Canada regulator warned banks on AI cyber risks, email shows

OSFI communicated these concerns to technology, security, and risk officers across the financial industry. The regulator stated that advanced AI models "significantly compress the timeframe for effective risk mitigation" and outlined sound practices for enhancing risk identification, mitigation, and response. This bulletin aligns with OSFI's existing guidance and its technology-neutral, risk-focused approach to emerging technologies.

Globally, regulators are grappling with the cybersecurity implications of powerful AI. Experts note that models like Mythos are capable of identifying and exploiting vulnerabilities, presenting significant challenges for the banking sector's legacy systems. Following inquiries from Reuters, OSFI publicly posted a bulletin on generative and agentic AI.

In early April, Canadian bank executives met with regulators to discuss Mythos, shortly after U.S. Treasury Secretary Scott Bessent and then-Federal Reserve Chair Jerome Powell convened a similar meeting with bank CEOs. Three of Canada's major banks, including Royal Bank of Canada (RBC), have outlined plans to leverage AI for revenue generation, moving beyond experimental projects to applications like chatbots and internal tools.

RBC's chief technology officer, Bruce Ross, acknowledged in June that Mythos highlights a changing cyberattack landscape, necessitating rapid organizational responses and the development of AI-based defenses.