OSFI put agents on its risk list. Scope them before you're asked

In April, AI threats were not one of the top concerns in the annual risk outlook from Canada's financial regulator, according to the Financial Post. By October, AI was the main subject.

What happened

On October 8, OSFI released its 2026 Semi-Annual Risk Outlook, and the update focuses on frontier AI. OSFI says frontier models can amplify cyber, technology, third-party and reputational risks. As capabilities advance, it says, institutions should strengthen governance, controls and testing. Boards and senior management remain accountable.

At the press conference, Superintendent Peter Routledge was more direct about agents. The Financial Post reports that he pointed to recent stories of agents reading their task authorizations liberally. He said: "That is a risk front and centre for us." He has also asked his team to start thinking about whether the financial system needs an AI safety code to set minimum standards. He was clear that no draft exists yet.

The Post also summarizes three points from the report:

• Frontier models can chain several vulnerabilities across connected systems.
• Institutions have less time to detect and respond to attacks.
• Cross-border dependence on AI providers will likely grow, because most of the top AI companies are outside Canada.

A week later, on October 15, the Financial Stability Board published its final Sound Practices for Responsible Adoption of Artificial Intelligence. The 12 practices fall into two groups: organisation-wide governance, and managing risk across the AI lifecycle. The same day, OSFI endorsed them. It said they complement its existing guidelines, including B-10 (third-party risk), B-13 (technology and cyber risk), E-21 (operational risk and resilience) and E-23 (model risk).

OSFI also notes that it issued technology risk bulletins this year on generative and agentic AI, and on frontier AI.

Why it matters for operations teams

None of this is a new rule, and that is the point. OSFI is saying its existing guidelines already apply to agents, and that it now reviews institutions with AI in mind.

In practice, three things change.

Agent permissions are now a supervisory topic. An agent that reads its authorizations liberally is an agent with more access than its task needs. A claims agent that can read a file can often also write to it. It may be able to send email from a shared inbox, or call an API with a service account built for a human team. That gap used to be an engineering detail.

Evaluation and human oversight are named practices. Three of the FSB's 12 practices apply directly:

• Assessing materiality and risk when a use case starts, and again later (v).
• Evaluating the performance of AI use cases (ix).
• Human oversight that is appropriate and effective (x).

A pilot with no test set and an informal review step won't map cleanly onto any of them.

Model providers are third parties, and they are concentrated. The FSB's twelfth practice covers third-party AI dependencies, and OSFI's outlook flags cross-border reliance. Say your claims intake agent, or the one handling broker correspondence, depends on a single foreign model endpoint. That is a B-10 question, not just an architecture choice.

What we would do

Here is the checklist we would work through for any agent at an OSFI-supervised institution, before anyone asks.

1. Tier every use case by materiality. A drafting assistant whose output a person always edits is not the same as an agent that updates policy records. Write down each tier, the reason for it, and when it will be reviewed. Controls follow the tier. That is what the FSB means by proportionate.
2. Scope tools to the task, not the team. Give each agent its own identity, read-only by default, with every write action listed explicitly. Anything that moves money, changes coverage or contacts a customer goes through a logged approval step.
3. Test the edges, not just the happy path. Our evaluation sets include cases where the right answer is to refuse or escalate. One example is a document with instructions telling the agent to do something outside its job. Another is a request just beyond its authority. If the agent acts anyway, it fails, however good the result looks.
4. Make human oversight measurable. Record what the reviewer saw, what they changed and how long it took. A reviewer who approves everything in seconds is not providing oversight.
5. Keep a model exit plan. Run the evaluation set against at least one other model, ideally one you can host in your own cloud. Then a provider outage or a policy change abroad means switching models, not rebuilding.
6. Document as you build. Keep the inventory, tiers, evaluation results, oversight design and third-party dependencies in one place. That is the record a risk function or a supervisor will ask for. Keeping it as you go costs far less than rebuilding it later.

None of this slows a good project down. It is the same discipline that gets an agent from pilot to production: prove it on real cases, limit what it can touch, measure it, and hand over something the client's own teams can defend.

If a safety code arrives, institutions that already work this way will read it to confirm what they have. Everyone else will be starting projects.

Sources

1. OSFI releases fall risk update focused on frontier AI, Office of the Superintendent of Financial Institutions, October 8, 2026.
2. OSFI statement on the Financial Stability Board's publication of Sound Practices for Responsible Adoption of Artificial Intelligence, Office of the Superintendent of Financial Institutions, October 15, 2026.
3. FSB finalises sound practices for the responsible adoption of artificial intelligence (AI), Financial Stability Board, October 15, 2026.
4. AI threats now a top concern for Canada's banking regulator, Financial Post, October 8, 2026.