OSFI B-10 for Vendors: What a Bank's Vendor Review Asks

OSFI Guideline B-10 (Third-Party Risk Management) sets the rules Canadian banks, insurers, and trust and loan companies follow when they assess, contract with, and monitor their suppliers. B-10 does not regulate vendors directly. If you sell to a federally regulated financial institution, B-10 is the script behind the institution's due diligence questionnaire, contract redlines, and periodic review of you.

What is OSFI Guideline B-10?

OSFI Guideline B-10 is OSFI's third-party risk management guideline for FRFIs. The current version of Guideline B-10 covers any business or strategic arrangement between an FRFI and an outside entity or individual, by contract or otherwise.

B-10 explicitly lists these third parties, among others:

• Outsourced services
• Independent consultants
• Cloud service providers
• Managed service providers
• Technology companies that deliver financial services

Only customer relationships (depositors, policyholders) and employment contracts are excluded.

B-10 is organized around six expected outcomes, each tied to a part of the review a vendor will see.

Does OSFI B-10 apply to vendors directly?

OSFI Guideline B-10 applies to the FRFI, and the FRFI remains accountable for any activity handed to a third party. Principle 1 states that the FRFI is ultimately accountable for managing the risks arising from all types of third-party arrangements.

The obligations still reach vendors through three channels:

1. Due diligence. The bank must assess you before signing and periodically afterward.
2. The contract. B-10 expects written agreements for high-risk and critical arrangements to carry the provisions in Annex 2.
3. Regulator access. B-10 states that OSFI's supervisory powers should not be constrained because an activity is outsourced, and expects the agreement to let both the FRFI and OSFI evaluate the vendor's risk management practices for the service.

For a vendor, B-10 is a commercial requirement. Nothing in B-10 penalizes a SaaS company, but a bank that cannot satisfy B-10 for your arrangement has a supervisory problem. Declining to sign is one way for the bank to solve the problem.

When did OSFI B-10 take effect, and what about older contracts?

OSFI B-10 took effect on May 1, 2024. OSFI's response to consultation feedback set that date and asked that arrangements entered into before May 1, 2024 be reviewed and updated at the earliest opportunity. A February 22, 2024 amendment extended B-10 to foreign bank and foreign insurance branches, with a March 31, 2025 adherence date.

Vendors with bank contracts signed before May 2024 should expect B-10 language at renewal or at the next material change, since B-10 also expects due diligence and a fresh risk assessment at those points.

How does a Canadian bank decide how hard to review a vendor under B-10?

A bank scales the B-10 review to two ratings the bank assigns to your arrangement: criticality and risk. B-10 defines criticality as importance to the FRFI's operations, strategy, financial condition, or reputation, with the emphasis on impact regardless of likelihood.

B-10 gives examples of proportionality: an exit plan may not be needed for a low-risk arrangement, nor a legal review for a low-risk, short-term one. For a critical or high-risk arrangement, every expectation in Section 2 of B-10 becomes a minimum.

What stages of the B-10 lifecycle will a vendor go through?

OSFI B-10 expects the bank's third-party risk management framework to span the whole lifecycle of an arrangement, from sourcing and due diligence through to exit. Each stage produces a different request to the vendor.

Principle 4 and section 2.2.2.2 of B-10 expect due diligence before the contract, at renewal, and periodically after, so passing onboarding does not end the questions. The vendor risk assessment guide covers how buyers run this cycle from their side.

Which contract provisions does OSFI B-10 expect in a bank's vendor agreement?

OSFI B-10 Annex 2 lists the provisions FRFIs should include in agreements for high-risk and critical arrangements, and suggests considering them for others in proportion to risk. Sections 2.2.4 to 2.3.5 add detail on audit rights, subcontracting, data, and continuity. The table below lists the clauses a vendor's legal team will see in the bank's redline.

Data location questions in a B-10 review come from two places. Section 2.2.2.3 asks the FRFI to review the legal, political, and security risks of any third party or subcontractor operating outside Canada. Section 2.3.2.2 restates the federal statutes that require certain prescribed FRFI records to be kept in Canada, or accessible to OSFI where an exemption applies.

What evidence answers each OSFI B-10 due diligence question?

Each OSFI B-10 due diligence question maps to a document a prepared vendor already has. The table below lists what a Canadian bank's third-party risk team typically asks and the evidence that answers each question. B-10 names none of these documents. The evidence column reflects what bank reviewers tend to accept in practice, tied to the B-10 expectation in the first column.

Enterprise third-party risk teams often ask a second question alongside is the vendor secure: does the product let us stay secure. Product features that answer the second question include:

• SSO
• Role-based access mapped to directory groups
• Exportable security logs

The complementary user entity controls in a SOC 2 report show which controls the vendor operates and which the customer operates. B-10 section 4.1 asks the bank to be clear on who manages which technology controls.

Where do SOC 2 and ISO 27001 fit in an OSFI B-10 review?

SOC 2 and ISO 27001 are voluntary frameworks a vendor chooses to adopt, and B-10 names neither. B-10 is a supervisory guideline that sets OSFI's expectations for the FRFI. B-10 makes room for independent assurance in two places:

• Section 2.3.3.3 lists independent reports provided by third parties as an acceptable audit method.
• Section 4.2 expects third parties with elevated technology and cyber risk to meet FRFI standards or recognized industry standards, including for access management and data security.

A SOC 2 Type II report tests whether controls operated over a period, so bank reviewers tend to ask for a SOC 2 Type II report by name. An ISO 27001 certificate shows a certified information security management system with a defined scope. Either one answers a large share of the security questionnaire. The trade-offs between the two are covered in ISO 27001 vs SOC 2: key differences and how to do both, and the fintech-specific scoping questions in SOC 2 for Toronto fintech and insurtech.

A vendor's own vendor management also gets examined, because B-10 asks the bank to assess the adequacy of the vendor's third-party risk program. The SOC 2 CC9.2 vendor risk management post covers the SOC 2 control that evidences a vendor's own vendor management, and the data center as a subservice organization post covers how subservice organizations appear in a SOC 2 report.

How does OSFI B-10 connect to OSFI's incident reporting requirements?

OSFI B-10 requires a bank's vendor contracts to support the bank's own incident reporting to OSFI. Under OSFI's Technology and Cyber Security Incident Reporting Advisory, FRFIs must report a technology or cyber security incident to OSFI's Technology Risk Division and their Lead Supervisor within 24 hours, or sooner if possible. The Advisory lists impact to a third party affecting the FRFI as a reportable characteristic, and gives a breach at a material third party as an example.

B-10 section 2.4.2.2 closes the loop: the FRFI's agreements should contain provisions that let the FRFI meet the Advisory, including prompt notice of technology and cyber incidents at the vendor or the vendor's subcontractors, with information in line with the Advisory. The FRFI's own deadline to OSFI is 24 hours, so the vendor's contractual notice window is likely to be shorter.

Section 2.4.2.4 adds that the FRFI should ask the third party to perform and share a root cause analysis, commensurate with the incident's severity.

How does OSFI B-10 relate to OSFI Guideline B-13?

OSFI Guideline B-13 (Technology and Cyber Risk Management) is B-10's sibling: B-10 governs how a bank manages third parties, and B-13 governs how the bank manages technology and cyber risk in the bank's own operations. The two meet in B-10 Annex 1, which asks the FRFI to assess a third party's capacity to manage technology and cyber risks in accordance with B-13.

B-10 decides how deeply a vendor is reviewed. B-13 drives many of the security questions inside that review. One security program with SOC 2 or ISO 27001 evidence can answer both.

Payment service providers that serve banks also answer to the Bank of Canada. The RPAA compliance guide for payment service providers covers the operational risk and incident rules the Bank of Canada sets.

What should a vendor prepare before an OSFI B-10 review?

Use this checklist before a Canadian bank, insurer, or trust company sends the first B-10 questionnaire.

A vendor that hands over this package in the first week answers most of B-10's due diligence factors before the questionnaire starts. The security questionnaire automation post covers how to keep the answers current between reviews, and the Bill C-8 supplier requirements post covers the parallel flow-down to banks under the Critical Cyber Systems Protection Act, which received Royal Assent in June 2026 and is coming into force in phases.

What does a vendor gain by building for OSFI B-10 once?

OSFI B-10 asks banks to prove, arrangement by arrangement, that their suppliers have a mature security program. A vendor with a working program, current SOC 2 or ISO 27001 evidence, and prepared contract positions turns each bank review into a document handover. A vendor without them rebuilds the same answers for every institution while the deal waits.

Frequently asked questions about OSFI B-10

Does OSFI B-10 apply to SaaS vendors?

OSFI B-10 applies to federally regulated financial institutions, not to SaaS vendors directly. Vendors feel B-10 through their customers: banks, insurers, and trust companies must assess, contract with, and monitor third parties under B-10, so a SaaS company selling to them receives due diligence questionnaires, contract clauses on audit and incident notification, and periodic reassessments.

When did OSFI Guideline B-10 come into effect?

OSFI Guideline B-10 took effect on May 1, 2024. Third-party arrangements starting on or after that date are expected to adhere to B-10, and arrangements entered into earlier should be reviewed and updated at the earliest opportunity. Foreign bank and foreign insurance branches had until March 31, 2025 to adhere.

Is a SOC 2 report enough to pass a bank's B-10 due diligence?

A SOC 2 Type II report answers most security control questions in a B-10 review, but not the whole review. B-10 also covers financial strength, subcontractors, business continuity testing, incident notification timing, insurance, exit planning, and contract terms such as audit rights. Vendors need prepared answers and contract positions for those items as well.

Can OSFI audit a bank's vendor under B-10?

OSFI B-10 expects the bank's agreement with a vendor to give both the bank and OSFI the right to evaluate the vendor's risk management practices for the service, or to appoint independent auditors, and to access audit reports. B-10 also states that OSFI's supervisory powers should not be constrained because an activity is outsourced.

What is a critical third-party arrangement under OSFI B-10?

Under OSFI B-10, a critical third-party arrangement provides goods or services that, if disrupted, could put at risk the FRFI's continued operation, safety and soundness, or role in the financial system. For critical and high-risk arrangements, all of B-10's Section 2 risk management expectations are treated as minimums.

What is the difference between OSFI B-10 and B-13?

OSFI B-10 covers how a financial institution manages risk from third parties across the relationship lifecycle. OSFI B-13 covers how the institution manages technology and cyber risk in the institution's own operations. The two guidelines connect in B-10 Annex 1, which asks institutions to assess whether a third party can manage technology and cyber risk in line with B-13.