Deloitte · Tech Consulting · Hard · 35-45 min

Canadian Bank Core Replacement Under OSFI

Canadian Bank Core Replacement Under OSFI is a hard Deloitte tech consulting case interview that runs 35-45 min. A Canadian Schedule I bank — CAD 48B assets, 900k customers, core banking platform installed in 1999 — has an OSFI finding under Guideline B-13: technology and cyber risk governance is not commensurate with the estate. A strong answer works through 5 phases: Restate the OSFI finding as a control problem; Compare upgrade, progressive replacement, and SaaS core on resilience, data residency in Canada, and the four-year support cliff; Design the customer-migration path so deposits, payments, and mortgage servicing never big-bang; Map B-13 and B-10 obligations onto the target: who owns technology risk, how the vendor is overseen, what is tested; Recommend a path with a CAD range, a first product to move, and what the risk committee signs each quarter.

Last updated 2026-09-05

The brief

A Canadian Schedule I bank — CAD 48B assets, 900k customers, core banking platform installed in 1999 — has an OSFI finding under Guideline B-13: technology and cyber risk governance is not commensurate with the estate. The same exam flagged third-party concentration (Guideline B-10) on the core vendor, whose support window ends in four years. The CEO wants a core decision this quarter: upgrade in place, progressive replacement, or a SaaS core. Budget tolerance is CAD 180–250M. Retail deposits cannot have a weekend outage. You are defending the recommendation to the risk committee.

How to approach it

  1. Restate the OSFI finding as a control problem — governance, resilience, third-party — not as a license renewal
  2. Compare upgrade, progressive replacement, and SaaS core on resilience, data residency in Canada, and the four-year support cliff
  3. Design the customer-migration path so deposits, payments, and mortgage servicing never big-bang
  4. Map B-13 and B-10 obligations onto the target: who owns technology risk, how the vendor is overseen, what is tested
  5. Recommend a path with a CAD range, a first product to move, and what the risk committee signs each quarter

What a strong answer does

  • Leads with the supervisory finding and the support cliff, then the architecture
  • Rejects a single-weekend cutover for the deposit book
  • Keeps Canadian data residency and vendor exit as design constraints, not footnotes
  • Splits the CAD 180–250M into change, run-cost delta, and parallel-run
  • Names the accountable executive for technology risk after go-live, which is what B-13 is actually asking

Red flags interviewers score down

  • Picks a SaaS core because it is modern and never mentions OSFI
  • Plans a big-bang conversion of deposits
  • Assumes US-region cloud is fine for Canadian customer data
  • Treats B-10 as a procurement form after the vendor is chosen

Cases are written in each firm's style, written and reviewed by working consultants; they are not the firms' own published cases.

More Deloitte cases