Geopolitical tensions, economic uncertainty, and rapid advances in artificial intelligence have intensified risks to Canada’s financial system, exposing banks and other financial institutions to increasingly sophisticated cyberattacks, the country’s financial regulator says.
The Office of the Superintendent of Financial Institutions (OSFI) released its 2026 semi-annual risk outlook on Oct. 8, warning that risks to financial institutions have increased since its last assessment in April, adding the sector remains profitable and resilient.
The regulator said economic conditions in Canada have weakened and technological developments have introduced new threats.
“Global uncertainty has remained elevated and geopolitical tensions have intensified,” OSFI said in the report, adding that war between the United States and Iran has raised concern about disruptions to energy supply chains and economic shocks.
Meanwhile, Canadian economic growth remains volatile, inflation exceeds targets, and businesses and households face financial pressures, it said.
OSFI said the trade dispute between Canada and the United States has also discouraged business investment, disrupted supply chains, weakened consumer confidence, and increased financial market volatility.
The regulator said it had reduced its Domestic Stability Buffer earlier this year to support continued lending during economic uncertainty. It said the move gives Canada’s largest banks greater flexibility to use their capital to support the economy as it adjusts to changing trade, technology, and geopolitical conditions.
Artificial Intelligence Risks
The regulator devoted much of its latest assessment to the growing threats associated with frontier AI, the most advanced artificial intelligence systems available.
OSFI said AI capabilities have developed significantly since April, increasing cybersecurity, technology, third-party, and reputational risks for financial institutions.
In particular, the report said advances in AI are making cyberattacks faster, more sophisticated, and more accessible to criminals who previously would have needed substantial technical expertise.
Frontier AI systems can identify and exploit vulnerabilities across multiple interconnected computer systems, allowing attackers to combine relatively minor security weaknesses into major attacks, the report noted.
These developments have also shortened the time between discovering security vulnerabilities and exploiting them, giving financial institutions less time to identify threats and implement protective measures, the report said.
The regulator warned that increasingly automated cyberattacks, combined with emerging technologies such as quantum computing, will make the threat environment more complicated.
However, OSFI said AI could also help financial institutions identify vulnerabilities, strengthen cybersecurity, and improve productivity and risk management.
Reliance on Foreign Technology
Another concern involves the financial sector’s growing dependence on a relatively small number of technology companies that develop advanced AI models and provide cloud computing infrastructure.
OSFI warned that this concentration could expose multiple financial institutions to simultaneous disruptions if a major technology provider suffers a cyberattack, operational failure, or service outage.
The regulator also raised concerns about Canada’s reliance on technology services based in foreign countries.
As financial institutions increasingly adopt AI, their dependence on international technology providers could grow, leaving them vulnerable to geopolitical disputes, foreign government restrictions, and policy changes that limit access to essential services, the report said.
Financial institutions could also struggle to understand how outside technology providers use AI or manage vulnerabilities, making oversight and risk management more difficult, the regulator noted.
OSFI said institutions must strengthen their monitoring of technology providers and ensure their controls keep pace with technology.
The regulator also warned that institutions falling behind in adopting emerging technologies could face reputational risks and reduced competitiveness.
OSFI said it is strengthening its ability to assess AI-related threats and working with financial institutions, national security agencies, and international regulators to improve preparedness.
The regulator said it would continue examining the systemic implications of financial institutions relying on common technology providers.
