Trust centers for fintech suppliers
Selling to a Canadian bank means being assessed under OSFI's third-party risk guideline. A trust centre that anticipates it saves weeks.
A fintech company selling to Canadian banks and insurers should expect to be assessed under OSFI's Guideline B-10 on third-party risk management, which federally regulated financial institutions apply to their suppliers. Its trust centre should cover the areas those reviews probe: data location, security controls with an independent report, business continuity and resilience, subcontractors, incident notification and how the relationship can be exited. Expect a SIG questionnaire as well.
What does an OSFI B-10 review look for?
- Criticality. How important your service is to the institution's operations.
- Security and data. Controls, independent assurance, where data is stored and processed.
- Subcontractors. Who you depend on, and how you manage them.
- Resilience. Business continuity and disaster recovery, with test evidence.
- Incidents. How quickly and how you notify.
- Exit. How data is returned and the service transitioned if the relationship ends.
What should a fintech trust centre add?
A gated business continuity summary with the date of the last test, a subprocessor list with locations, an exit and data return statement, and a current SIG. A SOC 2 Type 2 is usually expected for anything touching customer financial data. Payment card handling brings PCI DSS; state your scope plainly.
What evidence do financial buyers expect?
| Area | Evidence | Where it lives |
|---|---|---|
| Independent assurance | SOC 2 Type 2, sometimes ISO 27001 | Gated |
| Resilience | Business continuity plan and last test date | Summary public, plan gated |
| Subcontractors | Subprocessor list with locations | Public |
| Data | Residency and encryption statements | Public |
| Exit | Data return and transition commitment | Public summary |
| Testing | Penetration test letter | Gated |
Reviews repeat each year for material relationships, which is where a managed trust centre earns its keep.
Common questions
Does OSFI B-10 apply to us directly?
No. B-10 applies to federally regulated financial institutions. It reaches you through their contracts and assessments, which is why their reviews are thorough and repeat annually.
Is a SOC 2 Type 1 enough for a bank?
Usually not for a material relationship. Banks generally expect a Type 2 covering a period, and may accept a Type 1 plus a dated plan for an early engagement. Ask the reviewer.
Prepare for financial institution reviews
A trust centre and SIG set up for bank and insurer buyers.
Get matched