OSFI B-13 & ITAD: FSM-N21 + FSM-N22 for asset disposal.
The Monetary Authority of Canada’s TRM Notice (FSM-N21) and Cyber Hygiene Notice (FSM-N22) — both effective 10 May 2024 — set legally enforceable expectations on regulated FIs. Asset disposal sits inside both. Here's how we align our delivery to support your TRM evidence.
TRM expectations on third-party service selection.
FSM-N21 (TRM) requires regulated FIs to apply technology-risk-management principles across the IT lifecycle — including disposal. In practice that means choosing service providers (including ITAD vendors) with a documented risk basis, getting evidence of the work performed, and being able to demonstrate continuity of control from in-service through to destruction.
The OSFI does not maintain a register of approved ITAD vendors. What it expects is that you can demonstrate, on inspection, that the vendor you chose performs the service competently and that the evidence of each disposal is on file.
TRM-aware document pack per job
- ♦ Vendor due-diligence pack: insurance certificates, parent-group references, sample destruction certificate, sample chain-of-custody log.
- ♦ NDA + SoW + per-asset disposition decision before pickup.
- ♦ Asset list reconciled against your CMDB — shows continuity of control.
- ♦ Locked-transit log with GPS evidence — shows custody never lapsed.
- ♦ NIST 800-88 destruction with two-operator + witness sign-off — shows the destruction was performed competently.
- ♦ Per-job Certificate of Destruction citing TRM-aware protocols — slotting straight into your TRM evidence file.
What OSFI does and does not certify.
The OSFI does not certify ITAD vendors. The phrase 'OSFI-aligned' in our materials means we provide documentation suitable to support your TRM evidence — not that the OSFI has reviewed or approved Maxicom Canada. Any vendor claim of OSFI endorsement for ITAD is not a real designation.
Maxicom Canada — frequently asked
Do you do OSFI-aligned destruction certificates as standard?
Yes. Every Certificate of Destruction we issue can include the TRM-aware citation by default. If your bank's TRM file expects specific wording, send it; we'll match it.