Canadian banking regulation separates two concerns. Consumer protection — transparency, complaint handling, fair dealing — is the Financial Consumer Agency of Canada's responsibility. Prudential regulation — capital, liquidity, underwriting discipline — belongs to OSFI. The two agencies work in parallel, but when fintech teams ask "what does the regulator say about mortgages" they almost always mean OSFI.
Who OSFI actually regulates
OSFI's statutory mandate covers federally regulated financial institutions — the chartered banks, federally incorporated trust and loan companies, and federally licensed insurers. A current list of regulated entities is maintained on OSFI's site. Two categories explicitly sit outside: provincially regulated credit unions (which answer to their provincial regulator — FSRA in Ontario, for example), and caisses populaires in Quebec (AMF). If your fintech integrates with a credit union, B-20 may not apply to the underwriting on the other side of the rail; ask before assuming.
Guideline B-20 — the underwriting rulebook
OSFI's principal instrument for residential mortgage underwriting is Guideline B-20, Residential Mortgage Underwriting Practices and Procedures. The guideline was first issued in 2012 as a principles-based framework. Five expectations drive it: a governance framework for mortgage policy, borrower due diligence, collateral management, debt service coverage, and underwriting of mortgages for investment purposes.
Each subsequent revision has converted principles into hard rules. The 2018 amendment added the original stress test for uninsured mortgages. The 2022–2023 consultation cycle brought tighter expectations on combined loan-to-value lending products and on lenders' management of concentration risk. The direction of travel is consistent: OSFI uses B-20 to narrow the underwriting band, leaving less room for cycle-driven exuberance.
The Minimum Qualifying Rate
The most consequential piece of B-20 for operational fintech is the Minimum Qualifying Rate (MQR) for uninsured mortgages: greater of the contract rate plus 200 basis points or 5.25%. A borrower applying for a five-year fixed at 4.5% must demonstrate debt service capacity at 6.5%. For insured mortgages the MQR is set by the Department of Finance and follows the same formula.
Two operational consequences. First, debt-service-ratio calculations on OSFI-regulated mortgages are benchmarked to the MQR, not the contract rate — downstream affordability analytics that ignore this will systematically over-estimate borrower capacity. Second, because the MQR floor is unchanged through rate cycles, it compresses mortgage approvals asymmetrically: more cutting in low-rate environments than in high-rate ones. This shows up in vintage performance if you slice it by year of origination.
What this means on the rails
For a payments or fintech team, three practical reads:
One, if you offer a payment product layered on a mortgage-secured line of credit (HELOC-style), and your lender partner is OSFI-regulated, the combined LTV cap in B-20 governs the underlying facility. Know the cap before you model the draw-down curve.
Two, stress-test default variance. Stress-tested books have lower default-rate tails, which tightens the loss distribution on any insurance or wrap you're offering on top. A five-year comparison of OSFI-regulated versus non-OSFI-regulated residential portfolios in the same geography will show materially different tail behaviour — the variance gap is the B-20 effect.
Three, watch amendments and OSFI consultations. Policy changes on underwriting rules move slowly through public consultation periods with clear comment windows. An announcement of a new consultation on B-20 is a better early signal for downstream risk than any earnings call.
Bottom line
OSFI is not where the retail-facing headlines live, but it is where the rules that shape a $2T mortgage book are written. Reading B-20 directly once a year — or at minimum when a new consultation opens — is cheap, and it tells you more about your partners' book than most partner-level data they'd share.