Navigating OSFI’s Revised E-23: Implications, challenges and mitigation strategies

OSFI's E-23 introduces significant changes for federally regulated financial institutions (FRFIs) in Canada. E-23 calls for an enterprise-wide perspective and a governance framework that aligns oversight with each model's importance. It mandates robust controls across the model lifecycle, including rationale, data, development, independent review, deployment, change management, monitoring, and retirement.

The scope now covers artificial intelligence (AI) and machine learning (ML) models, especially those impacting operations or customer experience. E-23 recognizes that eliminating model risk entirely is not feasible. Institutions must understand inherent model risks, apply proportionate oversight, and report residual risks to senior leadership. Crisil supports FRFIs by interpreting E-23 requirements, developing model risk management frameworks, implementing governance, and ensuring compliance with tailored strategies and practical support throughout the model lifecycle.