Karsten Wenzlaff, Advisor
August 26th, 2025
Fintech Competition | Oct 21, 2025

Image: Freepik/kues1
On October 8 2025, QED Investors and Oliver Wyman released Seizing the Bank Charter Moment (37 page PDF), tracking that fintechs filed more than 20 charter applications in 2025 (3x the number in 2023). The analysis found that obtaining a charter reduced funding costs by 150 to 300 basis points and improved net interest margins by 2 to 4%, driven by access to insured deposits and direct payment rails.
Also, on October 16 2025, Innovate Finance published Challenger Banks: A British Success Story (28 page PDF) confirming that UK challengers now hold about 25% of SME business current accounts and provide 60% of SME lending, up from under 5% seven years earlier.
The report found that fintechs with a bank charter earn an average return on equity of 14 to 16%, compared with 9 to 10% for those still operating as non-banks. The analysis outlined three main ways fintechs can hold a charter: (1) Full national bank charter; (2) Industrial loan company model that allows more flexibility for parent investors; and (3) Limited-purpose charter that does not take deposits but still falls under direct supervision.
The report shows that about 20 new applications had been filed by fintechs and new entrants, at the time of publishing. The Financial Technology Association said this renewal of new fintech charter bank activity can help increase competition. FDIC officials noted that the total number of US banks has fallen from roughly 8,500 in 2008 to 4,500 today, strengthening the case to restore market entry options.
For growing fintechs, the economic break-even point for considering the bank charter pathway is around $5 billion in assets and a return on equity above 12%. Meaning beyond that level, the cost savings from having a charter more than offset the added compliance and capital requirements. Even with about $50 to $100 million in new capital requirements and $8 to $12 million in yearly compliance costs, the charter still provides a net advantage.
As an aside, the lower cost of capital for chartered banks comes from structure, not size. Non-banks depend on wholesale funding or partner-bank arrangements that add about 1.5 to 3% to their cost of money because these funds are not insured. And chartered banks fund mainly through insured deposits, giving them a built-in advantage even after paying for regulatory oversight.
Innovate Finance report shows that challenger and specialist banks increased their small business lending to £110 billion in 2024 (about $140 billion CAD), which is 4.5% higher than the year before. The British Business Bank reports that these banks now provide about 60% of all lending to UK small and medium-sized enterprises (SMEs), a significant achievement.
However, the report warns that upcoming rules under Basel 3.1 and the Small Domestic Deposit Taker (SDDT) regime could make it harder for smaller banks to lend. They estimate that the new rules could reduce small business lending by up to £44 billion, which they describe as a potential tax on growth. Their Think Challenger proposal calls for more balanced regulation so that smaller, well-managed banks can continue to support small firms and customers while staying safe and sound.
This UK's experience offers clear lessons for Canada; that clear and fair (proportionate) rules can encourage innovation and competition while maintaining trust and stability in the system.
For larger banks, the benefits of collaboration are also visible. Institutions that work with challenger banks or fintechs on digital credit and data analytics see 10 to 15% faster deposit growth compared with those that compete alone.
In July 2025, the federal government began consulting on how to update the country’s deposit insurance system. Open banking including accreditation rules are expected to appear in the fall budget. The Retail Payment Activities Act (RPAA) is now fully in effect, bringing both domestic and international payment firms under the supervision of the Bank of Canada. Together these steps strengthen oversight but do not yet create a path for fintechs to operate as full banks.
For policymakers, both reports referenced in this article are evidence that fair and proportionate rules for capital and licensing help increase competition and small business lending without creating extra risk. Canada could adopt a tiered model where smaller fintech lenders meet simpler capital and reporting standards based on their size and activities, while full deposit-taking banks continue to meet the higher bar.
Canada doesn't yet have a charter pathway for fintechs or smaller non-bank lenders. Introducing a proportionate licensing framework with a transparent and time-bound review process would improve predictability, attract investment, and show that Canada is open to fintech banking innovation.
For fintech founders, timing, a level playing field and the ability to innovate and compete without structural barriers now matters. For investors, the valuation gap is becoming clear. In the US, fintech banks with charters trade at about 1.6 times book value, compared with 1.1 times for similar lenders without charters. A well-defined Canadian charter model could close that gap and attract more long-term domestic investment into fintech banking.
The simple truth is when proportionate rules are clear and scaled to risk, competition improves, credit costs go down, and innovation thrives. The UK and US results show that proportionate regulation produces measurable gains in lending and economic resilience. Canada now has a short window in 2025 to enable domestic fintechs a fair chance to grow and succeed at home.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create aa vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
UK Open Banking | Oct 16, 2025

On October 6, 2025, the FCA published a research note on open banking and open finance in the UK providing the most comprehensive update since the 2017 Open Banking Implementation Entity framework. The FCA report confirms that open banking has become a core part of the UK financial system, delivering measurable gains in innovation, competition, and consumer outcomes while setting a clear path towards open finance.
The FCA reports 13.3 million active users in March 2025 including individuals and businesses.
During early 2025 there were over 23 million one off open banking payments and about 3.7 million variable recurring payments in March.
There are more than 240 regulated third party providers active in the market.
The numbers show that most people start by using open banking for simple payments, then they move on to apps that help them manage money. These tools make it easier to track spending, combine accounts, and manage business cash flow. What began as a way to share data safely is now part of everyday financial life.
The FCA links the regulatory model to outcomes that people and firms feel and understand. API payments lower acceptance costs for many merchants, clear faster in regular use cases, and have lower charge-back risk.
Users of open banking tools report stronger confidence in managing money, better visibility over credit, and simpler product comparisons.
A growing share of regulated payment initiation and data services is now provided by non-bank firms. This is exactly what regulators aimed for, which is fair competition made possible by shared standards and clear oversight.
In April 2024, KPMG published a report on the roadmap to open finance in the UK. Now the FCA and HM Treasury are preparing an official Open Finance Roadmap for publication in early 2026.
Pilot activity is under way in mortgages, pensions, and small business lending. The technical stack is being upgraded so that systems use the same data format as ISO 20022. This lets APIs from different products connect and share information more easily.
Regulators are also testing shared rules for who is responsible if something goes wrong, and new dashboards that help people see and control which companies can use their financial data.
Commercial variable recurring payments are a key part of open banking’s next phase. They let customers authorize businesses to take payments automatically when conditions are met, such as usage or subscription activity, without having to reapprove each transaction. The UK Finance Wave 2 report on commercial variable recurring payments shows that adoption depends on clear business rules, predictable pricing, and consumer trust. It estimates that recurring payments could save merchants around £1.5 billion a year in processing costs while improving user convenience.
The report also points out that success will rely on creating fair commercial frameworks that balance innovation and stability. Clear incentives for both banks and payment providers can help recurring payments scale, lower operating costs, and give consumers more choice over how and when they pay.
The FCA’s benchmarking compares progress across Brazil, Mexico, Australia, Singapore, the United Arab Emirates, and Canada.
Brazil has a nationwide open finance network across multiple product types with mandatory participation.
Mexico continues to develop its framework with a measured, regulator led approach.
Australia extends the Consumer Data Right into energy and telecom.
Singapore and the United Arab Emirates use structured sandboxes and staged licensing to build interoperability.
Canada is recognized for policy design progress and oversight planning as implementation begins.
The common thread is that progress accelerates when governance is clear, standards are usable, incentives are aligned, and protections are visible.
The UK model brings competition policy, innovation policy, and consumer protection into one framework. Access is enforceable. Participants are certified. Interfaces are standard.
These choices lower barriers to entry and invite new financial intermediaries. Smaller providers compete on experience, cost, and transparency while trust in security remains high.
As open finance develops, success is measured by consumer value, SME productivity, and long term competitiveness. Effective regulation designed for growth becomes a national asset.
Open banking in the UK is about 7 years ahead of Canada's implementation, assuming Canada is still on track to implement phase 1 of open banking in 2026 (some have been told to expect Open Banking updates to be included in the Fall economic statement announced on November 4, but will it include an implementation timeline? Time will tell). The 2025 FCA update shows what can be achieved when regulation, technology, and market incentives pull in the same direction.
Open banking in the UK didn't reach scale overnight. It was built through coordinated governance, working standards, and consistent oversight. The move to open finance will test each jurisdiction’s balance of innovation and protection.
With the right structure, regulation can accelerate innovation, expand competition, and deliver lasting value across the financial system.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create aa vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Agentic AI Framework | Oct 6, 2025

iMAGE: Unlocking the right Agentic AI use cases (Deloitte, Sep 2025)
In September 2025, Deloitte released a research report titled, "Unlocking the Right Agentic AI Use Cases", outlining a structured way for evaluating where autonomous AI systems can deliver the most value. The report emphasizes that agentic AI is less about replacing jobs and more about transforming how organizations reason, decide, and learn at scale.
In this article, NCFA applies the framework to several common fintech processes from transaction monitoring to smart contract audits, and ranks how suitable they are for agentic AI adoption today and in the future as governance, transparency, and learning systems evolve.
Deloitte’s research includes 7 criteria to help developers determine how suitable agentic ai is for automating a particular process - see the table below.
| Criterion | Definition | Low End (Less Ideal) | High End (More Ideal) |
| 1. Reasoning and context | How much the process requires understanding across variables | Follows strict rules or thresholds | Requires judgment and context (e.g., fraud review) |
| 2. Autonomy and escalation | Degree of independent decision-making | Executes instructions only | Decides next actions, knows when to involve humans |
| 3. Goal orientation | Clarity of outcome or success metric | No clear endpoint | Defined goal (e.g., complete onboarding) |
| 4. Multistep nature | Whether multiple systems or tasks must be performed | Single-step task | Coordinates multiple systems sequentially |
| 5. Cyclic repetition | Frequency and feedback loops | One-time task | Repeats with measurable feedback loops |
| 6. Explainability | Transparency of reasoning | Opaque or black-box logic | Traceable reasoning with audit trails |
| 7. Continuous learning | Ability to learn and adapt | Static model | Improves through ongoing data input and correction |
Each process is scored out of ten points using Deloitte’s agentic AI use case suitability framework. The first score reflects current use case suitability in today’s environment. A second estimate indicates how use case suitability could rise in the future as digital governance, explainable systems, and automation standards mature over time.
Identity checks, risk screening, and document verification already rely on structured rules and data. Agentic AI fits naturally here, automating repetitive verification while escalating edge cases. As more jurisdictions adopt digital ID systems, this process could / will reach full autonomy with minimal human input.
Fraud detection already uses machine learning but agentic AI adds reasoning and adaptive responses. It can correlate patterns across payments, wallets, and behavioural data in real time.
With digital audit trails and explainable decision logs this process could operate fully autonomously under continuous supervision frameworks.
Matching incoming and outgoing payments is structured but still requires manual exception handling. Agentic systems can monitor ledgers, spot mismatches, and self-correct using feedback loops. As accounting platforms integrate autonomous verification standards, reconciliation could become a closed-loop agentic process with automated approvals.
Preparing reports for regulators involves collecting, validating, and submitting structured data. Agentic AI can manage workflows and track compliance deadlines. As regulators adopt machine-readable filing systems and trust frameworks, the need for human review will decline, allowing safe automation of most submissions.
Auditing blockchain contracts involves reasoning through logic and risk. Agentic AI can already identify anomalies and test execution scenarios. When standards for autonomous assurance and self-certifying code mature, agents could perform initial audits before human validation.
Today, human advisors must ensure advice suitability and fairness. Agentic AI can model goals and risk preferences, but oversight rules limit autonomy.
As explainability improves and regulators enable digital fiduciary models, these systems could autonomously generate and monitor recommendations.
Managing liquidity involves reasoning across cash flows, forecasts, and risk exposure. Agents can simulate scenarios and suggest rebalancing actions. Once real-time regulatory supervision and audit logs are common, agentic systems could adjust positions within safe parameters.
Tracking, transferring, and redeeming digital tokens are structured, rules-driven tasks. Agentic AI can monitor compliance and manage lifecycle events. As token standards and programmable compliance mature, these agents could manage portfolios with built-in governance.
Support interactions often follow clear procedures with measurable outcomes. Agentic AI can handle queries, resolve issues, and escalate complex cases. As conversational transparency and emotion modeling improve, these agents could manage most client interactions autonomously.
Scenario modelling tests business resilience under stress or uncertainty. Agentic AI can run continuous simulations, adjusting parameters as markets shift. In the future, these systems could interface with policy dashboards to flag emerging risks automatically.
This use case suitability assessment highlights how agentic AI can strengthen the efficiency, accuracy, and competitiveness of financial operations. Processes with structured data and repeatable outcomes like KYC, transaction monitoring, and reconciliation show the highest use case suitability today. These are areas where autonomous systems can already perform safely under human oversight.
For policymakers and regulators, the above examples demonstrate the importance of establishing auditable, explainable AI frameworks that allow more automation without compromising accountability.
For startups and financial institutions, the opportunity lies in targeting 'low lying fruit' (high-use case suitability functions) first to achieve measurable productivity and risk-management gains.
As data ecosystems become more interoperable and governance standards mature, the next stage of AI adoption will evolve from task-level automation to agentic collaboration. In this model, autonomous agents interact with systems, policies, and humans to drive continuous decision-making improvements.
This evolution could redefine the boundaries between financial service providers, regulators, and technology developers. Canada’s leadership potential lies in balancing innovation with responsible oversight, establishing itself as a trusted hub for explainable and accountable AI-driven finance.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create aa vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Payment Research | Oct 3, 2025

Image: Canadian Payment Methods and Trends 2025 (Payments Canada)
On October 2, 2025, Payments Canada published the 12th edition of their annual Canadian Payment Methods and Trends Report. Canada processed 22.5 billion transactions worth $12.2 trillion in 2024, with payment activity growing 3% in both volume and value year over year, showing steady momentum toward digital-first payment transactions.
Donna Kinoshita, Chief Payments Officer at Payments Canada:
“Canada’s payment ecosystem is more diverse, dynamic and fast-evolving than ever before. Innovations like real-time payments, consumer-driven banking, embedded finance and agentic commerce will continue to reshape the future of how Canadians make purchases and payments.”
Digital payments: 86% of volume (up) and 77% of value (up)
Contactless: 13B transactions, 58% of all payments (up 11%)
Mobile contactless: 3.4B transactions (up 28%), forecast 5.7B by 2028
E-commerce: $77B, 6% of retail sales (steady growth), projected $96.7B by 2028
The dominance of digital meets consumer preference for convenience and embedded financial services. Contactless is now mainstream, and mobile wallets are moving beyond early adoption. For fintechs, this unlocks opportunities in secure wallet apps, tokenization, and AI-driven checkout. Regulators will need to ensure interoperability and protection against fraud as transaction volumes accelerate.
Credit cards: 7.5B transactions, 33% of total (up 6%)
Average transaction: $105
Cards in circulation: 112M (up 5%)
Revolving balances: 32% of Canadians carry debt, average $4,616 (up)
Credit cards are still popular, now tying debit at the point of sale. But rising delinquency and revolving debt highlight financial stress among consumers. For banks and fintech lenders, this means offering attractive card benefits while keeping an eye on rising credit risks. Policymakers should monitor household credit health to prevent instability as card usage expands.
AI shopping support appeals to 28% of Canadians, nearly 40% among ages 18–34
64% of business leaders are exploring agentic AI
Social commerce: 18% interest
Live commerce: 20% interest
Smart home/social device purchasing: 13% of Canadians monthly.
AI-driven shopping assistants have arrived (no longer hypothetical) and are evolving expectations for search, recommendation, and payments. Younger demographics are especially open to participate, giving fintechs and retailers early markets to test autonomous transaction models. The investment capital flowing in agentic AI is expected to grow automated payment flows, as regulatory frameworks will need to address accountability, transparency, and consumer trust.
Cash use: 2.5B transactions, 11% of volume (down)
Average transaction: $27
48% of Canadians still use cash weekly, 3.5 times on average
57% do not want a cashless society; only 11% fully cashless
Cash use continues to decline but is still deeply entrenched for millions of Canadians. The resistance to going cashless highlights that modernization must be inclusive. Fintech and banking players should design strategies that maintain cash access while scaling digital options. Policymakers need to safeguard vulnerable populations from exclusion in a rapidly digitizing system.
Total payments: +9% volume, +22% value
Online transfers: +175% volume, +219% value
Credit cards: +14% volume, +32% value
Prepaid cards: +13% volume, +31% value
EFT value: +48%
Cheque value: –24%
The five-year data confirms structural realignment with transfers, cards, and prepaid instruments are increasing, while cheques continue their decline. For fintechs, the scaling of online transfers signals opportunity in peer-to-peer and cross-border solutions. Regulators must continue to balance innovation with systemic resilience, especially as volumes move away from legacy instruments like cheques.
With $12.2T in transactions and one in three payments on credit cards, the system is expanding digital capacity, testing AI commerce, and experimenting with livestream and social shopping. For fintechs, banks, and regulators, the challenge is to harness innovation while ensuring resilience, access, and trust.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create aa vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Report | Sep 25, 2025

Image: Top 200 Women Powered UK Businesses (report cover)
On September 16, 2025, J.P. Morgan and Beauhurst published the fifth annual Top 200 Women-Powered U.K. Businesses Report (Download 75 page PDF report), showcasing the scale and growth of female-founded and led enterprises in Britain. Since the inaugural edition, the number of women-powered businesses has more than doubled, rising from 6,085 in 2021 to 15,795 in 2025, representing 30.4% of all high-growth companies compared with just 18.3% four years ago.
The data shows that women-powered companies are growing faster than the broader high-growth ecosystem, which expanded by 56.1% over the same period. Regional analysis highlights London and the South East as hubs, with 4,916 and 2,124 women-powered firms respectively. In Wales, women-powered businesses now account for 32.7% of the high-growth firms, the highest proportion of any U.K. region.
Venture capital hit a record high, making up 21.9% of all deals, while women-powered businesses were slightly higher at 22.3%.
Equity crowdfunding has proven itself as transformational, driving the highest number of deals across the U.K.’s high-growth ecosystem. Since 2015, there have been 3,647 equity crowdfunding deals, of which 802 were women-powered fundraises, making it the leading investment route for female-founded and led businesses.
Entrepreneurs are increasingly attracted to equity crowdfunding because it provides access to early-stage capital often unavailable through traditional VC, combined with strong community backing and investor engagement. Two investment crowdfunding platforms stand out:
Over the last five years, equity investment in women-powered businesses grew nearly 97% from £2.29 billion in 2021 to £4.51 billion in 2025.
Exits also tell a updated story. After dipping in 2023, women-led companies generated £5.23 billion in disclosed exits in 2024, compared with £6.74 billion for male-led firms, creating one of the closest splits on record.
Charlotte Bobroff, Head of U.K. Women & Wealth:
"Women are surpassing milestones like never before, and their rapid rise is having a sizable impact on our overall economic output.”
Melis Kahya Akar, Managing Director at General Atlantic, noted persistent capital gaps. She added that investors have a responsibility to foster networks and mentorship:
“According to the World Bank, [women-led businesses] receive just 3% of global VC funding. When women do attract capital, they tend to raise smaller amounts than their male-led equivalents. The result is that fewer women-led businesses reach the later growth stage, at which we usually look to invest.
Representation matters, but there is currently a lack of visible role models, peers and mentors for women entrepreneurs. Only 11% of Fortune 500 CEOs are women, and while this is an increase on previous years, the relative scarcity can act as a deterrent for other women.”
The report highlights fintech and other digital sectors as among the most active areas for women-powered businesses.
In 2024, Software-as-a-Service, online retail, data provision, AI, and fintech were leading sectors for equity deal activity. Data-driven firms led by women have grown sharply, with deal activity in data provision rising from 233 in 2020 to 302 in 2024.
The doubling of female-led high-growth firms, growing access to capital, record-setting exits, and strong representation in fintech and digital-first sectors point to structural change. Download the full report
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create aa vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Cybersecurity | Sep 23, 2025

Image: Freepik/DC Studio
On September 18, 2025, researchers at Radware disclosed a zero click indirect prompt injection called ShadowLeak that caused ChatGPT Deep Research to leak Gmail data after it encountered a booby trapped email. It's a new class of risk where hidden instructions can manipulate agents while being invisible to users, so NCFA wants to ensure that fintechs and key stakeholders are aware of how attackers can turn AI helpers into data thieves in a way that users including developer's can't see.
Radware’s analysis shows that the leak originated from OpenAI’s own cloud infrastructure rather than a user’s device. A malicious email carried hidden HTML instructions such as white text on a white background. When the user later asked the agent to summarize emails, the agent followed the invisible prompt and sent private details to an attacker controlled URL.
Because the action happened in the cloud, the victim’s network defenses never saw it.
The researchers warned that the same trick could work on other connectors including Google Drive, Dropbox, Outlook, calendars, and GitHub. That means sensitive business data such as financial contracts, HR records, and meeting notes could also be exposed.
Radware reported the issue on June 18, 2025. OpenAI deployed fixes by early August and closed the case on September 3. An OpenAI spokesperson told Recorded Future News that the company continually improves safeguards against exploits like prompt injections.
ShadowLeak is not the only case of an AI agent being manipulated into acting against its user.
At Black Hat in August 2025, researchers demonstrated an attack called AgentFlayer that used a poisoned Google Drive document to leak secrets through ChatGPT connectors. The document contained hidden instructions that looked harmless to a person but were machine readable. When the agent processed the file, it followed the malicious prompt and attempted to extract sensitive data.
On August 20, 2025, security researchers at Brave (website browser company) disclosed a similar flaw in Perplexity’s Comet browser. They showed how a hidden Reddit prompt could read Gmail one time passcodes and expose them to an attacker.
On September 13, 2025, Tom's Hardware wrote about a malicious Google Calendar invite method could steer ChatGPT agents with connectors enabled to leak sensitive data, again by embedding hidden instructions in content that appears ordinary to the user.
From Radware’s advisory and government sources such as the U.S. National Institute of Standards and Technology, here are some suggested practices.
AI agents are being connected to sensitive systems at a time when fintech firms face increasing scrutiny over privacy and security.
If a connector exploit can quietly leak contracts, loan records, or customer identifiers, the implications are massive, such as regulatory fines, reputational loss, and reduced trust from partners and investors.
In Canada, where regulators are preparing rules on open banking and digital identity, firms cannot afford to treat agent security as an afterthought. Research shows that 57% to 80% of injection attempts succeed when attackers repeat them (i.e. 25 times), which is why layered defenses are essential.
Banks and financial technology firms must implement agent safeguards into compliance frameworks, risk models, and vendor contracts that will protect customer trust and reduce liability. Canadian fintechs should approach agent security not only as a technical concern but part of core competitiveness functionality.
Board oversight is also critical, as regulators and investors will expect firms to demonstrate how they manage AI risks.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create aa vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |