Lawyers expect additional guidance for technology risk to complement new guideline
The Office of the Superintendent of Financial Institutions Canada’s new guideline clarifies its expectations of foreign branches operating in Canada from a governance perspective but does not fundamentally alter most branches’ operations, a firm’s blog post has said.
Guideline E-4: Foreign Entities Operating in Canada on a Branch Basis aims to explain the OSFI’s expectations relating to foreign entities operating in Canada on a branch basis, with compliance expected by January 2022.
The guideline, which is modernized for better consistency with the OSFI’s other guidelines, shows a new focus on all those responsible for the management of a branch, collectively referred to as branch management, rather than just focusing on the chief agent and apparently sets a higher knowledge standard on branch management, explained Rick Da Costa and Gordon Goodman, partners in the insurance and reinsurance group of Cassels Brock & Blackwell LLP, in the blog post.
The blog post noted that the OSFI did not introduce significant amendments or issue significant new guidance relating to the electronic storage of records.
“Similarly, Guideline E-4 does not really recognize the effects of cloud computing, global IT platforms, and managing cyber security risks; however, we do expect additional OSFI guidance on technology risk in the coming months, which may very well complement the new Guideline E-4,” the blog post said.
OSFI’s supervisory role, which is limited to the foreign entity’s federally regulated business in Canada, covers compliance with the requirements of the Bank Act (BA), of the Insurance Companies Act (ICA) and of pertinent OSFI-issued guidance.
The OSFI expects branch management, which should have a composition commensurate with the overall size and complexity of the foreign entity’s federally regulated business in Canada, to take responsibility of the effective adaptation, implementation, and oversight of the following aspects of its Canada-based business:
- business objectives, strategies, and plans
- risk management policies and procedures and related risk management controls
- policies and procedures for managing the assets and liabilities recorded on the branch’s books and related accounts
- independent assessments of the adequacy and effectiveness of the aforementioned controls
Branch management is expected to have in-depth understanding of the business carried out in the branch, authority to carry out the overall management of that business and knowledge of the relevant Canadian legislation, regulations, guidelines and other supervisory or regulatory matters for the effective execution of the aforementioned activities.
The OSFI also expects branch management to document arrangements with the foreign entity’s home office in circumstances where the home office performs material functions, directly or indirectly via outsourcing arrangements, on the branch’s behalf, as well as arrangements involving the flow of funds between the home office and the branch.
Branch management is expected to update the records required by the BA or by the ICA and to ensure that such records are accurate and sufficiently detailed for the following purposes:
- to allow the OSFI to examine and inquire into the branch’s business
- to enable the OSFI to manage the branch’s assets, before the appointment of a liquidator, if the superintendent has taken control of the branch’s Canada-based assets
- to help the liquidator effectively liquidate the branch’s Canada-based assets
The OSFI expects electronic records to be capable of being reproduced in intelligible written form within a reasonable period of time, to be accessible without additional costs and with the use of readily available commercial applications and to be on a computer server physically found at the locations stipulated in the BA or in the ICA, subject to certain exemptions.
Other expectations provided in the guideline cover matters such as legislative requirements, supervisory and regulatory measures and changes to the membership of branch management.
The OSFI has said that it is presently reviewing Guideline B-10: Outsourcing of Business Activities, Functions and Processes as a distinct policy initiative, with the target date for the completion of this initiative seemingly set at the the end of 2021 or early 2022, wrote Da Costa and Goodman in the blog post.
