A new report from Canada’s Office of the Superintendent of Financial Institutions says secure digital identity has become a frontline issue for financial-sector risk management as AI-driven fraud and deepfake attacks spread across customer onboarding, remote work and internal operations. The report, part of OSFI’s second Financial Industry Forum on Artificial Intelligence, lays out an AGILE framework for adoption and risk controls in Canadian financial services.
One of the clearest identity findings in the report is that Canada lacks a universally adopted secure digital identity, which OSFI says leaves identity exposed as a key attack opportunity across onboarding, consumer channels and remote work environments. The report ties that gap to a wider rise in AI-assisted social engineering, synthetic identity fraud and deepfake impersonation. It also describes multi-factor authentication as a critical security baseline and calls for stronger digital identity security, real-time threat sharing and more mature incident-response arrangements.
The report draws on a workshop that brought together banks, insurers, supervisors, policymakers, academics and technology providers. In a participant questionnaire summarized in the report, 71 percent identified AI-enhanced social engineering as the sector’s most acute AI-related cybersecurity challenge, while 40 percent highlighted deepfake identity fraud. Another 60 percent said the speed of AI advancement was outpacing how quickly institutions could adapt their risk management.
The identity warning lands as Canadian providers keep building out verification services. TELUS recently expanded digital ID verification services through a Sumsub partnership, and Ottawa has also issued an RFQ for digital fingerprinting and CPIC verification services. Both moves reflect the growing institutional demand for stronger identity assurance that OSFI’s report now frames as a systemic resilience requirement.
OSFI’s AGILE framework organizes the operational response to AI risk across five areas: Governance covers oversight structures and accountability for AI adoption; Literacy addresses building AI awareness and skills across the institution; Identification places secure digital ID at the foundation of authentication and fraud prevention; Ecosystem focuses on collaboration and coordination across regulators, firms and technology providers; and Security encompasses controls and incident response for AI-era threats. The framework treats these five areas as interconnected, with digital identification occupying a central role because it underpins the integrity of nearly every other control layer. OSFI says addressing the identity gap will require cooperation across financial institutions, regulators and government bodies responsible for national digital identity infrastructure.
Source: Office of the Superintendent of Financial Institutions
–
By Cass Kennedy
