OSFI E-23 introduces broader model risk management expectations. But for many financial institutions, the biggest challenge may be identifying the models they already use.
By Bob Hill | BLS Consulting
Your institution may already be using more models than its model risk management team knows about.
Consider a software vendor that introduces an AI-powered forecasting tool, automated risk score, or predictive analytics feature through a routine platform update. The business starts using the functionality, but nobody registers it as a model. From an operational perspective, it is simply another software feature.
Under the revised OSFI E-23 Model Risk Management Guideline, that distinction matters.
Published on September 11, 2025, and effective May 1, 2027, the revised guideline significantly expands model risk management expectations for federally regulated financial institutions (FRFIs).
The real challenge is not necessarily understanding the framework. It is determining whether institutions have a complete and accurate picture of the models already operating across their businesses.
The Scope of Model Risk Has Changed
The previous E-23 guideline focused on models producing quantitative estimates and applied to federally regulated deposit-taking institutions.
The revised guideline takes a broader approach, covering models that process input data to generate results, explicitly including artificial intelligence and machine learning. Its application also extends to a wider range of federally regulated financial institutions, excluding federally regulated pension plans.
This creates a practical problem.
Traditional model inventories were often developed around credit risk, capital calculations, actuarial projections, and other established quantitative models.
Today, model-driven functionality may also exist within financial reporting systems, customer management platforms, fraud detection tools and third-party applications.
An institution’s existing inventory may therefore be accurate under its previous classification approach while missing models that now require assessment.
A model that has not been identified cannot be properly assessed, governed or monitored.
Third-Party Models Create the Greatest Visibility Challenge
One of the most significant aspects of OSFI E-23 is its treatment of third-party models.
Financial institutions increasingly rely on software providers whose products incorporate predictive analytics, automated decision-making and AI capabilities.
These functions may be introduced without a separate model procurement or approval process.
OSFI has made clear that third-party models remain subject to appropriate model risk management expectations. Its September 2025 covering letter also confirms that the regulator declined to introduce a general grace period for third-party model risk.
Guideline B-10 on Third-Party Risk Management remains relevant to these arrangements.
For financial institutions, this raises difficult operational questions.
Does the institution know which vendor applications contain models? Who is responsible for assessing them? Can the vendor provide sufficient documentation? How are material changes identified and reviewed?
These questions cannot be answered by the model risk management function alone.
Procurement, technology, finance, compliance and business teams may each hold information needed to establish a complete picture.
The challenge is bringing that information together.
A Model Inventory Is More Than a Compliance Register
OSFI E-23 establishes expectations across nine model lifecycle stages, from design and development through review, approval, monitoring and eventual decommissioning.
However, lifecycle governance depends on identifying the models to which those controls should apply.
The revised guideline expects institutions to identify and track models, assess inherent risk and maintain an accurate inventory of models with non-negligible inherent risk.
That means institutions need more than a spreadsheet listing familiar models.
They need a reliable process for identifying model-driven functionality across existing applications, new technology purchases, vendor updates and changing business processes.
The inventory must also remain current.
A one-time exercise completed before May 2027 will have limited value if newly introduced models can continue operating without appropriate identification and assessment.
What Should Financial Institutions Be Doing Now?
With the implementation deadline approaching, financial institutions should be testing the completeness of their existing model inventories rather than assuming those inventories are accurate.
A practical starting point is a model inventory and gap assessment that examines existing models, third-party applications, ownership responsibilities and current governance arrangements.
The objective is to identify where models may be missing, where documentation or oversight is insufficient, and which gaps require priority attention.
For CFOs, CROs and board risk committees, the central question should be straightforward:
Can management demonstrate that the institution knows which models it uses, including those embedded in third-party software?
If the answer is uncertain, that uncertainty deserves attention now.
The Real E-23 Readiness Test
May 1, 2027, is a fixed regulatory deadline. The scope of the work required to meet it may still be unclear for institutions that have not tested their model inventories.
Policies, governance committees and validation procedures are important. But they cannot compensate for models operating outside the institution’s visibility.
OSFI E-23 is ultimately about establishing effective model risk management across the organization.
That starts with knowing what is already there.
Preparing for OSFI E-23?
BLS Consulting helps organizations assess governance, operational processes and control gaps associated with AI and model adoption.
A model inventory and gap assessment can help establish where your institution stands, identify potential gaps and prioritize the work ahead of May 2027.
Contact BLS Consulting to discuss your readiness.
