AI in Canadian financial services is used most often for fraud detection, credit and insurance decisions, anti-money-laundering monitoring, and customer service, and the rules that apply attach to the institution rather than to the technology. The main new federal instrument is the Office of the Superintendent of Financial Institutions (OSFI) Guideline E-23 on model risk management, published September 11, 2025, which takes effect May 1, 2027 and expressly covers AI and machine learning models at federally regulated financial institutions.
Key takeaways
- A 2024 OSFI and FCAC survey found that about 50 percent of federally regulated institutions used AI in 2023, with about 70 percent expecting to by 2026.
- Guideline E-23 applies a risk-based approach to every model, including third-party and self-learning models, from May 1, 2027.
- Reported fraud losses in Canada passed CAD 704 million in 2025, and draft federal rules would require banks to have fraud detection and prevention policies.
- Consumer-driven banking is law but not yet operating: regulations were proposed on June 27, 2026, and the Bank of Canada is to supervise the system.
What the regulators say about AI use
OSFI and the Financial Consumer Agency of Canada (FCAC) published a joint risk report on AI on September 24, 2024. It drew on a voluntary questionnaire sent to federally regulated institutions in December 2023. Respondents reported that use of AI had reached about 50 percent in 2023, and about 70 percent expected to be using it by 2026. Fraud detection was one of the most common applications, and institutions were also applying AI to more consequential work such as underwriting, pricing, claims management, and credit adjudication. The top risks named were data privacy and security, model risk, legal risk, and business risk. The two regulators described their existing guidance on model risk, third parties, cybersecurity, and resilience as technology neutral, which means no separate AI rulebook was created.
Fraud detection and why it matters now
Pattern-matching models suit fraud work because card, payment, and login data arrive in large volumes and bad actors change tactics quickly. The scale of the problem in Canada is documented. The CAFC reported more than 112,000 fraud reports and more than CAD 704 million in reported losses for 2025, with investment fraud accounting for CAD 351 million. A federal news release from June 2026 adds that the government estimates only five to 10 percent of scams are reported.
The Department of Finance has proposed regulations that would require banks to maintain policies to detect and prevent fraud aimed at consumers and to report prescribed fraud data to the FCAC. They would also let customers disable certain account functions and set their own transaction limits. The proposals were published in the Canada Gazette on June 27, 2026, with a 30-day comment period for the anti-fraud text. As proposals, they can still change before they become final.
Model risk: Guideline E-23
E-23 replaces a 2017 guideline and now covers all models at all federally regulated financial institutions: banks, foreign bank branches, life and fraternal insurers, property and casualty insurers, and trust and loan companies. Federally regulated pension plans were removed from scope. OSFI states that the revisions add clarity for AI and machine learning, including explainability across the model lifecycle, self-learning models, and generative AI.
The guideline is proportionate. A model's risk rating, not a fixed calendar, drives how often and how deeply it is reviewed. Institutions set their own criteria for when a self-learning model has changed materially, need approvals before and after changes, and must keep third-party models under the third-party risk principles in Guideline B-10, with validation and monitoring matched to risk. OSFI's letter on Guideline E-23 gives the full scope and effective date.
Money laundering monitoring and who stays responsible
Automated monitoring helps reporting entities find unusual activity, but the legal test for a suspicious transaction report is set by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act framework: reasonable grounds to suspect that a transaction is linked to a money laundering or terrorist financing offence, with a report filed as soon as practicable and no minimum dollar amount. FINTRAC's guidance says a service provider may file a report on an entity's behalf, but the entity remains ultimately responsible and cannot delegate the obligation. The guidance does not discuss AI tools directly, so the point is stated here only as a general principle about outsourcing.
Consumer-driven banking: status as of October 2026
Consumer-driven banking, often called open banking, lets people share account data with accredited providers through secure connections. Budgeting and credit tools, including ones that use machine learning, could draw on that data once the system operates. The table summarizes what is in place.
| Element | Status | Detail |
|---|---|---|
| Legislation | Enacted | Bill C-15 amendments complete the Consumer-Driven Banking Act and amend PIPEDA for a data mobility right |
| Supervisor | Bank of Canada | Supervises participants, accredited providers, the technical standards body, and the complaints body, and keeps a public registry |
| Regulations | Proposed | Published in the Canada Gazette on June 27, 2026, with a 60-day comment period |
| Rollout | Staged | Accreditation comes first, followed by common rules and assessment fees within one year of final publication |
| Data scope | Defined | Deposit, payment, investment, and lending account data; derived data such as credit ratings is excluded |
The Department of Finance has not given a launch date. Its June 2026 announcement says timing for other products and services will be set when the final regulations are published.
Automated decisions and customer-facing tools
Chatbots and automated decisions raise questions about transparency. On June 15, 2026, the federal government introduced Bill C-36, which would add transparency requirements for automated decision systems, including AI-powered ones. It is a proposal and has not become law. For now, institutions rely on existing privacy statutes and the supervisory expectations above.
A note on company lists
This article does not rank or recommend companies. No independent, verifiable ranking of Canadian AI fintech firms was found, and a list built from marketing claims would not meet this site's sourcing standard. Readers comparing providers can start with the regulator registries and public filings of the institution in question.
The content here is general information about regulation and industry practice. It is not investment, credit, tax, or legal advice, and rules vary by institution type and province. Anyone making a financial decision should consult the primary sources listed below or a qualified professional.
FAQ
Does Canada have a law specific to AI in banking?
No. OSFI and the FCAC treat their existing guidance as technology neutral, and Guideline E-23 is a model risk guideline that names AI and machine learning within its scope.
When does Guideline E-23 take effect?
May 1, 2027, for all federally regulated financial institutions. OSFI published the final version on September 11, 2025.
Is open banking live in Canada?
Not yet. The law is enacted and draft regulations were published on June 27, 2026, but accreditation and the technical standard still have to be put in place, and no launch date has been announced.
Can a vendor take over a bank's compliance duties?
Not fully. E-23 requires third-party models to be validated and monitored according to risk, and FINTRAC states that a reporting entity stays responsible when a service provider files reports for it.
Related reading
More in AI in finance.
Last verified: October 2026
Sources
- Guideline E-23 Model Risk Management (2027), letter, OSFI, September 11, 2025
- OSFI-FCAC Risk Report: AI Uses and Risks at Federally Regulated Financial Institutions, September 24, 2024
- Government pre-publishes regulations to prevent fraud and facilitate the next phase of consumer-driven banking, Department of Finance Canada, June 2026
- Budget 2025: Canada's Consumer-Driven Banking Framework, Department of Finance Canada, 2025
- Top 10 frauds in 2025, CAFC, 2026
- Reporting suspicious transactions to FINTRAC, FINTRAC guidance
- Government of Canada introduces legislation to protect Canadians' privacy in the digital age (Bill C-36), Innovation, Science and Economic Development Canada, June 15, 2026