Canada’s Operational Resilience Regulation: OSFI Guideline E-21

OSFI Guideline E-21 requires Canada’s federally regulated financial institutions to manage operational risk and keep critical operations running through disruption. Learn what E-21 requires and how Fusion helps you meet it.

More than half* of the world’s largest banks rely on Fusion

Named Best Solution for Operational Resilience 2025

Helping over 400 customers across 20 countries

Winner of Most Innovative OpRes / BC Initiative 2025

What Is OSFI’s Guideline E-21?

Under Canada’s Office of the Superintendent of Financial Institutions (OSFI), Guideline E-21 establishes expectations for how federally regulated financial institutions (FRFIs) and pension plans in Canada manage their operational risk and deliver critical operations in face of a disruption.

Financial institutions operate in more complex, risk-heavy environments than even a few years ago. Internal control failures, infrastructure outages, and third-party disruptions can quickly become serious financial risks without guardrails, which is why regulators worldwide now require institutions to plan for and recover from disruption. With full adherence required as of September 1, 2026, Canada’s FRFIs must now meet all of E-21’s expectations.

OSFI Regulates and Supervises 350 Financial Institutions and 1,200 Pension Plans

As Canada’s federal regulator for financial institutions, OSFI exists to ensure that Canadians can trust that the organizations that house their savings, insurance, and retirement benefits are well-managed and prepared to mitigate any potential threats. OSFI protects depositors and policyholders by regulating and supervising the following FRFIs.

  • All banks operating in Canada
  • Federal trust and loan companies
  • Life insurance companies
  • Foreign banks with branches in Canada
  • Property and casualty insurance companies
  • Fraternal benefit societies

In addition to monitoring federally regulated financial institutions, OSFI also oversees federally regulated pension plans (FRPPs). This means that private plans that fall under federal rules such as plans covering employees in banking, telecommunications, and transportation also fall under OSFI’s oversight.

Guideline E-21 Establishes OSFI’s Expectations for Operational Resilience

To enforce Canada’s expectations for operational resilience, OSFI developed Guideline E-21. Pertinent to all FRFIs, E-21 applies on a risk basis that is proportional to each institution’s size, strategy, nature and complexity of operations, risk profile, and its interconnectedness with other financial institutions. Guideline E-21 centers around three crucial outcomes:

  • Operational risk management practice support operational resilience
  • Operational risks are managed within approved risk appetite and risk limits
  • Critical operations continue to be delivered through disruptions

Under the guideline, disruptions are assumed with operational resilience being the solution to ensure that organizations can continue delivering critical operations despite disruption.

Guideline B-10 Establishes OSFI’s Expectations for Third-Party Risk Management

OSFI also expects Canada’s financial institutions to take a risk-based approach to the way they conduct third-party arrangements. This means more rigorous expectations for higher-risk or critical arrangements, such as:

  • Due diligence
  • Minimum contractual terms
  • Concentration risk
  • Subcontractor risk

Similar to E-21, FRFIs are expected to apply B-10 proportionally based on risk and size and complexity of the organization.
B-10 and E-21 were designed to work hand in hand, with E-21 deferring to B-10 for third party expectations surrounding resilience. Then, third-party inventory information used for B-10 can be used as input for E-21.

How Fusion Supports OSFI E-21 and B-10 Compliance

Fusion’s Enterprise Resilience Decision System helps FRFIs meet the requirements that OSFI’s E-21 and B-10 outlines, from identifying critical operations through scenario testing and board reporting, all within the same service-and dependency model. With Fusion, exercise results and simulation results help paint a complete picture of your organization’s operational readiness.

Identify critical operations and map dependencies

After isolating which services customers, stakeholders, and regulators depend on, Fusion can help FRFIs connect to the people, processes, applications, facilities, vendors, vendor services, and data that they need to ensure delivery can still be executed. Through dependency mapping, points of failure are easier to identify and relationships are easier to understand.

Establish tolerances for disruption

Fusion enables users to easily document the maximum amount of disruption a critical operation can endure before the impact is no longer able to be mitigated. From there, that threshold can be translated into guidance on investment, testing, and priorities for recovery.

Test severe but plausible scenarios

With Fusion’s Scenario Testing, FRFI resilience leaders can formulate scenarios based on real dependencies within their organizations, run corresponding simulations, and validate if critical operations can still remain within valid tolerance levels.

Manage third-party risk in accordance with B-10 requirements

Assess and monitor third parties based on their risk and criticality, then connect each vendor to their corresponding operation. Third-party disruptions are handled as service risks rather than isolated to contract breaches.

Provide evidence for executives and regulators simultaneously

With dashboards showing critical operations, tolerances mapped, tolerances, defined, scenarios tested, and gaps addresses, regulators and executives can see the evidence they require easily in Fusion.

What Sets Fusion’s Operational Resilience Preparation Apart

True enterprise resilience is a decision problem. Most large organizations cannot answer the following four most important questions that must be answered at decision speed when disruption hits. A single tabletop exercise can only take one path through a problem, but Fusion can test multiple. Here’s how Fusion answers each decision question to fully prepare your organization for disruption:

01What is impacted and how?

Each scenario permutation can trace dependencies so that services, processes, and vendor disruptions can be addressed rather than discarded.

02What happens next?

Simulating disruptions can expose how an event can spread across dependencies, where recovery will be challenging, as well as which exposures are surfacing regularly.

03What is the financial exposure?

Business consequences of each vulnerability are made visible by evaluating business services, capabilities, and impact tolerances.

04What should be prioritized first?

The results of the simulation dictate what scenarios and services future testing should focus on, as well as what needs to be addressed first.

FAQs

All federally regulated financial institutions, including banks, federal trust and loan companies, life insurers, property and casualty insurers, fraternal benefit societies, and foreign bank and foreign insurance branches operating in Canada. E-21 applies proportionally to each institution’s size, risk profile, complexity, and interconnectedness. Provincially regulated credit unions fall outside OSFI’s supervision, although several provincial regulators have issued or are consulting on their own operational risk and resilience guidance.

The maximum disruption from an operational risk event that a financial institution can withstand under a range of severe but plausible scenarios. It can be expressed as outage time, diminished service, loss of data, or extent of customer impact, and it is typically greater than the institution’s risk appetite because it describes what can be absorbed in a crisis rather than what is willingly accepted in normal operation.

All three ask institutions to identify what matters most (critical operations in E-21, important business services in the UK rules, critical or important functions under DORA), set a maximum tolerable level of disruption, and test against severe but plausible scenarios. E-21 is principles-based supervisory guidance applied proportionally across all operational risk categories. DORA is EU regulation with detailed ICT risk, incident reporting, and third-party requirements. The UK rules are built specifically around important business services and impact tolerances. A single dependency model and testing program can serve all three.

B-10 sets OSFI’s expectations for managing third-party risk across the lifecycle of a third-party arrangement and took effect May 1, 2024. E-21 sets expectations for operational risk management and operational resilience across the institution and reaches full adherence in 2026 and 2027. E-21 refers to B-10 for third-party expectations and relies on the third-party inventory B-10 produces when institutions map the dependencies of their critical operations.

Get (and stay) ready for anything

See how efficient your organization can become at anticipating and preparing for any adversity.

REQUEST A DEMO TAKE THE RESILIENCE ASSESSMENT

Sign up to our newsletter

Receive updates about webinars, blogs, whitepapers, regulations and standards, events, and more!

Thank you for subscribing to Fusion’s newsletter!

You’ll now be receiving the most important and timely news stories impacting global enterprise resilience to your inbox every month.