OSFI’s Annual Risk Outlook – Fiscal Year 2024-2025

Real estate secured lending and mortgage risks

Of the mortgages outstanding as of February 2024, 76% will be coming up for renewal by the end of 2026. Canadian homeowners who will renew their mortgages during this time period could potentially face a payment shock. This payment shock will be most significant for homeowners who took out mortgages when interest rates were lower in 2020 to 2022. Households that are more heavily leveraged and have mortgages with variable rates but fixed payments will feel this shock more acutely. We expect payment increases to lead to a higher incidence of residential mortgage loans falling into arrears or defaults.

Mortgages that have already experienced payment increases due to renewal or product type, such as adjustable-rate mortgages, are already showing higher rates of non-performance. Should residential real estate markets weaken, this could lead to higher defaults, lower recovery rates, and, therefore, higher credit losses for institutions.

Variable rate mortgages with fixed payments (VRMFP) are of specific concern. Some of these mortgages are negatively amortizing, meaning the scheduled mortgage payments no longer cover the full interest costs or the principal. In these situations, lenders offset the shortfall by increasing the remaining outstanding principal. While most institutions report the shortfall as extended amortization periods, the contractual mortgage term does not change unless and until the mortgage is refinanced.

This means that borrowers with uninsured VRMFP will need to address higher outstanding principal balances, and are, therefore, at risk of suffering a significant payment shock. Borrowers have the option to make large lump sum payments or endure large monthly payment increases in the mortgage to return to their original contract term. Alternatively, if the circumstances warrant, borrowers can refinance their existing mortgage, however this may not eliminate monthly payment increases.

VRMFP make up about 15% of outstanding residential mortgages in Canada. If mortgage rates remain elevated, the financial commitment required by borrowers to return to their contractual amortization (for example, lump sum payment, mortgage payment increase) may put financial strain on many of those households.

With the current interest rate environment, loan-to-income and loan-to-value ratios of new mortgage originations are at near record low levels. Changes to the economic environment, such as weakening labour markets and declining rates, could reduce the payment shocks outlined above. However, the effects of potentially higher unemployment rates could increase the debt strain on households and contribute to higher losses for institutions.

OSFI response

OSFI continuously monitors the risk profiles of institutions’ residential mortgage lending activities and regularly conducts examinations to ensure they follow sound underwriting standards and use prudent lending, portfolio, and account management practices.

We are developing institution-specific loan-to-income limits at the portfolio level for uninsured mortgages to prevent a buildup of highly leveraged borrowers. These actions will consider the size, nature, complexity, and risk profile of each federally regulated financial institution. It will balance sound risk management against the need for federally regulated financial institutions to compete effectively and take reasonable risks.

We do not expect these limits to be binding under the current interest rate environment. These institution-specific loan-to-income limits are supervisory actions. OSFI cannot disclose more details given the constraints and requirements under Bank Act regulations, known as the Supervisory Information Regulations. We continue to engage with industry to ensure that institutions actively assess the risks posed by variable rate mortgages with fixed payments. This includes ensuring that adequate provisions and capital are in place to offset the increased credit risk, as well as promoting early intervention (prior to renewal) with borrowers vulnerable to payment shock.

In December 2023, we announced that we were maintaining the minimum qualifying rate for uninsured mortgages at the greater of the mortgage contract rate plus 2% or 5.25%. This helps ensure borrowers can still make payments if they experience negative financial shocks, such as a reduction in income, an increase in household expenses, or an increase in mortgage interest rates. Going forward, we will maintain our internal review process to evaluate the calibration of the minimum qualifying rate, with assessments conducted at least annually. However, we have discontinued set announcement dates in December and will only issue announcements if there are calibration changes.  Consequently, corresponding revisions have been made to the relevant footnote in Guideline B-20 to align with this revised approach.

In March 2024, we published a Regulatory Notice that reinforces OSFI’s expectations on sound residential mortgage account and portfolio management practices. Key areas include the need for robust risk monitoring of existing mortgages and proactive engagement with vulnerable borrowers. The Notice also underscores the inherent risks posed by variable rate mortgages with fixed payments and reinforces recent OSFI actions to strengthen risk-based capital requirements in relation to residential real estate exposures, including expectations around provisions for expected credit losses.

Wholesale credit risks

Wholesale credit risk, including risk from commercial real estate (CRE) lending as well as corporate and commercial debt, remains a significant exposure for institutions. Economic uncertainties and changes in these markets are impacting the risk environment. Current interest rate levels have produced challenging refinancing conditions for some commercial and corporate borrowers and the conditions could negatively affect wholesale credit markets in the coming year.

Higher interest rates, inflation, and lower demand have put CRE markets under pressure. We expect these challenges to extend into 2024 and 2025.

The office sub-segment of the CRE market is facing additional changes associated with the move towards hybrid work environments leading to rising vacancies and declining asset values. Lower quality office buildings face more acute risks while higher quality older properties have also experienced pressure from reduced demand for office space.

While office properties face challenges from changes in working environments, other CRE assets also face challenges. The construction market continues to show signs of a slowdown as developers face unfavorable economic conditions. There are also signs that the industrial sector is facing headwinds following a period of strong growth.

Corporate and commercial credit profiles have weakened, driven by higher borrowing and operating costs resulting in declining profitability. Canadian business insolvencies continue to trend higher than pre-pandemic levels. Highly leveraged borrowers remain particularly vulnerable to refinancing challenges.

These factors contribute to heightened refinancing, investment, and credit risk in the wholesale credit sector for institutions.

OSFI response

OSFI continuously monitors wholesale exposures and lending activities to assess borrower and portfolio vulnerabilities, account management and underwriting practices, and loan loss provisioning.

These efforts will be enhanced by a new loan level data call on CRE exposures at deposit-taking institutions. This data will:

• increase our understanding of the prudential impact of market developments
• allow us to compare risk across institutions and identify higher risk exposures for discussion with institutions
• support our supervision of the expectations outlined in the September 2023 CRE Regulatory Notice

We plan to broaden the scope of the data call to include all wholesale exposures in the future.

OSFI will continue to focus on monitoring institutions' exposures and risk management of wholesale credit risk through regular direct discussions, review of regulatory returns, risk reports, policies, and governance. Institutions should expect follow-up questions and potentially additional information requests for clarification arising from our monitoring efforts.

We are also completing supervisory reviews focused on account management practices, risk ratings, and downturn readiness. In the case of CRE, our supervisory reviews will also assess consistency with OSFI’s expectations, as set out in the September 2023 CRE Regulatory Notice.

Funding and liquidity risks

Liquidity and funding conditions remain sensitive to an uncertain financial market landscape. The expected and actual path of global interest rates will influence the risk appetite of market participants.

Liquidity shocks are a persistent concern and can arise if depositor behaviour shifts dramatically. Intensifying digitalization of the banking environment means that deposit outflows can arise more abruptly and intensely than some market participants expect. Deposit competition has increased over the past year as higher interest rates provide opportunities for depositors and other investors to seek the best possible returns. This has an impact on depositor behaviour and could affect bank deposit persistency and the assumptions deposit-taking institutions make when estimating funding costs. Access to wholesale funding and repo markets remain open, however, at current interest rates. Interest rate changes also impact valuations of high-quality assets held for liquidity at institutions and could reduce the capacity of markets to provide liquidity and contribute to market stability in periods of stress. Changes in depositor behaviour, funding costs and valuations also impact the management of interest rate risk in the banking book.

Funding and liquidity risk remains linked to credit risk as deteriorating conditions can negatively impact securitization markets. This can trigger increased liquidity risk for institutions that rely on securitization as a key source of funding. Severe credit deterioration could also have a negative impact on access to wholesale funding for impacted institutions.

In addition, risk related to intraday liquidity, which refers to an institution’s ability to make payments and settle obligations during the business day, can result from problems with the way counterparties interact. The near real-time nature of the risk can exacerbate liquidity stress at impacted institutions and impede the smooth functioning of payment systems. Liquidity shocks can also be triggered when collateral calls between market participants increase suddenly due to market volatility or an institution-specific event.

Overall, a competitive and market-sensitive funding environment, combined with digital advancements, heighten the challenges institutions would face in the event of a liquidity shock.

OSFI response

In 2024, OSFI plans to broaden and intensify its assessment of liquidity risk.

The approach will span key topics, with a focus on intra-day liquidity risk management, and liquidity and interest rate risk in the banking book management effectiveness in material foreign subsidiaries. OSFI will also deepen its line-of-sight into the operational aspects of contingency funding plans to better understand asset monetization decisions during stress events.

Intraday liquidity risk management work will be accompanied by industry consultations on the potential implementation of OSFI’s intraday liquidity guidance, in calendar Q2 of 2024. Specifically, consultations will cover proposed updates to the Liquidity Adequacy Requirements Chapter 7 – Intraday Liquidity Monitoring that reflect payment system modernization changes and the introduction of formal intraday reporting requirements. 

Furthermore, OSFI will continue to assess liquidity and funding risk vulnerabilities at individual institutions and require rapid remediation of material supervisory concerns.

Lastly, vulnerability to liquidity risk remains a heightened risk. OSFI expects institutions to continue improving reporting and operational capabilities to ensure they are effective, maintain data integrity, and are responsive to market disruptions.

Integrity and security amidst geopolitical uncertainty

As the pace of social and political conflict increases globally, so do risks to institutions. A major geopolitical event could disrupt markets and create instability for institutions. The escalation of political tensions and the polarizing effect of geopolitical issues have the potential to make Canadian institutions a target for politically motivated attacks.

We are concerned with threats to institutions’ integrity and security ranging from fraud and money laundering to cyber security and foreign interference. With advances in technology, financial institutions are facing more sophisticated and frequent threats to their security and operational resilience. Geopolitical instability increases the likelihood of risk materializing because geopolitical conflict can motivate hostile foreign nations, affiliated threat actors, or criminals to destabilize our institutions for the purposes of financial gain or the advancement of interests.

Institutions that have integrity and security vulnerabilities, gaps, or issues could be subject to reputational harm, financial risks, or a cyber or national security risk, including foreign interference. These issues could lead to regulatory compliance measures that fall under OSFI’s or the Minister of Finance’s authority.

Given that the financial sector has been identified as one of Canada’s critical infrastructure sectors, and that the institutions OSFI regulates are heavily integrated into the lives of Canadians, we take these threats seriously.  

OSFI response

To address these new and growing risks, OSFI has been given an expanded mandate by Parliament, and has established a National Security Sector. This new sector is responsible for helping OSFI ensure that FRFIs address threats from foreign interference and threats to national security that affect federally regulated financial institutions. OSFI also created an Integrity and Security Risk Division to lead integrity and security supervision and policy.

In 2024, OSFI issued an Integrity and Security Guideline with policy and procedure expectations for institutions. OSFI’s guidance aims to help institutions and the Canadian financial system become more resilient to these threats. Institutions also completed an integrity and security questionnaire to assess their alignment with OSFI’s integrity and security expectations. Additionally, we plan to work with institutions to provide them with information on the threat environment.

Public confidence in the Canadian financial system depends on its institutions acting with integrity and securing themselves against diverse threats, including foreign interference. We are building our capacity, and our partnerships with key stakeholders and partners, to leverage existing information and provide advice to monitor the threat environment as it relates to institutions. 

Other key risks

It is worth noting the interdependencies that the four ARO risks have on industries we regulate and supervise. For instance, a housing market downturn could cause stress in the mortgage insurance industry. Credit risks and market volatility could impact investment portfolios, asset liability management, and hedging strategies for all insurers.

OSFI considers risks related to deposit-taking institutions, as well as those that are unique to the insurance and pension industries. For example, the impact of a large earthquake and changing weather and flood patterns on the property and casualty industry, as well as changes to life expectancy, impacts both life insurers and pension plans.

OSFI also assesses many other risks posed by cyber and technology, climate, third party outsourcing, and transmission risk from the less-regulated or unregulated financial sector. We continue to monitor the number and severity of disruptive events arising from these risks. These events underscore the importance of operational resilience at institutions and pension plans. The direct costs and, more importantly, the reputational impacts of prolonged disruptions or outages can negatively impact the resilience and stability of an institution and create risk.

OSFI response

In 2024 and 2025, we will selectively review institutions against our technology and cyber risk management guidelines. We will also continue our cyber resilience testing to identify control weaknesses and monitor threats from emerging technologies.

We have observed that more disruptions affecting institutions’ critical operations are originating at third parties and their supply chains. Moreover, the emergence of a few dominant service providers increases the likelihood of a systemically disruptive event. We will continue to assess the effectiveness of institutions’ business continuity and disaster recovery plans to enhance our understanding of systemic concentration risk, risk trends, and the effectiveness of financial institutions’ preparedness for disruption. We will also consider any necessary adjustments to Guideline E-21 on Operational Risk and Resilience as we finalize the Guideline in the coming year.