OSFI E-23 vs PRA SS1/23: Canadian and UK MRM expectations
E-23 and SS1/23 are both principles-based MRM frameworks, but E-23 spans Canadian federally regulated banks and insurers while SS1/23 is a UK banking supervisory statement. Their terminology and implementation evidence should be mapped, not blended.
Decision factors
| Factor | OSFI E-23 | PRA SS1/23 |
|---|---|---|
| Institution scope | Covers Canadian federally regulated banks, insurers, trust and loan companies, and relevant branches. | Covers PRA-regulated banks, building societies, and designated investment firms within its stated scope. |
| Model risk classification | Defines inherent and residual model risk and expects a model risk rating for non-negligible models. | Requires identification and classification proportionate to model complexity, use, and potential impact. |
| Lifecycle | Defines design, review, deployment, monitoring, and decommissioning components. | Addresses development, implementation, use, validation, monitoring, changes, and mitigants through five principles. |
| AI coverage | Explicitly includes AI and machine-learning methods in its model definition and expectations. | Applies based on model risk and notes technical capabilities needed for complex and emerging techniques. |
| Implementation date | Takes effect on 1 May 2027. | Effective from 17 May 2024 for firms in scope. |
Guidance
Multinational firms can reuse inventory, workflow, and evidence infrastructure, but each legal entity needs a traceable local mapping. Preserve differences in scope, effective date, model definition, risk rating, approval, validation, and reporting.
Related guides
Ready to source a firm? Send a procurement-safe scope and we route it toward qualified firms.
Request firms