OSFI’s frontier AI risk update: what it says, and what it does not say about crypto-assets

1 day ago

4 min read

Canada’s bank and insurer regulator published its 2026 Semi-Annual Risk Outlook on 8 October. It does not mention crypto-assets. This note sets out its content and the limited routes by which it may reach crypto-asset service providers.

On 8 October 2026, the Office of the Superintendent of Financial Institutions (OSFI), which supervises Canada’s federally regulated banks, insurers and other financial institutions, published its 2026 Semi-Annual Risk Outlook. It updates the 2026–2027 Annual Risk Outlook released in April.

denouement CASP signal brief infographic: OSFI's frontier AI update does not mention crypto-assets

What OSFI published

The April Outlook identified four key risks: residential real estate secured lending (RESL) and mortgage risks, non-bank financial intermediation (NBFI) risks, funding and liquidity risks, and other risks. OSFI says these “remain highly relevant and continue to drive our regulatory focus”.

The October update concentrates on one subject. OSFI had identified AI innovation as a component of the “other risks” category in April. It now says recent developments in AI have amplified cyber, technology, third-party and reputational risks, and that these “warrant focused discussion”.

What it says

Cyber risk. OSFI states that “The time between vulnerability discovery and exploitation has been shortened”. It says frontier AI models “can rapidly and autonomously chain together multiple vulnerabilities across interconnected systems, allowing seemingly minor weaknesses to be combined into high-impact attacks”. It also notes that the same technologies offer “the potential for enhanced detection and patching of vulnerabilities before they are exploited”, and that advances, including quantum computing, “will continue to intensify the complexity of the cyber threat environment”.

Third-party risk. OSFI says “A small number of providers currently dominate the development of frontier AI models and the cloud infrastructure used to deploy them”, which increases the potential for correlated disruptions. It flags technology sovereignty, noting that “Many technology services are concentrated outside Canada”. It adds that institutions “may find it difficult to maintain a clear understanding of AI use, vulnerabilities, and controls at critical third-parties”.

Reputational risk. OSFI states that “Institutions and their third-parties need to remain at the forefront of technological advancement to avoid reputational risks associated with delayed adoption of emerging technologies”.

OSFI’s response. The update refers to two technology risk bulletins issued this year, on generative and agentic AI and on frontier AI; a joint OSFI and Canadian Centre for Cyber Security Industry Day in September; and OSFI’s work with other Financial Stability Board (FSB) members on sound practices for responsible AI adoption, published for consultation in June. It does not issue new guidance. It states: “Our current regulatory guidance supports responsible innovation while ensuring risks are effectively managed and accurately reported.”

What it does not say

Neither the update nor OSFI’s accompanying news release mentions crypto, crypto-assets, digital assets, stablecoins, tokenisation, blockchain or virtual assets. A text search of both documents returns no matches for any of these terms.

OSFI’s guidance applies to federally regulated financial institutions. Crypto-asset service providers (CASPs) are generally outside its supervisory remit.

Possible relevance to CASPs

The following points are our assessment. They are not stated in the update.

Through OSFI’s crypto-asset guideline for banks. OSFI’s Capital and Liquidity Treatment of Crypto-asset Exposures (Banking) guideline already states that “An institution holding crypto-assets may be exposed to additional ICT and cyber risks that include but are not limited to cryptographic key theft, compromise of login credentials, and distributed denial-of-service (DDoS) attacks.” The update says frontier AI shortens the time between discovering and exploiting a vulnerability. In our view, the two documents together are relevant to custody and key-management controls at banks that hold crypto-assets, and at CASPs that provide related services to them.

Through bank due diligence. In our view, CASPs that serve Canadian banks may receive more detailed questions about AI use, vulnerability management and controls, given OSFI’s statement on critical third parties.

Through the April frontier AI bulletin. OSFI’s April 2026 bulletin lists measures institutions “can consider”, including accelerated patch management, phishing-resistant multi-factor authentication and AI-specific red-teaming. It refers to Guideline B-13 (technology and cyber risk), Principles 16 and 17 on detection and response, Guideline E-21 (operational risk and resilience), and Guideline B-10 (third-party risk), Principle 9 on third parties’ ability to operate during disruptions. These guidelines apply to banks and other federally regulated institutions, not to CASPs directly. In our view, CASPs supplying Canadian banks may find them a useful reference when answering due diligence questions.

The update creates no new requirement and contains no crypto-specific content. Any effect on CASPs is indirect.

Related dates

8 October 2026: OSFI publishes the 2026 Semi-Annual Risk Outlook.
12 October 2026: the FSB publishes a letter from its Chair to G20 Finance Ministers and Central Bank Governors. The letter introduces reports, including finalised sound practices for the responsible adoption of AI, and is accompanied by a note on global stablecoin arrangements.
1 November 2026: OSFI’s crypto-asset guideline (2027) replaces the 2026 version for institutions with a fiscal year ending 31 October.
1 January 2027: the 2027 guideline takes effect for institutions with a fiscal year ending 31 December.