NEOEDGE AIE-23 for smaller lenders. What proportionate looks like.
OSFI’s Guideline E-23 applies to every federally regulated financial institution from May 1, 2027, including trust and loan companies. It scales with your size, complexity and model risk. A smaller lender still needs a model inventory, risk ratings, named owners and independent review, and lower-risk models get lighter treatment.
Does E-23 apply to us?
It applies if OSFI regulates you. That includes banks, foreign bank branches, insurers, and federal trust and loan companies. The final version no longer lists federally regulated pension plans. Credit unions and mortgage lenders regulated only by a province are outside OSFI’s scope.
What counts as a model?
OSFI defines a model as “an application of theoretical, empirical, judgmental assumptions or statistical techniques, including AI/ML methods, which processes input data to generate results.” OSFI kept the definition broad on purpose. It can cover credit scorecards, pricing spreadsheets with built-in assumptions, vendor tools and AI assistants.
What does proportionate mean for a smaller lender?
The guideline applies “on a risk-basis,” in proportion to your size, strategy, risk profile and complexity. The risk rating you give each model sets how much review, documentation and monitoring it needs. The guideline has no separate track for small institutions. Review must still be independent from development.
Does every spreadsheet go in the inventory?
You identify and track every model in use or recently retired, with six facts each: an ID, its name and use, its risk rating, its owner, its developer, and whether it was built in-house or bought. Only models with non-negligible risk go into the full inventory and its lifecycle rules.
What goes in the full inventory?
For each model with non-negligible risk, OSFI lists: version, date it went into production, reviewer, approver, dependencies, data sources, approved uses, limitations, date of the last review, monitoring status and next review date. The inventory should be “accurate, evergreen, and subject to robust controls,” and keep retired models for a period you consider reasonable.
Do vendor and AI models count?
Yes. AI and machine-learning methods are named in the definition itself. Vendor models are rated on their own, and OSFI expects “a framework in place for the governance of all third-party models,” alongside its third-party risk guideline, B-10. A vendor’s black box gets no exemption.
Who can do the independent review?
OSFI says model review “should be independent from model development” and can be done by “internal reviewers or objective third parties.” A lender without a model-risk team can use a qualified outside reviewer. Whoever built a model shouldn’t be the one reviewing it.
Where to start, with months to go
- List every tool in use that turns data into a result, including vendor and AI tools.
- Record the six basic facts for each one and give it a risk rating.
- Name an owner for each.
- Move the models with non-negligible risk into the full inventory and fill in the extra fields.
- Book independent reviews for the highest-rated models first.
Where I can help
I build the first inventory for one area of your business, with risk ratings, owners and first-line documentation your model-risk team can use. Fixed fee from CAD 10,000. This is first-line work. It isn’t validation, assurance or a readiness opinion.
Sources
This page summarizes OSFI’s published guideline. It isn’t legal or regulatory advice.