate analysis over time or across peers, nor flexible access (for example, via spreadsheet).
- Some other regulators publish substantially more time series information on bank performance and risk indicators at aggregate and individual institution levels.

*Source: _cr1471 - 7. Major acquisitions  C*

### 29. Abuse of financial services LC The last FATF review identified concerns in relation to

### 29. Abuse of financial services LC The last FATF review identified concerns in relation to

### Key assessment findings
- The last FATF review identified concerns in relation to FINTRAC’s supervisory practices and the lack of enforceable customer due diligence requirements in the PCMLTFA.
- In terms of the assessment under the Basel Core Principles and the specific formulation of the criteria, the test is not identical; however minor deficiencies remain including areas in which greater clarity or focus are desirable.

### Recommended actions to improve compliance with the Basel Core Principles and the effectiveness of regulatory and supervisory frameworks
- CP1: It is recommended that ways be explored to strengthen the enforceability of guidelines through statutory changes to the powers of OSFI under the Bank Act. It is further recommended that consideration be given to whether there are any key prudential standards that would benefit from a migration to the format of a regulation.
- CP2: It is recommended that the authorities codify the “prudential veto” clearly in the Bank Act in respect of all approvals in which prudential considerations are relevant (for example, transfer of ownership and investment).
  - It is recommended that the authorities consider exempting the supervisors from the government’s fiscal controls and administrative guidance, as in the case of some other financial agencies, in order to enhance OSFI’s financial autonomy.
- CP3: It is recommended that more frequent and structured arrangements, modeled perhaps on current formats, are put in place to ensure that relevant information is shared actively and proactively as necessary between provincial and federal authorities, rather than only on request, in order to enhance firm- and group-specific supervision and wider systemic understanding.
- CP4: The scope of the federal system does not, and cannot under current law, encompass all deposit-taking entities of significance. The relevant Canadian authorities should assess and as necessary revise laws and arrangements to ensure the soundness and stability of the entire financial system within Canada, and not only the federal aspect of that system.
- CP5: OSFI should institute a policy of assessing the fitness and properness of all new board members and new senior management executives.
- CP6: OSFI should consider a standardized form for the annual reporting of shareholdings and should institute an annual check on ultimate beneficial ownership on all institutions in order to obtain comfort that OSFI will have timely notification should indirect holdings or changes in ownership and control—whether increasing or decreasing—take place.
  - There should be a specific requirement for banks to notify OSFI of material adverse changes affecting the suitability of a major shareholder or controller. It is recommended that at a minimum OSFI introduce an explicit reporting requirement. If necessary, a requirement to file such a report to the Superintendent could be included in the next revision of the Bank Act.
- CP7: It is recommended that the Bank Act be amended to introduce an approval, or at minimum, notification requirement to OSFI when an acquisition is made through a foreign or provincially-regulated subsidiary.
- CP8: It is recommended that OSFI intensify its analysis of groups from a legal entity based perspective to complement the understanding yielded by the examination of significant activities. OSFI should also review the effectiveness of its communication and coordination with non-bank regulators for entities within the consolidated groups.
- CP9: It is recommended that OSFI consider whether its internal monitoring systems could be enhanced to further support the overarching, and risk-focused view of the institution to ensure timely actions and progress.
  - A requirement should be introduced, through amendment to the Bank Act or otherwise, for a bank to notify OSFI in advance of any material adverse development in the institution.
- CP10: It is recommended that OSFI review its prudential data needs to support ongoing supervision, taking into account particularly recent work on recovery and resolution planning which places greater focus on the individual legal entities.
- CP11: It is recommended that OSFI institute post facto reviews of staging cases in addition to interim reviews in order to identify how best to ensure appropriate momentum through the staging phase.
  - The authorities should consider whether further legal authority or powers are required to enable them to move more promptly to address situations where a bank’s business model is deemed or proved to be non-viable over a period of time.
- CP12: OFSI should require solo data for all regulated banks within the consolidated banking groups where this is not already the practice.
  - It is recommended that OSFI require periodic data on intra-group transactions.
  - OSFI should formalize its policy to always make access to parental data and notification of material parental business and governance changes a condition of licensing for those instances where the parent entity is not a regulated entity.
- CP13: It is recommended that in its recovery planning, OSFI consider and anticipate the potential needs in a crisis of supervisors in jurisdictions where the Canadian entity is material.
- CP15: OSFI should review its current set of prudential Guidelines relating to risk management against international standards and other OSFI prudential expectations and issue expanded or new guidance to close any identified gaps, particularly in areas such as credit risk.
- CP16: Over time, OSFI may wish to consider whether the D-SIB capital surcharge should differ across banks according to their risk or systemic importance. It is recommended that OSFI seek a formal BCBS Basel III FAQ to be published regarding the ‘purchase for cancellation’ provision for Additional Tier 1 and Tier 2 capital instruments.
- CP17: As discussed under BCP 15, OSFI should develop comprehensive guidance on credit risk management in line with international standards to ensure its expectations and minimum standards are well understood.
- CP18: OSFI should consider setting out its expectations with respect to problem asset management in comprehensive guidance on credit risk management, as discussed in BCP 15 and BCP 17.
- CP19: It is recommended that OSFI strengthen its large exposure reporting and monitoring regime to include, for example, regular regulatory reporting of compliance and notification of exposures greater than a specified level of capital. OSFI’s Large Exposure Guideline dates from 1994 and OSFI should consider updating its guidance in light of the BCBS project currently underway and to cover concentration risks more generally. OSFI should also reconsider whether the higher exposure limit for subsidiary banks continues to be appropriate.
- CP20: OSFI should establish a more formalized regime, including regular regulatory reporting, for monitoring related-party transactions. In addition, OSFI should consider whether the Bank Act limit on aggregate related party exposures of 50 percent of capital to directors and officers should be lowered to a level more consistent with the limits on large exposures.
- CP21: OSFI should consider issuing guidance documenting its expectations for the management of country and transfer risks.
- CP22: OSFI should consider clarifying its market risk management expectations for foreign bank branches and banks with small or no trading books, which are not subject to the Capital Adequacy Requirement Guideline on Market Risk.
- CP24: OSFI should ensure that, even with significant off-site analysis, reporting and review occurring, supervisors maintain regular on-site coverage of liquidity risk management to verify the effective application of policies and controls in practice.
- CP25: OSFI should consider issuing more comprehensive guidance on setting out its expectations for operational risk management and covering areas such as business continuity expectations.
- CP28: As OSFI and the banks view Pillar 3 requirements as minimum required disclosure practice, OSFI should consider issuing Pillar 3 requirements in Guideline format.
  - OSFI may wish to review best practices in other countries and consider publication of time series data sourced from its regulatory returns that would enhance the public understanding of banks’ operations and risk profile.
- CP29: It is recommended that OSFI explicitly state its expectation that banks’ compliance officer (CAMLO) is appointed at the management level.
  - It is also recommended that Guideline (B-10) on Outsourcing of Business Activities, Functions and Processes be amended to more clearly establish the requirement that the screening processes that are in place when the bank is entering into outsourcing relationships will ensure high ethical and professional standards.

### Authorities’ response
- The Canadian authorities express appreciation to the IMF and its assessment team for their assessment of the Canadian banking sector.
- The Canadian authorities share the view that Canada, primarily through the Office of the Superintendent of Financial Institutions (OSFI), has a very high level of observance with the Basel Core Principles for Effective Banking Supervision (BCPs).
- Canada is highly committed to the FSAP process and the insights that the IMF can provide with respect to a country‘s financial sector through this process. Canada fully agrees that it is important to continually review and seek to improve the regulatory framework and supervision practices.
- The IMF has made a number of observations and recommendations, which could further enhance the very high degree of compliance with the BCPs. These will be given consideration by the relevant Canadian authorities, having due regard to the various initiatives currently planned or underway, and taking into account the features of the Canadian regime that contributed to the performance of the Canadian banking system during and post-crisis.

*Source: _cr1471 - 29. Abuse of financial services LC The last FATF review identified concerns in relation to*

---


_Source: https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr1471.pdf_