Compliance Briefing — May 1, 2024

Executive briefing: The Office of the Superintendent of Financial Institutions (OSFI) Guideline B-10 becomes effective on May 1, 2024. Federally regulated financial institutions must demonstrate end-to-end governance over third-party arrangements, including cloud, fintech partnerships, and material outsourcing. Boards are responsible for approving risk appetite, while management must maintain lifecycle inventories, criticality classifications, and exit plans.

Key compliance checkpoints

• Board accountability. OSFI expects directors to approve third-party risk frameworks, review concentration metrics, and receive timely incident reporting.
• Lifecycle controls. Institutions must document due diligence, contract clauses, performance monitoring, and termination activities for each relationship, with enhanced scrutiny for critical services.
• Data residency and resilience. B-10 requires validation of data location, subcontracting arrangements, and business continuity testing that aligns with BCP and technology resilience expectations.

Control alignment

• Integrate B-10 with OSFI Guideline B-13. Map technology and cyber risk management controls to third-party oversight so cloud migrations and managed services align with B-13 expectations.
• Contract remediation. Refresh service-level agreements, audit rights, subcontractor approvals, and termination clauses to address B-10’s minimum contract requirements.
• Concentration dashboards. Develop reporting that aggregates exposures by vendor, geography, and service category to identify systemic risk concentrations.

Enablement moves

• Deploy third-party risk platforms or enhance GRC tools to capture due diligence evidence, issue tracking, and renewal workflows.
• Run tabletop exercises simulating vendor outages to validate exit strategies and contingency plans.
• Coordinate with procurement and legal teams to enforce onboarding checklists, residual risk sign-offs, and periodic reassessments.

Sources

• OSFI Guideline B-10: Third-Party Risk Management
• OSFI outsourcing expectations and implementation timeline

Zeph Tech maps OSFI B-10 controls to vendor inventories, contract clauses, and resilience testing so Canadian institutions can evidence compliant third-party oversight.

Related briefings

Curated signals from the same pillar or overlapping topics.

Compliance · Credibility 89/100 · December 5, 2023

Compliance Briefing — December 5, 2023

MAS and the Singapore FinTech Association launched a voluntary code of conduct for ESG rating and data providers, setting governance, transparency, and conflict management benchmarks for financial institutions’ vendors.

Compliance · Credibility 50/100 · October 20, 2025

Compliance Briefing — October 20, 2025

New York DFS cybersecurity amendments hit their final compliance deadline on 27 October 2025, requiring covered entities to evidence enhanced third-party risk governance, asset inventories, and incident notification…

Compliance · Credibility 86/100 · March 31, 2021

Compliance Briefing — March 31, 2021

The UK PRA’s Supervisory Statement SS2/21 set binding expectations for outsourcing and third-party risk, linking operational resilience mapping, contractual safeguards, and exit planning to enforcement starting in 2022.

Compliance · Credibility 89/100 · June 1, 2020

Compliance Briefing — June 1, 2020

Detailed briefing on the DOJ’s June 2020 Evaluation of Corporate Compliance Programs update, with risk-based design, governance, documentation expectations, and enforcement implications for corporate compliance leaders.

Compliance · Credibility 86/100 · April 24, 2024

Compliance Briefing — April 24, 2024

Canada’s House of Commons passed Bill C-27, advancing the Consumer Privacy Protection Act to the Senate and signalling organizations to ready GDPR-level consent, automated decision notices, and tribunal appeal processes…

Continue in the Compliance pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

• Third-Party Risk Oversight Playbook — Zeph Tech

  Operationalize OCC, Federal Reserve, EBA, and MAS outsourcing expectations with lifecycle controls, continuous monitoring, and board reporting.

• Compliance Operations Control Room — Zeph Tech

  Implement cross-border compliance operations that satisfy Sarbanes-Oxley, DOJ guidance, EU DORA, and MAS TRM requirements with verifiable evidence flows.

• SOX Modernization Control Playbook — Zeph Tech

  Modernize Sarbanes-Oxley (SOX) compliance by aligning PCAOB AS 2201, SEC management guidance, and COSO 2013 controls with data-driven testing, automation, and board reporting.