BCFSA regulates BC credit unions, insurance companies, pension plans, mortgage brokers, and financial planners. BCFSA's technology risk expectations include cybersecurity controls that ThreeShield assesses and monitors through Lavawall®.
BCFSA's supervisory framework includes technology risk as a key risk category. Regulated entities are expected to have governance, controls, and resilience practices proportionate to their size and risk profile.
Board oversight of technology risk. Chief Risk Officer or equivalent responsibility for cyber risk. Annual technology risk assessment reported to senior management.
Business continuity and disaster recovery plans covering cyber incidents. Tested recovery procedures. RTO/RPO targets for critical systems documented and validated.
Access management, MFA, encryption, vulnerability management, and security monitoring proportionate to the sensitivity of member/client data held.
Due diligence on critical technology vendors and cloud service providers. Contractual security requirements and exit strategies.
BC credit unions are provincially regulated by BCFSA, not federally by OSFI. While OSFI's B-13 guideline (technology and cyber risk management) applies to federally regulated banks and insurers, BCFSA has its own supervisory framework for provincially regulated entities. ThreeShield navigates both regulatory environments.
Yes - BC credit unions handling personal information in commercial activities face PIPEDA obligations in addition to BCFSA expectations. BC's Personal Information Protection Act (PIPA) may also apply. ThreeShield assesses compliance with all three simultaneously.
ThreeShield evaluates your technology risk controls against BCFSA expectations and delivers board-ready findings.
Book a Scoping CallDIY · Supported · Done-for-You · All engagement models available
Whether you have a strong internal team or need everything handled end-to-end, ThreeShield meets you where you are.
For lean IT teams and cost-conscious organizations with internal security capacity
For MSPs, IT teams with some security resources, and organizations that need expert guidance but retain internal capacity
For organizations that want full compliance delivery without managing the process internally