On November 13^th, the Office of the Superintendent of Financial Institutions (OSFI) issued the final version of Guideline E-13 – Regulatory Compliance Management (RCM Guideline).  The RCM Guideline sets out OSFI’s expectations for compliance risk management at all federally regulated financial institutions (including all Canadian banks and most Canadian insurance companies).  The Guideline replaces the former Legislative Compliance Management Guideline issued in 2003 (the 2003 Guideline).  Since the 2003 Guideline was issued, OSFI has reissued both its Guideline on Corporate Governance and its description of its Supervisory Framework, both of which make reference to aspects of OSFI’s expectations for compliance risk management.  In issuing the new RCM Guideline, OSFI stated that one of the primary purposes for reissuing the Guideline was to ensure that it was aligned with the guidance expressed in these more recent documents.

OSFI also maintains that the RCM Guideline does not create any new regulatory requirements.  In the broadest sense, this is true, as OSFI’s expectations for the general framework used to manage regulatory risk has not changed.  The 2003 Guideline clearly required that institutions adopt the three lines of defence model, with responsibility shared between operational management, an independent compliance function and internal audit.  However, the RCM Guideline elaborates considerably on the various aspects of the RCM framework.  Institutions will need to assess their current practices to determine whether any gaps exist between their existing RCM frameworks and the newly elaborated expectations.