Karsten Wenzlaff, Advisor
August 26th, 2025
Mar 26, 2026 | NCFA Insight | Artificial Intelligence And Data

On March 1, 2026, CodeWall, a security research firm focused on AI systems, privately reported security gaps to McKinsey. The firm said its agent found 22 unauthenticated endpoints, then chained a SQL injection issue and other weaknesses to gain read and write access across the production environment. CodeWall said the reachable data included 46.5 million chat messages, 728,000 files, 57,000 user accounts, 384,000 AI assistants, and 94,000 workspaces. It also said prompts, model configurations, and RAG related data were reachable.
On March 2, 2026, McKinsey acknowledged the findings and patched the unauthenticated endpoints the same day.
On March 9, 2026, CodeWall publicly shared research on vulnerabilities in McKinsey’s internal AI platform Lilli.
On March 11, McKinsey released this statement about the vulnerability and that a third party forensic review found no evidence that unauthorized parties accessed client data or client confidential information.
Public API documentation appears to have exposed a map of the system. Some endpoints reportedly required no authentication. One of them allegedly allowed database manipulation through JSON keys, which opened the door to SQL injection. From there, CodeWall said it could determine live production data and reach much deeper parts of the platform.
This incident doesn't point first to a model failure. It points to ordinary application security weaknesses around an AI system that had become deeply embedded in internal work.
McKinsey didn't confirm the full scale of the researcher claims. Instead, it focused on the response. The company said it fixed the issue quickly and found no evidence that unauthorized parties accessed client data or client confidential information.
Having said that, the reported scale of reachable internal material was large enough to raise questions about internal knowledge exposure, employee work patterns, and intellectual property concentration in one system.
CodeWall said prompt and configuration layers were reachable. If true, it means a bad actor could have potentially altered how the system retrieves information or generates answers. In an internal AI tool, that can create wrong outputs that look normal to staff.
That's where this type of incident becomes more useful for fintechs and financial firms. A publicly visible outage gets noticed whereas quietly altered outputs may not. In regulated environments, that can affect approvals, reviews, client treatment, policy interpretation, and internal decision support before anyone spots the pattern.
Banks, lenders, insurers, wealth firms, and fintechs are building similar internal AI layers right now. They connect those tools to policy documents, research, support logs, internal files, and customer related workflows because it saves time and helps staff move faster.
But that convenience comes with risk given that AI often pulls sensitive access into one place. If permissions are weak, endpoints are exposed, or prompt controls aren't protected, one internal tool can become a wider point of failure.
A key lesson founders and operators should take from this case, is to ask whether the application around it is locked down, whether prompts and retrieval rules are treated as sensitive assets, whether permissions are tight, and whether anyone has tested the system the way an attacker would.
Enterprise AI doesn't erase old security mistakes. It can magnify them by concentrating data, access, and trust inside a single interface.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
March 26, 2026

Image: Pixabay/tourque
There has been considerable discussion in recent years about gaming licenses from the Malta Gaming Authority (MGA) and whether they still hold value in an increasingly regulated world. With Canada’s provincial markets moving toward their own regulatory frameworks, some players question whether this license matters anymore. The possibility of more provinces following Ontario’s lead and introducing their own licensing systems has led some to believe that international MGA licenses will soon become unnecessary for Canadian players.
However, the reality is more nuanced. In practice, MGA licensed casinos remain some of the most commonly used and trusted platforms among Canadian players. For those looking into their options, websites like MGAcasinos.ca are dedicated to helping players find the best MGA casino sites in Canada. This website offers a list of online casinos that have a proven track record of player protection, fair gaming standards, and high-quality gaming features.
In this article, we’ll take a closer look at why the MGA license still holds strong value in the Canadian market and why so many players continue to prefer it across Canada.
The MGA is the government body responsible for regulating gambling in Malta. It was established in 2001, and Malta became one of the first countries in the European Union to formally regulate online gaming back in 2004. That head start gave the regulator decades to build out one of the most respected licensing frameworks in the industry.
It operates under Malta’s Gaming Act, which came into full effect in August 2018 after a major overhaul of the country’s gambling laws. Today, it oversees both land-based and online operators, sets the standards they must follow, and has the authority to issue fines, suspend licenses, or cancel them altogether when operators fall short.
What sets the MGA apart from lesser-known licensing bodies is the level of scrutiny involved. Operators must pass background checks, demonstrate financial stability, meet technical requirements, and implement responsible gambling measures before they can receive a license.
Ongoing compliance is expected, not just during the application stage. In practice, this means licenses are not automatically renewed. Recent figures reported by Next.io show that multiple operators applied for renewals, and not all were approved, reflecting the regulator’s continued oversight and willingness to deny extensions where standards are not met.
Canadian players have a lot of options when it comes to online gambling, but MGA licensed casinos consistently stand out. The reasons go beyond simply being internationally licensed. Here’s a clear breakdown of why these platforms are so popular among Canadian players:
Outside Ontario, most Canadian provinces don’t have fully regulated markets for private online casinos. Provincial lottery corporations offer their own platforms, but these options are limited. Additionally, most provinces haven’t established a licensing system for private operators.
As a result, many players turn to internationally licensed sites for more choice and flexibility. This is why Canadian players frequently encounter MGA licensed casinos, as these platforms are widely available and well-established, making them a natural choice for players seeking quality online gaming.
The MGA has been around for many years now and is well known among online casino players in Canada. This long presence has helped build familiarity and trust, so many players already recognise what to expect from it. Because of that, these licensed casinos are often preferred over other jurisdictions, not just for compliance reasons, but because players feel confident using platforms they already know.
Licensed casinos under the MGA have to follow strict player protection rules designed to keep players safe. This includes:
MGA casinos partner with some of the biggest software providers in the industry, including NetEnt, Microgaming, and Evolution Gaming. This means Canadian players have access to thousands of high-quality slot titles, table games, and live dealer experiences. The variety and innovation available at these casinos often surpass what provincial platforms can offer.
Canadian players benefit from a wide range of payment methods at MGA casinos, including:
Withdrawals are often faster, and the variety ensures players can deposit and play in ways that are convenient and secure.
MGA casinos are known for offering competitive welcome bonuses, free spins, cashback, and loyalty programs. Compared to provincial platforms, these promotions are generally more varied, giving players extra value and incentives to try new games.
Many MGA licensed casinos are run by established international brands that seek long-term growth rather than short-term profits. Because the MGA is a highly respected regulator, this attracts reputable companies, which in turn gives Canadian players access to stable, trustworthy platforms. For players, this means these casinos are less likely to disappear suddenly and more likely to offer consistent service, fair games, and reliable payouts over time.
The MGA makes it straightforward to verify whether a casino actually holds a valid license. Here is how to check:
The Malta Gaming Authority has built a reputation as one of the more rigorous online gaming regulators in the world, and that is why Canadian players frequently encounter MGA licensed casinos when looking for options outside provincial platforms.
These casinos offer Canadian players a winning combination of safety, fairness, and variety. With strict regulatory oversight, secure transactions and protections for players, it is no wonder these casinos are so popular. Whether you are a casual gamer or a high-stakes player, exploring MGA licensed platforms can help you find trusted options and enjoy peace of mind while playing.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Mar 25, 2026 | NCFA Fintech Market Activity | Payments And Money Movement

On March 25, 2026, Chexy closed a $14M Series A led by Khosla Ventures. Co-founder and CEO Liza Akhvledziani Carew said the company started by helping renters earn rewards on their biggest monthly expense, then grew into “something much bigger: a new way for money to move in Canada.”
Chexy’s own numbers speak for themselves. The company says it now supports 5,000+ businesses, $1B+ in annual payments, and $20M in rewards value. That's certainly not a narrow rent rewards story and points to a scaling payments company for businesses.
The company has already shown that rent can work as an entry point. In its first year, the company said it processed $30M in rental payments and generated $1M in rewards value. Now Chexy’s business offering has expanded considerably, including supplier payments, commercial rent, payroll, corporate tax, GST and HST remittance, payroll remittance, and property tax. This wider mix of recurring payments gives the company more ways to increase usage and build a deeper payments relationship.
While Chexy is part of the trend where rent and housing payments pull more fintech models into consumer finance, it's broadening it's model built around payments rather than point of sale credit. And the capital gives the fintech more runway to build and grow.
If rent brings users in, which payment flows give Chexy the best chance to become a durable Canadian money product?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |