Compliance Reference · Financial Services · BC

Financial Services Compliance in British Columbia: Prudential, Conduct, AML, and IT Security Requirements

This is a reference guide for BC financial services firms, including credit unions, insurers, mortgage brokers, trust companies, investment dealers, and money services businesses, summarising the federal, provincial, and sector-specific regulatory frameworks. Hexafusion is an IT services partner, not a legal advisor. Confirm current obligations with BCFSA, OSFI, FINTRAC, BCSC, and qualified counsel.

Federal regulatory framework

BC provincial framework

Financial services regulators and statutes

• BCFSA. The BC Financial Services Authority is the integrated provincial regulator for credit unions, insurance companies, mortgage brokers, pension plans, trust companies, and real estate in BC, operating under the Financial Institutions Act and sector-specific statutes.
• OSFI. The Office of the Superintendent of Financial Institutions is the federal prudential regulator for banks, federally authorised insurers, and federally regulated trust and loan companies. OSFI's technology and cyber risk management guideline sets out expectations for governance, third-party risk, cyber resilience, and incident reporting.
• FCAC. The Financial Consumer Agency of Canada enforces consumer protection provisions for federally regulated financial institutions.
• FINTRAC. Enforces the Proceeds of Crime (Money Laundering) and Terrorist Financing Act for reporting entities, including money services businesses, life insurance, and real estate brokers, among others.
• Canadian Securities Administrators and BC Securities Commission. The BC Securities Commission regulates investment dealers, portfolio managers, investment fund managers, and exempt market dealers in BC. National Instruments, including NI 31-103 on registrant obligations, set record-keeping and conduct rules.
• CIRO. The Canadian Investment Regulatory Organization (formed from the merger of IIROC and the MFDA) supervises investment and mutual fund dealers and their registered individuals.
• Financial Institutions Act modernisation. The BC FIA has been going through modernisation over multiple phases. Status as of early 2026, verify current wording and in-force provisions with BCFSA.
• Mortgage Services Act framework. BC has moved towards a modernised mortgage regulation regime. Status as of early 2026, verify current wording, in-force status, and which statute governs current licensees.

Cross-cutting frameworks

• PCI DSS for card acceptance and processing.
• NIST Cybersecurity Framework, CIS Controls, and ISO 27001 as common reference points.
• SOC 2 for cloud third-party risk assessments.
• Cyber insurance underwriter expectations. Multi-factor authentication, endpoint detection and response, tested backups, phishing training, incident response plans, patching, and additional questions about privileged access, logging, and cloud configuration.

Financial services firms sit under the most detailed technology and cyber guidance of any industry in Canada. OSFI's technology and cyber risk management expectations set a high bar for governance, operational resilience, third-party risk, and incident reporting at federally regulated institutions, and those expectations cascade into provincial regulator supervisory practice and into counterparty due diligence. Even a smaller BCFSA-supervised credit union or a provincial registrant inherits much of this baseline because counterparties, auditors, and insurers ask the same questions regardless of which regulator the firm sits under. Multi-factor authentication, endpoint detection and response, tested backups with offline copies, phishing training, written incident response, documented patching, privileged access management, centralised logging, and third-party risk monitoring together form the assumed baseline.

How IT controls map to the regulatory stack

• Retention schedules aligned with BCFSA, OSFI, FINTRAC, CSA, and CRA obligations. Record durations vary by instrument and registrant category.
• Access logs on core banking, policy administration, client relationship, and dealer systems, with fine-grained role separation.
• Encryption at rest and in transit, with key management practices that support regulator and assessor review.
• Written breach response plan that meets PIPEDA, BC PIPA, and sector-regulator incident reporting requirements, including OSFI technology incident reporting for federally regulated institutions.
• Tested backups and disaster recovery supporting operational resilience expectations.
• MDR, EDR, MFA, and patching, plus third-party and cloud risk assessment aligned with OSFI third-party risk guidance.

Firms that handle these controls well run them as a programme rather than a project. They document their technology estate, map controls against a recognised framework (often NIST CSF for cross-mapping to OSFI guidance, ISO 27001, or CIS Controls), assign named owners for each control, test periodically, and keep a short written rationale for any deviations. They treat third-party risk as an ongoing activity rather than a one-time intake question, with periodic reassessment of cloud and core vendors. They run tabletop exercises for incidents that test not only the IT response but the regulator and customer communications path, because the reporting obligations in financial services are often tighter than in other industries. And they keep the evidence artefacts in a form that can be handed to a regulator, auditor, or insurer without reassembly.

BCFSA examinations, OSFI supervisory reviews, FINTRAC compliance audits, BCSC and CIRO examinations, and insurer underwriting all ultimately probe the same underlying architecture. Can the firm evidence its controls, does it know where its data lives, does it monitor privileged access, does it patch, does it train its people, and can it recover after an incident. A firm that invests in these controls as one programme rather than as a series of responses to individual regulators reduces duplicated effort and avoids the fragile situation where a finding in one examination becomes a finding across all of them.

Where Hexafusion fits

Hexafusion operationalizes the IT controls that support BC financial services firms' prudential, conduct, AML, and privacy obligations. That includes Microsoft 365 hardening for confidential client data, privileged access management, backup and disaster recovery for dealer and broker systems, third-party risk documentation, and the written evidence package that supports BCFSA examinations, OSFI reviews, FINTRAC compliance audits, and insurer underwriting. Our founder's PCI DSS Internal Security Assessor background informs how we structure control evidence for third-party review.

We do not interpret the Financial Institutions Act, do not run your AML compliance programme, and do not give legal or securities advice. Those roles belong to qualified counsel, your chief compliance officer, and your MLRO.

Related compliance resources

• BC Financial Services Authority (BCFSA)
• Office of the Superintendent of Financial Institutions (OSFI)
• Financial Transactions and Reports Analysis Centre of Canada (FINTRAC)
• BC Securities Commission
• Canadian Securities Administrators
• Financial Consumer Agency of Canada (FCAC)
• Office of the Information and Privacy Commissioner for BC
• Canadian Centre for Cyber Security

Frequently Asked Questions

Other compliance reference pages

• Accounting firm compliance in BC
• Law firm compliance in BC
• Real estate compliance in BC

Reviewed by Alex Barari, Founder, former PCI DSS Internal Security Assessor (ISA).