Guide · OSFI E-23

Validation vs verification. What E-23 asks for.

By Sam Talasila · Last checked against OSFI’s guideline and letter on October 17, 2026

In OSFI’s Guideline E-23, OSFI treats validation and model review as the same thing, an independent check that a model is properly specified, working as intended and fit for purpose. Verification isn’t an E-23 term. It usually means checking that a model was built and runs as designed, which E-23 covers in testing, deployment and monitoring.

What does E-23 mean by validation?

OSFI’s letter on the final guideline says “validation” is interchangeable with “review.” Principle 3.4 asks for a process to “independently assess conceptual soundness and performance of models.” The review should confirm that models are “properly specified, working as intended, and fit-for-purpose.”

So what is verification?

E-23 doesn’t define it. The word appears once, in monitoring, as “verifying the model is within its original scope.” By it, people usually mean narrower checks: that the code matches the documented method, that the inputs are the right data, and that the model gives the same results in production as in testing. E-23 expects those checks under development, deployment and monitoring.

What can a model review include?

OSFI lists what reviews may include. A reviewer can confirm or challenge the risk rating, and check the model’s purpose, scope, soundness, limitations and the reasonableness of its outcomes. The review also covers data quality, new methods such as AI, the model’s explainability and any third-party parts. It ends with documented findings and a recommendation to the approver.

What should prompt a model review?

OSFI lists five events that should prompt a review: a new model, a change to a model, a breach of its performance limits, a significant change in its data, and a scheduled periodic review. The risk rating sets how often each model gets a review and how deep it goes. OSFI chose not to set a fixed frequency.

Who does which check?

Developers run performance tests on their own work. Owners coordinate deployment and monitoring. OSFI expects the review to be independent from development, and says institutions can use “internal reviewers or objective third parties.” The approver, often a committee or senior management, decides whether the model can be used after reading the reviewer’s findings.

Role	Checks it does	Independent?
Developer	Performance tests, documented assumptions and method	No
Owner	Tests in production, ongoing monitoring	No
Reviewer	Validation: soundness, data, limitations, outcomes, risk rating	Yes, from development
Approver	Decides on use, based on the review	Not the reviewer; often a committee or senior management

Do vendor and AI models need validation?

Yes. OSFI’s letter says third-party models should “receive validation and monitoring commensurate to the model risk.” OSFI gives no grace period for vendor updates, but an institution can set an exceptions policy that allows limited use before validation is done. OSFI says it is up to each institution to get adequate documentation from vendors. It also says its outcomes and principles are the same whatever the modelling method, with some added points for AI.

Can a smaller lender validate only part of a model?

OSFI didn’t add a separate option for targeted or reduced-scale validation. It said the risk rating should drive the scope of each review, so a low-rated model gets a lighter review. That review is still independent.

Where I can help

I build the first inventory for one area of your business, with risk ratings, owners and first-line documentation that your model-risk team or an outside reviewer can work from. Fixed fee from CAD 10,000. I don’t do independent validation. If I helped build or document a model, someone else should review it.

See E-23 evidence work Book a 30-minute fit call

Sources

This page summarizes OSFI’s published guideline. It isn’t legal or regulatory advice.