OSFI warns AI could amplify cyber and technology risks for lenders
Canada’s banking regulator is warning that growing reliance on a small number of AI and cloud providers could leave financial institutions exposed to disruptions affecting several firms at once.
In its fall risk outlook, released Thursday, the Office of the Superintendent of Financial Institutions said a cyber incident, outage or operational failure at a major provider could have consequences across the financial sector.
“As a result, third-party concentration risk may pose challenges to operational resilience as AI adoption expands,” the regulator said.
With many technology services based outside Canada, OSFI said greater AI adoption is likely to deepen financial institutions’ reliance on foreign providers, leaving them more exposed to technology restrictions or policy decisions in other countries.
OSFI said AI is making cyberattacks faster and more sophisticated, while putting capabilities that once required significant technical expertise within reach of a broader range of attackers.
Advanced systems can identify and combine weaknesses across interconnected networks, turning seemingly minor vulnerabilities into more damaging attacks. That leaves institutions less time to detect threats and respond, although the same technology can also help strengthen cyber defences.
Oversight needs to keep pace
OSFI said financial institutions may find it increasingly difficult to keep track of how their critical service providers use AI, the vulnerabilities that arise and the controls in place to manage them. That makes ongoing monitoring and oversight of those relationships more important.
The regulator also acknowledged AI’s potential to improve productivity and risk management, while emphasizing that governance, controls and testing need to advance alongside adoption. Boards and senior management remain accountable for managing the risks.
“In an era of advancing AI capabilities, resilience is a competitive advantage,” Superintendent Peter Routledge said in an accompanying release.
“Financial institutions that harness AI responsibly while managing cyber, technology, and third-party risks will position themselves to thrive in a complex environment.”
The update maintains OSFI’s focus on real estate secured lending, including mortgages, non-bank financial institutions and funding and liquidity risks. While economic uncertainty and geopolitical tensions continue to weigh on the operating environment, the regulator said federally regulated financial institutions remain resilient and profitable.
Visited 1 times, 2 visit(s) today
Annual Risk Outlook Office of the Superintendent of Financial Institutions OSFI OSFI’s annual risk outlook Peter Routledge
Last modified: October 8, 2026
