The Office of the Superintendent of Financial Institutions reports that recent changes to federal financial institutions legislation removed the need for federally regulated firms to obtain its approval to maintain and process data outside Canada.

OSFI says that while the repeal of the approval requirements releases firms from terms, conditions and undertakings contained in data processing orders granted prior to these changes, it still expects them to ensure that their material data processing outside Canada is in compliance with the risk management expectations contained in regulatory guidelines dealing with outsourcing.

In the coming months, the outsourcing guideline will be reviewed and revised to reflect the removal of the
restrictions on information and data processing outside Canada. In the interim, OSFI expects that firms will continue to ensure that OSFI has access to data and information relating to the preparation and maintenance of certain corporate, accounting and customer records that are maintained or processed outside Canada.

OSFI says it will consult with the industry if other significant changes are proposed as a result of this review.

It also notes that it may still direct a firm not to maintain or process data in another country, if it believes that it is incompatible with the fulfillment of OSFI’s responsibilities.