OSFI and Staff Training: The One Requirement, and the Competence Expectations Behind It

If you go looking for OSFI's staff training requirements you will not find them, because there is essentially one. Across its Integrity and Security Guideline and Guideline E-13 on Regulatory Compliance Management, the only explicit training obligation is a single clause about codes of conduct. Guideline E-13 does not use the word "training" at all.

That is not the same as having no obligation. OSFI's expectations are framed as competence, understanding and demonstrable effectiveness rather than as hours — which is harder to evidence, not easier. This guide sets out what the guidelines actually say, so a federally regulated financial institution can see where the burden really sits.

The documents, and a dating caveat

Guideline E-13, Regulatory Compliance Management (RCM), is dated 30 November 2014. It "revises and replaces the 2003 LCM Guideline", and OSFI's covering letter of 13 November 2014 states that implementation "by FRFIs is expected by May 1, 2015". That letter also records that the revision "does not create new regulatory requirements".

The Integrity and Security Guideline carries a visible date of 31 January 2024. Its page metadata shows a different date of 13 November 2023, and no separate effective date is stated on the guideline itself, so confirm the commencement position with OSFI's accompanying letter if the date matters to you.

The one training requirement

Integrity and Security Guideline, section 3.3: "Codes of conduct establish and communicate behavioural expectations, apply to all employees, and include regular training."

The codes themselves "should highlight" four themes: following the law and regulatory expectations, avoiding conflicts of interest, maintaining objectivity, and ensuring security and confidentiality. And they "should be assessed for effectiveness and reviewed and updated on a regular basis", with conformity monitored based on risk.

Note what is absent. No frequency is attached to "regular". No content specification beyond the four themes. No requirement to document or evidence that the training happened. Section 3.3 also requires expectations to be communicated clearly "to employees, contractors, and stakeholders, including how non-compliance issues will be addressed, resolved, and disclosed", and section 3.4 requires reporting channels — internal and external — to be "regularly reviewed, updated, and brought to the attention of employees".

The words "competence" and "skills" do not appear anywhere in the Integrity guideline.

Where E-13 puts the competence burden instead

E-13 has no training mechanism, but it has four competence and understanding expectations, and they are allocated to different people:

• Compliance staff and the CCO (section III) — "should have the appropriate skills and knowledge of the business and regulatory environments that are essential to effective RCM". There is no stated mechanism for maintaining those skills
• Appropriate individuals (section IV(ii)) — "Reasonable procedures should exist to assure that appropriate individuals are provided with current and accurate information needed to identify, assess, communicate, manage and mitigate regulatory compliance risk, and maintain knowledge of applicable regulatory requirements." Information must be updated for new and changing requirements, and when products, services, strategic plans, other activities or corporate structure change
• Line staff (footnote 4) — "Operational management should satisfy itself that FRFI line staff understand the regulatory compliance risks in the activity"
• Internal audit (section IV(iv)) — the review function "should be independent of the activities it reviews, have appropriate skills and a good knowledge of the business and regulatory environments"

Section V(viii) then requires that policies be "applied according to their terms by qualified individuals", and that "all staff understand their responsibilities for complying with such policies, procedures and processes, and are held to account for performance of their responsibilities".

Read together, that is a knowledge-currency obligation with a mechanism left entirely to the institution. The operative standard is "reasonable", which footnote 8 defines as measures "capable of achieving the prescribed outcome when considered by a reasonable person".

Documentation: roles, not records

This distinction matters when building a compliance file. Section IV(vii) says "OSFI expects the roles and responsibilities of all individuals involved in RCM to be clearly documented" — roles, not training completion. It also requires both the day-to-day and oversight levels to "produce sufficient documentation that demonstrates how regulatory compliance risk is managed", and says that documentation "should also support the periodic assessment of the RCM framework".

The Integrity guideline's equivalent is section 2: "The effectiveness of policies and procedures should be demonstrable and assessed on a regular basis." Detected incidents, including those below the reporting threshold, "should be documented and inventoried".

Neither guideline states a retention period, and neither requires a record of training completion or of background checks. An institution that wants to be able to demonstrate staff knowledge currency to a supervisor has to decide for itself what that evidence looks like — which in practice means a dated, individual record, because nothing else answers the question.

Background checks: risk-based, renewed, and no interval

Integrity guideline section 4.2.1 is more prescriptive than anything on training. Responsible persons, employees and contractors "should be subject to appropriate, risk-based background checks that are: Conducted prior to employment; Renewed on a regular basis; Reviewed off-cycle based on certain criteria."

The minimum is verification of identity and background, "frequently" including education and professional credentials and personal and professional references. For higher-risk positions the minimum adds criminal records checks and financial inquiries (credit checks). Standards "should consider factors such as authority, seniority, and access to sensitive information", and OSFI "may request that specific individuals of the financial institution obtain a higher level of security clearance".

Section 4.5 extends this to suppliers: an institution should assess "the adequacy of the third party's background check processes" before engagement and on an ongoing basis.

No renewal interval is given, and the off-cycle criteria are not specified. The guideline refers to Guideline E-17 on background checks on directors and senior management for that population.

The Chief Compliance Officer

Only E-13 addresses the role, and it is specific about independence rather than qualification.

Overall responsibility "should be assigned to an individual who is independent from operational management, has sufficient stature, authority, resources and support within the FRFI to influence the FRFI's activities", designated at least functionally as the CCO. Footnote 10 defines independence as "not directly involved in a revenue-generating function or in the management of any business line or product of the FRFI".

Section IV(i) requires "a clearly defined and documented mandate, unfettered access, and for functional purposes, a direct reporting line to the Board, or Branch Management". Section V(v)2 requires the CCO to opine at least annually and to report material instances of non-compliance on a timely basis, in formats that let senior management "clearly understand the regulatory risks".

Two practical points. OSFI expressly accommodates smaller institutions: it "recognizes that this individual may have other responsibilities as well, especially in the case of small, less complex FRFIs". And there is no headcount, budget or qualification requirement beyond the "skills and knowledge" wording in section III — the Board's approval of CCO resources and budget was removed from E-13 in the 2014 revision and left to the Corporate Governance Guideline.

Testing and validation is where the real work is

If OSFI does not prescribe training, it does prescribe assessment, and in layers:

• Section III — the RCM framework "should be reviewed and updated regularly, at least annually", and the review methodology "should include a mechanism that holds individuals or areas accountable"
• Section IV(iii) — day-to-day procedures "should also include a monitoring and testing component using a risk-based approach"
• Section IV(iv) — compliance oversight "should be validated by Internal Audit or other independent review function", on a rotational or other regular basis, testing "both operational and independent oversight levels"
• Section IV(vi) — the CCO's own activities are "subject to periodic review", including "an assessment of the effectiveness of the compliance oversight"

Footnote 14 adds that while FRFIs set the frequency of RCM reporting, "OSFI expects that they will occur at least annually".

So the chain is: staff must understand, management must satisfy itself that they do, the framework must be reviewed annually with accountability attached, and internal audit must validate the whole thing. Nobody is told to run a course.

Proportionality — and an inconsistency worth noting

E-13 section I lists size first among the factors that may legitimately produce different RCM practices, and section III adds that "Each FRFI, regardless of the size, is expected to have risk management controls that are proportionate to its identified risks".

The Integrity guideline's proportionality statement at section A3 lists ownership structure, business arrangements, strategy and risk profile, and scope, nature and location of operations — and does not list size. Whether that omission is deliberate is not stated, but a small institution relying on size alone as a proportionality argument under the Integrity guideline is relying on a factor that guideline does not name.

Three things to check

First, whether your code of conduct training is actually regular and actually covers the four themes — it is the one hard training obligation OSFI imposes, and the easiest to have let slip.

Second, whether you can demonstrate knowledge currency for the "appropriate individuals" under section IV(ii). OSFI does not tell you what that record looks like, so its absence is a gap you have chosen.

Third, whether background checks are being renewed at all. "Renewed on a regular basis" with no stated interval is the kind of requirement that quietly becomes pre-employment-only.

Compared with a rules-based regime like the FCA's — our guide to FCA training and competence records under TC 3 and SYSC 28 sets out the contrast — OSFI gives far less structure and expects the institution to supply it. On the registrant side of Canadian financial services, CIRO's continuing education programme does prescribe credits and cycles. Structured CPD programmes are one way to produce the demonstrable evidence OSFI asks for without being told to.

Sources and limits: written from OSFI's Integrity and Security Guideline and Guideline E-13, Regulatory Compliance Management (2014), together with OSFI's E-13 covering letter of 13 November 2014, all read in October 2026. OSFI's Corporate Governance Guideline, Guideline E-17 on background checks, the Regulatory Notice on Culture Risk Management and the Integrity and Security letter and FAQ were not read — the Corporate Governance Guideline in particular is where board and senior management expectations sit, and E-13 expressly defers to it. General information about published guidance, not legal or compliance advice.