The Financial Services Regulatory Authority of Ontario (FSRA) has published for comment new proposed guidance, an interpretation of enacted legislation and rules governing operational risk management and resilience, and how the regulator will approach the governance of credit unions in this respect going forward.
The requirement for credit unions to effectively manage operational risk and demonstrate resilience is part of the Credit Unions and Caisses Populaires Act, 2020 and Rule 2021-001, Sound Business and Financial Practices.
“Operational risk is the risk of loss resulting from inadequate or failed internal processes, people, and systems, or from external events. Improvements in the sector’s ability to monitor its current internal and external environments, anticipate future threats and respond effectively to stress events, will strengthen credit unions in Ontario,” the regulator writes in its call for comments about the new guidance.
“Credit unions are increasingly relying on technology, data, and the third-party ecosystem in their daily operations. As such, FSRA is placing a higher degree of importance on operational risk identification, assessment, and management, as well as operational resilience.”
The guidance interprets the existing legislation, outlines FSRA’s approach and considers environmental, social and governance (ESG) risk management guidance and standards which have been developed by other jurisdictions, and their potential future implications for credit unions.
The report also provides examples of potential risk events, including cyber attack, outdated systems failure, human error, reliance on third parties and on model assumptions that aren’t understood, and the possibility that a credit union could suffer future financial and reputational losses if the consideration of ESG risks are not incorporated into corporate governance and internal control frameworks today.
They add that the approach may have implications for a credit union’s overall risk rating, as well. Stakeholders are invited to comment on the guidance until March 31, 2023.
