Global Governance Insights on Emerging Risks

Bleu Azur Consulting | June 17, 2018

A HEIGHTENED FOCUS ON RESPONSE AND RECOVERY

Over a third of directors of US public companies now discuss cybersecurity at every board meeting. Cyber risks are being driven onto the agenda by

  • high-profile data breaches,
  • distributed denial of services (DDoS) attacks,
  • and rising ransomware and cyber extortion attacks.

The concern about cyber risks is justified. The annual economic cost of cyber-crime is estimated at US$1.5 trillion and only about 15% of that loss is currently covered by insurance.

MMC Global Risk Center conducted research and interviews with directors from WCD to understand the scope and depth of cyber risk management discussions in the boardroom. The risk of cyberattack is a constantly evolving threat and the interviews highlighted the rising focus on resilience and recovery in boardroom cyber discussions. Approaches to cyber risks are maturing as organizations recognize them as an enterprise business risk, not just an information technology (IT) problem.

However, board focus varies significantly across industries, geographies, organization size and regulatory context. For example, business executives ranked cyberattacks among the top five risks of doing business in the Asia Pacific region but Asian organizations take 1.7 times longer than the global median to discover a breach and spend on average 47% less on information security than North American firms.

REGULATION ON THE RISE

Tightening regulatory requirements for cybersecurity and breach notification across the globe such as

  • the EU GDPR,
  • China’s new Cyber Security Law,
  • and Australia’s Privacy Amendment,

are also propelling cyber onto the board agenda. Most recently, in February 2018, the USA’s Securities and Exchange Commission (SEC) provided interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents.

Regulations relating to transparency and notifications around cyber breaches drive greater discussion and awareness of cyber risks. Industries such as

  • financial services,
  • telecommunications
  • and utilities,

are subject to a large number of cyberattacks on a daily basis and have stringent regulatory requirements for cybersecurity.

See:  Bithumb $31 Million Crypto Exchange Hack: What We Know (And Don’t)

Kris Manos, Director, KeyCorp, Columbia Forest Products, and Dexter Apache Holdings, observed, “The manufacturing sector is less advanced in addressing cyber threats; the NotPetya and WannaCry attacks flagged that sector’s vulnerability and has led to a greater focus in the boardroom.” For example, the virus forced a transportation company to shut down all of its communications with customers and also within the company. It took several weeks before business was back to normal, and the loss of business was estimated to have been as high as US$300 million. Overall, it is estimated that as a result of supply chain disruptions, consumer goods manufacturers, transport and logistics companies, pharmaceutical firms and utilities reportedly suffered, in aggregate, over US$1 billion in economic losses from the NotPetya attacks. Also, as Cristina Finocchi Mahne, Director, Inwit, Italiaonline, Banco Desio, Natuzzi and Trevi Group, noted, “The focus on cyber can vary across industries depending also on their perception of their own clients’ concerns regarding privacy and data breaches.”

LESSONS LEARNED: UPDATE RESPONSE PLANS AND EVALUATE THIRD-PARTY RISK

The high-profile cyberattacks in 2017, along with new and evolving ransomware onslaughts, were learning events for many organizations. Lessons included the need to establish relationships with organizations that can assist in the event of a cyberattack, such as l

  • aw enforcement,
  • regulatory agencies and recovery service providers
  • including forensic accountants and crisis management firms.

Many boards need to increase their focus on their organization’s cyber incident response plans. A recent global survey found that only 30% of companies have a cyber response plan and a survey by the National Association of Corporate Directors (NACD) suggests that only 60% of boards have reviewed their breach response plan over the past 12 months. Kris Manos noted, “[If an attack occurs,] it’s important to be able to quickly access a response plan. This also helps demonstrate that the organization was prepared to respond effectively.”

Experienced directors emphasized the need for effective response plans alongside robust cyber risk mitigation programs to ensure resilience, as well as operational and reputation recovery. As Jan Babiak, Director, Walgreens Boots Alliance, Euromoney Institutional Investor, and Bank of Montreal, stressed, “The importance of the ’respond and recover’ phase cannot be overstated, and this focus needs to rapidly improve.”

Directors need to review how the organization will communicate and report breaches. Response plans should include preliminary drafts of communications to all stakeholders including customers, suppliers, regulators, employees, the board, shareholders, and even the general public. The plan should also consider legal requirements around timelines to report breaches so the organization is not hit with financial penalties that can add to an already expensive and reputationally damaging situation. Finally, the response plan also needs to consider that normal methods of communication (websites, email, etc.) may be casualties of the breach. A cyber response plan housed only on the corporate network may be of little use in a ransomware attack.

Other lessons included the need to focus on cyber risks posed by third-party suppliers, vendors and other impacts throughout the supply chain. Shirley Daniel, Director, American Savings Bank, and Pacific Asian Management Institute, noted, “Such events highlight vulnerability beyond your organization’s control and are raising the focus on IT security throughout the supply chain.” Survey data suggests that about a third of organizations do not assess the cyber risk of vendors and suppliers. This is a critical area of focus as third-party service providers (e.g., software providers, cloud services providers, etc.) are increasingly embedded in value chains.

More:  The growing cost of cybersecurity

FRUSTRATIONS WITH OVERSIGHT

Most directors expressed frustrations and challenges with cyber risk oversight even though the topic is frequently on meeting agendas. Part of the challenge is that director-level cyber experts are thin on the ground; most boards have only one individual serving as the “tech” or “cyber” person. A Spencer Stuart survey found that 41% of respondents said their board had at least one director with cyber expertise, with an additional 7% who are in the process of recruiting one. Boards would benefit from the addition of experienced individuals who can identify the connections between cybersecurity and overall company strategy.

A crucial additional challenge is obtaining clarity on the organization’s overall cyber risk management framework. (See Exhibit 1: Boards Need More Information on Cyber Investments.) Olga Botero, Director, Evertec, Inc., and Founding Partner, C&S Customers and Strategy, observed, “There are still many questions unanswered for boards, including:

  • How good is our security program?
  • How do we compare to peers?

There is a big lack of benchmarking on practices.” Anastassia Lauterbach, Director, Dun & Bradstreet, and member of Evolution Partners Advisory Board, summarized it well, “Boards need a set of KPIs for cybersecurity highlighting their company’s

  • unique business model,
  • legacy IT,
  • supplier and partner relationships,
  • and geographical scope.”

Nearly a quarter of boards are dissatisfied with the quality of management-provided information related to cybersecurity because of insufficient transparency, inability to benchmark and difficulty of interpretation.

EFFECTIVE OVERSIGHT IS BUILT ON A COMPREHENSIVE CYBER RISK MANAGEMENT FRAMEWORK

Organizations are maturing from a “harden the shell” approach to a protocol based on understanding and protecting core assets and optimizing resources. This includes the application of risk disciplines to assess and manage risk, including quantification and analytics. (See Exhibit 2: Focus Areas of a Comprehensive Cyber Risk Management Framework.) Quantification shifts the conversation from a technical discussion about threat vectors and system vulnerabilities to one focused on maximizing the return on an organization’s cyber spending and lowering its total cost of risk.

See:  FSB warns of third-party FinTech risk

Directors also emphasized the need to embed the process in an overall cyber risk management framework and culture. “The culture must emphasize openness and learning from mistakes. Culture and cyber risk oversight go hand in hand,” said Anastassia Lauterbach. Employees should be encouraged to flag and highlight potential cyber incidents, such as phishing attacks, as every employee plays a vital role in cyber risk management. Jan Babiak noted, “If every person in the organization doesn’t view themselves as a human firewall, you have a soft underbelly.” Mary Beth Vitale, Director, GEHA and CoBiz Financial, Inc., also noted, “Much of cyber risk mitigation is related to good housekeeping such as timely patching of servers and ongoing employee training and alertness.”

Boards also need to be alert. “Our board undertakes the same cybersecurity training as employees,” noted Wendy Webb, Director, ABM Industries. Other boards are putting cyber updates and visits to security centers on board “offsite” agendas.

Continue to the full article --> here

 

Click for News:

 

Nov 12, 2026 Buying a Canadian money services business starts with identifying what the buyer will acquire: a legal entity, a registration history, contracts, records and possibly an active operation. The value of that package depends on whether it supports the services the new owner intends to provide. A FINTRAC registration entry is an important starting point. It does not establish the company’s financial condition, the quality of its compliance programme or the availability of banking relationships after an acquisition. A payment business may also need a separate assessment under the Retail Payment Activities Act, or RPAA. For investors evaluating a Canadian MSB company for sale, due diligence should connect registration status, actual activities, transaction structure and financial evidence before the parties agree a completion timetable. Verify the Canadian MSB registration and legal entity Begin with the target’s exact legal name, incorporation details, registration number and current status. Match the entity in the corporate documents to the entity in FINTRAC’s Money Services Business Registry. FINTRAC explicitly states that registration does not mean it endorses or licenses a business. It also states that it does not issue licences or certificates of registration. A sales presentation using the phrase “FINTRAC licence” should ...
AI illustration of a Canadian MSB acquisition due diligence checklist covering FINTRAC registration, RPAA compliance, ownership, financial review and banking relationships
November 12, 2026 | NCFA Fintech Market Insight | Digital Assets Blockchain And Tokenization, Capital Markets Infrastructure And Funding, Wealthtech Investing And Trading Strategy still runs a software business, but Bitcoin now dominates its assets and capital raising. MSCI no longer treats that balance as an index eligible operating company. November 11, 2026, MSCI confirmed Strategy’s removal from the MSCI USA and MSCI World indexes after the November 30 close under its new methodology for non operating companies. MSCI is one of the world’s largest index providers, and its benchmarks are followed by funds investing across global equity markets. Japan’s Metaplanet is also being removed from an MSCI index. MSCI has decided that Strategy no longer qualifies for its equity indexes because Bitcoin now dominates its assets and much of its capital raising. Strategy still sells software and reports operating revenue, but MSCI is drawing a line between a business that holds investment assets and one where those assets have become the main financial story. Why Is MSCI Removing Strategy From Its Indexes? MSCI first looked at a rule aimed specifically at digital asset treasury companies. It later dropped that proposal and change it's methodology to cover companies whose finances ...
AI illustration of Bitcoin and public company symbols representing Strategy’s removal from MSCI indexes and the financing model behind Bitcoin treasury companies
Nov 12, 2026 Crypto market cap is calculated by multiplying an asset's reference price by its circulating supply. A token priced at $2 with 50 million units circulating has a market cap of $100 million. The calculation estimates the value of that supply at the reference price; it does not total the money investors deposited. To understand a change in the ranking, examine both inputs and the provider's definitions. A larger number can result from price changes, supply changes, or revised reporting. Establish what the two inputs represent The arithmetic is simple, but neither input is self-explanatory. “Price” may be a reference assembled from selected trading pairs and venues, rather than the last transaction on the exchange you use. A provider may exclude observations or convert quote currencies. Two services can publish different estimates because their source selection and methods differ. Circulating supply is an estimate of units treated as available in the market under a provider's rules. It may differ from the number minted, the total recorded by a contract, or the maximum permitted under a protocol's current design. Locked balances, treasury allocations, burns, and scheduled releases require interpretation. A transparent methodology matters because identical arithmetic can still use ...
AI illustration of stacks of coins beside financial charts illustrating how cryptocurrency prices and circulating supply affect crypto market capitalization
November 11, 2026 | NCFA Fintech Market Insight | Artificial Intelligence And Data, Capital Markets Infrastructure And Funding, Risk Compliance And Regtech Financial firms are putting AI agents into production well before giving them broad financial authority. That creates time to set identity, permissions and transaction controls before autonomous execution becomes common. On November 11, 2026, Bank of England Financial Policy Committee external member Jonathan Hall used his final FPC speech to examine what happens when AI agents get more authority inside financial firms. A Bank of England and FCA survey of 196 firms found that 80% already deploy AI agents and another 14% plan to within 12 months. Only 2% reported agents with broad autonomy, and none of those were in trading and payments. Finance is adopting agents quickly, but firms are still keeping people and hard limits around the decisions that can change money, positions or customer outcomes. AI Agents Are In Finance But They Are Not Trading Alone The 2026 Bank of England and FCA survey separates four levels of authority: Decision support lets an agent recommend an action while a person decides and executes it. Constrained execution lets the agent act inside preset rules. Conditional autonomy ...
AI illustration of AI agents connected across a financial trading network, representing shared market behaviour, trading automation and financial stability risk
November 10, 2026 | NCFA Fintech Market Insight | Capital Markets Infrastructure And Funding, Entrepreneurs Startups Small Businesses, Equity Crowdfunding And Alternative Funding A small group of large rounds is carrying Canadian venture totals while deal count and growth stage financing remain well below recent norms. On November 10, 2026, the Canadian Venture Capital and Private Equity Association published its Q3 2026 venture capital report. Canadian companies raised $4.3 billion across 397 deals through September, only 1% less capital than a year earlier. But 23 rounds of $50 million or more represented just 6% of disclosed deals and absorbed 58% of all venture capital invested. Deal count has also fallen every year since 2021. The national total is holding up far better than the number of companies getting financed. Six Big Rounds Carried 59% Of Q3 Venture Capital Q3 produced $1.35 billion across 129 deals. Capital was 1% higher than Q2, but deal count fell 15%. Six rounds above $50 million accounted for $793 million, or 59% of the quarter’s capital. That's a decent quarter for the companies that closed those rounds, but a weak quarter for everyone else. Mega rounds above $50 million totalled $2.5 billion across 23 transactions ...
AI Illustration of large venture capital deals dominating smaller financings, representing concentration in Canada’s VC market
November 11, 2026 | NCFA Story Intelligence | Competition And Market Structure, Wealthtech Investing And Trading, Regulation And Policy Canada is cutting bank fees and switching barriers after years of weak competition, high concentration and poor productivity. On November 7, 2026, the federal government proposed something Canadian investors have complained about for years. Banks would no longer be allowed to charge most investment account transfer fees, which typically cost about $150 per account. Ottawa also wants clearer transfer information and tighter timelines for moving investments to another financial institution. The fee matters because leaving can already be slow and frustrating. Receiving firms often reimburse the outgoing charge to win the account. That means a fee collected by the institution losing the customer can become part of the acquisition cost for the institution trying to win that customer. Canada's six largest banks hold roughly 93% of banking assets. The Competition Bureau was warning about barriers facing fintech competitors in 2017. Ottawa began reviewing open banking in 2018. A federal advisory committee later recommended an operating system by January 2023 and warned that government should not delay. January 2023 came and went. Real Time Rail also slipped years beyond its first expected ...
Digital illustration of Canada bank transfer fee reform showing easier investment account switching, lower fees, open banking, payment infrastructure and stronger financial competition
November 10, 2026 | NCFA Fintech Market Insight | Digital Assets Blockchain And Tokenization, Capital Markets Infrastructure And Funding, Regulation And Policy Funds, Collateral And Settlement Lead Canada’s Near Term Tokenization Opportunity On November 10, 2026, the Canadian Securities Administrators published its Project Tokenization Phase 1 findings, setting out where Canadian market participants see the strongest commercial opportunities for tokenization and what regulators plan to test next. The report draws on 233 organizations, 21 bilateral meetings and 80 survey responses, along with workshops attended by 281 people in Calgary and 491 in Toronto. Participants put investment funds, private assets, collateral, treasury and settlement infrastructure ahead of public stocks as the strongest near term opportunities. The report also cuts through one of tokenization’s biggest sales pitches. Blockchain can change how an asset is recorded, transferred or settled, but it doesn't automatically create liquidity, investor demand, broader eligibility or stronger ownership rights. Those outcomes still depend on the product, market, legal structure and infrastructure around it. The CSA now plans to take specific projects into Phase 2 through a 120 day public call for proposals. Firms may be able to use existing regulatory processes, tailored regulatory treatment or bounded testing in a ...
Digital illustration of tokenized financial assets, blockchain settlement and legal infrastructure, representing Canada's investment funds and collateral markets.
Nov 11, 2026 A positive work environment is key for any team that wants to succeed. Team morale is crucial for productivity, motivation, and job satisfaction. Engaging in activities that lift spirits and strengthen connections can lead to great results. Creating a positive team environment requires creativity, engagement, and some fun. Each activity can strengthen connections, boost motivation, and improve workplace dynamics. When teams focus on strategies to boost morale, they work toward shared success. These activities can lead to lasting memories and help build a stronger team culture. Here are some fun strategies to help improve your team's morale and make the workplace livelier. Fun at the Arcade Visiting an arcade spot is a great way to enjoy time together and build teamwork. Imagine your team facing challenges with various games. Whether it's racing or playing team games, the arcade encourages friendly competition and bonding. These fun experiences can help reduce stress and improve relationships among coworkers. Arcades offer many options to suit diverse interests and skill levels. The lively atmosphere invites everyone to relax and take a break from their daily tasks. Shared laughter and enjoyment can lead to better communication and teamwork when you return to the ...
Digital illustration of team building activities boosting workplace morale with coworkers playing games and laughing in a bright modern office
November 10, 2026 | Market Activity | Fundraising, Investing, Trading, Leadership, Competition, Human Capital, Health A Brokerage Race Beyond $0 Commissions On November 10, 2026, Webull Canada added Nasdaq Basic Canada, giving clients free real time Level 1 quote and trade data across Canadian listed equities. The feed provides best bid, best offer and last sale information for stocks listed on the TSX, TSX Venture, CSE and Cboe Canada. Nasdaq says its consolidated feed can reduce Level 1 market data costs by more than 60% compared with traditional Canadian data packages. Webull isn't first to give Canadian investors free real time information. The more interesting story is how quickly another paid feature is becoming part of the basic brokerage account. Wealthsimple helped normalize $0 trading in 2019, Questrade followed in 2025 and Webull dropped its own commissions in April 2026. With the headline trading fee largely gone, brokers now need other reasons for investors to move money and keep it on the platform. Who Led Canada’s Race To $0 Trading And Free Market Data Wealthsimple Trade launched nationally on March 13, 2019 with $0 commissions on Canadian and U.S. stocks and ETFs. Questrade removed commissions on listed stocks and ETFs ...
AI illustration of Canadian online brokerage competition with racing cars promoting $0 commissions, free real time market data and transfer match bonuses
November 10, 2026 | Market Activity | Artificial Intelligence And Data, Capital Markets Infrastructure And Funding A Toronto Fintech Riskfuel Analytics Brings AI Pricing Into BBVA’s Global Markets Workflow On November 10, 2026, BBVA deployed Riskfuel Analytics' neural pricing technology inside the pre-trade structuring workflow for autocallable products on its ePricer platform. Riskfuel is a Toronto fintech founded in 2019 that builds AI models for derivatives pricing. BBVA is a global bank with a large corporate and investment banking business. The deployment puts Canadian built AI directly into the calculations used to design complex structured products at a major global bank. Riskfuel's model is trained on BBVA's own pricing engine and uses more than 4,000 market and product inputs. The company says the surrogate was tested against more than 100,000 trades and can evaluate thousands of candidate structures in under a minute. BBVA had already added AI generated investment ideas to ePricer in September. Riskfuel goes further into the workflow by speeding up the numerical pricing work while BBVA's own model remains the reference. How Riskfuel Speeds Up BBVA's Autocallable Pricing Autocallables can depend on volatility, interest rates, dividends, maturity, coupon levels and several barrier conditions. Autocallables are structured investments ...
AI illustration of AI powered derivatives pricing shown on a financial trading screen, illustrating Riskfuel technology used in BBVA structured product workflows

 


The National Crowdfunding & Fintech Association of Canada (NCFA Canada) is a cross-Canada non-profit actively engaged with cryptocurrency, blockchain, crowdfunding, alternative finance, fintech, P2P, ICO, STO, and online investing stakeholders globally. NCFA Canada provides education, research, industry stewardship, services, and networking opportunities to thousands of members and subscribers and works closely with industry, government, academia, community and eco-system partners and affiliates to create a strong and vibrant crowdfunding and fintech industry. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: ncfacanada.org

Leave a Reply

Your email address will not be published. Required fields are marked *