Canadian Banks Face New Tech, Cybersecurity Reporting Rules (1)

Financial institutions in Canada will need to report cybersecurity incidents that significantly affect operations or external customers to a federal regulator starting March 31.

Canada’s Office of the Superintendent of Financial Institutions (OSFI) Jan. 24 released an advisory for federally regulated banks, insurers, and other financial institutions outlining new expectations for reporting tech and cybersecurity incidents. The advisory overrules any existing incident reporting instructions, the agency said in a statement.

The OSFI, a federal agency that regulates Canada’s financial institutions, describes a technology or cybersecurity incident as one that may “materially impact the normal operations” of the institution. Incidents that ...