Abstract

On September 1, 2026, the Office of the Superintendent of Financial Institutions (OSFI) expected federally regulated financial institutions (FRFIs) to reach full adherence with Guideline E-21, Operational Risk Management and Resilience. E-21 is often described as Canada’s answer to the European Union’s (EU) Digital Operational Resilience Act (DORA), and this article tests that comparison. It shows where the two frameworks line up, where E-21 depends on OSFI’s technology and third-party guidelines, B-13 and B-10, to cover ground that DORA covers alone, and where the regimes differ in legal force, incident reporting clocks, and testing scope. A side-by-side crosswalk follows, along with the sequence I would use to close gaps now, including for institutions that operate under both regimes.

September 1, 2026 has come and gone. It was the date the Office of the Superintendent of Financial Institutions (OSFI) set, back in August 2024, for federally regulated financial institutions (FRFIs) to reach full adherence with Guideline E-21, Operational Risk Management and Resilience (OSFI, 2024c). By then an institution was expected to have identified its critical operations, mapped what they depend on, and set tolerances for disruption, and to have built a scenario testing method and started using it. If that has not happened at your institution, you are now behind a schedule OSFI published two years ago.

The date matters, but the guideline behind it matters more. Much of my work has involved helping executives and boards see that resilience is not a technology topic or a procurement topic. It is a business topic, and the business feels it first when a critical service goes down or a key supplier fails. E-21 is OSFI’s most direct statement of that idea, which is why it deserves a close reading and not just a skim of the summaries.

That brings me to a comparison you will hear a lot. E-21 is often described as Canada’s version of the European Union’s (EU) Digital Operational Resilience Act (DORA), and the description is useful enough that I lean on it throughout this article. It does need one qualification up front. DORA is a single regulation that covers information and communications technology (ICT) risk, incident reporting, testing, and third-party oversight in one place (European Parliament & Council of the European Union, 2022). OSFI spreads the same ground across several documents. E-21 is the foundation, and it hands technology and cyber risk to Guideline B-13 and third-party risk to Guideline B-10 (OSFI, 2024b). OSFI itself calls E-21 a foundational guideline that supports those two (OSFI, 2024a). So the honest way to put it is this: E-21 is Canada’s closest counterpart to DORA in purpose, and the full equivalent is E-21, B-13, and B-10 read together. Keep that in mind as we go, because it shapes every section that follows.

What E-21 Actually Requires

The idea underneath E-21 is simple. Disruptions will happen, so an institution should know which of its services matter most, how much interruption each one can survive, and whether it would really survive it (OSFI, 2024b). The guideline applies to every FRFI, including foreign bank and insurance company branches operating in Canada, and OSFI expects institutions to apply it in proportion to their size, strategy, risk profile, complexity, and interconnectedness. It has four sections. The first two cover governance and operational risk management, where OSFI says its expectations have been in place since 2016. The other two carry most of the new material, which is operational resilience itself and the key areas that support it (OSFI, 2024c).

Three linked ideas do most of the work, so it helps to take them in order. A critical operation is a service or product that, if it failed, could threaten the institution’s survival or its safety and soundness, or spill over into other institutions through the connections between them. A tolerance for disruption then sets the ceiling on how much disruption that operation can take when tested against severe but plausible events, measured by things like how long a service is down, how far it degrades, whether data is lost, and how many customers are affected. Scenario testing is how you find out whether you would stay under that ceiling when something actually goes wrong (OSFI, 2024b).

Tolerance is also easy to confuse with risk appetite, and E-21 keeps them apart on purpose. Appetite is the risk you choose to take on to pursue your goals. Tolerance is the pain you can survive in a crisis, and it will typically sit higher than appetite (OSFI, 2024b). Treating the two as one number defeats the purpose of having both.

Those ideas only become usable once the mapping is done. Each critical operation has to be traced from start to finish, covering the people, processes, technology, data, facilities, and outside parties involved, and where a third party turns out to be critical, the institution should gather enough information to judge that party’s resilience. Testing then puts the map under pressure. E-21 points to severe but plausible events such as widespread system failures, cyber incidents, and disruption at a critical third party, with methods that range from tabletop discussions to simulations to tests on live systems, depending on how critical the operation is. Where it can, the institution should also coordinate with its critical third parties on broader exercises (OSFI, 2024b).

None of this works without clear ownership. Senior management is ultimately accountable for making sure resilience programs exist, that scenario testing happens, that deficiencies get fixed, and that any breach of a tolerance is escalated. Risk and compliance functions challenge the business, and internal audit or a similar function gives independent assurance. The board hears about it too, through regular reporting that includes scenario test results and an assessment of whether critical operations can be kept within tolerance (OSFI, 2024b).

All of this came with a schedule, and the dates are worth having in front of you. Sections 1 and 2 took effect immediately. Section 4 required full adherence by September 1, 2025. Full adherence to the whole guideline was due on September 1, 2026, with testing completed for every critical operation by September 1, 2027. OSFI also said it would check on progress through supervisory work at a selection of institutions during the transition (OSFI, 2024c). I read that as a signal that supervisors planned to look before the deadline, and the deadline passing does not make that scrutiny less likely.

One part of section 4 deserves special attention if you have been following my writing on artificial intelligence (AI) and data governance. E-21 names data risk as a key area, and the detail is telling. It calls for clear ownership of data, systems that let you trace where data came from, and routines for classifying and safeguarding it (OSFI, 2024b). Inventory, lineage, and classification, the themes of my earlier article “AI Is Using Your Data. Are You Aware?”, are written expectations here and not just good practice. Data risk is only one of several key areas that E-21 lists without covering in full, though, and that is where the companion guidelines come in.

Where E-21 Ends and B-10 and B-13 Begin

E-21 is deliberately not a complete rulebook. In its own text it points to B-13 for technology and cyber risk and to B-10 for third-party risk, and it treats both as key areas that strengthen resilience (OSFI, 2024b). A resilience program built on E-21 alone would have an obvious hole in it, so it is worth knowing what the other two contribute.

Guideline B-13, Technology and Cyber Risk Management, was finalized in July 2022 and took effect on January 1, 2024. It is organized around three domains: governance and risk management, technology operations and resilience, and cyber security (OSFI, 2022). Alongside it sits OSFI’s technology and cyber security incident reporting advisory, which expects institutions to report qualifying incidents within 24 hours and earlier where possible (OSFI, n.d.).

Third-party risk is B-10’s territory. Guideline B-10, Third-Party Risk Management, took effect on May 1, 2024 after a transition period (Torys LLP, 2023). Its reach is wide. It applies to any business or strategic arrangement with an outside party, “by contract or otherwise,” which goes well beyond traditional outsourcing. It is principles based and asks institutions to apply it in proportion to the risk and criticality of each arrangement. The institution stays accountable for what it hands to a third party, and it is expected to keep a running list of its third parties, ranked by how risky and how critical each one is (OSFI, 2023b).

Testing has its own supporting piece as well. OSFI’s Intelligence-led Cyber Resilience Testing (I-CRT) framework describes how OSFI and an institution run a realistic, threat-informed red team test against the systems behind critical business functions. It draws on the Bank of England’s CBEST framework and on the Threat Intelligence-Based Ethical Red Teaming (TIBER) approach used in Europe, and its current scope covers systemically important banks (SIBs) and internationally active insurance groups (IAIGs) (OSFI, 2023a).

Put those pieces together and two structural differences from DORA stand out. The first is legal force. DORA is a regulation that sits inside a penalty framework, while OSFI’s guidelines set expectations that it supervises against in proportion to an institution’s size and risk, and neither E-21 nor B-10 contains a penalty schedule. The second is breadth. DORA is about digital resilience, whereas E-21 addresses operational risk more broadly, including people and facilities as well as systems (OSFI, 2024b), which is why its resilience test starts from the service instead of the technology. The crosswalk that follows shows how those differences play out topic by topic.

The DORA and OSFI Crosswalk

With that structure in mind, the table below sets DORA beside the OSFI framework, row by row. Where an OSFI expectation lives in a different guideline from E-21, the table says which one. I kept the wording short on purpose, so treat it as a planning map and not a substitute for the source documents.

Where the Two Regimes Genuinely Differ

The table shows a lot of common ground, which is good news for any institution that has to satisfy both regimes. Three differences deserve more than a table cell, though, and the first is the one that tends to catch teams out in practice.

DORA runs three staged clocks for incident reporting. The initial notification is due within four hours of classifying an incident as major and no later than 24 hours after the institution becomes aware of it. The intermediate report follows within 72 hours of that first notice, and the final report within one month of the intermediate report (Springlex, n.d.). OSFI’s headline expectation is simpler, a single report within 24 hours, earlier where possible, with further detail supplied in updates as it becomes available (OSFI, n.d.). If you serve both regimes, the shorter clock should drive your design. In either regime the clock is only as good as your suppliers, so your contracts need to make sure they tell you fast enough to meet it.

That dependence on suppliers leads to the second difference, which is how each regime treats the largest technology providers. On November 18, 2025, the European Supervisory Authorities (ESAs) designated the first 19 critical ICT third-party providers (CTPPs) for direct EU-level oversight, a list that includes major cloud platforms (PwC Legal, 2025). Those providers now answer to an EU-level supervisor called a Lead Overseer, and the regulation allows periodic penalty payments of up to 1% of a provider’s average daily worldwide turnover if one fails to comply (European Parliament & Council of the European Union, 2022, Art. 35). It is tempting to read that as relief for the institutions that depend on them. It is not. Designation does not move responsibility away from the institution, which must still do its own diligence and manage its own risk (TLT LLP, 2025).

B-10 takes a different route. It contains no designation step. Instead it asks institutions to assess concentration risk at two levels, within their own organization and across the system, and to understand systemic concentration as far as they can (OSFI, 2023b). It also accepts that some contracts are standardized and cannot be negotiated. In that case the institution should formally accept the risk and offset it with measures such as redundancy and continuity planning (OSFI, 2023b). The lesson is the same on both sides of the Atlantic. Provider oversight, where it exists, supplements the institution’s own accountability. It does not replace it.

The third difference is testing. DORA requires threat-led penetration testing (TLPT) at least every three years for the financial entities their authorities identify, run on live production systems (European Parliament & Council of the European Union, 2022, Art. 26), and its technical standard, Commission Delegated Regulation (EU) 2025/1190, sets the criteria for who must test and how (European Commission, 2025). OSFI’s I-CRT rests on the same intelligence-led idea, but it is a supervisory tool that OSFI initiates for SIBs and IAIGs on roughly a three-year cycle, with event-driven tests possible after a major cyber incident. An institution outside those groups can ask OSFI for an I-CRT, and OSFI will consider the request case by case. The framework describes itself as a supervisory how-to guide and not a source of regulatory expectations (OSFI, 2023a). For every other FRFI, testing expectations come from E-21 scenario testing and from the security testing expectations in B-13.

What I Would Prioritize Now

So where does that leave an institution that is already past the date? If I were advising an FRFI today, in the weeks after the full adherence date instead of the months before it, this is the order I would work in.

First, confirm the foundation is actually finished. Can you name your critical operations, show the end-to-end map behind each one, and point to a tolerance for disruption that senior management owns? The September 1, 2026 expectation was completion of that work, not a plan for it (OSFI, 2024c). If any of the three is missing, everything else waits.

Second, put scenario testing on a calendar. OSFI expected the method to be built and testing to be under way by September 1, 2026, with every critical operation tested by September 1, 2027 (OSFI, 2024c). Choose scenarios that force uncomfortable questions, such as a critical supplier failing while a cyber incident is in progress. Concurrent and longer-lasting scenarios are exactly what E-21 asks for (OSFI, 2024b).

Third, connect the resilience map to the third-party inventory. For every critical operation, list the third parties it depends on, confirm each one appears in the B-10 inventory with a criticality rating, and check the contract against Annex 2 of B-10. Where a contract cannot be renegotiated, record the risk acceptance and the compensating measures, which B-10 expressly allows (OSFI, 2023b). Do the same for exit and contingency plans on the arrangements that matter most.

Fourth, make the incident clock real. Check that your critical suppliers must notify you quickly enough for you to report to OSFI within 24 hours, and run a timed exercise to prove it. B-10 expects contracts to support that reporting (OSFI, 2023b).

Fifth, bring the data under control. E-21’s data risk expectations, lineage and classification in particular, are where operational resilience and AI governance meet. An institution that cannot say where its critical data lives will struggle to show that a critical operation can survive losing it.

Finally, if you operate under both regimes, build once and build to the stricter requirement on each topic. Use the crosswalk to design a single register, a single contract standard, and incident procedures that meet the shorter clock. Keep testing programs separate, because the two regimes govern them differently.

The Board Conversation

Whatever order you choose, the board will be part of the story. E-21 makes one board conversation unavoidable, because senior management must report scenario test results to the board, including the deficiencies found, an assessment of whether critical operations can be kept within tolerance, and plans to fix the gaps (OSFI, 2024b). The board will see those results whether or not it asked for them, so it is better that the first conversation is deliberate.

The consequences also work differently from what many people expect. Neither E-21 nor B-10 contains a penalty schedule. What OSFI brings is supervision, and its I-CRT process, for example, ends with a supervisory letter and follow-up until findings are closed (OSFI, 2023a). DORA is different in structure. It leaves fines for financial entities to each member state and sets a turnover-based periodic penalty of up to 1% of average daily worldwide turnover only for designated critical providers (European Parliament & Council of the European Union, 2022, Arts. 35 and 50). In my experience, though, neither of those is the argument that moves a board. What moves it is a picture of a disruption at a critical supplier, with the regulator asking whether the institution had the contractual protections, the tested exit plan, and the tolerances in place before it happened.

The Bottom Line

E-21 is not simply Canada’s copy of DORA, and treating it as one would cause you to miss the parts that matter. It is the foundation of a set of OSFI guidelines that together cover the same ground, with a sharper focus on critical operations and tolerances for disruption, a lighter touch on prescription, and a supervisory model of enforcement instead of a statutory one. The institutions in the strongest position will be the ones that treated E-21, B-10, and B-13 as a single program, mapped it once against DORA where they need to, and started testing before anyone asked.

The date has passed, but the mandate has not. E-21 gives risk and security leaders something valuable, a supervisory reason to fund resilience work that deserved funding long before now. Use it.

References

European Commission. (2025). Commission Delegated Regulation (EU) 2025/1190 of 13 February 2025 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards for threat-led penetration testing. Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng

European Parliament & Council of the European Union. (2022). Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554

Office of the Superintendent of Financial Institutions. (n.d.). OSFI technology and cyber incident report: Detailed instructions. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/osfi-technology-cyber-incident-report-detailed-instructions

Office of the Superintendent of Financial Institutions. (2022, July 13). OSFI releases new guideline for technology and cyber risk, balancing innovation with risk management [News release]. https://www.osfi-bsif.gc.ca/en/news/osfi-releases-new-guideline-technology-cyber-risk-balancing-innovation-risk-management

Office of the Superintendent of Financial Institutions. (2023a). OSFI’s intelligence-led cyber resilience testing (I-CRT) framework. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/osfis-intelligence-led-cyber-resilience-testing-crt-framework

Office of the Superintendent of Financial Institutions. (2023b, April 30). Third-party risk management guideline (Guideline B-10). https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/third-party-risk-management-guideline

Office of the Superintendent of Financial Institutions. (2024a, August 22). Backgrounder: Guideline E-21, operational risk and resilience. https://www.osfi-bsif.gc.ca/en/news/backgrounder-guideline-e-21-operational-risk-resilience

Office of the Superintendent of Financial Institutions. (2024b, August 22). Operational risk management and resilience guideline (Guideline E-21). https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/operational-risk-management-resilience-guideline

Office of the Superintendent of Financial Institutions. (2024c, August 22). Operational risk management and resilience: Letter. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/operational-risk-management-resilience-letter

PwC Legal. (2025, November 26). ESAs publish first list of critical ICT third-party providers under DORA. https://legal.pwc.de/en/news/articles/esas-publish-first-list-of-critical-ict-third-party-providers-under-dora

Springlex. (n.d.). Article 5: Time limits for the initial notification, and for the intermediate and final reports [Regulatory technical standards on incident reporting]. https://www.springlex.eu/en/packages/dora/rts-ir-regulation/article-5/

TLT LLP. (2025, November 20). EU regulators designate critical ICT third-party providers under DORA. https://www.tlt.com/insights-and-events/insight/eu-regulators-designate-critical-ict-third-party-providers-under-dora

Torys LLP. (2023, May 31). OSFI B-10 third-party risk management: Updates to guideline B-10 expand scope beyond outsourcings. https://www.torys.com/en/our-latest-thinking/publications/2023/05/osfi-b-10-third-party-risk-management

Bola Mabawonku is a Senior GRC Manager and Cloud Security Architect based in Edmonton, Alberta, specializing in cloud security architecture, IAM governance, and compliance program management across CBN, NIST CSF, ISO 27001, and PCI DSS frameworks.