OSFI Guideline E-23 — Model Risk Management

OSFI Guideline E-23 — Model Risk Management — 81% of in-scope requirements covered.

4 requirements · 4 in scope (3 enforced · 1 advisory). The 81% is weighted over the in-scope base.

OSFI Guideline E-23: requirement → the KYE™ artefact that enforces it

Demo data

You learn: Which requirements KYE™ enforces at runtime and with which artefact. You can: Walk the requirements.

  1. inventory · enforced

    Model inventory + risk rating: maintain an enterprise-wide inventory of models, including AI/ML methods, each…

    Audit events: kye.risk.authority_register.v1, kye.risk_assessment.v1 · Constitution: 51 no spof, 14 agents and engines

  2. monitoring · enforced

    Ongoing monitoring: monitor model performance and limitations on a continuing basis and act on material…

    Audit events: kye.risk_assessment.v1, kye.purpose.admissibility.v1 · Constitution: 13 resilience loop

  3. accountability · enforced

    Roles + accountability: establish clear roles, responsibilities and accountability across the model lifecycle

    Audit events: kye.compliance.attestation.v1, kye.evidence.decision_map.v1 · Constitution: 12 purpose permission, 21 delegated auditability

  4. validation · advisory

    Development + validation: subject models to independent validation and effective challenge proportionate to…

    Audit events: kye.evidence.decision_map.v1, kye.replay.proof.v1 · Rule packs: kye:rule-pack:investment-decision-authority · Constitution: 13 resilience loop

How this widget is built
Demonstrates
KYE™ Compliance Mapping Rail™
Components
  • Framework requirement (clause)
  • Coverage status
  • KYE™ enforcement artefact (event, decision-record field, Evidence Pack™ entry)
Flow
Clause → status → the KYE™ artefact that enforces it, enforced requirements first. Architecture diagram
Used on

Source: Office of the Superintendent of Financial Institutions, Guideline E-23 Model Risk Management (revised final, effective 1 May 2027). Enterprise-wide model risk management across the model lifecycle: model inventory + risk rating, development and validation with independent challenge, ongoing monitoring, and clear roles and accountability — with the model definition expanded to capture AI/ML methods.

By category

CategoryReqsEnforcedDesignedAdvisoryDeferredCoverage
Model inventory + risk rating11000100%
Development + independent validation1001025%
Ongoing monitoring11000100%
Roles + accountability11000100%

Every requirement → the KYE™ artefact that enforces it

IDTitleStatusKYE™ enforcement
osfi-e-23.inventoryModel inventory + risk rating: maintain an enterprise-wide inventory of models, including AI/ML methods, each assigned a model-risk ratingenforcedaudit_events: kye.risk.authority_register.v1, kye.risk_assessment.v1
engines: internal, internal
constitution_refs: constitution/51-NO-SPOF.md, constitution/14-AGENTS-AND-ENGINES.md
osfi-e-23.validationDevelopment + validation: subject models to independent validation and effective challenge proportionate to their risk rating before and during useadvisoryaudit_events: kye.evidence.decision_map.v1, kye.replay.proof.v1
engines: internal, internal
rule_packs: kye:rule-pack:investment-decision-authority
constitution_refs: constitution/13-RESILIENCE-LOOP.md
osfi-e-23.monitoringOngoing monitoring: monitor model performance and limitations on a continuing basis and act on material deteriorationenforcedaudit_events: kye.risk_assessment.v1, kye.purpose.admissibility.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
osfi-e-23.accountabilityRoles + accountability: establish clear roles, responsibilities and accountability across the model lifecycleenforcedaudit_events: kye.compliance.attestation.v1, kye.evidence.decision_map.v1
engines: internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/21-DELEGATED-AUDITABILITY.md

Canonical KYE™ surfaces referenced on this page: KYE Protocol™.