Canada’s banking regulator warns banks about agentic AI cyber risks

Canada’s Office of the Superintendent of Financial Institutions has put generative and agentic AI on the operational-risk agenda for banks and insurers. Its July 1 Technology Risk Bulletin addresses the technology, cybersecurity and operational-resilience implications of increasingly capable AI systems.

The bulletin is advisory, not a new rule. OSFI says its technology risk bulletins are timely supervisory communications that highlight current and emerging risks, but are not regulatory expectations. Institutions may use the described practices to assess and manage their own risk and control posture.

Reuters separately reported that an April 29 OSFI email warned major financial institutions that advanced AI models could increase cyber threats and compress the time available to identify and respond to vulnerabilities. According to the report, the email referenced Anthropic’s Claude Mythos. That model-specific warning comes from the email obtained by Reuters, not from the public bulletin itself.

For financial institutions, the immediate issue is response speed: powerful models may change how quickly vulnerabilities can be found and exploited, while banks still have to govern their own use of agentic systems. OSFI has not announced a mandatory implementation standard or explained how it will assess compliance. The next meaningful signal will be whether this advisory material becomes formal guidance or produces institution-specific remediation requests.