Karsten Wenzlaff, Advisor
August 26th, 2025
Competition | May 15, 2025

Image: Competition Bureau 2025 2026 Annual Plan
On May 15, 2025 the Competition Bureau released its 2025 to 2026 plan and they intend to move earlier, faster, and deeper into markets that matter to Canadians, such as grocery pricing, housing, banking, telcom, artificial intelligence, and environmental claims. Instead of reacting after harm is done, the Bureau plans to use the new, more modernized, legal tools at its disposal to focus on affordability, digital power, and slow innovation.
With expanded powers from recent updates to the Competition Act, investigators can act more quickly and use more data to build stronger cases to tackle problems like drip pricing and greenwashing. They can target areas where high market concentration makes life less affordable, working to prevent harmful behaviour before it becomes a crisis.
The Bureau is already pushing governments across the country to remove rules that hold back competition. They encourage use of its Competition Assessment Toolkit, which is designed to help policymakers identify and fix outdated regulations.
The Bureau will also launch a new market study this year and expand its work on emerging issues like algorithmic pricing and data portability. They will also make compliance easier for small businesses with tools like the Compliance Hub and Compliance Bootcamp. Promoting competition is now mandatory, and part of how the Canadian government can help grow the economy and protect consumers.
To support all of the changes, the Bureau is hiring staff with digital skills, updating its systems to manage large volumes of data securely, and training teams to use AI and new enforcement tools. There is also a revitalized focus on diversity, mental health, bilingualism, and accessible leadership training. The Bureau plans to work more closely with domestic and international partners, and play a key role during Canada’s G7 presidency.
This year’s plan shows that Canada is taking competition more seriously. It's not just about enforcement anymore; it's about using smarter tools, faster action, and better policy to lower costs and open up markets.
For fintechs and startups, this creates a chance to grow in a market environment that rewards fair play and transparency. And to incumbent players relying on hidden fees or dominant behaviour, the pressure is rising to adapt.
Learn more: download the 7 page PDF '2025-2026 Annual Plan: Strengthening Competition in a Changing Economy'
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Cybersecurity | May 14, 2025

Image: Freepik/DC Studio
Patrick Opet, JPMorgan Chase’s Chief Information Security Officer, has dropped a rare public warning that the modern SaaS (Software-as-a-service) model is enabling cyberattacks and embedding systemic risk into the global economy. His message is that the security architecture is breaking down, and software providers are not doing enough to fix it. Below are some urgent quotes from his discourse and why they matter for Canadian fintechs, investors, and regulators.
1. “SaaS has become the default... embedding concentration risk into global critical infrastructure.”
Many fintechs are using the same core SaaS vendors for payments, data, and automation, exposing them to a single point of failure. If one of these vendors is compromised, the effects can spread fast like wild fire on a dry summer's night. For fintech startups, the risks may be inherited without full visibility.
2. “Over the past three years, our third-party providers experienced a number of incidents... requiring us to act swiftly and decisively.”
Canadian fintechs with lean security teams need contingency plans for third party supplier compromise and must monitoring vendor behaviour or risk the full wrath of a serious attack that will disrupt operations, result in data theft or leakage, fraud and financial loss, regulatory and legal exposure, reputational damage and even cascading or 'fourth party' risks. Even a global bank must isolate vendors during incidents. Read OSFI's Guidance here: Third-Party Risk Management Guideline.
3. “Fierce competition among software providers has driven prioritization of rapid feature development over robust security.”
Security is often sacrificed for speed. Fintechs should require vendors to provide (1) strong and secure default settings, (2) regular third-party audits, and proof or evidence of strong internal security programs such as SOC 2 Type II or ISO/IEC 27001 certification.
4. “Modern integration patterns dismantle essential boundaries... relying on overly simplified interactions between third-party services and firms’ sensitive internal resources.”
OAuth tokens and API integrations are often misused, allowing third and unwanted parties to access internal systems. Without strong segmentation and logging, attackers can move quickly once access is gained. Microsoft Threat Intelligence recently confirmed state actors are now targeting common SaaS apps to infiltrate customers.
5. “The most effective way to begin change is to reject these integration models without better solutions.”
Canadian fintechs should ensure procurement policies require secure integration design, advanced authorization models, and greater transparency from vendors. Startups should reference the Canadian Center for Cybersecurity Top 10 IT Security Actions for implementation guidance.
SaaS brought convenience and speed but also concentrated risk across fintech infrastructure. For smaller Canadian firms who often lack internal security engineering, the consequences of a poorly or unsecured SaaS integration can be severe. This warning should not be ignored.
Fintech leaders should:
OSFI and the CSA have made it clear that third party oversight is now a priority, so fintechs can expect questions on cybersecurity controls and operational resilience during regular reviews. SaaS is here to stay but without stronger default security and safer integrations and oversight, it'll remain a growing liability.
Fintech startups and scale-ups cannot rely on vendors to lead. Security must be a shared responsibility across the ecosystem, and it begins with better architecture, more transparency, and smarter procurement.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Payments Regulation | May 1, 2025

Image: PSP Connect, Retail Payments Supervision (Bank of Canada)
On April 30, 2025, the Bank of Canada (BoC) shared a new update on how it will enforce the Retail Payment Activities Act (RPAA). Payment service providers, known as PSPs, had until November 15, 2024 to register. Those who failed to do so are now being urged to act immediately or face enforcement.
BoC message:
“If you missed this deadline, you must apply immediately and at least 60 days before starting any retail payment activities. Failure to register may result in enforcement action,” the Bank stated in its April 30 message.
The Bank has updated its enforcement process outlining they may contact a PSP that is under investigation. Communication methods may include phone calls, encrypted email, courier delivery, and other secure channels. The approach is inline with the enforcement tools at their disposal published in June 2024, which include monetary penalties and compliance orders.
The BoC is also sending a reminder of how to submit a registration application through PSP Connect, the Bank's secure online portal.
1. Create a PSP Connect account
Here's a handy step by step tutorial and video available on the Bank of Canada's website to help you with the process.
2. Enter the required information and upload all documents
You can save your progress and return later if needed.
3. Submit your completed application and pay the fee
There's a $2500 application fee that must be paid in full by either credit card or debit. Alternative payment arrangements such as direct deposit or wire transfer may be arranged if several card payment attempts fail.
If you are new to the process or need further help, and have missed the workshops/tutorials, the Bank encourages PSPs to use its general inquiries form.
This update signals that the BoC is shifting from education to enforcement, as they are making it clear they are ready to take action against unregistered PSPs. Regulatory oversight of retail payments will only become more structured from here, and payment providers must meet their legal obligations or face financial and operational consequences.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |