Canada’s banking regulator is considering developing a new artificial intelligence “safety code” for financial institutions as increasingly powerful AI models and autonomous agents create fresh risks for the financial system. 

Speaking at the Global Risk Institute Summit in Toronto, superintendent Peter Routledge said Wednesday that the Office of the Superintendent of Financial Institutions (OSFI) has shifted from a largely hands-off approach to considering minimum standards for how banks use AI.

Routledge said rapid AI advances were driving the shift, pointing to Claude’s latest foundational model Mythos and other frontier models that could be used for cyberattacks or illicit activity, as well as autonomous AI agents operating with minimal human oversight.

“That’s frightening, and that is a risk that is front of center for us,” he told reporters.

The framework is still at an early stage. Routledge said there is no draft yet and no formally approved timeline for releasing it, though the consultation could come as early as spring. 

The safety code would go beyond OSFI’s previous AI advisory reports, Routledge said, and would likely build on the regulator’s work with the Global Risk Institute’s Financial Industry Forum on AI and its collaboration with the Financial Stability Board, an international organization.

Routledge said Canadian banks are generally prepared for AI-related risks, but some are further ahead than others. OSFI wants to set a “minimum level of safety or resilience” across the system, limiting the risk that weaknesses at one institution spread to other counterparts.

OSFI will also need more specialized expertise to manage those risks at a time when federal agencies are under pressure to cap headcount. Routledge said OSFI has enough staff overall, but plans to prioritize hiring experts with experience in emerging risks, particularly AI and digital technology.

The newly announced “safety code” comes as the regulator is also facing pressure over another emerging threat: financial crime.

The Financial Action Task Force (FATF) published a report last week downgrading Canada’s supervision of financial institutions to “partially compliant” from “largely compliant” in its first full assessment of the country since 2016. It found that the country falls short of international standards for enforcing anti-money-laundering controls at banks and for the independence and accountability of its banking regulator.

Routledge told reporters he did not dispute the FATF assessment, but argued that OSFI has made significant changes in recent years. The regulator now treats money laundering as a prudential risk and has brought the Financial Transactions and Reports Analysis Centre of Canada (Fintrac) onto the Financial Institutions Supervisory Committee, letting the agencies share information faster and co-ordinate their response when concerns emerge, he said.

OSFI has also built a national security team of roughly 30 people, with anti-money laundering forming a core part of its work. Routledge declined to say how many Canadian banks OSFI is monitoring more closely over financial crime weaknesses.

Canada ultimately avoided FATF’s “grey list,” which includes countries with weak money-laundering controls such as Haiti, Lebanon and Venezuela. A 2021 International Monetary Fund study found that grey listing can cut a country’s capital inflows by 7.6 per cent of its GDP per year, as governments face greater difficulty borrowing money and attracting foreign investment.

“We have a discipline in place across with Fintrac and internally in OSFI, such that when risks emerge, we can address them in a comprehensive, urgent way,” Routledge said. “And I have high confidence and conviction in that.”