CPI | Canada Intensifies Scrutiny of AI Risks in Banking Sector

Canada’s federal banking regulator privately cautioned major financial institutions earlier this year that advanced artificial intelligence systems could sharply increase cybersecurity risks and shorten the time available to detect and respond to vulnerabilities, according to internal communications obtained through access-to-information requests.

According to Reuters, the Office of the Superintendent of Financial Institutions (OSFI) circulated an email in April to senior technology, cybersecurity and risk executives at banks and insurers, specifically referencing Anthropic’s Claude Mythos model as an example of rapidly advancing AI capabilities that could alter the cyber threat landscape.

The communication highlighted concerns that increasingly capable AI systems may accelerate the discovery and exploitation of software weaknesses, requiring financial institutions to improve the speed of risk identification and incident response.

OSFI later confirmed that it had issued guidance to federally regulated institutions and subsequently published a public bulletin addressing generative and agentic AI risks. The regulator said its approach remains “technology-neutral” and focused on how institutions govern and manage emerging risks rather than on specific AI products themselves.

The warning reflects a broader international effort by financial authorities to assess the implications of frontier AI systems for critical infrastructure. Regulators in Europe, Asia and Australia have all raised concerns in recent months that highly capable AI models could be used by malicious actors to identify security weaknesses and launch cyberattacks at greater speed and scale.

Reuters previously reported that Canadian banking executives met with regulators in early April to discuss risks associated with Anthropic’s latest systems, shortly after senior U.S. officials, including Treasury Secretary Scott Bessent and Federal Reserve leadership, held discussions with major American banks on similar issues.

Related: Executive Order on Artificial Intelligence Expands Cybersecurity, Federal Oversight

The issue has taken on added significance because access to some advanced AI cybersecurity models has been limited. According to Reuters reporting, certain versions of Anthropic’s Mythos capabilities have been made available only to a restricted group of organizations through programs such as Project Glasswing, raising questions about whether uneven access to defensive AI tools could create competitive disparities among financial institutions.

The concentration of advanced AI capabilities among a small number of technology firms and selected financial institutions has also attracted regulatory attention in broader policy debates. Competition authorities in several jurisdictions have increasingly examined whether control over frontier AI models, computing resources and strategic partnerships could reinforce market power in both the technology and financial sectors, although no competition action related specifically to Anthropic’s banking initiatives has been announced. Researchers and policymakers have argued that governance frameworks for advanced AI systems should address transparency, risk management and coordination across the AI value chain.

Canadian banks have been rapidly expanding their use of artificial intelligence beyond experimental projects. Royal Bank of Canada, Toronto-Dominion Bank and Bank of Montreal have publicly outlined initiatives aimed at deploying AI across customer service, internal operations and software development, while other major lenders including Scotiabank, CIBC and National Bank have disclosed various AI programs.

Industry representatives said Canadian banks continue to invest heavily in cybersecurity and comply with OSFI’s requirements concerning cyber-risk management and incident reporting.

The concerns are not limited to Canada. Earlier this month, the European Central Bank instructed euro-zone lenders to prepare plans addressing AI-enabled cyber threats, while the Bank of England warned that artificial intelligence presents growing risks to financial stability and could alter the balance between cyber attackers and defenders.