Q&A with OSFI Superintendent Peter Routledge

 
OSFI published its semi-annual update to its Annual Risk Outlook on October 8. What are the key developments since the Outlook was published in April 2026?

The primary emphasis of our semi-annual update is on risks coming out of artificial intelligence (AI).

There are multiple vectors, but the two we are focusing on are the cyber risks that are amplified by frontier AI models, and the risks posed to institutions as they use AI internally.

What we have seen this year is an extraordinary nonlinear expansion of AI capabilities. This is affecting both cyber risks as an external threat, and the use of AI internally and the risks that go along with it.

OSFI is still very focused on commercial real estate risks, the risks posed by interconnectedness and non-bank financial institutions, and risks posed by general liquidity conditions in the market. These were our top three risks from our latest Annual Risk Outlook (ARO) in April. We think AI is going to crack the top three in our next ARO. And we will have to adapt to that.

So far, we have taken the approach of first, do no harm. This is new technology. Industries, including the banking sector, are used to incorporating new technology all the time. They'll figure it out before we will. We don't want to get in the way of anything.

That mindset is now running into reality and we are starting to ask ourselves: Are there basic safety measures we should start promulgating across the industry, so that there is a minimal level of safety with regard to managing cyber risk from AI, and with regard to managing the risks of applying AI internally?

We have to at least start asking the question of whether we need minimal safety standards. That's how I see all of OSFI’s regulatory guidance—as establishing a baseline minimum and viable set of standards across counterparties in our sector, so the weak link isn't too harmful to the overall system.

Has OSFI’s focus shifted, considering the ongoing trade tensions with the United States? How are tariffs and broader trade tensions changing the risk profile of Canadian financial institutions, and what indicators are you watching most closely?

Our starting premise is that our trade relationship with the United States has fundamentally changed, and we are not going back to the period of 1987 to 2021. That's our operating premise. I see that as just reality.

So now we have a transition to make. And it seems to me the trade conflict signifies that the transition will be sharper and, hopefully, shorter. This would be our preferred route. Canada has a highly resilient financial system. We can absorb a short, sharp shock. And if we get to a place where the economy adapts faster, in the long run, that's better for the economy—and better for the financial system.

I actually think we should see the trade conflict as a reason for medium-term optimism, and that Canada will make a shorter, sharper turn. Then, if we can move at least as fast as the federal government intends, we will get to a much more diversified trade mix and a much more diversified economy. Although the pain in the near term is likely to be greater, the benefits in the long term are also likely to be greater.

In terms of what we are most acutely worried about in the short term—it is the Canadian household. That is where we see the greatest concentration of leverage. The sharp shock will affect that part of our system most directly and acutely. We are watching that closely.

Even as we speak today, we see no evidence to suggest the impact of the trade conflict is anything other than a normal course deterioration of credit quality, which will be absorbed through earnings, leaving capital largely untouched. Now, in six months, that diagnosis may change, but there's no empirical evidence that suggests we are outside that.

That is also one of the surprises in the last two years: how resilient the economy has been in Canada. So we know what we're looking for, we just haven't seen it yet in the headlines.

OSFI has said it has developed a "toolbox" of measures that could be deployed if economic conditions deteriorate because of trade disruptions or other shocks. What types of actions are available to OSFI, and what conditions would trigger their use?

We're pretty much using the toolbox now. We started to put it together early in 2025 after thinking about the broader economic environment. We began implementing measures over the last year in the insurance industry. We lightened capital requirements for infrastructure. In the banking industry, we've lightened up capital requirements for commercial industrial lending, specifically small and medium-sized enterprise lending. Those moves are obviously trying to hit singles, by making productive incremental changes to our regulatory regime to respond to the risks we face today.

Hopefully, we will do this intelligently and shrewdly. It means OSFI needs to accept more risk in the financial system for worthwhile benefits that are required now. Those benefits are both promoting sustainable economic growth and enabling a greater degree of competitive intensity in the banking system.

OSFI has identified AI as both an opportunity and a risk for federally regulated financial institutions. How do you balance this out as AI adoption advances so quickly in the financial sector?

Here is where we can be helpful as a regulator in raising the bar. To address the biggest risks posed by AI—whether it's the use of AI for risk-taking or use of AI as defence against cyber risk—we want common and equivalent protections across the system.

This is critical. As soon as there is a perception that those protections are uneven, then experience tells us that funding will go to where the safety is perceived greatest and go away from where danger is perceived as greatest. To me, this is where OSFI can be particularly useful at adding a bit of regulatory rigour into the system if it serves the broader purpose of getting regulated institutions at some base level of safety. This means that wherever you bank or insure, you believe you are covered at a standard level of protection.

This matters because people will then be less likely to abruptly move their business from one place to another, which is where you get financial system instability. That's our greatest utility in managing that risk.

In April, CD Howe Institute released a report, Rethinking Prudential Rules to Strengthen Canada’s Economy Through Improved Business Lending. One proposal was to change the capital rules for credit unions to make them more competitive. Has there been further thinking from OSFI about this recommendation?

I thought the report was very thoughtful, as I have publicly said before. We are considering all the ideas it proposes, including the issue of NVCC as a capital tool across the system, and particularly for mutual institutions like credit unions. So yes, it's something we are thinking about.

We will be providing an update on our draft capital adequacy requirements guideline for 2028 in our next quarterly release. That would be where you would see any changes we make on that matter. The next quarterly will appear on November 19, 2026.

If we were having this discussion in 2030, what do you think would be the most significant change in the Canadian financial system?

That's my favourite question, and it’s a challenging one to answer.

The variants in the paths forward are so wide. We have a fat tail system right now. What “fat tail” means is there are many scenarios that have big downside risks, and many scenarios that have big upside risks.

In 2030, I think digitalization will have advanced considerably.

I think in three years at OSFI, we will be working hard to upgrade our talent so that we can understand how new technologies affect traditional risks.

I think the recent announcement of a tokenized deposit framework that six institutions will join is going to fundamentally change how deposits are used as money in our financial system. I think it's a good innovation, one that will add more value to the system over time. And it's going to change how we think about risk.

For example, under the current system, deposits that are not tokenized exist on a single general ledger, at Bank X or Bank Y. When we move to tokenized deposits, by definition, that means a deposit is going to exist on a distributed ledger. In this case, it would be a centralized one that all the players would use. And it's also going to be a claim on a bank, which means it's going to exist on that general ledger.

The issue is—how do we supervise deposits to make sure that A equals B on both ledgers? Because that's going to be really important. The confidence that A equals B amongst depositors is OSFI’s raison d'être. We are going to need people who understand that so that we can have the right safety measures in place.

I also think, and this is hope, not fact yet, that at the turn of the decade we are going to see more entrants in the financial services sector. There will be very, very different business models in the banking and the insurance system. The traditional incumbents are going to be challenged as they've never been challenged before by these new incumbents. That can be done safely for the benefit of the financial system overall.

But I do think another term for what will happen by 2030 is creative destruction. We want as much creativity as possible—and as inexpensive destruction as possible. I think we'll be dealing with that.