Canada's federally regulated financial institutions (FRFIs) face a fixed deadline: full adherence to the Office of the Superintendent of Financial Institutions (OSFI)'s Guideline E-21, covering operational risk management and resilience, is required by 1 September 2026.
E-21 is the new expectation. It sits on top of Guideline B-10, the third-party risk management guideline that has been in force since May 2024. The two are connected: an institution cannot demonstrate E-21 resilience if its B-10 third-party foundations are not already operational.
In practice, an examiner wants to see three things.
1. That third-party relationships are governed, meaning someone senior owns the risk and escalation is documented, not just written into a policy.
2. That vendors are tiered by the risk they pose rather than what they cost.
3. institution has tested how it would keep running if a critical third party failed.
This article defines each in plain terms, explains what B-10 and E-21 ask of FRFIs, and shows where a vendor management platform carries the load.
What is the risk of doing nothing?
OSFI's guidelines are expectations with consequences. If an institution cannot show it meets them, OSFI can order remediation, place conditions or restrictions on how it operates, and mark down its supervisory rating.
There is a financial cost too. OSFI can impose monetary penalties, and since September 2025 it has said it will use them more readily, and for smaller breaches than before. Not complying with a condition it sets, or withholding information it asks for at examination, are penalised in their own right.
Two things cannot be faked. A programme thrown together before an examination shows it, because the evidence trail only starts when the notice arrives. And a vendor no one is monitoring can fail quietly until customers feel the outage. The deadline is the visible pressure. The unmanaged failure does the damage.
Why is data residency a critical consideration for Canadian FRFIs?
B-10 requires FRFIs to understand where their vendor, contract, and risk data is geographically stored, who can access it, and under what legal jurisdiction, including data held in external systems by the vendors that provide third-party risk management services to the institution.
The risk is specific: data stored on infrastructure subject to a foreign jurisdiction, particularly US-hosted or US-owned platforms subject to the CLOUD Act, may under certain conditions be accessible to foreign law enforcement without the FRFI's consent, creating a conflict with Canadian privacy law and OSFI's expectation of data control. When you choose a third-party risk platform, three things shape your data residency risk:
- Where the data is hosted. This sets the country your data physically sits in.
- The provider's country of incorporation and ownership. This sets which governments and regulators can legally compel the provider to hand the data over, wherever it happens to be stored.
- Independent security certification, such as ISO 27001. This gives outside assurance that the provider's information security controls are sound.
What do B-10's six outcomes require of FRFIs?
B-10 sets out six expected outcomes for FRFIs, some harder to achieve than others. Here is what each one asks of the institution.
- Governance and accountability. The board maintains oversight of the third-party risk management framework, with clear accountability assigned. You likely do not need a new governance structure: most institutions extend the enterprise risk governance they already have, then decide who owns third-party risk and how escalation is documented.
- Risk identification and assessment. Every third-party relationship is identified, and the risk each one poses is assessed against the institution's risk appetite at a frequency that reflects how relationships change. This is the foundation that tiering, monitoring, and contract design all depend on.
- Contract and relationship management. Contracts contain the provisions B-10 needs: audit rights, incident notification, data handling, and termination terms that do not leave you exposed. Contracts predating B-10 must be reviewed and remediated, and new ones must meet the standard at origination.
- Ongoing monitoring. Continuous rather than periodic activity, covered in detail below.
- Technology and cyber risk transparency. Also continuous, and closely tied to OSFI's Guideline B-13. Like monitoring, this is where programmes most often degrade after the initial build.
- Independent assessment. Independent assurance over the programme, not a self-assessment. OSFI will test whether the independence is real: an internal audit function reporting into the same governance it assesses does not satisfy this.
How does Gatekeeper support your B-10 programme?
A platform supports a compliance programme, it does not replace the institution's judgement. Gatekeeper handles the inventory, tiering, contract, and monitoring work directly, shares the governance and cyber-transparency work, and leaves independent assessment and board oversight where B-10 requires them to sit, with you.
| Requirement area | Support level | What Gatekeeper does |
|---|---|---|
| Third-party inventory | Direct support |
Every third-party relationship sits in one central repository on a single data model, with defined processes that keep the inventory current rather than static. |
| Risk tiering | Direct support |
Vendors are tiered by operational impact and data sensitivity. Tiers are reviewed on a schedule and reclassified when triggering events such as contract expansion, a change in data access, or an incident occur. |
| Contract provisions | Direct support |
Audit rights, incident notification, data handling, and termination provisions are enforced at origination through playbooks. Legacy contracts can be searched and reviewed to find and close the gaps that predate B-10. |
| Ongoing monitoring | Direct support |
Monitoring depth follows each vendor's tier, with certificate and attestation tracking, risk intelligence feeds, vendor self-reporting through the portal, and a documented, retrievable audit trail. |
| Governance and accountability | Shared |
Configurable workflows assign ownership, route approvals, and record escalation paths on a complete audit trail. Board-level oversight of the framework stays with the institution. |
| Technology and cyber transparency | Shared |
Vendor security attestations, certificates, and assessment records are tracked against each relationship. Interpreting them against your own cyber risk appetite stays with your team. |
| Data residency | Shared |
Gatekeeper keeps your vendor, contract, and risk data in one place, so you can show where it is stored and whose laws apply. Deciding whether any foreign-law exposure is acceptable stays with you. |
| Operational resilience and recovery (E-21) | Shared |
Critical third-party dependencies are identified and documented, with the audit trail that supports recovery planning. Defining return-to-service targets, testing recovery scenarios, and assessing concentration risk remain with the institution. |
| Independent assessment | Your responsibility |
Gatekeeper provides the complete, retrievable evidence trail an assessor relies on. The assessment itself must be carried out independently of the platform and of the governance structure it reviews. |
Direct support means Gatekeeper performs the work. Shared means Gatekeeper supports it but part of the task stays with your team. Your responsibility means the platform supplies the evidence but cannot perform the task itself.
Gatekeeper is built around the programme architecture B-10 describes: a single third-party inventory, risk tiering, contract control, and the continuous, documented monitoring an OSFI examination relies on. If this article has surfaced gaps in your current programme, Gatekeeper's vendor management software can help you close them before the deadline.
What is the third-party inventory problem, and how should FRFIs approach it?
None of B-10's outcomes can be met without an accurate, complete, and current picture of the institution's third-party relationships. The data most likely exists, but may not be centralised. That fragmentation is where compliance programmes stall, when institutions try to perfect their data before building governance around it.
The more productive approach is to build governance around the inventory as it stands, however incomplete. Establish a central repository and a policy that requires each function to contribute its third-party data to it. Define the process for keeping the repository current, and treat it as the backbone of a wider vendor management process rather than a one-off data clean-up. Improve the inventory continuously, including a review of existing contracts that may predate B-10 and lack the audit rights, notification obligations, or termination provisions the guidelines require.
A purpose-built vendor management platform provides the central repository this approach requires: one that captures vendor relationships, contract obligations, and risk data in a single model rather than across disconnected systems.
How should FRFIs structure risk tiering to satisfy OSFI examination?
B-10 requires that third-party risks be managed within the institution's risk appetite framework. The mechanism that makes this workable is risk tiering: a structured way of classifying third parties so that due diligence, monitoring, and contractual requirements are proportionate to the risk each relationship represents.
Tiering frameworks that fail under examination generally do so for one of two reasons. They use too many tiers. A three-tier model of low, medium, and high is sufficient to drive proportionate due diligence and monitoring decisions; additional tiers add administrative burden without improving outcomes. Or they define tiers by contract value, which represents commercial significance rather than operational risk.
A vendor that processes sensitive customer data under a low-value contract cannot be considered low-risk. A cloud provider supporting customer-facing digital banking services, for instance, may present significantly greater operational risk than a higher-value facilities management provider.
What OSFI will scrutinise is whether the criteria are consistently applied and defensible, and whether the due diligence and monitoring activity connected to each tier is proportionate. A three-tier model anchored to operational impact and data sensitivity satisfies these tests. Two tiers are sometimes sufficient for smaller institutions with limited third-party populations.
The tier assigned to a vendor must be changeable to reflect the ongoing nature of the relationship. A vendor that starts at a low tier can move to a higher one as the relationship deepens or the services expand. Risk tiers should be reviewed at least annually for ongoing relevance, with events such as contract expansion, changes in data access, or incidents driving reclassification as needed. Vendor management best practices increasingly treat risk tier as a dynamic attribute, reviewed on a schedule and revised as relationships change.
What does OSFI require for ongoing third-party monitoring?
Monitoring third-party relationships serves two purposes. The first is operational: determining whether vendors are delivering what was contracted, whether service levels are being met, and whether the quality of the relationship remains sufficient for the institution's needs.
The second is regulatory: providing the evidence that risks are identified as they evolve or disappear, and that the institution's understanding of its current risk exposure is current rather than historical.
Where monitoring identifies performance deterioration, relationship breakdown, or emerging risk, the consequences of not acting are proportionate to the degree of failure. Operationally, undetected deterioration can compound until an event, whether a missed service level, a complaint, or a more serious incident, makes it visible. From a regulatory standpoint, the absence of monitoring activity, or monitoring that cannot be evidenced, is itself a material gap, independent of whether any vendor has actually failed to perform.
The frequency and depth of monitoring should reflect the tier assigned to each vendor:
- High-tier vendors, typically those with access to sensitive data, critical systems, or significant operational responsibilities, generally warrant more frequent formal reviews, regular executive engagement, and continuous automated monitoring of cyber and operational indicators where available. Many institutions run quarterly reviews for this tier, though the cadence should reflect the nature of the risk.
- Medium-tier vendors generally suit annual formal reviews with event-driven interim reviews.
- Low-tier vendors require periodic, lower-intensity monitoring.
Tracking vendor performance systematically, not just at contract renewal, is what separates a monitoring programme that satisfies an examiner from one that merely satisfies an internal checklist.
Monitoring should also extend beyond the vendor's own performance to include visibility into their material third-party dependencies. Contractual disclosure requirements, and periodic confirmation that subcontracting arrangements have not changed, are what maintain that visibility.
Effective monitoring is bi-directional. The institution monitors vendor performance and risk from its own vantage point, but vendors should also carry a contractual obligation to self-report material incidents, breaches, or changes in their risk profile within defined timeframes. The monitoring framework should include a process for receiving, recording, assessing, and acting on those notifications.
As the third-party population grows, manual monitoring becomes unsustainable. Automation and risk-based prioritisation are essential at scale. Records of monitoring activity must be documented and readily available, because evidence of continuous oversight is what an OSFI examiner looks for. An otherwise well-designed monitoring programme that leaves no audit trail cannot provide that evidence.
What does E-21 require for third-party recovery planning?
E-21 requires FRFIs to hold documented recovery plans that account for third-party failure. A credible plan goes beyond naming critical dependencies. It needs a defined return-to-service target for each critical third-party relationship, documented alternative sourcing or manual workarounds where they exist, and tested scenarios that confirm the plan works. A workaround only counts if it has been rehearsed.
The concentration risk dimension is particularly demanding: where many FRFIs rely on the same provider for the same critical service, that provider's failure is a sector-wide outage rather than an isolated one, and recovery plans need to reflect that reality rather than assume the service can simply be replaced.
Recovery planning is the part of E-21 that sits outside a vendor management platform. The plans, the return-to-service targets, and the scenario testing are the institution's to build. Rather than start from a blank page, work from established sources: OSFI's own Guideline E-21 sets out the expectations, and recognised business continuity standards such as ISO 22301 provide a tested structure for recovery and impact-tolerance planning.
How should FRFIs prepare for the 1 September 2026 deadline?
A programme is examination-ready only when the institution can readily evidence that its third-party relationships are governed, risks are workably tiered, and resilience has been demonstrably tested. Documentation alone does not meet the bar.
Institutions that struggle at examination tend to have governance that exists as policy rather than practice, risk tiering that was set at launch and never revisited as the third-party population changed, and monitoring that can show a set of completed reviews but cannot demonstrate continuous activity. These are programme design failures that documentation cannot conceal.
With full E-21 adherence required by 1 September 2026, institutions should prioritise the foundations regardless of their current state of readiness: a centralised third-party inventory, a workable tiering model, and monitoring that generates a continuous, documented record. An examiner gives more credit for a programme that is genuinely operational in part than one that is complete on paper but cannot show it has actually been run.
The path to E-21 adherence runs through the same foundations for every FRFI: inventory, tiering, monitoring, and the evidence that each is being actively maintained. A vendor management programme structured around those foundations produces the continuous, documented record OSFI examiners expect to see.
Frequently asked questions
When is the OSFI E-21 deadline?
OSFI expects full adherence to Guideline E-21 by 1 September 2026. Compliance checks began on 1 September 2025, and scenario testing across all critical operations must be complete by 1 September 2027. Because E-21's third-party resilience expectations build on the third-party risk foundations set out in Guideline B-10, institutions should treat the 2026 date as the point by which both guidelines need to be operational, not just documented.
Does OSFI B-10 apply to all third-party relationships or only critical ones?
B-10 applies to all third-party arrangements, but the depth of due diligence, monitoring, and contractual requirements is proportionate to the risk each relationship represents. Every arrangement must be identified and assessed; the intensity of ongoing oversight scales with the tier assigned to each vendor based on operational impact and data sensitivity. A vendor management platform such as Gatekeeper keeps that full inventory in one place and applies monitoring depth by tier.
Does B-10 cover subcontractors and fourth parties?
Yes. FRFIs must assess the risks posed by their vendors' subcontractors, with oversight tailored to criticality, and contracts should require transparency over subcontractor use. The practical mechanism is contractual: disclosure requirements at origination and periodic confirmation that subcontracting arrangements have not materially changed. Holding those obligations and confirmations against each vendor record is part of keeping the third-party inventory current.
Which Canadian financial institutions are subject to B-10 and E-21?
Both guidelines apply to federally regulated financial institutions (FRFIs), a category that includes banks, federal credit unions, insurance companies, and trust and loan companies regulated by OSFI, including the Canadian branches of foreign banks and insurers. Provincially regulated institutions answer to their provincial regulator, whose requirements vary by jurisdiction and may differ from OSFI's framework in scope and timing.
Can a FRFI use a non-Canadian vendor under B-10?
B-10 does not prohibit non-Canadian vendors, but FRFIs must understand and manage the data residency risks that non-Canadian hosting introduces. Where a vendor's infrastructure or corporate ownership is subject to a foreign jurisdiction, the institution must assess whether its own data governance obligations can still be met and document that assessment as part of its third-party risk programme. Keeping vendor, contract, and risk data in one place makes it possible to show where data sits and whose laws apply.
What is the minimum viable risk tiering model under B-10?
B-10 does not mandate a specific tiering structure, but a three-tier model (low, medium, and high) is generally sufficient to drive proportionate due diligence and monitoring. Tiers should be defined by operational impact and data sensitivity, not contract value. OSFI examiners will assess whether the criteria are defensible, consistently applied, and connected to proportionate monitoring activity.
What happens if an FRFI is not examination-ready by the E-21 deadline?
OSFI can require remediation, impose conditions or restrictions on how the institution operates, and reflect the gap in its supervisory rating. It can also levy administrative monetary penalties, and in September 2025 it signalled it would use them more promptly and at lower thresholds than before. A programme assembled after an examination notice is identifiable as such, because evidence gaps and inconsistencies between policy and practice cannot be remedied by documentation alone. Institutions should treat September 2026 as an operational milestone, not a filing deadline.
How does Gatekeeper help with OSFI B-10 and E-21?
Gatekeeper gives FRFIs a single repository for every third-party relationship, risk tiering by operational impact and data sensitivity, contract provisions enforced at origination, and continuous monitoring with a documented audit trail. That covers the operational core of B-10 and supplies the evidence an E-21 examination relies on. Recovery planning, independent assessment, and board oversight remain the institution's responsibility.
.png)
.png)
.png)
-4.png)