Take a Canadian SME that sells document management software. Its first banking client sends a draft contract: a security schedule, a right to audit, an incident notification deadline, a subcontractor clause, an exit plan. And a two-hundred-question questionnaire. Management's reaction fits in one sentence: "We're not a bank, these rules don't apply to us."
Our position: "we're not a bank" won't get you out of B-10. The guideline doesn't target you directly, that's true. But your client has to comply with it, and the only way it can is by writing it into your contract. This is a reading, not legal certainty: your counsel remains the reference for your own contract.
What B-10 is, in four facts
- What it covers. Guideline B-10, "Third-Party Risk Management", from the Office of the Superintendent of Financial Institutions (OSFI) applies to federally regulated financial institutions: federally regulated banks, insurers and trust companies. Published on April 30, 2023, it replaces the former B-10 on outsourcing. Status: confirmed by OSFI.
- Since when. It has been in effect since May 1, 2024. Arrangements entered into before that date are to be updated at the earliest appropriate renewal or revision point. Status: confirmed by OSFI. In other words, every renewal with a bank is an opportunity to add B-10 to your contract.
- Who counts as a "third party". Almost everyone. B-10 defines a third-party arrangement as any type of business or strategic arrangement between the institution and an entity or individual, independent consultants included, and states that the absence of a written contract does not imply the absence of a third-party arrangement. Only the institution's customers and employment contracts are excluded. Status: confirmed, text of the guideline.
- Who stays accountable. The institution retains accountability for the business activities, functions and services outsourced to third parties. Status: confirmed. That sentence explains everything else: since the bank cannot hand off its accountability, it hands you obligations.
Why it lands on your desk
B-10 is proportionate. OSFI expects the intensity of oversight to depend on the risk and criticality of each arrangement, criticality meaning importance to the institution's operations, strategy, financial condition or reputation. An office supplies vendor gets a form. A vendor that hosts customer data or supports a critical operation gets everything else.
Two other texts often join B-10 in the same file. OSFI Guideline B-13, in effect since January 1, 2024, covers technology and cyber risk; B-10 points to it when assessing a third party's ability to manage those risks. And insurers, credit unions, trust companies and other deposit institutions authorized in Québec answer to the Autorité des marchés financiers, which published its own third-party risk management guideline in March 2026. It takes effect on April 1, 2027; arrangements entered into before that date are expected to be brought in line at their next renewal. If your Québec client renews your contract in the next eighteen months, expect these questions. Status: confirmed by OSFI for B-13, by the AMF for its guideline. The questions look alike.
What you will be asked
Before signing: due diligence. Annex 1 of B-10 lists examples of what the institution examines. Among them: your experience and capacity, your financial strength, the strength of your information security program, your ability to manage technology and cyber risk in line with B-13, to keep delivering through a disruption, to manage your own subcontractors, the geographic location of your operations and your subcontractors', how easily you could be replaced, and your insurance. That is where the questionnaire comes from.
In the contract: the clauses. Annex 2 lists the provisions expected for high-risk and critical arrangements: nature and scope, roles and responsibilities, use of subcontractors, ownership and access, security of records and data, notifications to the institution, regulatory compliance, business continuity and recovery, default and termination, insurance.
During the relationship: notifications. B-10 expects the agreement to require the third party to report events in a timely manner. It doesn't set a number of hours; the contract will. And it will be short, because the institution itself must notify OSFI in writing within 24 hours, or sooner if possible, of a reportable technology or cyber incident, including an impact to a third party that affects the institution. Status: confirmed, OSFI incident reporting advisory. Your deadline becomes a fraction of those 24 hours.
The three clauses that surprise suppliers
- OSFI's right to audit. The agreement should give the institution and OSFI the right to evaluate your risk management practices related to the service. Decide who hosts the auditor and which documents you show.
- Your subcontractors. B-10 defines a subcontractor as an entity in your supply chain, and the institution must manage the risk that comes with it. Your hosting provider, your support tool, your backup provider: you will be asked for the list, where the data sits, and the right to be told of a change. We covered this in our article on concentration risk.
- The exit. Default, termination, notice, return of data: the bank needs to know how it would leave you, in normal times and in a crisis.
How to prepare: one page
The questionnaire will change from one client to the next. The answers don't. Gather them on one page, before anyone asks:
- What you provide and what you touch: the service, the client data you process, the access you hold in their systems.
- Your subcontractors: who, for what, where the data is.
- Your controls, each with evidence: multi-factor authentication, tested backups, patching, access management, awareness. A policy without evidence is a ticked box, nothing more.
- Your notification commitment: a deadline in hours, a contact reachable at any time, what the first notice contains.
- Your continuity: target recovery time, date of the last test, procedure for returning data at the end of the contract.
- Your insurance: cyber and professional liability coverage, with amounts.
It's not a certification, but it lets you answer the questionnaire in days rather than weeks, and negotiate the clauses instead of enduring them.
What you should have a week from now
The one-page sheet, filled in, with one person in charge of keeping it current. The list of your subcontractors and where your data sits. A notification deadline you can actually meet, signed off by the team that would be woken up at 3 a.m. And, for your next banking renewal, the list of B-10 clauses you accept as written and those you want to discuss.
To see what a buyer asks, our free vendor security questionnaire generates the questions a client would ask, subcontractors and incident notification included. Our page on customer security proof shows how to answer once for all your clients. The vocabulary is in our entry on third-party risk management.
And you?
Have you already received a security schedule from a bank, an insurer or a credit union? Which clause surprised you most: the right to audit, the notification deadline or the subcontractor list? Tell us in the comments.
On the platform side, Forta Suppliers keeps a record for each third party and Forta Compliance links your evidence to your clients' requirements.
Sources: OSFI, Guideline B-10, Third-Party Risk Management (April 30, 2023) · OSFI, summary response to consultation feedback and B-10 effective date · OSFI, Guideline B-13, Technology and Cyber Risk Management · OSFI, Technology and Cyber Security Incident Reporting advisory · Autorité des marchés financiers, Third-Party Risk Management Guideline (March 2026)