Do You Need a Penetration Test for OSFI? What B-13 and B-10 Mean for Fintech Vendors

Do you need a penetration test for OSFI? If you are a fintech or software vendor, OSFI does not regulate you and no OSFI guideline orders you to commission one. Your bank or insurer customer is regulated, though. Guideline B-13 expects it to test its technology through methods such as penetration testing, and Guideline B-10 expects it to check its vendors. In practice, that means you will be asked for a recent third-party test report.

Who OSFI actually regulates

The Office of the Superintendent of Financial Institutions supervises federally regulated financial institutions, which its guidelines call FRFIs. That covers banks, including foreign bank branches, federally incorporated trust and loan companies, and federally regulated insurers. Provincial credit unions, most provincial insurers and the large majority of fintechs sit outside OSFI's direct reach.

This is the first thing to get straight, because a lot of vendor anxiety starts with the assumption that OSFI rules apply to the vendor. They do not. What applies to you is your contract with the regulated institution, and that contract is written by people who answer to OSFI.

So the useful question is not "am I covered by OSFI?" It is "what will my FRFI customer need from me so it can show OSFI it is meeting its own guidelines?" Two guidelines answer that.

What Guideline B-13 says about penetration testing

Guideline B-13, Technology and Cyber Risk Management, was published in July 2022 and took effect on January 1, 2024. It applies to all FRFIs, including foreign bank branches.

The testing language sits in section 3.1.2, under the heading that intelligence-led threat assessment and testing is conducted. FRFIs "should also regularly perform tests and exercises" to find vulnerabilities and control gaps, and the guideline gives "penetration testing and red teaming" as examples, run "using an intelligence-led approach." It also asks institutions to set defined triggers and minimum frequencies for those assessments, and to define the scope and potential impact of each test in advance.

Section 3.1.3 adds regular vulnerability assessments of technology assets, "including but not limited to network devices, systems and applications," with the scan and assessment frequency written down. Section 3.2.6 expects patching and remediation to be tracked against defined timelines.

None of that names a vendor. It describes what the institution must do with its own technology assets. Where your product is one of those assets, because it processes the bank's data or supports a business service, the institution's testing programme has to account for it somehow. Testing your production platform itself is rarely an option for a bank, so it relies on evidence you supply instead.

How B-10 brings vendors into scope

Guideline B-10, Third-Party Risk Management, was published in April 2023 and its updated version took effect on May 1, 2024. During consultation, OSFI moved third-party technology risk out of the B-13 draft and into B-10, and B-10 tells institutions to read the two together.

B-10 defines a third-party arrangement broadly. It covers any business or strategic arrangement with an outside entity, explicitly including cloud and technology providers. Within that, a few provisions matter most to a vendor:

• Risk assessment and due diligence. Annex 1 asks the institution to consider a third party's capacity to manage technology and cyber risks in line with B-13, and to review how often the third party tests and what the results were.
• Audit rights. Section 2.3.3.3 says the agreement should give the FRFI, and OSFI, the right to evaluate the third party's risk management practices for the service. It names "independent reports provided by third parties" as one acceptable method.
• Security of records and data. Section 2.3.2.1 expects the contract to set responsibilities for confidentiality, integrity and availability, access controls, breach liability and breach notification.
• Subcontractors. The FRFI may require notice before you add a subcontractor, and may reserve the right to refuse one.

Put B-13 and B-10 side by side and the vendor obligation becomes clear. The bank must test its technology and must satisfy itself that third parties manage technology and cyber risk to a comparable standard. The cheapest way for both sides to get there is an independent penetration test of your service, delivered with remediation status, plus a contract that lets the bank ask again next year.

What a bank partner will usually ask for

Requests vary by institution and by how critical your service is to them. B-10 is explicitly proportionate, so a low-risk tool gets a lighter review than a platform that holds customer account data. For a vendor that touches customer or transaction data, the following is a common request set.

Request	Where it comes from	What satisfies it
Recent third-party penetration test	B-13 3.1.2 on the bank's side; B-10 due diligence and testing review	An executive summary and findings table from an independent tester, dated within the last year, covering the application and API the bank uses
Remediation status of findings	B-13 3.2.6 remediation against timelines	A tracker showing each finding, severity, owner, fix date and retest result
Vulnerability management process	B-13 3.1.3	Scan frequency, coverage of your assets, and patch timelines by severity
Independent assurance report	B-10 2.3.3.3	A SOC 2 Type II or ISO 27001 certificate, with the bridge letter if the period has ended
Incident notification commitment	B-10 security and notification provisions	A contractual clock you can meet, backed by an exercised incident response plan
Subcontractor list	B-10 2.2.4.2	A current subprocessor register with locations

For the full picture of fintech-specific testing scope, our guide to penetration testing for fintech companies covers what gets tested on payment flows, ledgers and APIs.

Does the test have to be "intelligence-led"?

B-13 asks FRFIs to take an intelligence-led approach to their own testing, meaning scenarios grounded in the threats that actually target financial institutions. OSFI also published an Intelligence-led Cyber Resilience Testing (I-CRT) framework in April 2023. That framework is a supervisory red team exercise run with the largest institutions. It is not something a vendor buys, and you will not be asked to run one.

What you can do is make your test look like it was scoped by someone who knows who attacks fintech platforms. That means:

• Testing authenticated, multi-tenant paths, not just the login page. Cross-tenant data access is the finding a bank reviewer cares about most.
• Testing business logic on money movement: approval bypass, replayed requests, rounding and race conditions.
• Testing the API the bank integrates with, using the same credential type and permissions the bank will hold.
• Stating in the report which threat scenarios drove the scope, so the reviewer can map it to their own threat assessment.

An automated scan dressed up as a penetration test fails this review quickly. Bank reviewers read a lot of reports and can tell when nobody tried to break the business logic. Our checklist on how to vet a penetration testing firm lists the questions that separate the two.

Penetration test or red team for a bank customer?

For almost every vendor, a well-scoped penetration test is the right purchase. A red team exercise tests whether an organization detects and responds to a realistic, objective-driven attack over time. It is useful for a mature security team with a monitoring function to test. For a fifty-person fintech, the bank wants to know whether your application and infrastructure resist attack, and that is what a penetration test answers. The trade-offs are covered in red team vs penetration test.

How often, and what "recent" means

B-13 does not set a frequency for vendor testing. It asks institutions to define minimum frequencies and triggers for their own. In practice most institutions translate that into an annual third-party test for vendors in scope, plus a new test after a significant change such as a new platform, a major architecture change or a new product line the bank will use.

A report older than twelve months is usually treated as stale. If you are mid-cycle, say when the next test is scheduled and offer the previous report with its remediation tracker. Reviewers accept a dated plan far more readily than silence.

Common mistakes vendors make with bank security reviews

• Sending the full report unredacted to a procurement inbox. Share an executive summary and findings table first, and the full report under NDA if they need it.
• Testing the marketing site instead of the product. Scope has to match the service the bank buys.
• Leaving high findings open with no dates. An open finding with an owner and a fix date is acceptable. An open finding with nothing next to it reads as a control failure.
• Agreeing to audit rights you cannot operate. B-10 asks for audit rights, but you can negotiate how they are exercised, for example by delivering independent reports first, with on-site audit reserved for cause.
• Assuming a SOC 2 replaces the test. It does not. A SOC 2 report tells the bank your controls operated. A penetration test tells them whether the application resists attack. Banks usually ask for both. See do you need a penetration test for SOC 2 for how the two connect.

Common questions about OSFI and penetration testing

Does OSFI require penetration testing?

OSFI Guideline B-13 expects federally regulated financial institutions to regularly test their technology using methods such as penetration testing and red teaming, with defined triggers and minimum frequencies. It applies to the institutions, not to their vendors. Vendors are reached through Guideline B-10 and the contract, which is why bank partners ask suppliers for a recent independent penetration test.

Does OSFI B-13 apply to fintech companies?

Not directly. B-13 applies to federally regulated financial institutions such as banks, foreign bank branches, trust and loan companies and federally regulated insurers. A fintech that sells to one of them is affected through the institution's third-party risk management under B-10, which asks the institution to assess whether the vendor manages technology and cyber risk in line with B-13.

How often does a bank expect a vendor penetration test?

B-13 leaves frequency to each institution, which must set minimum frequencies and triggers. Most institutions ask in-scope vendors for an independent test at least once a year, and again after a significant change to the service. A report older than twelve months is commonly treated as out of date, so schedule the retest before the anniversary.

Will a SOC 2 report satisfy an OSFI-regulated customer?

A SOC 2 Type II report helps a great deal, because B-10 names independent third-party reports as a way for an institution to assess a vendor. It does not replace a penetration test. Most bank reviews ask for both, plus remediation status for open findings and a contractual incident notification commitment.

What is OSFI's I-CRT framework and do vendors need it?

The Intelligence-led Cyber Resilience Testing framework, published by OSFI in April 2023, is a supervisory red team exercise that OSFI oversees with large financial institutions. It is not a vendor requirement. A vendor's job is a well-scoped, independent penetration test whose scenarios reflect the threats that target financial services.