OSFI B-13 Cyber Insurance for Canadian Federally Regulated Financial Institutions
OSFI B-13 Cyber Insurance for Canadian Federally Regulated Financial Institutions
OSFI Guideline B-13 — Technology and Cyber Risk Management — sets the supervisory expectations for how Canadian federally regulated financial institutions (FRFIs) govern technology and cyber risk. It also reshapes what a defensible cyber insurance program needs to look like. This guide walks through the alignment.
OSFI Guideline B-13 does not mandate cyber insurance, but it does reshape what a defensible program looks like. Cyber insurance is one mechanism used to transfer residual risk after B-13’s governance, third-party risk, incident management, and technology resilience controls are in place. Alignment matters in four places: (1) board-approved risk appetite that’s consistent with retention and limit selection; (2) incident response that can support a 24-hour regulatory notification; (3) contingent BI and dependent-security coverage for critical third-party technology providers; (4) Canadian regulatory defense including PIPEDA, provincial privacy regimes, and Quebec Law 25.
What OSFI B-13 actually requires
Guideline B-13 — Technology and Cyber Risk Management — is OSFI’s supervisory expectation for how federally regulated financial institutions govern technology and cyber risk. It applies to all FRFIs: Schedule I and II banks, trust and loan companies, federally regulated insurers, and federally regulated pension plans.
The guideline is organized around four domains:
- Governance and risk management. Board and senior management accountability, documented risk appetite, three-lines-of-defense structure applied to technology and cyber risk.
- Technology operations and resilience. Technology architecture, change management, capacity management, and resilience through testing and continuity planning.
- Cyber security. Cyber risk identification, protective controls, detection, response and recovery capabilities.
- Third-party technology risk. Due diligence, contract management, ongoing oversight and concentration risk assessment for third-party technology providers, including cloud service providers.
The guideline does not prescribe cyber insurance as a required control. It does, however, require FRFIs to identify residual risks after mitigating controls and to have a documented approach to how those residuals are managed — which is where insurance sits.
The four alignment points
Alignment 1: risk appetite and program structure
Under B-13, the FRFI’s board (or a delegated committee) approves a documented risk appetite for technology and cyber risk. That appetite translates into tolerances for financial loss, operational disruption duration, customer and third-party impact, and regulatory consequence.
The cyber insurance retention, limit and coverage scope should be internally consistent with that appetite. A board that has articulated a low tolerance for financial loss from cyber events but signs off on a cyber policy with a retention that materially exceeds that tolerance is creating an inconsistency that a supervisor may reasonably question. Similarly, if the aggregated limit is materially below the modeled worst-plausible cyber loss for the institution, the delta needs to be explained and documented as accepted risk.
Practical check. Pull your board- or committee-approved risk appetite statement. Compare (a) the documented financial loss tolerance for cyber events against your current cyber policy retention; (b) the modeled worst-plausible cyber loss (through PML modeling or scenario analysis) against your aggregate limit. Any material disconnect is worth surfacing at your next renewal or risk committee cycle.
Alignment 2: incident response and the 24-hour reporting expectation
OSFI expects FRFIs to notify the regulator of material technology or cyber incidents within 24 hours of determining the incident meets the reporting threshold. Threshold criteria include impact on operations, customers, or third parties.
This has a direct implication for how the cyber policy’s incident response coverage needs to work. The named breach coach, forensics vendor, and communications support have to be reachable, authorized, and mobilized fast enough that the FRFI can make a defensible 24-hour reporting decision with the benefit of professional counsel. A policy that requires 48-hour notification to the carrier before authorized vendors can be engaged, or a panel structure with vendors that don’t have Canadian operations, creates a mismatch.
Items to confirm at placement or renewal:
- Notification-to-carrier windows that support 24-hour regulatory reporting
- Panel of pre-authorized vendors with Canadian breach coach counsel and forensics with Canadian operations
- Ability to engage counsel and forensics before the carrier has determined coverage position
- Public relations and customer communications support that understands Canadian regulatory context
Alignment 3: third-party technology risk and dependent coverage
B-13 places substantial weight on third-party technology risk management, including cloud service providers and other critical technology vendors. The FRFI is expected to conduct due diligence, define contractual expectations, exercise ongoing oversight, and specifically assess concentration risk where multiple critical services depend on a single provider.
The insurance implication runs across three coverage elements:
- Contingent business interruption. The cyber policy should respond to a business interruption event where the trigger is at a named critical third-party technology provider, not at the FRFI itself. A cloud provider outage that takes the FRFI’s services offline is a cyber contingent BI event.
- Dependent security coverage. Where a security event at a critical third party causes an incident at the FRFI — a supply-chain compromise that flows through a software vendor into the FRFI’s environment — the policy needs to respond to the downstream event, not just to events originating on the FRFI’s systems.
- Vendor liability caps. Cloud and SaaS providers typically limit their contractual liability to a small multiple of fees paid. Where the FRFI’s recoverable loss exceeds that cap — and it commonly does — the delta needs to sit somewhere. Cyber contingent BI is one place it can sit.
Alignment 4: Canadian regulatory defense and privacy obligations
An FRFI operating in Canada faces a layered privacy and regulatory regime: PIPEDA federally, provincial private-sector privacy legislation in British Columbia, Alberta and Quebec (with Quebec Law 25 being materially more prescriptive than the others), OSFI supervisory expectations, and industry-specific requirements.
Cyber policies issued in other jurisdictions — particularly US-issued policies covering a Canadian subsidiary of a US parent — do not always contemplate the full Canadian regulatory picture. Confirm explicitly:
- PIPEDA-related regulatory investigation defense and covered notification costs
- Provincial privacy regulatory defense (BC OIPC, Alberta OIPC, Quebec CAI)
- Quebec Law 25 obligations, including the confidentiality incident register, mandatory reporting to the CAI, and impacted-individual notification with specific content requirements
- OSFI-related defense costs where the regulator initiates an examination or enforcement action tied to a cyber incident
- Regulatory fines and penalties where legally insurable in the relevant Canadian jurisdiction
Common gap. A US-issued cyber policy inherited by a Canadian FRFI subsidiary through parent placement may have Canadian regulatory coverage sublimited or excluded, may not name Canadian regulators explicitly, and may not respond to Quebec Law 25 obligations. If your FRFI operates under such a program, the alignment review before B-13 self-assessment is worth doing.
What a B-13-aligned cyber insurance file looks like
For a FRFI, the internal file supporting the cyber insurance program should typically include:
- Board or committee approval of retention, limit and material coverage terms
- Documentation of how the program aligns with the technology and cyber risk appetite
- Scenario analysis or PML modeling that informed limit selection
- Vendor panel confirmation with Canadian capability documented
- Third-party technology risk register cross-referenced against contingent BI and dependent security coverage
- Confirmation of Canadian regulatory coverage scope
- Annual review integrating updates from B-13 self-assessment
None of this is prescribed by OSFI. All of it is what a supervisor would reasonably expect to see if the cyber insurance program came up in an examination.
Placement in the Canadian market
NextGuard is licensed in Florida and New York and places programs across Canada through Canadian broker partners licensed in every province and territory. The Canadian broker partners handle all regulated activities in-jurisdiction. The Commercial Insurance Broker Canada hub landing covers the full vertical footprint, disclaimer language, and program access model.
Have your OSFI-aligned cyber program reviewed
Send us your current cyber declarations pages and a summary of your B-13 self-assessment status. We’ll return a written review of alignment gaps within five business days.
Request Program Review → WhatsApp →Frequently Asked Questions
Does OSFI B-13 require cyber insurance?
B-13 does not mandate cyber insurance as a specific control. It requires FRFIs to govern technology and cyber risk through documented risk appetite, third-party risk management, incident management and reporting, and technology resilience. In practice, a cyber insurance program is one of the mechanisms used to transfer residual risk after those controls are in place — and the way the program is structured should be consistent with the risk appetite documented under B-13.
What is the OSFI Technology and Cyber Incident Reporting requirement?
OSFI expects FRFIs to notify the regulator of material technology or cyber incidents within 24 hours of determining that an incident meets the reporting threshold. The threshold criteria include impact on operations, customers, or third parties. A cyber insurance policy’s incident response coverage should be able to mobilize a breach coach, forensics vendor and communications support fast enough to support a 24-hour regulatory notification decision — not on a five-business-day timeline.
How does B-13 change third-party technology risk insurance requirements?
B-13 places significant weight on third-party technology risk management, including cloud service providers and other critical technology vendors. The insurance implications: (1) confirm that the cyber policy responds to incidents originating at a critical third-party provider (contingent business interruption and dependent security coverage); (2) understand where the third-party’s own liability caps interact with your recoverable loss; (3) where a critical provider fails and the FRFI incurs regulatory or customer notification costs, confirm those costs are covered.
What is the typical cyber insurance limit for a Canadian FRFI?
Materially wider range than any single benchmark. For smaller FRFIs (credit unions, trust companies, specialty insurers), limits commonly sit in the CAD $10M–$50M range. For mid-sized federally regulated banks and insurers, CAD $50M–$250M is common. For the largest Schedule I banks and national insurers, structured towers of CAD $500M+ built across multiple markets are the norm. The right limit is the one your board-approved technology and cyber risk appetite says it is.
Does a US-based cyber policy respond to PIPEDA and Quebec Law 25 obligations?
It depends on the wording. A cyber policy issued to a US parent with a Canadian subsidiary may exclude or sublimit Canadian regulatory investigations, PIPEDA-related notification costs, and Quebec-specific obligations under Law 25 (formerly Bill 64). Confirm explicitly that Canadian regulatory defense, PIPEDA and provincial breach notification costs, and Quebec Law 25 obligations sit inside the covered defense costs and regulatory fines definitions where legally insurable.
How should a FRFI structure cyber insurance procurement alongside B-13 governance?
The cyber insurance program should be documented as part of the FRFI’s technology and cyber risk management framework, not as a separate procurement exercise. Board or delegated committee approval of the retention, limit and coverage scope should reflect the risk appetite documented under B-13. Renewal reviews should incorporate updates from the annual B-13 self-assessment, including any control gaps identified.
