Model Risk Directory emblemModel Risk Directory
OSFI E-23

OSFI Guideline E-23: Model Risk Management

The final E-23 guideline applies to Canadian federally regulated financial institutions, including banks, foreign bank branches, insurers, and trust and loan companies. It expands model risk management beyond deposit-taking institutions and explicitly addresses AI and machine-learning models. Expectations are proportional to the institution's size, strategy, risk profile, operational complexity, and interconnectedness. The guideline organizes requirements around enterprise-wide governance, risk-based classification, model lifecycle controls, review, deployment, monitoring, and decommissioning.

Published: Last updated: Last reviewed by: Model Risk Directory editorial team
Quick answer

OSFI E-23 is Canada's enterprise-wide model risk management guideline for federally regulated financial institutions. The final 2025 guideline takes effect on 1 May 2027 and applies a risk-based approach across model identification, inventory, risk ratings, lifecycle governance, independent review, monitoring, third-party models, and decommissioning.

Jurisdiction
Canada
MRM relevance
Direct model risk management guidance
Effective date
1 May 2027
Issuing body
Office of the Superintendent of Financial Institutions
Official reference
www.osfi-bsif.gc.ca/en/guidance/guidance-library/guideline-e

What it covers

  • Enterprise-wide MRM governance, reporting, resourcing, and senior-management accountability.
  • Periodic model identification and an accurate, controlled enterprise model inventory.
  • Inherent model-risk ratings that drive review, documentation, approval, monitoring, and mitigation intensity.
  • Model review that is sufficiently independent from development and use.
  • Lifecycle controls for design, deployment, monitoring, change, limitations, and decommissioning.
  • Coverage of external, vendor, AI, and machine-learning models using a proportional risk-based approach.

Adoption status

OSFI published the final revised guideline on 11 September 2025. It takes effect for all federally regulated financial institutions on 1 May 2027. Until then, affected institutions should distinguish implementation planning from current compliance status and confirm which earlier OSFI expectations still apply to them.

Reference only. This page explains what OSFI E-23 covers; it is not a claim that Model Risk Directory or any listed vendor satisfies it. Verify alignment directly against the issuing body's own current text before relying on it.

Sources. source 1 · source 2 · source 3. Data as of 2026-07-29. See methodology.

Related content

GuideModel Risk ManagementModel risk management (MRM) is the discipline of identifying, measuring, and controlling the risk that a bank's quantitative models produce incorrect or misused results. An MRM advisory firm helps build or run that discipline: model inventory, tiering, governance, and independent validation, rooted in Federal Reserve SR 26-2 (formerly SR 11-7) and OCC guidance.GuideModel Risk Management FrameworkA model risk management framework is the documented set of policies, roles, and processes an institution uses to identify, tier, govern, and validate its models. Under SR 26-2, a sound framework covers model development and use, independent validation, and governance and controls, scaled to the institution's size and model risk profile rather than applied uniformly.GuideModel Risk ValidationModel risk validation is the independent testing of a specific model's conceptual soundness, ongoing performance, and outcomes, performed by staff or a third-party firm genuinely separate from that model's development. It is the 'effective challenge' function required under SR 26-2 and SR 11-7, distinct from broader model risk management program design.GuideModel Risk Management SoftwareModel risk management software centralizes a bank's model inventory, tracks validation status and lifecycle events, and automates governance workflows like tiering, revalidation scheduling, and audit-trail documentation. It replaces manual spreadsheet tracking, which becomes unmanageable once an institution has more than a handful of tiered models.FrameworkOSFI E-23 vs PRA SS1/23: Canadian and UK MRM expectationsE-23 and SS1/23 are both principles-based MRM frameworks, but E-23 spans Canadian federally regulated banks and insurers while SS1/23 is a UK banking supervisory statement. Their terminology and implementation evidence should be mapped, not blended.FrameworkSR 26-2 vs OSFI E-23: US and Canadian model risk guidanceBoth frameworks use a risk-based approach to model governance, but they apply in different jurisdictions, use different structures, and have different effective timelines. This comparison is a planning aid, not a crosswalk or legal conclusion.