Regulatory Compliance for Financial Institutions

AI governance is becoming a real business issue, not just a theoretical one. This session will focus on the concrete practices needed to approve, validate, monitor, and oversee AI systems in regulated environments. We will discuss:

• Establishing structured intake, risk‑tiering, and documented business justification for every AI deployment
• Managing privacy and auditability with strong data controls, traceability, and evidence that automated decisions meet regulatory expectations
• Running continuous validation to detect drift, errors, and customer‑impact risks before they escalate
• Governing generative AI, shadow AI, and experimentation to prevent unmanaged or unauthorized risk
• Preventing bias and poor outcomes with fairness testing, scenario reviews and guardrails to protect vulnerable customers
• Strengthening oversight and building trust between technical teams and compliance through shared controls, documentation, and transparent model behaviours

These small-group conversations are a chance to compare how AI is actually being used across financial services, what’s working, what’s stalling, and where teams are encountering friction.

Discuss persistent barriers around data, governance, testing, and regulatory uncertainty. Share practical lessons and approaches for building effective AI strategies.

1. Where is AI actually improving day-to-day work in your organization, and where does adoption still stall?
2. What data or governance gaps most often slow down AI deployment across your teams?
3. How are emerging AI rules affecting how you design, test, or approve new AI use cases?
4. What real-world lessons or approaches have helped you move AI projects from experimentation into production?

This session will explore how financial institutions are tightening vendor oversight and resilience practices as new guidelines reshape expectations for critical operations, incident response, and technology risk.

• Aligning third‑party, technology, cyber, and resilience controls into one governance model
• Meeting new regulatory standards: Adapting to OSFI’s evolving expectations for critical operations, vendor concentration, and incident response
• Applying global best practices and international approaches that modeled RPAA-style frameworks (Retail Payment Activities Act)
• Shifting from outsourcing critical systems to rebuilding internal capabilities for greater control and resilience.

These small-group discussions are a chance to compare how different financial institutions are approaching third-party risk, what’s working, where teams are running into friction, and how people are adapting to OSFI’s expectations.

Discuss practical challenges around vendor oversight, compliance alignment, and cross-border dependencies, and share real-world steps that help strengthen third-party risk programs.

1. How is your organization interpreting and applying OSFI’s B-10 requirements for vendor oversight and resilience, and where do you see the biggest challenges?
2. How are you integrating third-party controls with AML, privacy, and cyber obligations, and where do these requirements create friction or gaps?
3. What issues arise when managing foreign branches, data-location constraints, or jurisdictional requirements, and how are you addressing them?

Administrative Monetary Penalties (AMPs) are reshaping how regulated entities including banks, Payment Service Providers (PSPs), and Money Service Businesses (MSBs) approach accountability, remediation, board oversight, and engagement with OSFI.

This session outlines what AMPs mean for day‑to‑day compliance operations and how institutions can prepare for a more assertive supervisory environment.

• Interpreting OSFI’s new model and heightened supervisory expectations, and the shift toward more proactive enforcement
• Clarifying accountability, strengthening remediation processes and elevating board reporting
• Competing under stricter standards and aligning frameworks, governance and board involvement to remain competitive in a more demanding regulatory landscape
• Implementing key guidelines: Applying E‑13, B‑10, and B‑13 across compliance, third‑party risk, cyber, and governance functions

Compliance teams, especially in small and mid‑sized institutions are being asked to absorb more regulatory change, more technology risk and more board scrutiny while operating with tighter budgets and fewer people.

This session explores practical, applicable ways to prioritize work, communicate effectively with leadership, and modernize compliance operations without overengineering.

• Prioritizing what matters and focusing limited resources on the highest‑impact risks, regulatory changes, and control gaps
• Right‑sizing compliance teams: Clarifying CCO accountability, addressing talent shortages, and defining what a modern compliance function should look like
• Leveraging technology using automation, metrics, and workflow tools to scale oversight with fewer people
• Improving board communication: Demonstrating effective controls, simplifying reporting, and elevating issues that require board attention