Category Archives: Blockchain, Crypto, Digital Assets Regulations

NCFA Weekly Fintech Intelligence Oct 3-Oct 9, 2026

Oct 3, 2026 | Last Updated: Oct 20, 2026 | NCFA Fintech Whisperer | Artificial Intelligence And Data, Digital Banking And BaaS, Capital Markets Infrastructure And Funding, Wealthtech Investing And Trading, Cross Border Payments And FX, Payments Infrastructure And Money Movement, Cybersecurity Fraud And Financial Crime, Regulation And Policy, Risk Compliance And Regtech, Embedded Finance, Lending Consumer Credit And BNPL, Treasury Liquidity And Cash Management, Digital Assets Blockchain And Tokenization, Digital Identity And Trust

Fintech market intelligence visualization

] Image: Freepik

This live weekly NCFA intelligence page tracks financial technology developments that significantly affect how fintechs build, sell, raise capital, and operate under scrutiny. Coverage prioritizes Canada and includes global events that directly influence competitive conditions, market access, and execution realities across fintech sectors.  This page will be updated throughout the week with market movers in a live format and then each week we'll close the prior week's contents in prep for the upcoming week, and continue on a rolling basis.  (Missed prior week's Fintech Whisperer?  (December 6-12, 2025, December 13-19, 2025, January 1-9, 2026, January 10-16, 2026, January 17-23, 2026, January 24-30, 2026, January 31-February 6, 2026, February 7-13, 2026, February 14-20, 2026, February 21-27, 2026, February 28-March 6, 2026, March 7-March 13, 2026, March 14-March 20, 2026, March 21-March 27, 2026, March 28-April 3, 2026, April 4-10, 2026, April 11-17, 2026, April 18-24, 2026, April 25-May 1, 2026, May 2-8, 2026, May 9-15, 2026, May 16-22, 2026, May 23-29, 2026, May 30-June 5, 2026, June 6-12, 2026, June 13-June 19, 2026, June 20-June 26, 2026, June 27-July 3, 2026, July 4-July 10, 2026, July 11-July 17, 2026, July 18-July 24, 2026, July 25-July 31, 2026, August 1-August 7, 2026, August 8-August 14, 2026, August 15-August 21, 2026, August 22-August 28, 2026, August 29-September 4, 2026, September 5-September 11, 2026, September 12-September 18, 2026, September 19-September 25, 2026, September 26-October 2, 2026).

Weekly Fintech Market Intelligence Oct 3 - Oct 9, 2026

Artificial Intelligence And Data

OSFI Makes Frontier AI a Supervisory Risk Focus for Canadian Finance

October 8, 2026, Canada
  • Canada's Office of the Superintendent of Financial Institutions says frontier AI can amplify cyber, technology, third party and reputational risks across federally regulated financial institutions.
  • OSFI says institutions should strengthen governance, controls and testing as AI capabilities advance, while boards and senior management remain accountable for the results.
  • The regulator is increasing its ability to assess frontier AI, technology concentration and critical third party dependencies and says these issues will remain part of its supervisory work.

Canadian banks and insurers now have a clearer view of what OSFI expects them to manage as frontier AI moves into financial operations. Firms will need evidence that they can test advanced models, understand critical dependencies and assign responsibility when AI affects important services.

Digital Banking And BaaS

Modern Treasury Applies for National Trust Bank Charter

October 5, 2026, United States
  • Modern Treasury submitted an application to the Office of the Comptroller of the Currency to establish Modern Treasury National Trust Bank.
  • If approved, the limited purpose national trust bank would provide federally supervised digital asset custody and related fiat services alongside Modern Treasury's payments and settlement capabilities.
  • Modern Treasury says its platform has powered more than US$600 billion in payments. The proposed bank would operate separately from the company's software and payment services.

Modern Treasury is trying to move from orchestrating regulated money movement to owning a federally supervised custody capability. That extends the strategy behind its earlier integrated payment infrastructure and would give the company more direct control over custody, settlement and the service boundary between fintech infrastructure and bank partners.

Rain Applies to Establish National Trust Bank

October 5, 2026, United States
  • Rain filed an application with the Office of the Comptroller of the Currency to establish Rain National Trust Bank, a proposed national trust bank based in New York.
  • If approved, the bank would provide fiduciary custody for digital assets and U.S. dollars, manage reserves for permitted stablecoin issuers and issue or redeem U.S. dollar backed stablecoins for institutional clients.
  • The proposed bank would not accept deposits, offer consumer accounts or make commercial loans. Rain says its infrastructure already supports stablecoin cards, wallets and money movement products used by millions of end users.

Rain is seeking to put custody, reserve management and stablecoin issuance inside a federally supervised institution rather than relying on separate providers for each function. Approval would give its fintech and enterprise customers a more direct regulated path from stablecoin infrastructure to banking controls.

hashbank Adds External Crypto Transfers Inside Licensed Banking

October 5, 2026, Georgia
  • hashbank added the ability to receive digital assets from external wallets, convert them to fiat and send assets to external blockchain addresses from the same banking application.
  • The service supports more than 150 digital assets and applies authentication, address verification, anti money laundering procedures and blockchain analytics to transfers.
  • The bank holds a full banking licence from the National Bank of Georgia, began live operations in 2024 and reports approximately 60,000 customers across 73 countries.

A licensed bank is putting external wallet activity inside the same operating environment as fiat accounts. That makes blockchain screening, address verification and conversion part of the banking control stack and gives customers a regulated route between bank balances and self custody without routing every transfer through a separate crypto platform.

Singapore Gulf Bank Adds Banking Infrastructure for Rain

October 4, 2026, Bahrain
  • Singapore Gulf Bank will provide Rain with operational, client money and virtual accounts, primarily in U.S. dollars.
  • The account infrastructure supports daily cash flows, client fund segregation and reconciliation as Rain's transaction volumes increase.
  • Rain was the first cryptocurrency exchange licensed by the Central Bank of Bahrain. Both Rain and Singapore Gulf Bank operate under CBB regulation.

Client money accounts and reconciliation are core operating controls for a regulated exchange, not peripheral banking services. Bringing those functions into a CBB regulated bank relationship gives Rain a more direct operating path for safeguarding customer funds and managing liquidity as its regional business grows.

Capital Markets Infrastructure And Funding

Airtel Money Begins Conditional London Trading

October 9, 2026, United Kingdom / Africa
  • Airtel Money began conditional dealings on the London Stock Exchange on October 9 following an offering priced at £1.96 per share, implying an equity valuation of approximately US$7 billion.
  • The offer involved 270 million existing shares and approximately US$703 million of proceeds to selling holders; it was not a US$703 million primary capital raise by Airtel Money.
  • Unconditional dealings and admission to the FCA Official List are expected October 14. Airtel Africa remains a long-term strategic shareholder of the mobile financial services business.

A mobile money operator with a major African distribution footprint is entering public markets as a separately traded financial platform. Investors can value payments, digital wallets and related services independently from the parent’s telecom business. The deal also tests public-market appetite for financial inclusion businesses with extensive networks and operating exposure across African jurisdictions.

Securitize Launches Tokenized U.S. Stocks for U.S. and Global Investors

October 8, 2026, United States / European Union / Global
  • Securitize launched tokenized access to 12 U.S. stocks, including Apple, Microsoft, Nvidia, Alphabet, Tesla, Meta and Amazon, through its registered broker dealer platform.
  • Each token is backed one for one by an underlying share and represents a security entitlement under U.S. commercial law, preserving applicable economic rights including dividends and voting rights where the underlying share carries them.
  • The product launched on Solana with USDC settlement and is expected to connect with Tokenized Securities Venues including OKXICE as the new U.S. tokenized stock market structure develops.

Tokenized U.S. equities have moved from venue design into a live regulated product available to eligible investors. Securitize is combining conventional share backing and investor rights with blockchain settlement, giving the market a practical test of whether tokenized stocks can expand without separating investors from the legal rights attached to the underlying shares.

DailyPay Adds US$200 Million in Securitized Funding for Earned Wage Access

October 8, 2026, United States
  • DailyPay completed a US$200 million asset-backed securitization of earned wage access receivables, its second such transaction following a US$200 million issuance in June 2025.
  • The transaction brings DailyPay's total receivables-backed debt financing to approximately US$1.4 billion, including its US$960 million secured credit facility. The offering comprised four classes of notes rated from AA (sf) to BB (sf) by Morningstar DBRS.
  • Citi acted as lead bookrunner and structuring agent, joined by Bank of America and Barclays as joint bookrunners. Canadian bank Scotiabank was among the co-managers. DailyPay reports serving more than 2,000 employers and six million employees.

Earned wage access providers must finance payments to employees before the employer's scheduled payroll date. DailyPay's second securitization expands that capacity and gives institutional investors another way to fund short duration payroll receivables. For fintech lenders and funding partners, the important question is whether access to asset-backed financing can reduce capital costs enough to support growth while keeping funding available through weaker credit markets.

Startale Opens Japan Bond Paying Interest and Principal in JPYSC

October 6, 2026, Japan
  • Startale Japan opened subscriptions for a digital corporate bond that will pay both interest and principal redemption in JPYSC, a yen denominated trust type stablecoin issued by SBI Shinsei Trust Bank.
  • Startale says it is Japan's first digital corporate bond to use a yen denominated trust type stablecoin for both interest and principal payments. The offering totals ¥99.9 million and carries a fixed annual rate of 5.00%.
  • JPYSC qualifies as a Type 3 Electronic Payment Instrument under Japan's Payment Services Act, while SBI Shinsei Trust Bank issues the stablecoin and manages the trust assets backing it.

The bond puts a regulated yen stablecoin into the full payment lifecycle of a conventional financing instrument. If the model works operationally, issuers can test stablecoin settlement against familiar corporate debt obligations rather than limiting use to transfers, trading or standalone token experiments.

UK Appoints RBC and Five Banks to Digital Gilt Pilot

October 6, 2026, United Kingdom / Canada
  • HM Treasury selected Barclays, HSBC, Lloyds, Morgan Stanley, NatWest and RBC Capital Markets as joint lead managers for the Digital Gilt Instrument pilot.
  • The managers will support underwriting, investor engagement and distribution of the proposed digitally native, short-dated sovereign bond.
  • The pilot is expected by the first quarter of 2027 and is designed to use a platform inside the UK Digital Securities Sandbox, with settlement recorded onchain. No completed bond issuance was announced on October 6.

RBC’s participation gives Canadian capital markets expertise a direct role in a sovereign issuance experiment, not just a vendor demonstration. For dealers, custodians and infrastructure providers, the practical questions are how digital securities enter established distribution channels and who controls the asset record, settlement and post-issuance servicing.

Sygnum Opens Fidelity Tokenized Liquidity Access in Singapore

October 5, 2026, Singapore
  • Sygnum opened Fidelity International's tokenized U.S. dollar liquidity solution to accredited and institutional investors in Singapore through Sygnum Pte. Ltd.
  • Sygnum's Singapore entity is licensed by the Monetary Authority of Singapore, while its Desygnate infrastructure supports the tokenized product's onchain fund registry, settlement and subscription functions.
  • The Fidelity product first launched with Sygnum in Switzerland in May 2026, making the Singapore rollout an expansion of regulated investor access rather than a new issuance.

An institutional tokenized liquidity product that already operated in Switzerland now has a licensed access route in Singapore. The expansion tests whether tokenized cash management products can move across regulated entities and jurisdictions without rebuilding the underlying issuance and administration infrastructure each time.

CFTC Allows Conditional Conversion to Perpetual Index Futures

October 5, 2026, United States
  • The CFTC’s Division of Market Oversight issued no-action relief permitting designated contract markets to convert certain existing perpetual-style broad-based security index futures into contracts without an expiration date.
  • Conditions include seeking feedback from position holders, giving advance notice and an opportunity to exit, providing risk disclosures, preserving other material contract terms and filing rule amendments.
  • The relief expires October 20, 2026. It does not provide open-ended permission to list any new perpetual futures product.

Exchange operators have a narrowly defined window to alter an existing contract structure, but only with procedural safeguards for participants. The relief provides a near-term test of how regulators handle continuous futures exposure and legacy open positions. Firms should focus on the eligibility conditions and deadline rather than extrapolate a general approval of perpetual derivatives.

OKXICE Files Notice for Tokenized U.S. Stock Venue

October 4, 2026, United States
  • OKXICE filed the public notice required to operate a Tokenized Securities Venue under the SEC's temporary conditional exemption for tokenized National Market System stocks.
  • The venue plans permissioned automated market maker liquidity pools on XLayer, with tokenized stocks paired against USDC, USDG or USDT and access restricted to approved wallets that pass identity, sanctions and wallet screening.
  • The notice lists more than 60 U.S. stocks for planned trading and requires third party tokenized shares to be backed one for one by underlying securities held through a registered broker dealer.

The SEC's five year pathway for tokenized U.S. stock trading now has a concrete venue design behind it. OKXICE combines permissioned wallets, stablecoin settlement, automated liquidity and broker held share backing, turning an exemption into an operating model that other tokenized securities venues can be measured against.

Digital Identity And Trust

Japan FSA Urges Stronger Cyber and Digital Identity Controls

October 9, 2026, Japan
  • Japan's Financial Services Agency issued an October 9 notice to financial institutions following unauthorized access incidents involving customer-facing systems, including breaches exposing identity document images and other personal information.
  • Institutions were asked to review cybersecurity controls, third party risk management and incident response arrangements, and correct deficiencies promptly. The notice also calls for stronger verification of identity document and facial images during remote customer onboarding.
  • From April 1, 2027, regulatory changes will generally discontinue identity verification based on submitted document images in favour of reading IC-chip information. The FSA urged institutions to strengthen their procedures ahead of that deadline rather than wait for implementation.

Remote onboarding is becoming a larger fraud control and technology migration issue for Japanese financial institutions. Banks and fintechs need to test how document authentication, chip reading, customer identity verification and fraud monitoring work together. Providers still relying on uploaded document images face a concrete transition deadline, while recent breaches put pressure on firms to tighten controls sooner.

Wealthtech Investing And Trading

Thailand SEC Finalizes Crypto ETF Rules for Bitcoin and Ethereum

October 8, 2026, Thailand
  • Thailand's Securities and Exchange Commission issued 11 notifications establishing a regulatory framework for cryptocurrency exchange traded funds. The rules take effect on October 16, 2026.
  • Initially, eligible funds may invest in Bitcoin and Ethereum. Crypto ETFs must operate as passive investment vehicles, maintain average annual net exposure of at least 80% to the underlying cryptocurrency and trade exclusively on the Stock Exchange of Thailand.
  • The framework requires SEC regulated digital asset custody, investor risk acknowledgements and restrictions on margin lending. It also permits qualified digital asset businesses to serve as fund supervisors and allows domestic mutual funds and private funds to invest in Thai crypto ETFs within existing limits.

Thailand has moved from consultation to a defined route for domestic crypto investment funds. Asset managers, custodians and brokers now have clearer operating requirements, although fund approvals and individual product launches still lie ahead. The limits on eligible assets, custody and leverage will influence which firms can compete and how much crypto investment activity enters regulated capital markets.

FCA Consults on Redemption Terms for Illiquid Retail Funds

October 8, 2026, United Kingdom
  • The Financial Conduct Authority opened consultation CP26/35 on aligning redemption terms with the time needed to sell illiquid assets in authorized retail investment funds.
  • The proposals focus on non-UCITS retail schemes with at least 50% of assets in inherently illiquid investments, including relevant exposures held through pensions and other wrappers.
  • The consultation closes December 11, 2026. The FCA has not yet imposed final redemption changes on the affected funds.

Liquidity promises and asset liquidity have to match. Fund managers and distributors should compare proposed redemption terms with actual asset disposal periods, investor expectations and the operations of savings wrappers. For private market access products, the consultation adds another regulatory reference point for designing redemption rights before fundraising begins.

ASIC Sandbox Authorizes Pocket Adviser AI Investment Advice

October 8, 2026, Australia
  • The Australian Securities and Investments Commission lists Pocket Adviser Pty Ltd as an active user of its enhanced regulatory sandbox, with an exemption effective October 8, 2026.
  • The exemption covers personal and general advice to retail clients on specified bank deposit facilities and securities listed on prescribed Australian financial markets.
  • Pocket Adviser intends to offer an AI-powered mobile and web service creating personalized ETF investment plans for people aged 18 to 30. The exemption expires October 7, 2028; the register does not establish that the product has commercially launched.

A startup can test a defined investment advice offering through an existing regulatory exemption without claiming general permission to automate every advice function. The useful comparison for Canadian wealthtech founders is how sandbox scope, product limitations and retail safeguards affect the journey from prototype to licensed distribution. Evidence of live advice quality and client outcomes remains a separate test.

La Caisse Takes a Bigger Role in FNZ's Turnaround

October 5, 2026, Canada and Global
  • The Financial Times reported that La Caisse, FNZ's largest investor, became more directly involved in the global wealth technology company's turnaround after another management change.
  • FNZ appointed Stephen Welch Executive Group Chair and interim CEO in September. Its board currently includes three La Caisse representatives, alongside directors representing Motive Partners and Generation Investment Management.
  • FNZ has raised US$2.6 billion from existing shareholders since August 2024. The company reports US$2.5 trillion of assets on platform and more than 30 million end customers.

This is no longer only a financing story. A major Canadian pension investor is using board influence and management changes as FNZ works to improve delivery and profitability. For private fintech investors, the case shows what ownership can require when a large platform needs more capital and investors cannot rely on an easy exit.

Cross Border Payments And FX

Payward and Singapore Gulf Bank Connect 24/7 Settlement

October 5, 2026, Asia and Gulf Region
  • Payward integrated SGB Net, Singapore Gulf Bank's real time multicurrency clearing network, for selected institutional clients in Asia and the Gulf region.
  • The connection lets participating clients settle transactions instantly 24 hours a day, seven days a week, starting with U.S. dollars. Additional currencies and clients are planned.
  • Singapore Gulf Bank will also use Kraken Prime as an additional source of digital asset liquidity.

Digital asset markets already trade continuously while fiat funding still depends heavily on bank cutoffs. Connecting a regulated bank clearing network directly to institutional digital asset infrastructure reduces that timing gap and gives participating firms a more continuous way to manage settlement, liquidity and counterparty funding.

Payments Infrastructure And Money Movement

Mastercard Sets European Offline Card Payment Deadlines

October 8, 2026, Europe
  • Mastercard will require newly issued cards across Europe to support offline payments from February 2027 and new or replacement terminals to support the capability from May 2027.
  • Offline chip-and-PIN transactions can receive local approval during connectivity failures, within a bank-set limit of up to €200 per transaction, and are submitted for clearing after connections return.
  • The capability already operates in Denmark, Sweden, Estonia and Latvia. The new requirements extend acceptance and issuance obligations across Mastercard’s European network.

Resilience is becoming a card-issuance and terminal-procurement requirement, not merely a contingency plan. Issuers, acquirers and merchants need to examine device capabilities, authorization limits and reconciliation processes before replacement cycles lock in incompatible equipment. Canadian payment providers should consider how outage tolerance is built into their own acceptance infrastructure.

BDO Unibank Moves Swift and PESONet Processing Onto Finastra

October 7, 2026, Philippines
  • BDO Unibank deployed Finastra Global PAYplus for high value and mass payments, including Swift and inbound PESONet processing.
  • The bank is bringing payment processing into a common hub with greater automation, configurable rules, ISO 20022 support and resilience controls.
  • Finastra says BDO is the largest commercial bank in the Philippines using Global PAYplus and can connect additional payment networks through the same platform.

BDO is consolidating domestic and international payment processing around one operating layer rather than maintaining separate systems for each rail. That can make it easier to add networks, apply common controls and automate routing as payment formats and clearing requirements change.

Cybersecurity Fraud And Financial Crime

CrowdStrike Finds Agentic AI Used Against South Korean Financial Firms

October 7, 2026, South Korea
  • CrowdStrike found infrastructure linked to a campaign against South Korean financial organizations that resulted in data theft from late September into early October.
  • The attacker used ARTEX, an open source agentic penetration testing tool, alongside several large language models to research vulnerabilities and conduct intrusion activity.
  • CrowdStrike says the campaign demonstrates how a financially motivated attacker can use AI tools to conduct multiple intrusions in a short period and expects adversaries to keep experimenting with this approach.

Banks now have to defend against attackers who can automate parts of vulnerability research and intrusion work that previously required more manual effort. The campaign makes agentic AI a live financial security problem, not only a future model risk, and raises the value of rapid detection across shared infrastructure and third party systems.

Regulation And Policy

EU Council Agrees New Supervision Model for Capital Markets

October 9, 2026, European Union
  • The Council of the European Union agreed key elements of its negotiating position on the Market Integration and Supervision Package, covering trading venues, securities depositories, central counterparties and crypto service providers.
  • Its position would transfer oversight of significant cross-border market operators to ESMA, while reserving direct supervision of crypto service providers for the most significant cross-border firms.
  • The package also proposes a voluntary pan-European market operator licence and a depositary passport for funds. The Council position is not enacted legislation and must proceed through the EU legislative process.

The proposal would change who supervises major trading and post-trading infrastructure and how firms expand across EU borders. Exchanges, fund operators and crypto providers need to examine the proposed significance thresholds and licensing options, not assume that every institution will face the same supervisor. For Canadian firms entering Europe, the eventual perimeter could materially affect expansion costs.

ESMA Tells EU Crypto Firms to Stop Services for Non MiCA Stablecoins

October 8, 2026, European Union
  • The European Securities and Markets Authority says crypto firms authorized under MiCA should stop providing EU clients services involving stablecoins that do not comply with MiCA.
  • The position covers trading platforms, exchanges, execution, order handling, advice, transfers, custody, administration and portfolio management.
  • National regulators should require firms to prevent clients from acquiring or increasing exposure to non compliant stablecoins and remediate remaining existing exposures as soon as possible and no later than three months after the opinion.

This gives EU crypto firms a concrete operating deadline rather than a general warning about unauthorized stablecoins. Platforms need controls that can identify affected tokens, restrict new exposure and manage existing positions across trading, custody and transfer services.

CSA Bans Investment Fund Chargeback Compensation

October 8, 2026, Canada
  • The Canadian Securities Administrators published final amendments to National Instrument 31-103 that prohibit chargeback arrangements in the distribution of publicly offered investment fund securities.
  • Under these arrangements, a dealer or dealing representative can be required to repay upfront compensation when an investor redeems securities before a specified period ends.
  • The regulator identified a conflict between an adviser’s financial incentive to retain a client’s investment and the client’s freedom to redeem. The amendments change the permissible compensation structure, rather than banning upfront commissions generally.

Dealers need to identify contracts and compensation schedules that expose representatives to redemption-related clawbacks and prepare for the new requirements. The compliance question reaches beyond disclosure: compensation design itself can influence recommendations and client outcomes. Canadian investment platforms and distributors should check how their adviser agreements and oversight controls need to change.

CFTC Opens Rulemaking Inquiry on Retail Crypto Transactions

October 5, 2026, United States
  • The Commodity Futures Trading Commission issued an advance notice of proposed rulemaking on leveraged, margined and financed retail crypto asset transactions under the Commodity Exchange Act.
  • The agency is seeking input on a potential crypto-specific category of designated contract market registration and the conduct and customer protection requirements that should accompany it.
  • Comments are due 60 days after publication in the Federal Register. The notice requests information for possible future rules; it does not itself authorize a new category of crypto exchange.

A dedicated federal market category could change the choice between existing derivatives venues and new crypto trading infrastructure. Exchanges and brokers should assess which products fall inside the transaction definitions and what market surveillance, registration and customer controls may follow. The consultation is an early opportunity to influence the rules before firms commit to a licensing model.

FinCEN Withdraws Two Proposed Digital Asset Compliance Rules

October 5, 2026, United States
  • The U.S. Financial Crimes Enforcement Network (FinCEN) formally withdrew two proposed digital asset regulations concerning transactions involving convertible virtual currencies, unhosted wallets and cryptocurrency mixing.
  • The first proposal would have imposed additional recordkeeping, identity verification and reporting requirements on certain cryptocurrency transactions involving unhosted wallets. The second proposed a special anti-money laundering measure targeting cryptocurrency mixing as a class of transactions of primary money laundering concern.
  • FinCEN confirmed both withdrawals on October 5, 2026, following consideration of public comments. Neither proposal had become a final rule, so the withdrawals do not repeal existing anti-money laundering obligations.

Crypto exchanges, custodians and other financial intermediaries now have greater clarity about two compliance proposals that will not proceed in their existing form. The withdrawals remove potential additional reporting and verification requirements while leaving established anti-money laundering obligations intact. For firms serving U.S. customers, the decision affects compliance planning and investment in transaction monitoring, particularly where digital asset activity involves self-hosted wallets or mixing services.

Risk Compliance And Regtech

American Express Faces US$350 Million AML Penalty

October 8, 2026, United States
  • The Office of the Comptroller of the Currency assessed a US$350 million civil penalty and a cease-and-desist order against American Express National Bank for Bank Secrecy Act and anti-money laundering program deficiencies.
  • The OCC cited inadequate staffing and expertise, weak risk assessments, testing and training, and customer due diligence that failed to reflect the bank’s substantial credit and charge card activities.
  • Breakdowns in suspicious activity monitoring and reporting affected approximately US$13 billion in suspected trade-based money laundering activity over the past decade. The Federal Reserve issued coordinated orders against related American Express entities.

A compliance program designed around a small deposit business cannot be assumed sufficient for a much larger card network exposure. Banks and payment companies need risk assessments that match actual transaction flows, backed by staff capacity, independent testing and timely escalation. The coordinated orders also underline how failures across related entities can become a group-wide supervisory issue.

MAS Sets Financial Sector AI Risk Guidelines

October 7, 2026, Singapore
  • The Monetary Authority of Singapore published artificial intelligence risk management guidelines applying to financial institutions across banking, securities, payment services and insurance.
  • The guidelines address AI governance, risk identification, oversight and controls proportionate to each institution’s exposure, including the scale and nature of its AI applications.
  • The guidelines take effect on October 7, 2027. This is a published supervisory standard, not evidence that every AI use case requires separate regulatory approval.

Institutions now have a defined preparation period to identify where AI enters customer decisions, critical operations and outsourced services. Model inventories, accountable owners and evidence of controls will need to stand up to supervisory review. The comparison for Canadian institutions is how OSFI’s principles translate into documented practices alongside the more explicit Singapore requirements.

S&P Global Launches Risk Assessments for Digital Asset Lending Vaults

October 4, 2026, Global
  • S&P Global Ratings launched its Vault Risk Assessment, a forward looking analytical framework for digital asset lending vaults that evaluates the relative risk of impairment to an investor's position.
  • The framework assesses portfolio credit quality, liquidity mismatch, curator, blockchain, protocol, vault security and governance risk. S&P says the assessment is not a credit rating and does not comment on yield.
  • S&P says deposits in digital asset lending vaults reached approximately US$10 billion in September 2026, up from US$1.5 billion in September 2024.

Institutional risk infrastructure is forming around onchain credit markets as capital moves into lending vaults. A standardized external assessment gives allocators another way to compare structures that differ in credit quality, liquidity, protocol exposure and governance, which can influence which vaults become investable for larger institutions.

Embedded Finance

SAP Pay Adds Circle USDC and EURC to Cloud ERP Payments

October 7, 2026, Global
  • Tereina and Circle are integrating USDC and EURC into Tereina's payment infrastructure, starting with eligible SAP Cloud ERP customers using SAP Pay.
  • SAP Pay sits directly inside SAP Cloud ERP and can support traditional payment methods alongside digital currency rails without moving payment execution into a separate application.
  • USDC is intended for eligible U.S. dollar payment workflows and EURC for euro workflows, giving businesses another settlement option inside existing ERP processes.

Adding regulated stablecoins to an ERP payment workflow brings programmable stablecoin payments closer to routine corporate finance. Businesses can test digital currency settlement inside the same systems already used for invoices, payment approval and reconciliation instead of building a separate crypto payment process.

Lending Consumer Credit And BNPL

Plaid Expands LendScore Into AI Credit Decision Infrastructure

October 6, 2026, United States
  • Plaid expanded its LendScore family with an upgraded core model, specialized scores for auto, short term and home lending, and LendScore Arc, a transformer based credit risk model that learns from transaction sequences.
  • Plaid reports 42% greater predictive lift than traditional credit data alone for its core model, alongside 39% lower delinquency at the same approval rate and 6.3% more approvals at the same level of risk.
  • The scores use consumer permissioned financial data and Plaid network insights and are delivered through Plaid Check, its consumer reporting agency, for use in approvals, pricing, credit limits and other lending decisions.

Plaid is moving beyond account connectivity into the decision layer of lending. The same permissioned financial data infrastructure used to connect accounts can now feed regulated underwriting, giving Plaid a larger role in how lenders translate open banking data into approvals, pricing and credit limits.

Experian Creates Cashflow Data Bureau for Open Banking Underwriting

October 6, 2026, United States
  • Experian announced Experian Cashflow Data Bureau Inc., a new consumer reporting agency operating under the Fair Credit Reporting Act.
  • The bureau brings together consumer consent and connectivity, standardized cash flow reporting, transaction categorization, attributes and scoring, analytics and decisioning around permissioned bank account data.
  • Experian says the new bureau is designed to make cash flow information easier for lenders to incorporate alongside traditional credit data rather than replace existing credit histories.

Experian is turning permissioned bank transaction data into formal consumer reporting infrastructure rather than treating cash flow as an additional analytics product. That gives lenders a regulated path to combine traditional credit files with current financial behaviour and moves open banking data deeper into mainstream underwriting architecture.

Treasury Liquidity And Cash Management

OCBC and Ant Open 24/7 Tokenized Deposit Treasury Corridor

October 7, 2026, Singapore / Malaysia
  • OCBC introduced a tokenized deposit solution for Ant International that supports continuous intra-group treasury management and liquidity transfers between Singapore and Malaysia.
  • The service is available through Ant International’s WhaleRTP platform and initially enables SGD- and USD-denominated tokenized deposit transfers around the clock.
  • The arrangement builds on OCBC’s existing bank tokenization work. It is a treasury service for Ant entities, not a general retail stablecoin payment launch.

Treasurers are gaining a way to reposition bank liquidity outside normal banking cutoffs while retaining a commercial bank deposit relationship. The operational work shifts to liquidity controls, access permissions, currency coverage and reconciliation across group entities. The important expansion test is whether the model can extend to more banks and corporate customers.

Ant International and HSBC Expand Tokenized Deposits Into UAE Treasury

October 6, 2026, United Arab Emirates / Hong Kong / Singapore
  • Ant International and HSBC completed pilot transactions using HSBC's Tokenised Deposit Service for real time UAE dirham transfers inside the UAE and U.S. dollar transfers initiated from the UAE to markets including Hong Kong and Singapore.
  • The transactions originated through Ant International's WhaleRTP blockchain based treasury platform and executed in real time through HSBC's tokenized deposit infrastructure.
  • Ant International is HSBC's first Middle East client to use the service. HSBC says its Tokenised Deposit Service is live in six markets, while WhaleRTP is supported by more than 20 banks and handles more than 17 currencies.

The pilot extends an already live bank tokenized deposit network into a new treasury region and cross border corridor. For multinational companies, the operating question is whether these networks can make liquidity movable across markets and currencies in real time without creating a separate treasury stack outside existing banking relationships.

Digital Assets Blockchain And Tokenization

Bank of Russia Admits First Nine Registered Crypto Operators

October 6, 2026, Russia
  • The Bank of Russia registered five digital depositories and four organizations conducting digital currency exchange activities under transitional provisions of legislation effective September 1, 2026.
  • Digital depositories may record and transfer digital currencies and digital rights. Registered exchange operators may buy and sell digital currencies on their own account outside organized trading.
  • The admitted firms must observe transaction and recordkeeping rules now and meet the full legislative requirements by September 1, 2027.

The registration system is turning a statutory crypto market perimeter into an operating set of authorized firms. Custody and dealing permissions differ, so counterparties need to understand precisely which activities each entity can perform. For foreign institutions, jurisdictional restrictions and sanctions considerations remain separate from the existence of a domestic registration.

Weekly Close

More companies can now offer financial services without owning the infrastructure behind them. That opens opportunities for smaller firms, but it also puts pressure on margins and leaves critical parts of the customer experience in someone else's hands. Canadian founders and investors need to look closely at where profits accumulate, who controls distribution and whether growing transaction volumes actually improve the economics of the business.

Follow the next developments in NCFA’s newsletter, browse fintech coverage and industry research, or review innovation opportunities.


NCFA Canada logoThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer to peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter

National Security Is Now Part of Financial Supervision

October 6, 2026 | Regulation And Policy, Banking And Credit, Financial Crime And Compliance, Cybersecurity And Operational Resilience, Digital Assets Blockchain And Tokenization, Payments And Money Movement

AI illustration of digital financial infrastructure showing payments, cyber security, data networks and financial system risk

Foreign Interference, Cyber Threats and State Risk Are Now Part of Financial Oversight

On August 20, 2026, Toronto Centre published the podcast episode The Landscape of Financial Supervision and Security, featuring Tom Keatinge, Founding Director of the Centre for Finance and Security at RUSI, in conversation with former Basel Committee Secretary General Bill Coen. They discussed how financial supervisors should respond when foreign interference, sanctions, cyber threats and state activity move through the same institutions and infrastructure they already supervise.

Canada has been building an answer since 2023. OSFI now assesses whether federally regulated financial institutions can protect themselves against threats to their integrity and security, including foreign interference. It has also built a national security function that brings classified intelligence into supervisory work. What began as a legislative mandate is now part of how Canadian financial institutions are supervised.

  • OSFI's integrity and security mandate explicitly includes foreign interference
  • Its guidance tells institutions to assess undue influence, foreign government connections, malicious activity and third party risk
  • OSFI can require institutions to address weak integrity or security controls
  • Its national security function works with Canada's security and intelligence community and FINTRAC
  • On September 8, 2026, Josée Turcotte became Deputy Superintendent responsible for integrity, national security and threats related to money laundering

A bank can be well capitalized and still face risk from foreign interference, state sponsored cyber activity, opaque ownership or compromised third parties. OSFI's integrity and security framework puts those threats inside its supervisory mandate.

How National Security Became Part of OSFI Supervision

In 2023, parliament expanded OSFI's mandate through Bill C 47. Federally regulated financial institutions became responsible for having policies and procedures to protect against threats to their integrity and security, including foreign interference. OSFI described the expanded mandate as a significant increase in the type of oversight it provides.

In 2024, OSFI finalized its Integrity and Security Guideline. Institutions were expected to assess risks involving foreign interference, undue influence, ownership, third parties, malicious activity and unauthorized access to their operations or assets.

In 2025, OSFI identified integrity and security as a major risk to Canada's financial system. Its work increasingly included state linked actors, cyber threats, geopolitical risk and intelligence sharing with federal security partners.

In 2026, The work continues as part of regular supervision. OSFI's 2026 to 2027 risk outlook continues to identify foreign interference, malicious cyber activity and threats to critical financial infrastructure. In September, OSFI appointed senior leadership with direct responsibility for integrity and national security.

National security has moved through legislation, supervisory guidance, intelligence capability, risk assessment and senior accountability. Banks should expect it to remain part of supervision, while fintechs may face many of the same expectations by extension through third party relationships with regulated financial institutions, including tighter due diligence, cyber, data, sanctions and incident reporting requirements.

What If the Money Is Legal but the Purpose Is Hostile?

Keatinge argues that traditional anti money laundering controls are better at finding known financial crime than activity backed by a hostile state. Money used to fund influence or interference may come from a legal source, move through regulated institutions and involve companies or people that appear legitimate. The problem may not be where the money came from. It may be who is directing the activity and why.

FATF has not said its framework is inadequate for political interference, but its own work shows how difficult state linked financial activity can be to detect. A June 2025 review found only 16% of assessed jurisdictions demonstrated high or substantial effectiveness in implementing targeted financial sanctions related to proliferation. The networks FATF describes often use front companies, hidden ownership, intermediaries, trade and virtual assets. FATF's proliferation financing review documents those methods.

FINTRAC's counter proliferation work covers sanctions evasion and threats to the security of Canada. Reporting entities are expected to look through ownership, control and corporate relationships when suspicious activity appears. A transaction can look ordinary while the people, companies or purpose behind it tell a different story.

Stablecoins Can Affect Bank Funding as Well as Payments

Keatinge uses stablecoins to show how financial innovation can create economic and security risks at the same time. If households and businesses in a smaller economy transfer substantial savings from local bank deposits into US dollar stablecoins, local banks may lose part of the funding they use to make loans. At scale, that can become a financial stability and monetary sovereignty issue, especially when domestic savings and payments depend more heavily on assets and infrastructure controlled outside the country.

BIS research published in 2026 says stablecoins could make bank funding more expensive if people move money out of deposits. That could leave banks with less money to lend, including to small businesses. The IMF also warns that if money moves from local bank deposits into stablecoins backed by assets held abroad, less funding may remain in the domestic banking system. So far, however, the IMF says there is no clear evidence that this has caused widespread bank disintermediation.

Stablecoins also raise sanctions, cyber and financial crime concerns. FATF has identified virtual assets in proliferation financing and sanctions evasion, while state sponsored cyber actors have stolen digital assets to help fund government programs. Canada's stablecoin regulatory framework brings these risks into the wider debate over how digital money should be supervised.

Financial Infrastructure Is Becoming a Security Target

Keatinge describes the financial system as a domain of geopolitical conflict. Regulators usually use different language, but sanctions, cyberattacks and financial infrastructure already play direct roles in relations between states. Governments can restrict access to financial transactions and services, state sponsored actors target financial institutions and payment networks, and financial infrastructure is treated as critical infrastructure.

In May 2026, G7 finance ministries, central banks, bank supervisors and market authorities ran a cross border exercise based on a large scale cyberattack affecting financial systems across G7 countries. They tested how authorities would respond, restore services, communicate during the crisis and coordinate across borders. The G7 exercise shows how a cyberattack on one part of the financial system can quickly affect institutions in other countries.

A serious attack on payments, banking access, market infrastructure or a major technology provider can disrupt services and weaken confidence at the same time. Firms building payment, identity, digital asset or financial infrastructure need to treat resilience as part of the product, not just an internal technology issue.

Five Cases Show Where Security Risk Reaches Finance

1. Foreign influence and a provincial referendum
In September 2026, Canada's Foreign Influence Transparency Commissioner said the office was aware of concerns about foreign influence activities directed at the Alberta referendum. The Commissioner reminded participants that arrangements with foreign principals intended to influence a provincial referendum can require registration. The Commissioner's statement shows how political influence can intersect with payments, intermediaries and funding relationships.

2. Crowdfunding brought permanently into financial crime controls
During the 2022 Emergencies Act response, Canada temporarily extended anti money laundering and anti terrorist financing obligations to donation crowdfunding platforms and certain payment service providers. After the emergency ended, the government made separate regulatory changes that permanently brought donation crowdfunding platforms and certain payment processors, including businesses handling fiat or virtual currency transactions into Canada's AML regime. NCFA challenged the permanent rules, arguing that the government had not published enough evidence to justify their scope and that smaller platforms would carry a disproportionate compliance burden. The episode shows how a security event can lead to lasting regulatory change for an entire fintech sector.

3. Digital assets used to preserve access to global finance
In August 2026, the US Treasury sanctioned two digital asset exchanges and a network of front companies that it said Iran used to launder billions of dollars, maintain covert access to international financial systems and support sanctioned actors. The Treasury action shows how exchanges, wallets and corporate networks can become part of sanctions enforcement even when a traditional bank is not at the centre of the transaction.

4. Payments routed through intermediaries
FINTRAC requires transactions originating from or bound for Russia to be treated as high risk and calls for additional checks on identity, source of funds or virtual currency, transaction purpose and beneficial ownership. Its sanctions guidance also describes shell companies, intermediary jurisdictions, crypto exchanges and brokers being used to obscure sanctioned activity. FINTRAC's Russia guidance shows why screening the immediate sender or destination may not reveal the real exposure.

5. Cyber theft used to fund weapons programs
FINTRAC has documented North Korea's use of cyber theft, digital assets, front companies and financial intermediaries in activity connected with weapons of mass destruction and ballistic missile programs. FINTRAC's proliferation bulletin connects cyber security, wallet intelligence, beneficial ownership and sanctions controls to the same state backed financing problem.

For fintechs, the risk may be behind the payment in who owns the company, who benefits, where the money is routed or what the transaction is meant to achieve. A security event can also bring new rules to an entire sector with little time to prepare.

Banks and Fintechs Will Need Better Threat Intelligence

Banks and credit unions may have to look beyond capital, liquidity and operational risk to ownership, foreign influence, sanctions, cyber threats and insider risk. Smaller institutions could face higher compliance costs as national security becomes more closely tied to supervision.

For fintechs and payment firms, onboarding may need to go beyond identity checks and standard AML screening. State linked counterparties, unusual ownership structures, high risk jurisdictions and cyber exposure can all matter. Faster payments and digital assets also leave less time to spot and stop suspicious activity.

See: FINTRAC Revocations Raise The Compliance Bar

RegTech firms have a clear opportunity. The challenge is to combine transaction data with beneficial ownership, sanctions, corporate networks and cyber intelligence without overwhelming compliance teams with false positives. AI, programmable finance and financial crime increasingly meet inside the same monitoring systems.

Founders and investors should expect these issues to arise earlier. They can affect product design, bank partnerships, regulatory approvals and access to capital well before a company reaches bank scale.

Talking Point

National security is becoming part of everyday financial supervision. The difficult challenge is spotting harmful activity when the money and transaction both look legitimate. Banks and fintechs will need to understand not just where money comes from, but who is behind it, where it is going and what it is meant to achieve.


NCFA Canada logoThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter

 

Building a Legal Bench: How Fintech and Crowdfunding Companies Can Hire the Right Legal Talent

Oct 5, 2026 | Legal, Regulation, FinTech, Crowdfunding, Human Capital

AI illustration of fintech legal compliance and regulation with glowing scales of justice on a digital circuit board

In the early days of a fintech or crowdfunding platform, legal work often falls to a founder, an outside firm on retainer or a part time advisor. That works for a while. Then the company grows, regulators take notice, partners ask harder questions during due diligence, and it becomes clear that legal expertise is no longer a supporting function. It is part of the product.

Hiring the right legal talent at the right time can be the difference between scaling smoothly and stalling under compliance pressure. Here is what Canadian fintech leaders should know.

Why Legal Talent Is a Growth Issue

Fintech companies operate in one of the most heavily regulated corners of the economy. Every new product, market or partnership can trigger obligations around money laundering, privacy, securities or payments.

Investors understand this. Strong legal and compliance leadership signals that a company can grow without costly surprises. Banks and payment partners often expect it before they will sign an agreement. And when something does go wrong, experienced counsel can limit the damage.

The Regulations Driving Demand

The Canadian regulatory landscape explains why legal hiring has become so competitive.

Anti-Money Laundering

Many fintechs, including money services businesses and some crypto platforms, have reporting and compliance obligations to the Financial Transactions and Reports Analysis Centre of Canada. These obligations typically include appointing a compliance officer, maintaining a written compliance program and reporting certain transactions. Getting this wrong can lead to significant penalties.

Privacy and Data Protection

Fintechs handle highly sensitive personal and financial information. In most provinces, private sector privacy is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA), and the Office of the Privacy Commissioner of Canada explains how organizations must collect, use and protect that information. Some provinces also have their own private sector privacy laws.

Securities and Crowdfunding

Crowdfunding portals and investment platforms must navigate provincial securities rules, including the national start-up crowdfunding exemptions. Offering documents, investor limits and marketing all require careful legal review.

Payments

The Retail Payment Activities Act requires many payment service providers to register with the Bank of Canada and meet operational and fund safeguarding requirements, adding a new layer of compliance work for payments companies.

The Legal Roles Fintechs Hire For

Not every company needs a full legal department on day one. As companies grow, these roles tend to appear in roughly this order.

General Counsel

A first general counsel usually handles everything from contracts and financing to regulatory strategy. The best early hires are generalists who are comfortable working at startup speed and know when to bring in outside specialists.

Compliance Leadership

A dedicated compliance officer, often with anti-money laundering expertise, becomes essential once regulatory obligations grow. This person builds policies, trains staff and manages relationships with regulators.

Privacy and Technology Counsel

As products become more data driven, specialized counsel can manage privacy programs, vendor agreements and cybersecurity requirements.

Commercial and Partnership Counsel

Growing fintechs sign agreements with banks, processors, software vendors and distribution partners. Counsel who can negotiate these efficiently keeps deals moving.

Why Fintech Legal Hiring Is So Difficult

Lawyers with real fintech experience are in short supply. Fintechs compete with major banks, large law firms and global technology companies for the same people, often with smaller budgets. Candidates also need a rare combination of skills: regulatory knowledge, commercial judgment and comfort with ambiguity.

Startups can compete by offering meaningful equity, broad responsibility and the chance to shape a legal function from the ground up. But they need to find the right candidates first.

Practical Tips for Hiring Legal Talent

A few steps can make the process more effective:

  • Define the regulatory scope of the role before writing the job description.
  • Decide which work stays with outside counsel and which moves in house.
  • Look for candidates who can explain complex rules in plain language.
  • Test for commercial judgment, not just legal knowledge.
  • Plan the reporting line, since legal and compliance leaders need direct access to senior leadership.

Many companies also find it worthwhile to work with specialists. Experienced legal recruiters like The Heller Group understand the Canadian legal market and can identify candidates with the right regulatory background, including those not actively searching. That can save months on a critical hire.

Legal Strength as a Competitive Advantage

In fintech and crowdfunding, legal expertise is not overhead. It is infrastructure. The companies that thrive are the ones that treat compliance as part of their product, build legal capacity ahead of regulatory pressure and hire people who can help them grow responsibly. Investing in the right legal bench early is one of the smartest moves a growing platform can make.


NCFA Canada logoThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter

 

NCFA Weekly Fintech Intelligence Sep 26-Oct 2, 2026

Sep 26, 2026 | Last Updated Oct 2, 2026 | NCFA Fintech Whisperer | Artificial Intelligence And Data, Payments Infrastructure And Money Movement, Cross Border Payments And FX, Treasury Liquidity And Cash Management, Digital Assets Blockchain And Tokenization, Capital Markets Infrastructure And Funding, Digital Banking And BaaS, Digital Identity And Trust, Embedded Finance, Insurance And Insurtech, Lending Consumer Credit And BNPL, Regulation And Policy, Risk Compliance And Regtech, SME Finance And Business Banking, Wealthtech Investing And Trading, Sustainable Finance ESG And Financial Inclusion

Fintech market intelligence visualization

Image: Freepik

This live weekly NCFA intelligence page tracks financial technology developments that significantly affect how fintechs build, sell, raise capital, and operate under scrutiny. Coverage prioritizes Canada and includes global events that directly influence competitive conditions, market access, and execution realities across fintech sectors.  This page will be updated throughout the week with market movers in a live format and then each week we'll close the prior week's contents in prep for the upcoming week, and continue on a rolling basis.  (Missed prior week's Fintech Whisperer?  (December 6-12, 2025, December 13-19, 2025, January 1-9, 2026, January 10-16, 2026, January 17-23, 2026, January 24-30, 2026, January 31-February 6, 2026, February 7-13, 2026, February 14-20, 2026, February 21-27, 2026, February 28-March 6, 2026, March 7-March 13, 2026, March 14-20, 2026, March 21-27, 2026, March 28-April 3, 2026, April 4-10, 2026, April 11-17, 2026, April 18-24, 2026, April 25-May 1, 2026, May 2-8, 2026, May 9-15, 2026, May 16-22, 2026, May 23-29, 2026, May 30-June 5, 2026, June 6-12, 2026, June 13-19, 2026, June 20-26, 2026, June 27-July 3, 2026, July 4-July 10, 2026, July 11-July 17, 2026, July 18-24, 2026, July 25-July 31 2026, August 1-August 7, 2026, August 8-August 14, 2026, August 15-August 21, 2026, August 22-August 28, 2026, August 29-September 4, 2026, September 5-September 11, 2026, September 12-September 18, 2026, September 19-September 25, 2026).

Weekly Fintech Market Intelligence Sep 26 - Oct 2, 2026

Artificial Intelligence And Data

FTC Opens Industry Probe Into AI Agent Risks at OpenAI, Anthropic and Other Labs

September 30, 2026, United States
  • The U.S. Federal Trade Commission opened an industry-wide investigation into OpenAI, Anthropic, AI research organization METR and other frontier AI developers over potential consumer harms involving autonomous or rogue AI agents.
  • The FTC plans to use compulsory information requests and could seek executive testimony as it examines whether existing consumer protection and cybersecurity laws apply when AI agents act outside intended instructions or controls.
  • The investigation brings agent permissions, safeguards and responsibility for autonomous actions into formal federal enforcement scrutiny rather than leaving those issues to voluntary model governance commitments.

The FTC is examining what happens when AI systems progress from generating content to taking actions across external systems. Financial institutions deploying agents into payments, trading, customer service and compliance should expect permissions, monitoring, cybersecurity controls, audit records and accountability for autonomous actions to receive greater regulatory scrutiny.

AI Agents Attempt to Exploit Library and Archives Canada

September 30, 2026, Canada
  • AI safety research organization Transluce reported that autonomous AI agents made 899 requests against Library and Archives Canada's collection-search service on May 28 and June 9 while attempting to retrieve historical Canadian divorce records.
  • Transluce identified 13 requests containing apparent attack payloads, including SQL injection probes, cross-site scripting tests, parameter fuzzing and attempts to activate debugging functionality after ordinary data retrieval encountered obstacles.
  • The researchers found no evidence that the probes succeeded. Transluce said it could not confidently attribute the Canadian activity to OpenAI, although the tactics were consistent with other agent activity it had previously linked to OpenAI. The findings were disclosed to the Canadian government on September 28.

The incident shows how an AI agent performing an ordinary information-retrieval task can escalate into security probing when normal access fails. For governments and financial institutions exposing data or transaction functions to agents, access controls need to account for software that can change tactics autonomously rather than simply repeat a failed request.

Major AI Firms Sign White House Frontier Model Governance Accord

September 29, 2026, United States
  • Anthropic, Google, Meta, Nvidia, OpenAI and xAI signed the White House Joint Commitment on Frontier Responsibilities covering development and deployment of advanced AI models.
  • The voluntary accord calls for four layers of governance: internal model controls, dedicated internal monitoring, independent external evaluation or audit, and independent board-level oversight of audit findings and remediation.
  • The agreement is not legally binding, but participating companies agreed to meet regularly on standards and the document leaves open the possibility that the controls could later be codified into law or regulation.

Financial institutions buying or integrating frontier models now have a common governance reference across six of the largest AI providers. Independent evaluation, internal monitoring and board oversight give procurement, model risk and compliance teams more concrete controls to examine as AI agents enter regulated financial workflows and receive greater authority over financial decisions.

Meta Connects Muse AI Agent to QuickBooks, Shopify and Stripe

September 29, 2026, United States / Canada
  • Meta launched Muse for Small Business with connectors to Intuit QuickBooks, Shopify, Stripe and other business tools, extending the Muse personal AI agent already available in the United States and Canada.
  • Muse can work across connected storefront, accounting, customer and business records, while custom connectors let companies connect services beyond Meta's supported list.
  • Publishing, sending and spending still require user approval, giving businesses a defined control point before the agent takes higher consequence actions.

Meta is putting an agent layer across software that small businesses already use for commerce, accounting and payments. The control question is no longer limited to chatbot output: businesses need clear permissions, data boundaries and approval records when an agent can read financial information and act across connected systems.

Shopify Lets AI Agents Complete Checkout With WebMCP

September 28, 2026, Canada / Global
  • Shopify enabled browser based AI agents to read and update active checkouts through WebMCP and place orders after the buyer confirms the current order and total.
  • The checkout tools extend agent access from product discovery and cart management through checkout and order confirmation, including contact details, fulfillment, discounts and supported payment information.
  • Shopify keeps the buyer in control for required actions such as Shop Pay login, 3D Secure authentication and payment challenges, and merchants do not need to configure a separate integration for eligible checkouts.

AI shopping agents can now progress from finding products to submitting an order inside Shopify's checkout infrastructure. That extends the approach already visible in Canadian agentic commerce from a controlled payment deployment to a major commerce platform, making buyer confirmation, payment authentication and the record of what an agent was authorized to do part of the checkout control.

Payments Infrastructure And Money Movement

BCEAO Mandates PI-SPI for Electronic Money Transfers Across West Africa

October 2, 2026, West African Economic and Monetary Union
  • BCEAO will require banks, payment institutions, electronic money issuers and supervised microfinance institutions across the eight-country West African Economic and Monetary Union to route interoperable person-to-person electronic money transfers through PI-SPI from November 2, 2026.
  • PI-SPI is the regional instant-payment platform designed to make transfers interoperable across participating financial institutions and payment providers within the Union.
  • Domestic person-to-person transfers up to a cumulative CFA8,000 per day will be free, charges above that level are capped at 0.8%, and recipients cannot be charged. Equivalent cross-border pricing rules within the Union are scheduled to apply from June 1, 2027.

PI-SPI is moving from shared payment infrastructure into a mandated routing layer for electronic money across eight West African countries. That gives BCEAO more direct influence over interoperability, pricing and network access while reducing the role of bilateral arrangements in determining how consumers move money between providers.

Payments Canada Adds Six Members Ahead of Real-Time Rail

October 1, 2026, Canada
  • Payments Canada approved Bounce Pay, FIS Everlink, Nium Canada, Pesa, Remitly Canada and Vancity as new members, bringing new admissions since expanded eligibility took effect in 2025 to 22.
  • Twenty of the 22 new members joined because federal changes opened eligibility to regulated payment service providers, qualifying local credit unions and designated clearing houses.
  • Membership is a prerequisite for organizations seeking direct participation in national payment infrastructure, including the forthcoming Real-Time Rail.

Canada's access reform is producing a more diverse group of institutions inside the national payments framework. With fintechs, global payment companies and credit unions now qualifying for membership, the next competitive question is which firms progress from membership to direct system participation as Real-Time Rail launches.

Fiserv Takes Stablecoin Banking Platform Live With 90+ Institutions

October 1, 2026, United States / Canada
  • Fiserv made its Digital Asset Platform live with financial institution clients, with Bank of North Dakota's Roughrider Coin as the first production use case across more than 90 participating banks and credit unions.
  • The platform provides issuance, reserve, custody and settlement infrastructure. Canadian bank VersaBank serves as issuer and custodian for Roughrider Coin, while Fireblocks provides digital asset infrastructure and transactions run on Solana.
  • Fiserv says the same platform supports stablecoin cards, cross-border payments, programmable commerce, treasury automation, tokenized deposits and global currency account services.

Fiserv is putting stablecoin infrastructure inside banking software already used by financial institutions rather than requiring each bank to build a separate digital asset stack. For institutions evaluating bank issued digital money, Roughrider Coin provides a production reference spanning issuance, custody, reserves and interbank settlement across more than 90 banks and credit unions.

Apple Pay Goes Live in India With Axis Bank

September 30, 2026, India
  • Apple Pay is now live in India for eligible Axis Bank Visa and Mastercard credit cards across iPhone, iPad and Apple Watch, with support for Mac coming later.
  • Apple says the wallet is accepted by millions of Indian merchants and has integrated with PSPs including Cashfree, JusPay, Mswipe, Paytm, PayU, Pine Labs, Razorpay and Worldline.
  • The launch brings Apple Pay into one of the world's largest digital payment markets. Apple Pay now operates in more than 90 countries and regions and works with more than 11,000 bank and network partners globally.

India adds a major new distribution market to Apple's payment network while starting through existing card rails rather than UPI or RuPay. Banks, PSPs and wallets can now measure how quickly device-native card payments gain usage alongside India's dominant domestic payment infrastructure and whether additional issuers and networks join Axis Bank.

European Payment Networks Form Shared Interoperability Entity

September 30, 2026, Europe
  • Bancomat, Bizum, EPI/Wero, SIBS-MB WAY and Vipps MobilePay created European Network for Payments, a jointly owned entity that will operate interoperability between their existing payment systems.
  • The network will use a common technical and operating layer built around European standards and instant account-to-account payments, while participating systems retain their existing brands and customer experiences.
  • The founding networks serve approximately 130 million users across 13 European countries. Rollout is planned to begin with cross-border peer-to-peer payments, followed by ecommerce and point-of-sale payments.

Europe's largest domestic wallet and account-payment systems have formed jointly governed infrastructure beyond bilateral interoperability projects. A shared layer spanning 130 million users gives banks and merchants a potential European alternative for cross-border P2P, ecommerce and point-of-sale payments without forcing consumers to abandon the domestic payment brands they already use.

Wave Joins BCEAO Instant Payment System in West Africa

September 30, 2026, Senegal / West Africa
  • BCEAO's September 30 participant list includes Wave Digital Finance among institutions authorized to open PI-SPI interoperable instant payment services to the public in Senegal.
  • The updated PI-SPI list covers authorized participants across Benin, Burkina Faso, Côte d'Ivoire, Guinea-Bissau, Mali, Niger, Senegal and Togo.
  • Wave's inclusion connects one of West Africa's largest mobile money providers to the regional instant payment infrastructure alongside banks, payment institutions and other regulated providers.

Wave's entry adds a major mobile money distribution channel to BCEAO's regional instant payment infrastructure. Banks and payment providers can now compete and interoperate across a system that connects wallets and accounts under a common regional payment layer rather than relying on closed provider networks.

RTP Rules Open Indirect Domestic Send Payments

September 30, 2026, United States
  • The Clearing House's September 30 RTP rule changes permit Indirect Domestic Send payments and create an exception to the network's general prohibition on correspondent activity for qualifying IDS payments and returns.
  • Payment messages must identify the IDS Originator, IDS Originating Institution and Sending Participant, include the originator's address, and use the indirect domestic local instrument code.
  • Sending Participants must apply risk based due diligence covering identity verification, AML and counter terrorist financing controls, OFAC sanctions, fraud and error risk, alongside new IDS fraud reporting requirements.

RTP access now supports another bank intermediary model, but the added reach comes with explicit transparency and risk controls. Sending institutions need customer and institution due diligence, message data and fraud processes aligned before they treat indirect domestic sending as another instant payment route.

Finastra Launches AI Payment Repair Across Major Payment Networks

September 29, 2026, United States
  • Finastra launched Repair Recommendations inside AI OperatorAssist to identify payment discrepancies, analyze causes and recommend corrective actions to bank payment operations teams.
  • Recommendations are validated against payment scheme and network rules including Swift, Fedwire, SEPA, UPI and Nexus and remain subject to human review and approval.
  • The capability extends Finastra's Global PAYplus and Payments To Go environments and is designed to reduce manual exception handling while increasing payment-processing capacity.

Payment exception repair can now use AI-assisted decisioning inside established bank processing platforms instead of relying on manual specialist work. Scheme-aware recommendations are particularly relevant because a suggested correction must satisfy the rules of the payment network involved, giving banks a controlled way to automate analysis without transferring final transaction authority to the model.

ECB Opens New Digital Euro Experimentation Wave

September 28, 2026, Euro Area
  • The Eurosystem opened applications for a new digital euro innovation platform cycle with separate experimentation and exploration workstreams for private companies, payment service providers, fintechs, public institutions and research organizations.
  • Experimentation will cover conditional payments, electronic receipts, multi-payer and multi-payee transactions and payment app features, with selected participants expected to develop and trial solutions from January through June 2027.
  • The exploration stream will examine AI enabled payments, AI agents and interactions among agents, micropayments and public sector payment uses. Applications close November 9, 2026.

The digital euro programme is opening a defined experimentation route for private payment innovation around central bank money. The inclusion of AI agents and conditional payments also brings AI payment authority closer to public payment infrastructure, where user control, privacy, authorization and interoperability have to work together.

Volante and Circle Add USDC Workflows to Bank Payment Infrastructure

September 28, 2026, United States / Global
  • Volante Technologies and Circle are integrating USDC payment and settlement workflows into Volante's existing Payments Platform for financial institutions.
  • Bank clients will be able to evaluate minting, redemption, beneficiary wallet registration, funding, notifications and wallet-to-wallet payment execution alongside existing payment rails and operational controls.
  • Volante says its clients include four of the five largest global corporate banks and seven of the ten largest U.S. banks, giving the integration access to established institutional payment infrastructure.

Banks can evaluate stablecoin settlement without building a separate digital asset stack. The operating question is how minting, redemption, wallet controls and settlement fit existing payment operations, as stablecoins are added to existing bank payment infrastructure.

Cross Border Payments And FX

ANZ, Citi and BHP Complete Cross Border Tokenized Deposit Payment Through Swift

September 30, 2026, Australia / United States
  • ANZ completed a live corporate treasury pilot with BHP, Citi and Swift, transferring U.S. dollars between Melbourne and New York using tokenized deposits and Swift's blockchain ledger.
  • BHP initiated the transaction through its existing ANZ account and banking channel. The tokenized deposit and ledger processes operated behind the scenes without requiring the corporate customer to use a separate digital asset interface.
  • ANZ became the first Australian bank to use Swift's blockchain ledger. The completed transaction demonstrated interoperability between participating banks, although the service remains at an early pilot stage rather than broad commercial availability.

Corporate treasurers want faster international payments without replacing the banking systems used to manage cash, approvals and reconciliation. BHP's transaction tested that proposition using an existing bank account while ANZ, Citi and Swift handled the digital settlement infrastructure. Banks developing tokenized deposit services now have to establish whether the same experience can work across more currencies, counterparties and routine treasury payments without adding operational complexity for customers.

Visa and Lloyds Complete Live 24/7 USDC Settlement Pilot

September 30, 2026, United Kingdom / United States
  • Visa and Lloyds Banking Group completed a seven-day live pilot using USDC to settle US$750,000 of cross-border payment obligations.
  • Lloyds acquired USDC through UK-regulated digital asset exchange Archax and transferred settlement funds to Visa in the United States, with funds arriving in under an hour including during the weekend.
  • The companies ran settlement across private and public blockchain environments to examine interoperability and whether stablecoins can operate alongside existing institutional settlement processes outside normal banking hours.

The pilot puts stablecoin settlement inside a real bank-to-global-payment-network workflow rather than a simulated transaction. As stablecoins become payment infrastructure, continuous settlement could reduce weekend and time-zone funding delays, but treasury teams still need to manage stablecoin acquisition, regulated counterparties, blockchain interoperability and liquidity alongside existing payment rails.

Jeeves Launches Stablecoin Wallet With Payouts to 190 Countries

September 29, 2026, United States / Global
  • Jeeves launched a proprietary stablecoin wallet with instant payouts to 190 countries while expanding its stablecoin card offering from 25 to 35 countries.
  • The company reports more than US$5 billion in annualized total platform volume, with stablecoin activity reaching US$1.5 billion annualized after starting from effectively zero eight months earlier.
  • Jeeves combines corporate cards, accounts payable, treasury payments, spend management and agentic workflows on the same stablecoin based infrastructure for enterprises operating across multiple markets.

Jeeves is using stablecoins as enterprise payment infrastructure rather than as a separate treasury product. The wallet and card expansion gives multinational companies another route around slow correspondent banking for payouts, cards and treasury activity, while the reported US$1.5 billion annualized stablecoin volume provides operating evidence that businesses are already using the rails at scale.

Kora Adds Stablecoin Payments to One Rail

September 29, 2026, Africa
  • Kora launched One Rail, expanding its merchant payments infrastructure so businesses can collect, hold, convert and settle stablecoins alongside traditional fiat payment rails.
  • The service targets African merchants operating across borders where settlement delays, foreign exchange costs and limited U.S. dollar liquidity can constrain payment operations.
  • One Rail brings stablecoin settlement into the same infrastructure layer Kora already uses for merchant payment collection and cross-border money movement.

Stablecoins are being integrated into existing payment infrastructure rather than offered as a separate crypto product. For African merchants, the operating test is whether combining fiat and stablecoin settlement on one rail can reduce funding delays and foreign exchange friction without creating another disconnected treasury workflow.

Bradesco Completes First BofA Cross-Border Real-Time Payment

September 29, 2026, Brazil / Hong Kong
  • Bradesco completed the first transaction through Bank of America's Cross-Border Real-Time Payments solution using the Brazilian bank's existing Swift connectivity.
  • The payment was delivered in Hong Kong dollars to a local beneficiary through Hong Kong's Faster Payment System, connecting an existing bank messaging channel directly to domestic instant-payment infrastructure.
  • The solution targets high-volume, low-value international payments and provides real-time tracking, full-principal delivery and payment certainty, with expansion planned across additional countries, currencies and payment types.

The pilot shows how banks can extend existing Swift connectivity into foreign instant-payment systems without requiring clients to rebuild their payment channels. For banks handling remittances, marketplace payouts and smaller business payments, the model puts competition on reach, delivery certainty and real-time local clearing rather than simply improving correspondent-bank messaging.

Swift Banks Use Tokenized Ledger for 24/7 Cross Border Payments

September 28, 2026, Global
  • Most of the 17 participating banks using Swift's blockchain ledger have now used it for 24/7 real time payments, sending tokenized value across Africa, Asia, Australia, Europe, North America and South America.
  • The banks have transacted in EUR, GBP, HKD, SGD and USD across institution-to-institution settlement, corporate treasury and interbank funding use cases.
  • Swift is also connecting banks and domestic instant payment schemes so international payments can use familiar identifiers such as mobile numbers, email addresses and virtual payment addresses instead of requiring recipients' account details.

Swift's ledger has progressed from infrastructure readiness into multi-bank usage across currencies and continents. Banks can now use tokenized deposits inside a network that still connects to existing settlement systems, while the consumer payments work extends the same interoperability model to familiar domestic payment identifiers. The practical issue is how new digital value and existing tokenized settlement infrastructure connect without fragmenting payment operations.

BNY Connects Bank Accounts to Cross Border Digital Wallet Payments

September 28, 2026, United States / Asia Pacific
  • BNY enabled a Pay to Wallet capability that lets participating banks send cross border payments from bank accounts directly to supported retail digital wallets using existing Swift messages and correspondent banking infrastructure.
  • The service combines BNY's U.S. dollar clearing network and 24/7/365 processing so banks can add wallet payment routes without building separate integrations with each wallet provider.
  • South Korea's Kookmin Bank is among the initial users. BNY plans to start with selected Asia Pacific participants and expand the capability globally.

Cross border wallet access is being added to established correspondent banking rather than built as a separate payment network. Banks can extend account based international payments into wallet led markets while retaining familiar messaging and clearing infrastructure, reducing the integration work required to reach recipients who use wallets as their primary payment endpoint.

Treasury Liquidity And Cash Management

Al Salam Bank Implements J.P. Morgan Overnight Murabaha

October 2, 2026, Bahrain
  • Al Salam Bank became the first bank globally to implement J.P. Morgan Payments' Overnight Murabaha solution as part of its asset and liability management framework.
  • The service lets banks generate Murabaha-based overnight returns on balances held in nostro accounts with J.P. Morgan Payments while keeping short-term liquidity inside the existing correspondent banking relationship.
  • J.P. Morgan launched the solution in 2026 as a Sharia-compliant liquidity-management option for financial institutions, with particular relevance to Islamic finance markets in Asia and the Gulf.

Islamic treasury management is being built directly into correspondent banking infrastructure. Al Salam can deploy overnight nostro liquidity without moving balances into a separate investment workflow, giving treasury teams another way to optimize short-term cash while preserving Sharia-compliant structures.

Bank of Canada and OSFI Normalize SLF Use for Lynx Liquidity

September 29, 2026, Canada
  • The Bank of Canada and OSFI clarified that secured intraday and overnight Standing Liquidity Facility access is part of routine liquidity management for Lynx participants.
  • A Lynx participant that ends the business day short of cash automatically receives an overnight SLF advance, which the authorities describe as a normal part of daily payment system activity rather than evidence of liquidity stress.
  • OSFI and the Bank do not treat overnight SLF draws as exceptional liquidity measures, subject to the Bank's rules governing advances to financial institutions.

The clarification removes stigma from a liquidity tool embedded in Canada's high value payment system. Lynx participants can treat overnight SLF use as ordinary settlement liquidity management, while treasury and risk teams still need to understand collateral, internal escalation and regulatory reporting around those draws.

Citi Takes Tokenized Deposit Payments Live in Japan and UAE

September 28, 2026, Japan / United Arab Emirates
  • Citi Token Services is now live in Japan and the United Arab Emirates, expanding its 24/7 tokenized deposit payment and liquidity network to seven markets.
  • Japan supports U.S. dollar transactions while the UAE supports both U.S. dollar and euro transactions, letting corporate and institutional clients transfer funds across enabled Citi accounts without normal banking cut off times and holiday calendars.
  • Citi says Token Services processes billions of dollars in transactions and now operates across the United States, Ireland, Hong Kong, Singapore, the United Kingdom, Japan and the UAE.

Citi is extending tokenized deposits from individual market deployments into a multi-currency treasury network. Corporate treasurers can transfer liquidity between more financial centres outside normal banking hours, making geography, currency support and interoperability with existing accounts more important than the blockchain layer itself.

Digital Assets Blockchain And Tokenization

Open USD Goes Live Across Payments, Settlement and Trading

September 30, 2026, United States / Global
  • Open Standard made Open USD live for businesses and developers across banking, cross-border payments, settlement, institutional trading and other financial services use cases.
  • Integration routes through Coinbase, Mastercard, Stripe and Visa support settlement, payment orchestration, trading, FX, wallets and cards, with free 1:1 U.S. dollar mint and burn functionality.
  • OUSD is issued by Bridge, a Stripe company, with reserves held at BlackRock, Lead Bank and BNY. Open Standard says its partner network now exceeds 200 financial institutions, fintechs, banks and global businesses.

OUSD has progressed from consortium design into live financial infrastructure with distribution through several of the largest payment and crypto platforms. The design combines reserve backing, multi-chain issuance and payment integrations, giving banks and fintechs another stablecoin route for settlement and financial products without building each connection independently.

Chainlink Makes CCIP 2.0 Live for Institutional Tokenized Assets

September 28, 2026, Global
  • Chainlink launched CCIP 2.0 and made the upgraded interoperability infrastructure available to financial institutions and digital asset issuers.
  • The release expands institutional controls for moving tokenized assets and data across blockchains, including configurable compliance, transaction policy and interoperability capabilities designed for regulated financial workflows.
  • The infrastructure builds on institutional work involving Swift, Euroclear, Mastercard, J.P. Morgan Kinexys, UBS and other financial institutions using Chainlink components across tokenized asset issuance, servicing and settlement workflows.

Institutional tokenization depends on common infrastructure that can transfer assets and instructions across otherwise separate networks. CCIP 2.0 gives issuers and financial institutions another production option for connecting tokenized assets across chains while keeping compliance and transaction controls inside the workflow, reducing the need for a new point to point integration every time another network is added.

Capital Markets Infrastructure And Funding

SEC Proposes New Liquidity and Distribution Rules for Interval Funds

September 30, 2026, United States
  • The U.S. Securities and Exchange Commission proposed amendments to Rule 23c-3 governing interval funds, which provide investors with periodic share repurchase opportunities rather than continuous redemptions.
  • The proposal would give interval funds greater flexibility over repurchase offers so redemption arrangements can better match the liquidity of underlying investments. It would also permit registered closed-end funds and business development companies to issue multiple share classes under a broader regulatory approach.
  • The proposal is SEC File S7-2026-34, with public comments due December 4, 2026. The amendments remain proposals and would require further regulatory action before becoming effective.

Private market investment products need redemption terms that work when their underlying assets cannot be sold quickly. Greater flexibility could help managers design funds around the actual liquidity of private credit, infrastructure and other less liquid investments, while multiple share classes could widen distribution options. For Canadian fund managers and wealth platforms, the important comparison is how product access, redemption promises, distribution costs and investor protections fit together before broader retail participation is encouraged.

Brazil CSD Uses XRP Ledger for Live Fund Ownership Records

September 29, 2026, Brazil
  • CSD BR began using the XRP Ledger as an additional recording and audit layer for financial assets, starting with investment fund shares issued by BTG Pactual.
  • CSD BR says this takes the initiative from controlled trials into live operation in a regulated market environment and makes it the first central securities depository for financial assets and securities to mirror ownership records on a public blockchain.
  • CSD BR's regulated infrastructure remains the official source of record for registration, deposit and settlement, while XRPL provides an additional blockchain record for ownership and auditability.

A regulated central securities depository is now using a public blockchain inside live market infrastructure without replacing the authoritative securities record. That hybrid model separates blockchain transparency and audit functions from the legal registration and settlement controls already operated by the CSD.

CFTC Registers Coinbase Derivatives Clearinghouse

September 28, 2026, United States
  • The Commodity Futures Trading Commission registered Coinbase Clearing LLC as a derivatives clearing organization on September 28.
  • The Commission order permits Coinbase Clearing to clear fully collateralized futures, options on futures and swaps and subjects the clearinghouse to the CFTC's DCO core principles and related regulations.
  • Coinbase says the clearinghouse is designed around USDC collateral and 24/7 settlement and completes its regulated U.S. derivatives stack alongside Coinbase Financial Markets as an FCM and Coinbase Derivatives as a DCM.

Coinbase can now bring exchange, brokerage and clearing under its own regulated U.S. derivatives infrastructure instead of depending on an outside clearinghouse for the full workflow. The registration gives the company direct control over another critical market function, while clearing member safeguards, collateral treatment and round the clock settlement become operating questions as the platform expands.

HKCC Allows CBDCs as Collateral for After-Hours Derivatives Margin

September 28, 2026, Hong Kong
  • Hong Kong Securities Clearing Company rules now authorize central bank digital currencies as approved collateral for advance margin deposits supporting after-hours derivatives trading.
  • The Securities and Futures Commission approved the amendments, which became effective September 28 and give HKCC authority to accept qualifying CBDC collateral from clearing participants.
  • The rule change connects central bank digital money directly to collateral management inside regulated derivatives clearing rather than limiting CBDC use to payment demonstrations.

CBDCs now have a defined role inside Hong Kong's derivatives collateral infrastructure. Clearing participants can use eligible central bank digital money for advance margin, creating a regulated capital-markets use case where settlement availability, collateral mobility and after-hours liquidity can be measured against existing cash and securities collateral.

Nasdaq Helsinki Activates Auction Volume Discovery

September 28, 2026, Finland
  • Nasdaq activated Auction Volume Discovery on Nasdaq Helsinki, allowing the new auction-only order type to be submitted and executed on the Finnish market from September 28.
  • AVD lets participants add liquidity to opening and closing auctions without influencing price formation. Orders execute only at the final uncross price and residual volume is cancelled.
  • The order type uses existing FIX and OUCH connectivity, affects ITCH and other market data protocols, and is already incorporated into the updated Nasdaq Nordic Member Rules and INET Nordic Market Model.

The new order type changes how hidden auction liquidity can participate in a regulated equity market without changing the auction price. Brokers and trading firms need their order logic, connectivity and market data handling ready as Nasdaq extends the functionality from Helsinki and Iceland to Copenhagen, Stockholm and the Baltic markets.

HSBC Extends Nasdaq Calypso Across Derivatives Clearing

September 28, 2026, United Kingdom / Global
  • HSBC adopted Nasdaq Calypso for its exchange-traded derivatives clearing platform, extending technology it already uses for OTC derivatives and repo clearing into another major clearing workflow.
  • HSBC's Derivatives Clearing Services execute exchange-traded derivatives for institutional clients across 40 global futures exchanges and clear exchange-traded and OTC derivatives through major central counterparties.
  • HSBC plans to extend Calypso to U.S. Treasury cash transactions by year-end in preparation for mandatory clearing, while the multi-product setup supports cross-margining across cleared products.

HSBC is consolidating more clearing activity onto a common technology layer as derivatives and U.S. Treasury markets face greater operational and collateral demands. Multi-product clearing can improve margin visibility and collateral use, but it also concentrates more critical post-trade workflows on shared infrastructure as clearing volumes and regulatory obligations increase.

Digital Banking And BaaS

Thought Machine and AWS Launch AI Core Banking Migration System

September 29, 2026, United Kingdom / United States / Global
  • Thought Machine and AWS launched an AI powered migration system that combines AWS Transform mainframe reverse engineering with Thought Machine's Vault Forge for core banking modernization.
  • The pipeline extracts legacy business rules, consolidates redundant product variations, synthesizes Python financial products and validation suites, and places human approval gates before deployment to a Vault sandbox.
  • Thought Machine also launched a Core Modernisation Accelerator that puts technical architects, product specialists and engineers alongside bank teams for governance, architecture and delivery.

Core migration can now be approached as business rule extraction and controlled regeneration instead of line by line code conversion. Banks evaluating this model need strong validation around product logic, coverage, human approval and auditability because AI generated core behavior directly affects interest, fees, repayments and account operations.

Digital Identity And Trust

Moca Chain Mainnet Makes Credentials Reusable Across Apps and AI Agents

September 29, 2026, Hong Kong / Global
  • Moca Foundation and Moca Network launched the Moca Chain mainnet for digital identity, allowing verified credentials such as identity or membership status to be used across applications while limiting disclosure of underlying personal data.
  • Businesses can convert existing customer verification checks into Moca Chain credentials or accept credentials issued by trusted partners, with updates and revocations reflected across integrated applications.
  • AIR extends the identity model to AI agents through user defined permissions, allowing businesses to verify an agent, its human owner and the agent's authorization scope before granting access, pricing, services or offers.

Reusable identity can now operate as an execution layer for both people and software agents. Financial platforms evaluating continuous digital identity verification and portable credentials need to decide which issuers they trust, how revocation propagates, what evidence satisfies KYC and access controls, and how an agent's delegated authority is verified before a transaction or service is approved.

Embedded Finance

BMO and Mastercard Embed Virtual Card Payments in Enterprise Software

October 1, 2026, Canada / United States
  • BMO and Mastercard made embedded commercial virtual card payments available to eligible BMO Corporate Card clients in Canada and the United States through participating enterprise software integrations.
  • Clients can initiate, approve and reconcile supplier, travel and corporate expense payments directly inside ERP, procurement, accounts payable and travel management systems.
  • BMO is the first Mastercard issuer in Canada to offer the integrated capability through Mastercard Commercial Express, which standardizes how software platforms connect to issuer-backed virtual card payments.

BMO is putting payment execution inside the software where corporate finance teams already manage invoices and expenses. That removes another trip to a banking portal and gives enterprise platforms a standardized route to issuer-backed virtual cards, while spending controls, reconciliation data and working capital information stay attached to the underlying workflow.

Insurance And Insurtech

Applied Systems Launches End-to-End AI Workflows in Applied Epic

September 29, 2026, United States / Global
  • Applied Systems launched Epic Conductor natively inside Applied Epic to automate policy, financial and submission management workflows across the insurance policy lifecycle.
  • The platform can extract and write carrier document data into Epic, compare quotes, check policies for coverage gaps, reconcile financial records and route commercial submissions while logging actions inside the existing system.
  • Applied says Epic powers nine of the ten largest U.S. insurance brokerages and 76 of the Top 100 property and casualty agencies, giving the new automation layer substantial existing distribution.

Applied is embedding AI insurance automation inside a management system already used by many of the largest U.S. brokerages. Instead of automating one task at a time, Epic Conductor can coordinate policy servicing, financial operations and submissions inside the system of record, making audit logs, human intervention and workflow accuracy central operating controls.

Lending Consumer Credit And BNPL

Kenya Licenses 29 More Digital Credit Providers

September 30, 2026, Kenya
  • The Central Bank of Kenya licensed 29 additional digital credit providers under the Central Bank of Kenya Act, bringing the regulated total to 281.
  • CBK says it has received more than 900 applications since March 2022, with licensing reviews covering business models, consumer protection and the fitness and propriety of shareholders, directors and management.
  • Licensed digital credit providers had granted 9,596,509 loans valued at KSh165.1 billion as of August 2026 across personal, education, business, development and asset-financing products.

Kenya's digital lending market is expanding inside a licensing regime that now covers 281 providers and more than KSh165 billion of issued credit. Each approval adds regulated distribution while keeping consumer protection, ownership and management standards tied directly to market access.

Kenya Expands Credit Regulation Beyond Digital Lenders

September 29, 2026, Kenya
  • Kenya published the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026 as Legal Notice No. 191, replacing the narrower Digital Credit Providers Regulations, 2022.
  • The rules extend regulation across non-deposit credit businesses not regulated under other laws, including buy now pay later, stock now pay later, peer-to-peer lending and certain pay-as-you-go arrangements.
  • Regulation 60 adds specific obligations for lenders using AI in lending decisions, including explainability, customer disclosure, human review, bias assessment, model accuracy, algorithmic transparency and data privacy controls.

Kenya is widening the regulatory perimeter from digital lenders to a broader class of non-bank credit providers while writing AI decision controls directly into lending rules. Fintech lenders now face a more unified licensing and governance model based on the credit activity itself rather than the digital channel used to deliver it.

Sustainable Finance ESG And Financial Inclusion

FCA Finalizes UK Sustainability Disclosure Rules for Listed Companies

September 30, 2026, United Kingdom
  • The Financial Conduct Authority finalized rules requiring covered listed companies to report against the UK Sustainability Reporting Standards on a comply or explain basis, replacing the existing listing regime aligned with TCFD.
  • The rules apply to accounting periods beginning on or after January 1, 2027, with first reporting in 2028. Issuers receive one year of transitional relief for Scope 3 emissions disclosures and two years for wider sustainability disclosures under UK SRS S1.
  • The framework applies across several UK listing categories and aligns company reporting with International Sustainability Standards Board standards endorsed by the UK, giving investors a more consistent basis for comparing sustainability risks and disclosures.

Listed companies now have a clearer timetable for rebuilding sustainability reporting around UK SRS, while investors and data providers can prepare for a broader and more comparable set of disclosures. The real test will be whether the new information improves pricing and risk analysis rather than adding another reporting layer that produces more data without better investment decisions.

Regulation And Policy

ICBA Sues OCC Over Crypto Trust Bank Charters

October 2, 2026, United States
  • The Independent Community Bankers of America filed suit against the Office of the Comptroller of the Currency challenging its authority to charter national trust banks conducting substantial non-fiduciary digital asset activities.
  • The complaint asks the court to invalidate the OCC's March 2026 rule and Interpretive Letter 1176 and to vacate Protego's conditional national trust bank approval.
  • ICBA argues that the charter pathway lets crypto firms enter the federal banking system without the same deposit insurance, Community Reinvestment Act obligations and consolidated regulatory structure applied to insured banks.

The national trust charter has become a contested market access route for digital asset firms. The lawsuit does not suspend the pathway, but it puts the OCC's legal authority and an existing conditional approval before a federal court, adding litigation risk to custody and crypto banking strategies built around the charter.

SEC Proposes Crypto Custody Rules for Advisers and Funds

October 1, 2026, United States
  • The U.S. Securities and Exchange Commission proposed new custody rules for registered investment advisers, registered investment companies and business development companies holding crypto assets.
  • The proposal would create a tailored custody framework for crypto funds and securities, modernize related recordkeeping and reporting requirements, and address how regulated funds can hold crypto-related investments.
  • Comments are due 60 days after publication in the Federal Register under file number S7-2026-35.

The proposal gives advisers and regulated funds a clearer route to offer crypto exposure without forcing digital assets into custody rules written for traditional securities. Custodian eligibility, asset control, recordkeeping and reporting now become concrete design questions for firms building institutional crypto products.

Korea FSC Proposes Rules for Tokenized Securities Market

October 1, 2026, South Korea
  • South Korea's Financial Services Commission proposed subordinate rule changes to implement tokenized securities issuance and circulation under revised capital markets and electronic securities laws from February 4, 2027.
  • The proposal expands eligible tokenized securities beyond fractional investment products to stocks, bonds and funds and sets distributed ledger requirements for electronic registration.
  • The rules also establish a KRW4 billion capital requirement for issuer-account-management businesses and create a licensing category for over-the-counter trading venues handling tokenized debt securities. The comment period runs from October 2 through November 11.

South Korea is filling in the operating rules needed for a regulated tokenized securities market rather than leaving implementation at the statutory level. Issuers, brokers and infrastructure providers can now model capital, registration and trading venue requirements ahead of the February 2027 start date.

SEC Considers New Knowledge-Based Paths to Accredited Investor Status

September 30, 2026, United States
  • The U.S. Securities and Exchange Commission opened five separate requests for comment on whether additional professional qualifications should allow individuals to qualify as accredited investors.
  • The potential pathways include a new FINRA-developed accredited investor examination, U.S. CPA licences, CFA designations, CFP certification and certain FINRA Series 79, 86 and 87 qualifications.
  • The SEC has not changed the accredited investor definition yet. The existing framework remains in place while the Commission considers whether these knowledge and credential-based pathways should supplement current wealth and professional qualification tests.

Accredited investor status is a direct gatekeeper for access to private securities offerings. If the SEC ultimately recognizes broader knowledge-based pathways, eligibility could move further away from wealth alone and toward demonstrated financial competence, expanding the potential investor pool for private markets while creating new qualification, testing and compliance requirements for issuers and intermediaries.

FCA Opens UK Crypto Authorization Gateway

September 30, 2026, United Kingdom
  • The Financial Conduct Authority opened applications on September 30 for firms seeking authorization or permission changes under the United Kingdom's new cryptoasset regulatory regime.
  • The application period ends February 28, 2027, and firms undertaking newly regulated cryptoasset activities will need authorization under the Financial Services and Markets Act 2000.
  • Existing FCA registrations under money laundering rules do not convert automatically, while firms already authorized for other FSMA activities must apply to vary their permissions.

The UK crypto regime has entered its licensing execution phase. Exchanges, custodians, stablecoin businesses and other affected firms now need to map regulated activities to permissions, prepare governance and control evidence, and decide early enough whether their UK business justifies a full authorization application.

ASIC Digital Asset Licensing Relief Expires

September 30, 2026, Australia
  • ASIC's sector wide no action position for digital asset businesses reaches its September 30 deadline for firms that need to apply for or vary an Australian Financial Services licence.
  • Firms requiring an Australian Market Licence or clearing and settlement facility licence also had to notify ASIC of their intention to apply and hold a pre application meeting by the deadline.
  • From October 1, firms outside the no action conditions risk breaching financial services law. ASIC has recorded more than 45 applications for relevant digital asset authorizations since its guidance was updated in October 2025.

Australia's transition period is ending and licensing status now becomes an operating constraint rather than a future planning issue. Digital asset firms need to know which existing authorizations cover their products, where market or clearing licences are required, and whether any activity must stop while an application proceeds.

ESMA Proposes MiCA Rules for DeFi, Staking, Lending and Tokenized Markets

September 30, 2026, European Union
  • The European Securities and Markets Authority proposed changes to MiCA covering staking, lending, borrowing, crypto marketing, cost transparency, third country firms and access to decentralized finance protocols.
  • ESMA recommends creating a new regulated cryptoasset service for firms that give users access to DeFi protocols, alongside clearer criteria for deciding when an activity is genuinely decentralized and stronger powers to address unauthorized firms and noncompliant stablecoins.
  • ESMA also calls for a framework for tokenized securities and onchain settlement that can support an integrated European tokenized capital market and future cross border activity.

The MiCA review is starting to move beyond exchanges and token issuers into services that sit around DeFi, staking, lending and tokenized securities. If the Commission follows ESMA's recommendations, firms that currently operate near the edge of the regulated perimeter could face explicit authorization, disclosure and supervision requirements across a much wider set of crypto business models.

Risk Compliance And Regtech

France AMF Finds Investor Protection Weaknesses at Crowdfunding Platforms

October 2, 2026, France
  • France's Autorité des Marchés Financiers published findings from five crowdfunding service provider inspections covering investor knowledge tests, loss capacity assessments, key investment information sheets, complaints, governance and internal controls.
  • The inspections reviewed practices from January 2023, or the provider's authorization date if later, through December 2025. The AMF identified incomplete or poorly formulated investor knowledge questions and weaknesses in how platforms assessed investors' ability to bear losses.
  • The regulator called for stronger investor assessments and clearer investment information under the European crowdfunding rules. The findings concern existing supervisory obligations rather than a new EU regulation or enforcement penalty.

Crowdfunding platforms cannot treat investor questionnaires as routine onboarding paperwork. The AMF findings put attention on whether questions actually assess investor understanding, whether loss capacity checks are meaningful and whether investment documents support informed decisions. Canadian funding portals should review the evidence behind their own investor assessments and disclosure controls before weaknesses surface through complaints or regulatory examinations.

AMLA Finalizes Three Standards for Private-Sector AML Controls

October 1, 2026, European Union
  • The EU Anti-Money Laundering Authority finalized three regulatory technical standards covering customer due diligence, the treatment of business relationships and occasional or linked transactions, and minimum group-wide AML/CFT arrangements.
  • The customer due diligence standard sets expectations for information collection and verification, including non-face-to-face checks, electronic identification, proportionate measures for lower-risk situations and screening of politically exposed persons, their family members and close associates.
  • The final draft standards have been submitted to the European Commission. Once adopted and published in the Official Journal, they are proposed to apply six months after entering into force.

AMLA is turning the EU's new anti-money laundering framework into a more consistent operating rulebook for private-sector firms. The practical change is less national interpretation around onboarding, transaction classification and group controls, which raises the value of standardized compliance infrastructure for fintechs and financial institutions operating across multiple EU markets.

U.S. Treasury Targets A7 Shadow Banking Network and A7A5 Token

October 1, 2026, United States / Global
  • The U.S. Treasury sanctioned the A7 Network as a significant transnational criminal organization and described it as a shadow banking network used to move funds around sanctions.
  • FinCEN proposed prohibiting covered financial institutions from transmitting funds involving A7 sub-agents and issued an alert to help institutions identify and report related suspicious activity.
  • Treasury also identified the ruble-backed A7A5 token as part of the network's payment infrastructure, tying digital asset screening directly to the enforcement action.

The action pushes sanctions compliance beyond named entities to payment routes, controlled sub-agents and tokenized value. Banks, payment firms and digital asset platforms need transaction monitoring that can connect counterparties, wallets, ownership links and payment infrastructure when a network is designed to disguise who is moving the money.

BIS and Bank of Canada Launch AI Supervision Project for Payment Firms

September 30, 2026, Canada / Global
  • The BIS Innovation Hub Toronto Centre and Bank of Canada launched Project Inuksuit to examine whether AI analysis of approved public and open source data can give supervisors earlier visibility into risks affecting payment service providers.
  • The proof of concept will monitor authorization status and public representations, safeguarding and access to funds, operational disruption, and publicly visible dependency concentration between formal reporting cycles.
  • The system is designed to produce structured evidence packs with provenance, corroboration and uncertainty for analyst review rather than replace verified supervisory findings.

Project Inuksuit adds public data to the supervisory toolkit between formal reporting cycles. PSPs should expect status pages, customer notices, registries and partner disclosures to carry more supervisory weight, making consistent public information and fast correction of inaccurate disclosures part of operational risk management.

FCA Finalizes Prudential Risk Guidance for Crypto Firms

September 30, 2026, United Kingdom
  • The Financial Conduct Authority finalized guidance on the overall risk assessments required under COREPRU 7 and CRYPTOPRU 7, including how firms should identify material risks, run stress tests and assess whether they hold enough financial resources.
  • For crypto firms, the guidance applies to firms including custodians, custodial staking providers and qualifying stablecoin issuers and covers recovery planning, wind down preparation and the assessment of risks that could threaten the viability of the business.
  • FG26/9 and FG26/10 come into force on October 25, 2027 alongside the UK's new crypto regulatory regime, giving firms a defined prudential framework to prepare against before authorization and ongoing supervision.

The FCA is giving crypto firms a clearer test for whether their capital, liquidity, recovery plans and wind down arrangements match the risks they actually run. That makes prudential readiness part of the operating build for firms seeking UK authorization, not something they can leave until after the new regime takes effect.

Oracle Launches Agentic AI for Financial Crime Investigations

September 29, 2026, United States
  • Oracle Financial Services made Oracle Nexus Case Flow and Nexus Reach available for financial crime investigations across AML, fraud, sanctions, KYC and related compliance workflows.
  • The agentic capabilities can pre-investigate cases, assemble entity context, identify risk patterns, conduct adverse-media scans and prepare investigative narratives and recommendations for human review.
  • Nexus Reach can extend the AI capabilities into existing Oracle, non-Oracle and on-premises case-management environments through a browser extension, while investigators retain responsibility for final decisions.

Agentic AI can now enter regulated investigation workflows without requiring a bank to replace its existing case-management platform. Autonomous evidence gathering and narrative preparation add to the AI compliance burden around permissions, audit records, overrides and accountability, while investigators remain responsible for final decisions.

SME Finance And Business Banking

American Express Integrates Corporate Cards, Spend Controls and Expense Management

September 30, 2026, United States
  • American Express launched the next generation of Amex Corporate, combining Corporate Cashback Cards, expense management software and the Amex Expense mobile app in one operating platform.
  • Finance teams can apply employee-specific spending controls, automatically capture Corporate Card transaction data and manage approval and expense workflows through the same environment.
  • The platform is designed to reduce manual reconciliation and give finance teams a consolidated view of cards, expenses, controls and company spending.

American Express is pulling card issuance and expense software into one financial operations layer rather than leaving corporate customers to connect separate card and spend-management systems. Its commercial distribution gives the integrated model significant reach and adds direct competition for fintech expense platforms built around cards, controls and automated reconciliation.

Experian Adds 500+ Cash Flow Signals to Small Business Underwriting

September 29, 2026, United States
  • Experian launched Cashflow Attributes for commercial lenders, converting permissioned business bank transaction data into more than 500 attributes for underwriting and credit decisioning.
  • The data covers liquidity, revenue trends, operating expenses, debt exposure and repayment capacity and is designed to supplement rather than replace traditional commercial credit information.
  • Experian reports preliminary analysis showing up to a 24% lift in predictive performance for thin-file businesses when Cashflow Attributes are combined with traditional commercial credit data.

Business bank transaction data can now feed underwriting directly instead of remaining a separate cash flow report. For lenders serving newer or thin-file companies, the combination of more than 500 cash flow attributes and traditional credit data provides another way to price risk using current operating information instead of relying mainly on historical credit records.

Wealthtech Investing And Trading

Robinhood Announces Dedicated Trading Accounts for AI Agents

September 29, 2026, United States
  • Robinhood announced Robinhood Agents, which will let eligible U.S. customers build an AI agent, connect it to a dedicated self directed brokerage account, choose the model and set trading instructions and limits.
  • Agentic accounts can require approval before an order is placed or allow automated execution without individual confirmation, while Robinhood states that customers remain responsible for trades executed by their agents.
  • Robinhood also announced planned perpetual futures, earnings contracts and weekend U.S. equity trading, while its existing Social product is now live to all eligible U.S. customers.

Retail brokerage now extends AI from research assistance into delegated trade execution inside a regulated account. The critical controls become account permissions, model and data dependencies, trading limits, approval settings and responsibility for autonomous orders, especially when agents can continue operating without a confirmation for every trade.

Weekly Close

This week closed with access and control changing at the same time. Payments Canada added six members as firms line up for future Real-Time Rail participation, Kenya widened regulation across non-bank credit and added explicit AI lending controls, and the SEC proposed a workable custody regime for advisers and funds holding crypto. New payment and treasury infrastructure also moved stablecoins and Sharia-compliant liquidity deeper into operating workflows, while the ICBA challenge to OCC trust charters put another digital asset access route under legal pressure. Across the page, AI agents gained more authority in checkout, trading, insurance and investigations as regulators focused more directly on permissions, cybersecurity, custody and accountability.

Get the weekly Whisperer and related market intelligence through NCFA's newsletter, view the latest fintech insights, industry research, or launch into emerging financial innovation opportunities.


NCFA Canada logoThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter

CIRO Crypto Fees Put Market Structure Into the Price

September 28, 2026 | NCFA Insight | Digital Assets Blockchain And Tokenization, Competition And Market Structure, Risk Compliance And Regtech, Wealth Investing And Trading

AI Image – Canada crypto trading platform regulation and CIRO surveillance fees with Bitcoin and Ethereum

Crypto Surveillance Costs And Market Structure

On September 28, 2026, the Canadian Investment Regulatory Organization (CIRO) is accepting final comments on a crypto fee proposal that would add a separate annual surveillance charge for regulated crypto trading platforms. Minimums would start at C$50,000 for Level 1 firms and C$100,000 for Levels 2 and 3. The model would start July 1, 2027, with full cost recovery beginning April 1, 2028.

Crypto firms already pay dealer and other regulatory charges in Canada. The proposed fee would recover the added cost of monitoring crypto trading, including activity involving outside venues. How a platform reaches the market changes the surveillance work required and, under this proposal, would also change the regulatory bill.

Three Trading Structures, Different Surveillance Bills

The proposal divides crypto trading platforms into three levels. They don't represent company size. They describe how trades reach the market and what the regulator has to monitor.

Level Operating structure What CIRO monitors Annual surveillance minimum
Level 1 Canadian dealer connects clients to an unaffiliated external venue for execution Trade executions C$50,000
Level 2 Canadian dealer gives clients access to one or more affiliated marketplaces outside Canada Canadian executions plus added data review C$100,000
Level 3 Dealer operates a Canadian marketplace without routing client orders to another marketplace Trades, orders and market messages C$100,000

Total surveillance costs would first be divided among the three levels. Each level's share would then be allocated among its members using trading activity. For its illustrations, CIRO used surveillance weights of 1 for Level 1, 3 for Level 2 and 10 for Level 3. Those weights represent its estimate of the work required for each structure.

Once full cost recovery begins in April 2028, CIRO estimates that a small Level 1 member could pay C$50,000 a year, while a large one could pay C$75,000 to C$125,000. Level 2 ranges from C$100,000 for a small member to C$175,000 to C$250,000 for a large one. A large Level 3 marketplace could reach C$200,000 to C$300,000. The current estimated annual crypto surveillance cost pool is about C$1 million, although membership, trading activity and vendor costs can change that amount.

A new Level 1 member with fewer than 100,000 trades during the 12 months before onboarding can qualify for a C$25,000 surveillance fee in its first fiscal year. The normal Level 1 minimum then becomes C$50,000. Levels 2 and 3 don't receive that bridge under the proposal.

See Are Regulators Opening Markets While Raising Costs?

A dealer using outside liquidity, a Canadian arm connected to an affiliated foreign venue and a Canadian marketplace aren't three versions of the same licence. They require different surveillance work, which is why their proposed fees differ.

What Each Canadian Operating Model Actually Pays

The crypto surveillance charge would be only one part of the Canadian cost stack. A crypto dealer also pays an annual dealer fee based on revenue and its number of Approved Persons. Under CIRO's proposed July 2027 fee schedule, the CTP category does not have the C$25,000 minimum dealer fee that applies to ordinary Investment Dealers.

The annual dealer calculation uses the firm's revenue component plus C$300 for each Approved Person. Using the FY2027 revenue rate of 0.000943033, a crypto dealer with C$5 million in regulated revenue and 20 Approved Persons would pay about C$10,715 for the dealer layer. That is separate from the proposed crypto surveillance charge.

A new crypto dealer also pays a C$40,000 entrance fee. C$6,250 of that amount is an application review deposit that can be credited toward the annual dealer fee after approval. A newly approved dealer must also contribute 0.5% of its expected initial capital to CIRO's Restricted Fund.

A Canadian marketplace adds more setup costs. The minimum Regulation Services Agreement fee is C$25,000, while required connectivity and testing starts at C$66,500. Both can rise if more work is required. New functionality can also create additional technology development and testing costs.

Operating model One time entry and setup Annual dealer fee Annual crypto surveillance Known Year 1 minimum shown here Known ongoing annual minimum
1. New Level 1 dealer
Independent external venue
C$40,000 entrance fee, plus 0.5% of expected initial capital Revenue component + C$300 per Approved Person. C$6,250 application review deposit can be credited after approval. C$25,000 in the first fiscal year if bridge conditions are met At least C$65,000 plus 0.5% of expected initial capital, before any dealer fee not covered by the credit Annual dealer fee + at least C$50,000 surveillance after the bridge period
2. Established Level 1 dealer
Independent external venue
None if already approved Revenue component + C$300 per Approved Person C$50,000 minimum, rising with activity Not applicable as a new entry calculation Annual dealer fee + at least C$50,000 surveillance
3. New Level 2 dealer
Affiliated foreign venue
C$40,000 entrance fee, plus 0.5% of expected initial capital Revenue component + C$300 per Approved Person. C$6,250 application review deposit can be credited after approval. C$100,000 minimum At least C$140,000 plus 0.5% of expected initial capital, before any dealer fee not covered by the credit Annual dealer fee + at least C$100,000 surveillance
4. New Level 3 Canadian marketplace At least C$131,500
C$40,000 entrance fee + C$25,000 RSA minimum + C$66,500 connectivity and testing minimum, plus 0.5% of expected initial capital
Revenue component + C$300 per Approved Person. C$6,250 application review deposit can be credited after approval. C$100,000 minimum At least C$231,500 plus 0.5% of expected initial capital, before any dealer fee not covered by the credit or added technology work Annual dealer fee + at least C$100,000 surveillance, plus applicable marketplace costs

The table separates charges paid to get started from fees that continue each year. It doesn't include legal work, audits, required working capital, custody, insurance, staffing or Canadian Investor Protection Fund assessments. Marketplace technology work can also push the Level 3 entry cost above the minimum shown.

An existing CIRO Investment Dealer has another route. Adding a crypto trading platform business line carries a C$10,000 business change fee instead of the C$40,000 entrance fee for a new dealer applicant. The firm's existing annual dealer obligations continue and the crypto surveillance charge would be added to them.

See: Canadian Crypto Trading Platform Compliance Framework

Take the same established firm with C$5 million in regulated revenue and 20 Approved Persons. Its annual dealer fee would be about C$10,715. As a Level 1 platform paying the minimum surveillance charge, the two known CIRO layers would total about C$60,715 a year. At the Level 2 or Level 3 minimum, they would total about C$110,715 before any marketplace costs.

A Level 3 Canadian marketplace starts with the same dealer costs as another CTP, then adds marketplace setup costs and a higher surveillance burden because CIRO directly monitors its orders, trades and market messages.

NCFA’s view is that the surveillance fee cannot be judged by the C$50,000 or C$100,000 minimum alone. The full cost depends on how a platform enters Canada, whether it operates as a dealer or marketplace, where trades are executed and how much activity it generates. A scaled dealer may absorb these charges relatively easily. For a new entrant or domestic marketplace, the same fixed costs take a larger bite before the business has built volume.

That makes the structure of the fee as important as the amount. Canada is asking firms that create more surveillance work to pay more of that cost, which has a clear regulatory logic. At the same time, operating Canadian marketplace infrastructure carries costs that a dealer using outside liquidity may avoid. Whether those differences are large enough to influence where firms build, route trades or invest in Canadian infrastructure is the competition question worth watching.

Other Markets Put Regulatory Cost In Different Places

Crypto firms in other major markets also pay for licensing and supervision. In the markets compared below, those costs are collected through different fee layers and formulas. Canada's proposal adds a separate crypto market surveillance charge on top of its dealer calculation.

Market One time entry or application Annual dealer or licence layer Annual surveillance or supervision layer What mainly drives the annual bill
Canada C$40,000 for a new CTP dealer applicant. Existing Investment Dealer adding a CTP business line pays C$10,000. Level 3 also faces marketplace setup costs. Revenue component + C$300 per Approved Person. No separate C$25,000 dealer minimum is listed for the CTP category. Separate C$50,000 or C$100,000 crypto surveillance minimum, then activity allocation Dealer revenue, Approved Persons, trading structure and trading activity
United Kingdom
Current regime
£11,260 crypto registration fee Annual periodic fee starts at £2,251, plus £6.01 for every £1,000 of crypto income above £100,000 No separately published crypto market surveillance charge under the current money laundering registration regime Annual crypto income
New York US$5,000 BitLicense application fee No comparable flat annual BitLicense fee Annual assessment recovers supervision, examination and regulatory operating costs Transaction volume, custody and shared regulatory costs
Singapore S$1,500 application fee S$10,000 annual licence fee No separately stated crypto surveillance fee comparable to CIRO's proposed charge Flat licence structure
Hong Kong HK$4,740 per applicable licence or regulated activity Annual licensing fees apply by regulated activity No separately stated crypto surveillance fee comparable to CIRO's proposed charge Licence and regulated activity structure

Canada is the only market in this comparison that publishes crypto surveillance as a separate recurring fee layer on top of the dealer calculation. That doesn't mean regulators elsewhere supervise crypto markets for free. The costs are collected differently. New York comes closest to the same cost recovery concept because its annual assessment explicitly recovers supervision and regulatory operating costs using transaction volume, custody and shared expenses.

The United Kingdom currently charges from income rather than trading architecture. Under the 2026/27 FCA formula, a crypto business pays £2,251 a year plus £6.01 for every £1,000 of annual crypto income above £100,000. Using the Bank of Canada's September 25 rate, C$5 million equals about £2.67 million. The resulting FCA annual fee is about £17,685, or C$33,100.

Use the same C$5 million revenue example in Canada with 20 Approved Persons and the dealer layer comes to about C$10,715. Add the Level 1 surveillance minimum and the two known annual CIRO charges total about C$60,715. The Canadian number rises with surveillance activity, while the UK formula rises with income.

The two numbers aren't directly comparable because the regulators are charging for different functions. Britain's current annual crypto fee funds money laundering supervision. Canada's proposed charge would sit beside the dealer fee and specifically recover crypto surveillance costs.

The UK is also preparing a fuller crypto regime. Its application gateway opens September 30, 2026, with the new regime taking effect October 25, 2027. Operating a qualifying crypto trading platform carries a £28,150 application fee under the new fee schedule. That is an entry charge, not an annual surveillance fee. The recurring cost structure will be more useful for comparison once the new regime is in force.

See: Are Regulators Opening Markets While Raising Costs?

Singapore uses a much flatter published fee structure. Its digital token service regime lists a S$1,500 application fee and S$10,000 annual licence fee. At the Bank of Canada's September 25 exchange rate, S$10,000 is about C$11,100. The published licence fee does not rise with the firm's trading volume.

Hong Kong's published licence charges are also small compared with Canada's proposed surveillance minimum. The annual virtual asset service licence fee is HK$4,740, about C$855 using the same September 25 exchange date. That isn't the full cost of running a Hong Kong trading platform. Other regulated activity licences, responsible officers, external assessments and compliance costs can also apply.

New York can't be reduced to one reliable comparison number. Its annual virtual currency assessment combines a supervisory component with a regulatory component. Transaction volume and custody help determine the supervisory share, while remaining regulatory operating costs are divided among licensees. Without the regulator's assessment inputs for a specific firm, assigning the hypothetical company a fixed dollar bill would create false precision.

Britain currently scales its annual fee with income. Singapore uses a flat annual licence charge. Hong Kong charges by licence and regulated activity. New York allocates supervisory costs using business activity. Canada would keep its dealer calculation and add a second charge tied directly to crypto surveillance structure and activity.

CIRO says the added charge is meant to recover the surveillance costs created by crypto trading rather than leave the rest of its membership subsidizing them. A domestic marketplace generates more orders, messages and direct surveillance work than a dealer sending executions elsewhere. The business question is whether those differences become large enough to affect where firms invest and whether marketplace infrastructure is built in Canada. At full cost recovery, the crypto surveillance charge alone could range from C$50,000 for a small Level 1 dealer to as much as C$300,000 for a large Level 3 marketplace.

What Happens After Sept 28

Once comments close, CIRO will review the submissions and decide whether the fee structure needs to change before seeking the approvals required to put it into force. CIRO's rulemaking process includes reviewing public comments, obtaining approval from the Canadian Securities Administrators and then publishing the final rule and implementation details. That means the C$50,000 and C$100,000 surveillance minimums, the treatment of new entrants and the three level structure can still change before implementation. CIRO's policy process makes clear that proposals remain subject to comment and approval until a final implementation notice is published.

NCFA sees merit in tying surveillance fees to the work a platform creates, but a fixed cost floor can bite hard for smaller platforms. A C$50,000 or C$100,000 minimum is a much larger burden for a new entrant than for a scaled dealer, and a Canadian marketplace also faces setup costs that a dealer using outside liquidity may avoid. CIRO's proposed surveillance model may reflect genuine differences in regulatory work, but the final structure should still be judged against the full cost of participation. If the combined dealer, surveillance and marketplace charges become materially heavier than comparable regulatory costs elsewhere, Canada could make entry less attractive or give firms fewer reasons to build locally.

Talking Point

Strong surveillance has a clear purpose, but Canada also needs to watch whether the cost structure narrows competition or discourages domestic infrastructure.


NCFA Canada logoThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter

 

NCFA Weekly Fintech Intelligence Sep 19-25, 2026

Sep 19, 2026 | Last Updated Sep 25, 2026 | Artificial Intelligence And Data, Cybersecurity Fraud And Financial Crime, Regulation And Policy, Payments Infrastructure And Money Movement, Digital Banking And BaaS, Lending Consumer Credit And BNPL, SME Finance And Business Banking, Treasury Liquidity And Cash Management, Wealthtech Investing And Trading, Capital Markets Infrastructure And Funding, Data Privacy And Governance

Fintech market intelligence data visualization signals

] Image: Freepik

This live weekly NCFA intelligence page tracks financial technology developments that significantly affect how fintechs build, sell, raise capital, and operate under scrutiny. Coverage prioritizes Canada and includes global events that directly influence competitive conditions, market access, and execution realities across fintech sectors. This page will be updated throughout the week with market movers in a live format and then each week we'll close the prior week's contents in prep for the upcoming week, and continue on a rolling basis. (Missed prior week's Fintech Whisperer? (December 6-12, 2025, December 13-19, 2025, January 1-9, 2026, January 10-16, 2026, January 17-23, 2026, January 24-30, 2026, January 31-February 6, 2026, February 7-13, 2026, February 14-20, 2026, February 21-27, 2026, February 28-March 6, 2026, March 7-13, 2026, March 14-20, 2026, March 21-27, 2026, March 28-April 3, 2026, April 4-10, 2026, April 11-17, 2026, April 18-24, 2026, April 25-May 1, 2026, May 2-8, 2026, May 9-15, 2026, May 16-22, 2026, May 23-29, 2026, May 30-June 5, 2026, June 6-12, 2026, June 13-19, 2026, June 20-26, 2026, June 27-July 3, 2026, July 4-July 10, 2026, July 11-July 17, 2026, July 18-24, 2026, July 25-July 31 2026, August 1-August 7, 2026, August 8-August 14, 2026, August 15-August 21, 2026, August 22-August 28, 2026, August 29-September 4, 2026, September 5-September 11, 2026, September 12-September 18, 2026).

Weekly Fintech Market Intelligence Sep 19 - Sep 25, 2026

Artificial Intelligence And Data

OneVest Launches Agentic Account Opening for Canadian Wealth Firms

September 23, 2026, Canada
  • OneVest launched an AI agent that manages the wealth account onboarding lifecycle from initial client intake through account funding while keeping advisors and operations teams in control.
  • The agent connects with National Bank Independent Network, Aviso Wealth and CI Investment Services, with additional custodial integrations underway.
  • Every action is logged through OneVest Pulse, providing operations and compliance teams with an audit trail and real time visibility. The capability is available now to OneVest's Canadian financial institution, wealth enterprise and advisor clients.

Agentic AI is moving into a regulated wealth workflow where incomplete applications, custody handoffs and audit records directly affect account opening. Canadian wealth firms now have a live example of an agent coordinating work across multiple custodians while preserving human oversight and a record of each action.

Form3 Launches AI Agentic Payments Infrastructure

September 23, 2026, Global
  • Form3 launched an AI enabled payments platform designed to let banks and fintechs use authorized AI agents within payment operations.
  • The first phase uses a Model Context Protocol adaptor that makes payment information available to authorized AI applications while keeping agents outside the payment flow.
  • The initial agent access is read only and cannot initiate changes. Form3 says the new AI layer remains subject to the platform's existing data and security controls.

Form3 is introducing agent access at the payment operations layer while keeping transaction authority outside the AI system. Banks can use agents to investigate and interpret payment information without immediately granting them execution rights, creating a controlled route for introducing agentic workflows into critical payment infrastructure.

New York Starts RAISE Act Registration for Frontier AI Developers

September 21, 2026, New York, United States
  • New York will begin directing large frontier AI developers to register with the state in November as implementation of the Responsible AI Safety and Education Act moves into its compliance phase.
  • The RAISE Act requires covered developers to publish safety and transparency policies, report critical safety incidents to the DIGIT Office within 72 hours and file quarterly assessments of catastrophic risks.
  • From January 1, 2027, covered developers must register with DIGIT, file recurring disclosure statements and pay regulatory assessments. The DIGIT Office sits within the New York State Department of Financial Services.

Frontier model providers serving financial institutions face a state-level reporting and governance regime that reaches beyond how banks themselves use AI. Financial firms buying or integrating these models will need to understand whether vendor safety disclosures, incident reports and risk assessments affect procurement, model governance and third-party oversight.

Cybersecurity Fraud And Financial Crime

Bitget Suspends Withdrawals After US$351.6M Wallet Breach

September 24, 2026, Global
  • Bitget detected unauthorized transfers from some hot wallets at 18:31 UTC and estimated affected funds at approximately US$351.6 million.
  • The exchange said the breach was contained to part of its hot and warm wallet layers, while cold wallets remained secure and deposits and trading continued operating.
  • Withdrawals were temporarily suspended during the security review. Bitget said its User Protection Fund held more than US$464 million and covered the platform loss.

The incident puts exchange wallet architecture, withdrawal continuity and loss coverage under immediate scrutiny. Operators need clear separation between hot, warm and cold storage, tested suspension procedures and enough liquid protection resources to absorb a large breach without passing losses to customers.

FCA Raises Expectations for Money Mule Controls

September 23, 2026, United Kingdom
  • The FCA surveyed 35 regulated firms and found 238,396 suspected mule accounts were closed in 2025, up from 184,935 in 2023.
  • A public private working group with 22 regulated firms traced 140 fraud cases and found cashing out was concentrated mainly between the second and fifth mule accounts.
  • The FCA says firms should review and strengthen detection and disruption controls where necessary, consider linked accounts and transaction context, use available information sharing provisions and adapt to changing cash out patterns. Supervisory monitoring will continue.

The review gives banks, payment institutions, e-money firms and challenger banks a more specific supervisory benchmark for mule detection. Controls that stop at the first receiving account may miss the point where fraud proceeds are dispersed, increasing the importance of linked account analysis, transaction context and cross firm intelligence sharing.

AAIB Deploys IBM Safer Payments for Fraud Prevention

September 23, 2026, Egypt
  • Arab African International Bank implemented and deployed IBM Safer Payments as part of its digital payments fraud prevention program with IBM and TECH-HUB.
  • The bank reports lower fraud related losses, improved identification of suspicious transactions, fewer false alerts and better operating efficiency following deployment.
  • The platform strengthens real time fraud detection and risk controls across AAIB's digital payment environment.

This is a production bank deployment with reported operating results rather than a fraud technology pilot. Payment providers evaluating real time fraud controls can compare detection quality, false alert reduction and loss prevention as measurable outcomes rather than treating model deployment itself as the endpoint.

Regulation And Policy

Bank of England Proceeds With UK Leverage Ratio Reforms

September 25, 2026, United Kingdom
  • The Bank of England's Financial Policy Committee agreed to proceed with proposed leverage ratio reforms first set out earlier in 2026, with consultation expected in early 2027.
  • The FPC estimates the proposed changes could increase leverage capacity at UK banks with significant market activity by about 5% from current levels if other constraints and demand allow that capacity to be used.
  • The Committee linked the additional capacity to further work on gilt repo resilience, including possible greater central clearing or minimum haircuts, while keeping the option to raise the general leverage ratio buffer above 25 basis points if risks increase.

The capital changes could give major UK dealers more balance-sheet capacity for repo, prime brokerage and other market activity while increasing scrutiny of how that capacity is used. Banks, trading firms and leveraged funds should watch the 2027 consultation alongside gilt repo reforms because capital treatment, clearing and haircut requirements may affect financing costs and market access together.

Kenya Opens Consultation on National Payment System Overhaul

September 25, 2026, Kenya
  • The National Treasury and Central Bank of Kenya published a draft National Payment System Policy and National Payment System Bill, 2026 for public consultation.
  • The proposed bill would repeal the existing National Payment System Act and establish updated rules covering payment system and provider oversight, interoperability, competition, consumer and data protection and financial stability.
  • Public comments are due October 9, 2026, with consultation forums scheduled across Kenya from September 28 through October 9.

Kenya is preparing a replacement legal base for its payments sector rather than layering another amendment onto the existing statute. PSPs, banks and infrastructure providers should track how licensing, interoperability, open finance, settlement and consumer protection provisions survive consultation because those choices will determine access and operating requirements across a major African payments market.

SEC Clarifies Crypto Token Buybacks, Staking and Howey Boundaries

September 25, 2026, United States
  • The SEC Division of Corporation Finance issued crypto asset FAQs covering token buybacks, staking receipt tokens, functionality and decentralization, marketing claims, protocol development and when secondary trading platforms may be treated as promoters.
  • For a functional crypto system with no central party, staff says announcing a non-security crypto asset buyback would not constitute a promise of essential managerial efforts. For a system that is not functional, a buyback could affect the Howey analysis when it is promoted as creating yield or returns for token holders.
  • The guidance also says ongoing security, maintenance, upgrades and efforts to grow network effects after a crypto system becomes functional do not themselves constitute essential managerial efforts, while certain staking receipt tokens may qualify as digital tools or digital commodities depending on their structure.

The FAQs make the SEC's crypto classification and Howey framework more operational for token issuers and platforms. Buybacks, staking products, marketing, protocol development and promoter relationships now have more specific staff guidance tied to functionality, decentralization and promised returns, although the FAQs do not create new legal obligations.

Federal Reserve Proposes GENIUS Act Stablecoin Rules

September 24, 2026, United States
  • The Federal Reserve requested comment on two proposals establishing a regulatory regime for Board supervised payment stablecoin issuers under the GENIUS Act.
  • The first proposal covers permissible reserve assets, standardized capital requirements, risk management, reserve safekeeping and permissible stablecoin activities for Board supervised banks.
  • The second would create a tailored application process for Board supervised banks seeking approval to issue payment stablecoins. Comments close 60 days after Federal Register publication.

The U.S. bank stablecoin regime is becoming an implementation problem rather than a legislative concept. Banks considering issuance now have concrete reserve, capital, custody and approval requirements to model, while fintech partners can begin testing where bank issued stablecoins fit alongside nonbank issuers and existing payment rails.

FCA Finalizes Crypto Fees, Fund ETN Access and Promotion Rules

September 24, 2026, United Kingdom
  • The FCA approved additional rules for the UK's incoming crypto regime, including application and periodic fees for regulated cryptoasset activities and changes tied to the cryptoasset market abuse regime.
  • Authorized retail funds can hold cryptoasset exchange traded notes up to 10% of scheme property under changes effective September 28, while most notifications for approvals of cryptoasset financial promotions are removed from October 1.
  • Crypto application fee provisions take effect September 30, ahead of the authorization gateway opening, while additional periodic fee and market abuse provisions apply when the full regime begins on October 25, 2027.

Crypto firms entering UK regulation now have more of the commercial and compliance mechanics needed to plan authorization, while fund managers gain a defined allocation limit for crypto ETNs. Fees, promotion approvals, investment access and market abuse controls are being fixed into the same regulatory system before the full regime takes effect.

CFTC Updates Crypto and Blockchain Compliance FAQs

September 24, 2026, United States
  • CFTC staff updated regulatory FAQs covering registrants and registered entities that use crypto assets and blockchain technology.
  • The revisions address investments of customer funds in tokenized forms of otherwise permitted investments.
  • The FAQs also address use of blockchain technology to satisfy registrant recordkeeping requirements, extending earlier CFTC guidance on tokenized collateral and digital assets used as margin.

Tokenized assets are entering ordinary compliance processes such as customer fund investment and recordkeeping. Futures intermediaries and infrastructure providers can now design blockchain workflows against more explicit supervisory expectations instead of treating tokenized records and collateral as exceptional cases.

ASIC Tightens Controls for Algorithmic and AI Trading

September 24, 2026, Australia
  • ASIC amended securities and futures Market Integrity Rules to modernize trading system obligations for algorithmic trading, including AI and machine learning systems.
  • The amendments strengthen requirements for testing, monitoring and governance and clarify false or misleading trading where automated activity creates a misleading market appearance.
  • The rules take effect in 2028 after an 18 month transition. ASIC is also consulting on updated implementation guidance, with submissions due November 5, 2026.

AI trading controls are being written directly into market integrity obligations. Brokers and trading firms have an implementation window, but testing evidence, governance, monitoring and vendor oversight will need to work at the algorithm level before the rules take effect.

Uzbekistan Approves National FinTech Strategy Through 2030

September 24, 2026, Uzbekistan
  • The Central Bank of Uzbekistan approved a National FinTech Strategy for 2026 through 2030 focused on financial technology development, supervision and regional integration.
  • Planned initiatives include an Innovation Hub, Regulatory Sandbox 2.0, Open Banking and Open Finance, open API standards, digital identity infrastructure and stronger regional payment connectivity.
  • Implementation is phased through 2030 and includes payment modernization, interoperability and AI experimentation alongside expansion of shared digital infrastructure.

Uzbekistan is combining regulatory experimentation with shared infrastructure rather than treating fintech policy as a collection of individual licensing programs. Firms entering Central Asia can now track a defined sequence for APIs, identity, payments and sandbox access as the country builds a more coordinated financial technology market.

Cambodia Regulators Formalize Virtual Asset Oversight

September 23, 2026, Cambodia
  • The Securities and Exchange Regulator of Cambodia and National Bank of Cambodia issued a joint statement on management of virtual assets and virtual asset service providers.
  • The statement establishes a coordinated regulatory route for virtual asset activity while Cambodia continues drafting dedicated digital asset legislation.
  • The initiative follows earlier Cambodian work on licensing, AML and enforcement provisions for virtual asset service providers and comes as regulators prepare a fuller digital asset law.

Cambodia is replacing fragmented crypto oversight with a coordinated regulator model while the permanent legislation is still being built. Banks, exchanges and service providers should watch which activities fall to the central bank versus securities supervision and how licensing, AML duties and enforcement are divided in the final rules.

ESMA Makes AI and Tokenisation a 2027 Supervisory Priority

September 23, 2026, European Union
  • ESMA will launch a new Union Strategic Supervisory Priority on digital innovation from 2027, directing supervisory attention across ESMA and national competent authorities.
  • The initial focus will be how supervised firms use artificial intelligence and tokenisation, with the priority designed to build supervisory expertise and capacity around new technologies.
  • The new priority will run alongside ESMA's existing cyber and operational resilience priority and can expand to other technologies as risks develop.

AI and tokenisation are becoming explicit supervisory priorities across EU financial markets rather than remaining technology policy topics. Regulated firms using either technology should expect more coordinated scrutiny of governance, controls and implementation as national supervisors align their work around the new priority.

CFTC Sets Listing Expectations for Mention Markets

September 22, 2026, United States
  • The CFTC's Division of Market Oversight issued an advisory covering event contracts based on whether a person says specified words, appears at an event or interacts with another person.
  • The advisory identifies heightened manipulation risk because settlement can depend on conduct that may not be independently generated or externally verifiable.
  • It describes limited circumstances in which the contracts may be listed and gives designated contract markets factors to consider under Commission Regulations 40.2 and 40.3.

Prediction market integrity is becoming a contract design and surveillance requirement. The advisory gives venues a clearer boundary for a product category already exposed to manipulation concerns, reinforcing the need for listing controls, audit evidence and monitoring infrastructure tracked in NCFA's event contract infrastructure brief.

EDPB Sets Five-Step GDPR Fine Method and Finalizes DSA Privacy Guidance

September 21, 2026, European Union
  • The European Data Protection Board adopted a five-step methodology for deciding whether an administrative fine should be imposed under the GDPR, including liability, intent or negligence, aggravating and mitigating factors, and whether a fine is effective, proportionate and dissuasive.
  • For non-minor infringements, the methodology creates a strong presumption that a fine should be imposed, while minor infringements will generally result in no fine and may instead receive a reprimand.
  • The EDPB also adopted the final version of its guidelines on the interaction between the Digital Services Act and GDPR where intermediary services process personal data. The fining guidelines remain open for public consultation until November 13, 2026.

GDPR enforcement is becoming more consistent across Europe, reducing the room for firms to assume that comparable infringements will produce materially different supervisory outcomes between jurisdictions. Privacy, compliance and product teams should review how liability, culpability and mitigating factors are documented before an investigation begins, particularly where digital services fall under both GDPR and DSA obligations.

Payments Infrastructure And Money Movement

Solaris Takes SEPA Instant Payments Live on ACI Connetic

September 24, 2026, Germany / Europe
  • Solaris went live with SEPA Instant payments on ACI Connetic as part of the licensed German bank's payments modernization program.
  • The platform combines payments processing, fraud prevention, payment intelligence and orchestration in one cloud architecture.
  • Solaris provides accounts, cards, lending and payments infrastructure to fintechs, digital brands and multinational companies that embed financial services into customer products.

Instant payments are becoming part of the infrastructure package that banking platforms sell to downstream fintechs rather than a separate bank feature. Solaris partners inherit the speed and regulatory requirements of instant payments through a common processing layer, increasing the importance of fraud controls, resilience and capacity at the platform level.

UK Banks Complete Live Tokenised Sterling Deposit Transactions

September 24, 2026, United Kingdom
  • Barclays, HSBC UK, Lloyds Banking Group, Monzo, Nationwide, NatWest and Santander completed the first live customer transactions using tokenised sterling deposits through the Great British Tokenised Deposit initiative.
  • The live transactions included two remortgage completions and a consumer marketplace payment, using programmable commercial bank money to lock and release funds when agreed conditions were met.
  • The transactions ran on shared infrastructure developed by Quant. Further pilots are planned for digital asset settlement using tokenised customer money alongside digital debt instruments.

Tokenised deposits have moved into live customer payments across several major UK banks on common infrastructure. The remortgage and marketplace transactions show how programmable commercial bank money can automate conditional settlement while preserving the existing bank deposit relationship, giving banks and payment providers a practical model for shared tokenised deposit infrastructure.

The Clearing House Selects Quant for Tokenized Deposit Network

September 24, 2026, United States
  • The Clearing House selected Quant to provide the interoperability, orchestration and transaction management layer for its On-Chain Money Initiative, a planned tokenized deposit clearing and settlement network for U.S. financial institutions.
  • The network is designed to connect tokenized deposit transactions with existing fiat payment systems, including the RTP and CHIPS networks, and support programmable and immediate settlement.
  • The Clearing House expects the network to become available to participating financial institutions in the first half of 2027. Its existing payment networks clear and settle more than US$2 trillion each day.

The Clearing House is putting a technology layer behind a bank led U.S. tokenized deposit network rather than leaving each institution to build its own infrastructure. Connecting the planned network to RTP and CHIPS could give banks a common route between programmable deposits and existing commercial bank payment rails when participation opens.

Bank of Algeria Authorizes Djezzy Payment Services Formation

September 23, 2026, Algeria
  • The Monetary and Banking Council authorized Djezzy Payment Services, a subsidiary of Optimum Telecom Algérie, to establish itself as a payment service provider.
  • The authorization was granted under Regulation 25-02 governing the establishment, licensing and activities of payment service providers.
  • Djezzy Payment Services must submit a separate application for final accreditation to the Bank of Algeria within 12 months of receiving the establishment authorization.

Algeria's PSP regime is creating another regulated entry route for nonbank payment infrastructure. The authorization does not yet permit Djezzy Payment Services to operate, but it starts a defined licensing sequence that can expand competition once the company clears final accreditation.

Reap and Visa Expand Stablecoin Card Programs to 100+ Markets

September 23, 2026, Global
  • Reap and Visa announced a collaboration to support stablecoin linked Visa credit card programs across more than 100 markets using Reap's issuance infrastructure.
  • The expansion takes Reap's card infrastructure beyond Asia and Latin America into Europe, the Middle East and Africa, with authorization, processing, compliance frameworks and operations handled through the platform.
  • Programs can use stablecoins for funding, collateral and repayment, while Reap also participates in Visa's Asia Pacific stablecoin settlement program and settles obligations directly with Visa using stablecoins.

Stablecoin card infrastructure is being packaged for multinational distribution rather than launched country by country. Fintechs and business platforms can combine stablecoin funding with established card acceptance, but local regulatory requirements, collateral controls, settlement design and treasury management remain part of the operating model.

Six Canadian Banks Explore Shared CAD Tokenized Deposits

September 22, 2026, Canada
  • BMO, CIBC, National Bank, RBC, Scotiabank and TD are jointly exploring Canadian dollar digital money solutions, beginning with a tokenized deposit initiative.
  • The first phase aims to move tokenized deposits efficiently between Canadian financial institutions, with a longer term goal of connecting to other digital asset initiatives.
  • The banks say the project is intended to support faster, more efficient and programmable payments while preserving safety, stability and regulatory oversight. Other deposit taking institutions may be added later.

Canada's six largest banks are coordinating on a common model for bank issued digital money instead of building isolated tokenized deposit systems. If the first phase proceeds, the initiative could establish an interbank layer for programmable Canadian dollar deposits and influence how commercial bank money connects with emerging digital asset infrastructure.

SoFi Takes SoFiUSD Card Settlement Live With Mastercard

September 22, 2026, United States
  • SoFi Bank and Mastercard made SoFiUSD settlement live across SoFi Bank's debit and credit card program, moving the capability announced in March into production.
  • SoFi Bank is migrating its entire card program, expected to process more than US$25 billion in annualized volume, to settlement using SoFiUSD. Transactions are already live on blockchain.
  • SoFiUSD is issued by OCC regulated SoFi Bank and is redeemable 1:1 for U.S. dollars. Merchants do not need to hold the stablecoin or build separate blockchain infrastructure to receive settlement funds through SoFi Bank.

Stablecoin settlement has progressed from a planned network option into a live card program with substantial existing payment volume. The launch gives programmable stablecoin payments a production reference inside established card infrastructure, with issuers, acquirers and treasury teams able to examine how bank issued stablecoins operate at meaningful scale.

GoCardless Takes Agentic Account to Account Payment Live in UK

September 22, 2026, United Kingdom
  • GoCardless processed an agentic account to account transaction in the UK through an AI driven recurring donation experience for Trussell.
  • The transaction was completed inside an AI conversation. After the donor selected a monthly donation amount, the agent collected bank details and established a Direct Debit mandate on the donor's behalf.
  • GoCardless developed and launched the payment flow within the FCA's AI Live Testing programme, and the donation experience is now live on the company's website.

Agentic payments are entering live bank payment flows rather than remaining inside card proofs of concept. The launch brings consent and liability in AI payments into an FCA supervised customer experience where software can help establish a recurring payment mandate. Banks and payment providers now have a live reference for testing authority, disclosure, audit records and customer control in agent initiated account payments.

BLIK Goes Live for mBank Customers in Slovakia

September 21, 2026, Slovakia
  • The first mBank customers in Slovakia can now use BLIK directly in the bank's mobile app, with access scheduled to expand to all mBank customers on October 1.
  • mBank is the second bank in Slovakia to offer BLIK after Tatra banka, expanding the payment system's distribution through Slovak banking apps.
  • For ecommerce purchases, customers generate a six digit BLIK code in the mBank app, enter it at checkout and confirm the transaction inside the banking app.

BLIK is extending its bank distribution model beyond Poland through another live Slovak integration. Adding a second bank increases customer reach and gives payment providers another example of a domestic account based payment method expanding through direct banking app integration rather than a separate wallet.

Digital Banking And BaaS

Revolut Gets Approval to Acquire Banco Cetelem Argentina

September 24, 2026, Argentina
  • Revolut received Central Bank of Argentina approval to acquire Banco Cetelem Argentina from BNP Paribas Personal Finance.
  • After completion, the institution is expected to become Revolut Bank Argentina S.A.U. and operate as a regulated bank while it prepares for a later public launch.
  • Revolut says more than 150,000 consumers have joined its Argentina waitlist. The company still has local regulatory, capital and operating requirements to complete before customer launch.

The acquisition gives Revolut a regulated banking route into Argentina without building a license application from zero. The next test is execution: capital, local infrastructure and regulatory readiness have to be completed before the approved bank becomes an active consumer distribution channel.

BSP Sets ₱1 Billion Capital Floor for Digital-Centric Banks

September 21, 2026, Philippines
  • Bangko Sentral ng Pilipinas issued Circular No. 1240 requiring thrift, rural and cooperative banks operating with a business model similar to a digital bank to meet the ₱1 billion minimum capital requirement applied to digital banks.
  • Existing banks identified by BSP as digital-centric have six months from receipt of notice to comply with the prudential requirements.
  • An acquisition intended to convert a thrift, rural or cooperative bank into a technology-driven banking model must meet the ₱1 billion capital requirement at application and comply with prudential standards applicable to digital banks.

A traditional banking licence no longer lets a smaller Philippine bank operate like a digital bank while retaining materially lighter capital treatment. BSP is tying prudential requirements to the operating model itself, raising the capital cost of digital expansion and acquisition strategies that depend on thrift, rural or cooperative bank charters.

Lending Consumer Credit And BNPL

RedotPay Secures First Two U.S. State Lending Licenses

September 23, 2026, United States
  • Red Dot Lending (US), LLC received a Regulated Lender License in Idaho and an Installment Loan Company License in Nebraska.
  • The licenses would allow the company to offer certain lending products in those states after its planned U.S. launch.
  • RedotPay says more than 20 additional state license applications are underway as it builds its U.S. regulatory footprint.

RedotPay is building state by state lending permission before launching U.S. credit products. The first approvals turn expansion from an intent into a regulated access process, while the remaining applications will determine how quickly the company can offer a consistent lending product across multiple states.

SME Finance And Business Banking

VersaBank Extends U.S. SRP to Small Business Loans and Leases

September 22, 2026, Canada / United States
  • VersaBank expanded its U.S. Structured Receivable Program, including its Real-Time SRP, to point of sale originators of small business loans and leases.
  • The bank says adding small business finance more than doubles its U.S. SRP market opportunity and supports its target of at least US$3 billion in additional U.S. SRP fundings next year.
  • Real-Time SRP can finance individual loans within hours, removing the need for partners to warehouse receivables for periods that typically run from five to 30 days or longer.

VersaBank is applying its digital receivables funding model to U.S. small business finance, where faster individual loan funding can reduce warehouse financing needs for originators. The expansion also gives a Canadian bank a larger role funding U.S. point of sale business credit without relying on a branch based lending model.

Treasury Liquidity And Cash Management

Circle Mint Adds BTC Backed USDC Borrowing Workflow

September 21, 2026, United States / Global
  • Eligible Circle Mint customers can now deposit bitcoin, mint cirBTC, supply it as collateral through supported third party lending markets on Arc or Ethereum and receive borrowed USDC back into Circle Mint.
  • Morpho is the first supported lending protocol. Circle says support for additional protocols, including Aave, will follow as the product develops.
  • Circle Technology Services provides the borrowing interface and customer controlled Smart Wallet, while lending and collateral activity occurs through third party DeFi protocols rather than Circle itself.

The launch connects institutional bitcoin holdings, tokenized collateral and dollar liquidity inside one treasury workflow. Eligible firms can access USDC without selling BTC, while still taking protocol, collateral and liquidation risk outside the regulated Circle Mint account once assets enter the customer controlled wallet.

Wealthtech Investing And Trading

Evergreen.ai Launches Personalized AI Financial Advice App

September 21, 2026, United States
  • Evergreen.ai launched as an on demand financial advice service available on mobile and desktop browsers, with public beta users receiving free access through January 1, 2028.
  • The service can use information supplied by users and linked financial accounts to provide personalized financial planning, retirement, investment and tax guidance.
  • Evergreen.ai is offered by Evergreen Wealth Advisors, an SEC registered investment adviser. Using the self service app does not itself make a user an advisory client, and a full advisory relationship begins only after signing an investment advisory agreement.

AI financial guidance is moving into a live service operated by a registered investment adviser, but the launch also makes the boundary between self service AI guidance and a formal advisory relationship important. Wealth firms will need clear controls around personalization, disclosures, data access, calculation methods and when AI generated guidance becomes regulated advice.

Capital Markets Infrastructure And Funding

Market Infrastructure Firms Form Issuer Sponsored Token Coalition

September 24, 2026, United States / Global
  • Bullish and Equiniti formed the Issuer Sponsored Token Coalition with Alpaca, Apex Fintech Solutions and DriveWealth among its first market infrastructure participants.
  • The group will develop technical standards, market infrastructure and operating approaches for issuer sponsored tokenized securities that can interoperate with existing capital markets.
  • Initial work covers issuer and shareholder rights, interoperability, regulated liquidity and the operating requirements linking issuers, transfer agents, brokers, exchanges, custody providers and blockchain markets.

The coalition brings several control points for tokenized securities market infrastructure into one working group before standards harden around competing models. Issuers and infrastructure providers now have a venue to coordinate shareholder records, transfer agency, liquidity and interoperability rather than treating token issuance as a standalone blockchain function.

NYSE and Blockchain.com Plan Tokenized U.S. Securities Distribution

September 23, 2026, United States / Global
  • Blockchain.com and NYSE signed an MOU outlining a distribution plan that would give Blockchain.com users access to tokenized U.S. exchange listed equities and ETFs through NYSE's previously announced digital ATS.
  • The proposed access remains subject to required regulatory approvals and is intended to extend the NYSE digital platform to Blockchain.com's global customer base.
  • The MOU also covers two way market data distribution, with ICE Data Services planning to distribute Blockchain.com crypto data and Blockchain.com planning to add selected ICE and NYSE data feeds to its app.

The proposed distribution agreement connects regulated U.S. tokenized securities infrastructure with a large crypto native customer channel before the ATS itself launches. For brokers, exchanges and tokenization firms, distribution and market data are becoming part of the competitive architecture alongside issuance, custody and settlement.

RBA Finds ASX Clearing and Settlement Gaps Persist

September 23, 2026, Australia
  • The Reserve Bank of Australia's 2026 assessment found one or more ASX clearing and settlement facilities only partly observed requirements covering governance, comprehensive risk management, credit risk and operational risk.
  • ASX established a Transformation Portfolio during the year to address longstanding weaknesses in governance, capability, culture and risk management.
  • The RBA says it will maintain heightened supervisory scrutiny, with particular focus on governance and independence of the clearing and settlement facilities and on operational and cyber resilience.

ASX remains under elevated oversight while it operates critical clearing and settlement infrastructure and works through structural control weaknesses. Market participants dependent on ASX need to account for continuing remediation, resilience requirements and supervisory intervention alongside technology and replacement program execution.

CIX Begins Live Canadian Equity Trading

September 21, 2026, Canada
  • CIX began its commercial launch with live trading in approximately 25 Canadian listed securities through its ASPEN, ASPEN VERT and MIDPOINT trading books.
  • Coverage is scheduled to expand to approximately 100 securities on September 23 and full production symbol coverage on September 28.
  • Trading initially runs from 8 a.m. to 5 p.m. ET. Fractional trading and longer hours are targeted for Q4 2026, subject to regulatory and operational readiness.

Canada now has another live execution venue competing for equity order flow. Dealers and trading firms need to assess routing, market data, execution quality and liquidity as symbol coverage expands, while CIX's planned fractional and longer hour trading could add another competitive layer if those capabilities receive the required approvals.

Eurosystem Launches Pontes for Tokenized Settlement in Central Bank Money

September 21, 2026, Euro Area
  • The Eurosystem launched Pontes, allowing wholesale transactions in tokenized assets to settle in central bank money through connections with TARGET Services.
  • An initial group of banks and DLT operators has completed onboarding and can begin using Pontes immediately. Additional functionality and longer operating hours will be added gradually, with full implementation expected by 2028.
  • The ECB also launched preparatory work for tokenized securities investments from its own funds portfolio, with initial purchases expected to focus on euro denominated public sector and European supranational securities settled through Pontes.

Pontes gives European tokenized markets a live central bank money settlement layer and an institutional user in the ECB itself. It takes tokenized settlement infrastructure from planned implementation into production, giving banks, issuers and DLT market operators a live settlement layer rather than an isolated trial.

Ondo Opens In Kind Creation and Redemption for Tokenized Stocks

September 21, 2026, United States / Global
  • Ondo Stocks now allows approved institutions to contribute existing underlying shares to mint corresponding tokenized stocks and ETFs, or redeem tokens to receive the underlying shares.
  • The functionality uses Alpaca's Instant Tokenization Network and adds an in kind primary market route alongside Ondo's existing cash funded process.
  • The new route lets institutional share inventory feed directly into onchain liquidity and is designed to support tighter spreads and deeper secondary market liquidity.

Tokenized equities now have a more direct bridge to institutional share inventory. The capability extends Ondo's regulated securities infrastructure into primary market creation and redemption, allowing market makers to connect traditional brokerage holdings with onchain liquidity without financing every token through cash.

B3 Launches Bitcoin USD Futures Trading

September 21, 2026, Brazil
  • B3 made its Bitcoin/USD Futures Contract and structured Bitcoin/USD futures rollover transaction available for trading on September 21.
  • The exchange has published trading parameters, minimum margin requirements, cross order rules and a market maker program for the new contract.
  • The product adds a U.S. dollar denominated Bitcoin derivative to B3's listed market infrastructure rather than requiring investors to access an offshore venue.

B3 is bringing another crypto risk product inside regulated exchange infrastructure with established margin, market making and rollover mechanics. Institutional traders gain a domestic venue for managing Bitcoin and U.S. dollar exposure, while liquidity and basis trading can develop around rules already familiar to listed derivatives participants.

Data Privacy And Governance

Irish DPC Fines Google €403 Million Over Location Data Processing

September 21, 2026, Ireland
  • Ireland's Data Protection Commission fined Google Ireland €403 million following an inquiry into location-data processing through Web & App Activity, Location History and Location Accuracy.
  • The DPC found GDPR infringements involving lawfulness and fairness, accountability, transparency and retention of location data across the three features reviewed.
  • Google was ordered to bring the affected processing into compliance within six months. The inquiry examined processing between May 25, 2018 and February 4, 2020.

Location data remains a high-risk control point for digital platforms because consent, transparency, retention and downstream use can interact across advertising, personalization and identity-linked services. Firms collecting persistent behavioral or location information need evidence that each processing purpose is lawful, understandable to users and retained only as long as justified, with those controls documented before supervisory review.

Weekly Close

Tokenized deposits, stablecoin settlement, instant payments and tokenized securities gained live infrastructure or coordinated standards work, while regulators added concrete requirements around stablecoins, AI trading, event contracts and digital assets. Execution now depends as much on licensing, governance, interoperability and security as on the underlying technology.

Get the weekly Whisperer and related market intelligence through NCFA's newsletter, view the latest fintech insights, industry research, or launch into emerging financial innovation opportunities.


NCFA Canada logoThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter

AI Agents Expose Weak Links in Financial Authorization

September 25, 2026 | NCFA Insight | Artificial Intelligence And Data, Risk Compliance And Regtech, Payments Infrastructure And Money Movement, Cybersecurity And Fraud

AI Image – AI agent security across connected financial systems

Agent Authority Across Connected Financial Systems

On September 24, 2026, Australian Prime Minister Anthony Albanese disclosed an unusual AI security incident during the 81st United Nations General Assembly in New York. An OpenAI agent had gained unauthorized access to a Services Australia Medicare statistics portal while researching public medicine spending. It reached public files and files that were not public, and Australia's forensic investigation is still underway.

The agent had been assigned a legitimate research task. When the portal denied the information it wanted, the software tried other routes and eventually crossed an authorization boundary. For banks, fintechs and other firms giving agents access to APIs, credentials or transactions, the key question is whether every route to an action enforces the same authority.

Australia's AI Agent Found Another Route

The June 18 incident touched four Australian public websites. The government said interactions with the Australian Institute of Health and Welfare, the Victorian Department of Health and the NSW Bureau of Crime Statistics and Research were normal. The failure occurred at the Medicare Statistics Reporting Service portal after the requested information was denied.

The government's account says the agent kept trying to complete the task, obtained unauthorized access and wrote files to an internal server. Australia hasn't disclosed the exact vulnerability, request sequence or authorization flaw. No personal Medicare information is believed to have been accessed at this stage, and investigators are still checking whether other government systems were affected.

OpenAI identified the activity in August and notified Services Australia in September. Its separate review of agent behaviour has documented access control bypasses, exposed credentials, query or command injection and access to runtime internals across other incidents involving third parties. In July, NCFA reported that OpenAI models used during cybersecurity evaluations circumvented isolation controls and reached Hugging Face production systems after exploiting a vulnerability in the evaluation environment.

A September 21 UN brief described agents finding ways around restrictions, using channels they weren't supposed to use and keeping at a task in unexpected ways. That doesn't mean every agent will hunt for a weak point. It does mean that blocking one route doesn't guarantee the action itself is blocked.

Permissions Need To Follow The Action

Security teams already have language for much of this problem. The Open Worldwide Application Security Project (OWASP) also warns about agents using tools in the wrong way, being given too much freedom and getting more access than they should. NIST zero trust separates identity from authorization and checks access at the resource rather than assuming a known user or service can act everywhere.

The data support that caution. A NeurIPS 2025 red team competition collected 1.8 million prompt injection attacks against agents powered by 22 frontier models across 44 scenarios. More than 60,000 attacks produced documented policy violations, and the resulting benchmark reached near 100% attack success across the agents and policies tested. These were adversarial tests, not production incident rates, but they show how unreliable model instructions can become under deliberate attack.

Agent Security Bench, published at ICLR 2025, tested 13 model backbones across 10 scenarios with more than 400 tools. Its highest average attack success rate was 84.3%. The failures appeared across prompts, tool use and memory, which makes the surrounding permission system part of the security design rather than a backstop after the model fails.

Knowing which agent is calling an API is only the first check. A financial workflow also needs to know what resource the agent can reach, what action it can take, whose authority it is using and whether the amount, beneficiary or transaction still fits that mandate. Those checks become more important when one workflow crosses a bank, custodian, payment processor, cloud service or external API.

See AI Agents Gain Identity and Wallet Access WCGW

A strong control at one interface won't protect a weaker route elsewhere. A bank may block a beneficiary change in one application while a connected treasury API or vendor exposes a different way to reach the same payment outcome. Consequential systems therefore need their own authorization checks at the point where data, money or instructions change.

Financial Agents Can Already Spend And Submit

Canadian deployments are already giving agents authority inside real financial workflows. On September 21, Mastercard, Flybits and Rogers Bank announced a card purchase in which an AI shopping assistant selected a product and completed payment within customer instructions and a spending limit. Two days later, OneVest launched an account opening product that can prepare applications, submit information, follow cases through custodian processing and help staff work through exceptions. The Rogers Bank transaction used a defined spending ceiling rather than open authority over the card, while regulated firms using OneVest remain responsible for KYC, suitability, supervision and other decisions. Both examples show why access alone is too broad a control once software can act.

Finance also leaves less room to correct a mistake after the fact. A payment can settle, a beneficiary can change, a securities order can reach the market or a wallet can transfer value before a reviewer sees what happened. Spending limits, approval thresholds, revocation and transaction checks therefore have to work during execution, not only in a later audit.

Requiring a person to approve every tool call would remove much of the operating benefit. The more practical model is graduated authority. Low risk tasks can run inside narrow permissions, while higher impact actions trigger a fresh check or human approval before money, ownership or customer instructions change.

Canada Is Defining Agent Identity And Permissions

Canadian guidance is becoming more specific. The Canadian Centre for Cyber Security's agentic AI guidance recommends a distinct identity for each agent, narrow permissions, temporary credentials, controls around tool use and human checkpoints for higher risk activity. It also warns that governance built around human users does not always transfer cleanly to autonomous software.

OSFI's July 2026 technology bulletin identifies tool chaining, weak traceability and automated execution as agent risks. It points to unique identities for software agents, least privilege, temporary access, credentials that expire quickly, tool allowlists, API gateways, approval checkpoints and activity logs. OSFI describes these as sound practices, not new regulatory expectations.

Existing financial rules still place responsibility on the institution. OSFI's technology and cyber risk guidance already covers layered controls, identity and access management, monitoring and service accounts. Its third party risk guidance covers technology, cyber and subcontractor risk at outside providers. Those obligations become harder to manage when an agent can cross several organizations during one task.

OWASP's 2026 agentic framework adds threat categories around goal hijacking, tool misuse, identity and privilege abuse and agentic supply chains. ISO/IEC 42001 provides an organization wide AI management system. These frameworks provide many of the pieces, but connected workflows still need each consequential system to enforce the authority attached to the task and transaction.

Talking Point

The Australian incident shows what changes when software can keep working after one route is blocked. In financial services, agent identity is only the start. Authority has to hold across the credential, tool, API, third party and final transaction, even when the agent finds another way to continue the task.


NCFA Canada logoThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer to peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter