Canada regulator considers AI safety code
Canada’s financial regulator is exploring the development of an artificial intelligence safety code for financial institutions due to increasingly capable AI models and autonomous agents posing new risks to the system. The Office of the Superintendent of Financial Institutions (OSFI) has moved away from a hands-off stance toward establishing baseline requirements for how banks utilize AI.
Superintendent Peter Routledge said OSFI needs more specialized expertise in AI, despite having enough staff overall. He defended OSFI’s anti-money-laundering efforts after the Financial Action Task Force downgraded Canada’s supervision of financial institutions to “partially compliant” from “fully compliant”.
Routledge pointed to rapid AI advances as the driver of the shift, citing Claude’s latest foundational model Mythos and other frontier models that could be used for cyberattacks or illicit activity. He also mentioned autonomous AI agents operating with minimal human oversight, saying “that’s frightening, and that is a risk that is front of center for us”.
The framework for the safety code is still at an early stage, with no draft yet and no formally approved timeline for releasing it. However, the consultation could come as early as spring. The safety code would build on OSFI’s previous AI advisory reports and its collaboration with the Global Risk Institute’s Financial Industry Forum on AI and the Financial Stability Board.
Routledge said Canadian banks are generally prepared for AI-related risks, but some are further ahead than others. OSFI wants to set a minimum level of safety or resilience across the system, limiting the risk that weaknesses at one institution spread to other counterparts.
As OSFI develops the safety code, it will also need to prioritize hiring experts with experience in emerging risks, particularly AI and digital technology.
The newly announced safety code comes as OSFI faces pressure over another emerging threat: financial crime. The Financial Action Task Force (FATF) downgraded Canada’s supervision of financial institutions to “partially compliant” from “largely compliant”, finding that the country falls short of international standards for enforcing anti-money-laundering controls at banks.
Routledge argued that OSFI has made significant changes in recent years, treating money laundering as a prudential risk and bringing the Financial Transactions and Reports Analysis Centre of Canada (Fintrac) onto the Financial Institutions Supervisory Committee. OSFI has also built a national security team of roughly 30 people, with anti-money laundering forming a core part of its work.
Canada ultimately avoided FATF’s “grey list”, which includes countries with weak money-laundering controls. A 2021 International Monetary Fund study found that grey listing can cut a country’s capital inflows by 7.6 per cent of its GDP per year. Routledge said OSFI has a discipline in place to address risks in an urgent way, and he has high confidence and conviction in that.
