AI threats weren’t a top concern for Canada’s banking regulator, but a lot has changed in 6 months

Skip to Content News Archives Economy Defence Energy Oil & Gas Renewables Electric Vehicles Mining Commodities Agriculture Real Estate Mortgages Mortgage Rates Finance Banking Insurance Fintech Cryptocurrency Defence Work Wealth Smart Money Wealth Management Investor Personal Finance Family Finance Retirement Taxes High Net Worth FP Comment Executive Women Puzzmo Newsletters Financial Times Business Essentials More Innovation Information Technology FP500 Podcasts Small Business Lives Told Tails Told Shopping Financial Post Store Obituaries Place a Notice Advertising Advertising With Us Advertising Solutions Postmedia Ad Manager Sponsorship Requests Classifieds Place a Classifieds ad Working Profile Settings My Subscriptions My Offers Newsletters Customer Service FAQ News Economy Energy Mining Real Estate Finance Defence Work Wealth Investor FP Comment Executive Women Puzzmo Newsletters Financial Times Business Essentials This advertisement has not loaded yet, but your article continues below.HomeCybersecurityFinanceBankingAI threats weren't a top concern for Canada's banking regulator, but a lot has changed in 6 monthsThe advances in AI, which are likely to continue, mean financial institutions have less time to detect and respond to threatsLast updated 31 minutes ago Despite concerns, Peter Routledge said he's satisfied with how prepared Canada’s banks are to tackle AI-related threats, though not all institutions are at the same level. Photo by Galit Rodan/Bloomberg via Getty ImagesThreats linked to artificial intelligence were not one of the top concerns for Canada’s banking regulator in April, when it released its annual risk outlook, but a series of incidents in the past six months have now led it to elevate the risks that financial institutions face due to AI.THIS CONTENT IS RESERVED FOR SUBSCRIBERS ONLYSubscribe now to read the latest news in your city and across Canada.Exclusive articles from Barbara Shecter, Joe O'Connor, Gabriel Friedman, and others.Daily content from Financial Times, the world's leading global business publication.Unlimited online access to read articles from Financial Post, National Post and 15 news sites across Canada with one account.National Post ePaper, an electronic replica of the print edition to view on any device, share and comment on.Daily puzzles, including the New York Times Crossword.SUBSCRIBE TO UNLOCK MORE ARTICLESSubscribe now to read the latest news in your city and across Canada.Exclusive articles from Barbara Shecter, Joe O'Connor, Gabriel Friedman and others.Daily content from Financial Times, the world's leading global business publication.Unlimited online access to read articles from Financial Post, National Post and 15 news sites across Canada with one account.National Post ePaper, an electronic replica of the print edition to view on any device, share and comment on.Daily puzzles, including the New York Times Crossword.REGISTER / SIGN IN TO UNLOCK MORE ARTICLESCreate an account or sign in to continue with your reading experience.Access articles from across Canada with one account.Share your thoughts and join the conversation in the comments.Enjoy additional articles per month.Get email updates from your favourite authors.THIS ARTICLE IS FREE TO READ REGISTER TO UNLOCK.Create an account or sign in to continue with your reading experience.Access articles from across Canada with one accountShare your thoughts and join the conversation in the commentsEnjoy additional articles per monthGet email updates from your favourite authorsSign In or Create an Account“Recent stories about how agents are at least interpreting their task authorizations liberally and potentially posing dangers to institutions — that’s frightening,” Peter Routledge, head of the Office of the Superintendent of Financial Institutions (OSFI), said at a press conference on Wednesday. “That is a risk front and centre for us. AI has sort of moved along the capabilities curve.”This advertisement has not loaded yet, but your article continues below.He was referring to how frontier models of AI companies in the United States such as Anthropic PBC and OpenAI Inc. went rogue in the past few months and tried to hack other organizations.Breaking business news, incisive views, must-reads and market signals. Weekdays by 9 a.m.By signing up you consent to receive the above newsletter from Postmedia Network Inc.A welcome email is on its way. If you don't see it, please check your junk folder.The next issue of Posthaste will soon be in your inbox.We encountered an issue signing you up. Please try againAs a result, OSFI is mulling over whether Canada’s financial system requires an AI safety code.Routledge did not provide details on what such a code would look like, but said the main goal would be to improve the ability of financial institutions to tackle threats linked to AI.“Maybe play a useful role in elevating basic standards to a minimum level, so we have some semblance of confidence that across the financial system there’s a basic level of safety and protection,” he said. “I am using the words ‘safety code’ as sort of emblematic of that. We haven’t developed it. I don’t have a draft of it. I have asked my team to start thinking about it.”But Routledge said he’s satisfied with how prepared Canada’s banks are to tackle AI-related threats, though not all institutions are at the same level, so he’s looking to establish a minimum level of safety for all the institutions OSFI supervises because of the high level of interconnectivity in the financial sector.This advertisement has not loaded yet, but your article continues below.“You are connected to your counterparties, and if there’s poison at the counterparties, it’s flowing through to you as an institution,” he said. “Our highest utility is to try and lessen the risk that scatters around the system.”OSFI, in its semi-annual risk report released on Thursday, said advances in AI have increased the “effectiveness, speed and sophistication of malicious cyberattacks.”It said frontier AI models can chain together multiple vulnerabilities across systems that are connected, allowing seemingly minor weaknesses to be combined to launch high-impact attacks.The advances in AI, which is likely to continue, also mean institutions have less time to detect and respond to threats.The majority of the top AI companies are situated outside Canada, and as financial institutions rely on their services, cross-border dependencies will likely increase, the report said.“Geopolitical tensions, including technology restrictions and policy actions in foreign jurisdictions, could affect access to critical technologies and services,” it said.This advertisement has not loaded yet.This advertisement has not loaded yet, but your article continues below.The report also said it is also important to ensure that governance, controls and testing evolve at a similar pace as institutions use AI technologies to improve their businesses.Aside from AI, OSFI once again said the risks linked to the housing sector and non-bank financial institutions remain highly relevant.The housing sector has held up well despite the stuttering economy, but it remains on the list because of the size of the risk concentration, Routledge said.“Housing prices, although stressed, are not in severe correction mode,” he said. If homeowners don’t get their price, they pull their home off the market. What does that mean? Well, they can cover their mortgage. There always will be folks who struggle with mortgages, but, overall, the systemic health of that asset class is sound.”The non-bank financial institution industry is not giving OSFI any “heartburn” either, he said, but the aggregate concentration is growing, so it’s important to monitor it.We apologize, but this video has failed to load.This advertisement has not loaded yet.Notice for the Postmedia NetworkThis website uses cookies to personalize your content (including ads), and allows us to analyze our traffic. Read more about cookies here. By continuing to use our site, you agree to our Terms of Use and Privacy Policy.