Karsten Wenzlaff, Advisor
August 26th, 2025
November 11, 2026 | NCFA Fintech Market Insight | Artificial Intelligence And Data, Capital Markets Infrastructure And Funding, Risk Compliance And Regtech

On November 11, 2026, Bank of England Financial Policy Committee external member Jonathan Hall used his final FPC speech to examine what happens when AI agents get more authority inside financial firms. A Bank of England and FCA survey of 196 firms found that 80% already deploy AI agents and another 14% plan to within 12 months. Only 2% reported agents with broad autonomy, and none of those were in trading and payments. Finance is adopting agents quickly, but firms are still keeping people and hard limits around the decisions that can change money, positions or customer outcomes.
The 2026 Bank of England and FCA survey separates four levels of authority:
Among respondents, 80% reported decision support agents, 46% constrained execution and 22% conditional autonomy. Broad autonomy was just 2%. Trade and execution was much lower at 7%, 5%, 1% and 0%.
Payments came in at 7%, 5%, 2% and 0%. Even after planned deployments are included, no more than 9% expect agents within the next year to execute trades, approve customer outcomes, initiate or block payments, or change financial limits and controls.
Canadian firms are already testing that boundary. Questrade MCP lets selected customers give an AI agent access to approved brokerage and market data and prepare an order. The customer still has to approve the trade before it is submitted, so it's not autonomous trading. It's a live example of a financial company giving an agent useful access without handing over final authority.
Thousands of agents using similar technology can become a market risk. The survey found that the three largest cloud and compute providers account for 79% of reported provider relationships. The three largest model API and hosting providers account for 54%.
Several banks, funds or trading firms could use different applications while relying on the same models, cloud providers or data. If those agents read the same market conditions and respond by selling assets, reducing exposure or pulling back liquidity at roughly the same time, many individually reasonable decisions could hit the market together.
Hall focuses on three things. How concentrated are the firms providing financial services? How similar is their behaviour in normal markets? How similar does it become when markets are under pressure? On whether AI will increase that concentration or correlation, he says “at this point we don’t know, but there is a risk that it will.”
Currently, AI agents are not currently causing market wide instability at scale. The concern comes from growing adoption, common technology providers and the possibility that greater autonomy could make reactions faster and more alike. The Bank of Canada’s 2026 Financial System Survey found that nearly all respondents use AI, mostly at limited or moderate levels, and continue to rely on human judgment for decisions carrying significant financial, legal or reputational consequences.
Project Logos is testing the behaviour regulators cannot yet observe at scale in live markets. The BIS Innovation Hub, Bank of England and Deutsche Bundesbank are building a simulated financial market where traditional rules based portfolio managers operate beside LLM based agents. Investor agents allocate capital while both groups make portfolio decisions over time.
Researchers can then quantify whether AI portfolio managers respond differently from traditional automated strategies, whether small changes in models or prompts alter their decisions, and whether their behaviour becomes more correlated when markets deteriorate. Project Logos remains ongoing.
Hall also mentions laboratory research where agents developed unexpected group behaviour, including collusion, and a separate experiment where agents communicated after encountering blocked tasks. Those results show that multi agent behaviour can produce outcomes that were not explicitly planned. They don't however show AI agents colluding in live financial markets.
Further, financial market rules already prohibit manipulation, which can make detection harder if agents learn to coordinate indirectly through price, volume, timing or rapid trading. Hall specifically raises tacit collusion and momentum ignition as behaviours that may be difficult to control through permissions alone.
Companies don't need to wait for autonomous trading to become common before tightening controls. The practical starting point is to separate an agent’s capability from its authority. A model may be able to initiate a payment, change an account or place an order. That doesn't mean the company should give it permission to do so.
Hall calls for unique agent identities, narrow access, secure credentials, transaction limits, sandboxing and monitoring. Those controls let a firm identify which agent acted, restrict the systems it can reach, cap what it can do and revoke access when something goes wrong. Firms remain responsible for the agent’s actions.
OSFI’s July 2026 agentic AI guidance tells Canadian financial institutions to give agents unique identities, limit what they can access, require approval for higher risk actions and keep records of what each agent does. OSFI also wants firms to test failures and outages, understand which outside services support critical work and keep manual backups when those services fail.
AI Agents Expose Weak Links in Financial Authorization shows how the same problem plays out across financial systems. One task can pass through an AI model, cloud service, API, bank, custodian or payment system. Each system that can change money, ownership or customer instructions needs to know what the agent is allowed to do and who approved it.
Companies also need to know whether their AI suppliers are really independent. Two vendors can look separate while relying on the same model or cloud provider. A firm may have strong controls inside its own business and still depend on the same outside infrastructure as competitors and counterparties.
Financial firms should treat AI autonomy as an authorization decision, not a software feature. Start with the job the agent needs to perform, give it only the data and tools required, cap financial actions and require another approval before higher impact decisions change money, ownership or customer outcomes. Record what the agent does, test how it behaves when systems fail and keep a manual way to stop or complete critical work.
The same review should cover outside dependencies. Know which models, clouds and APIs support important workflows and where several suppliers depend on the same infrastructure. An agent can work exactly as designed inside one company and still add to market stress if many firms use similar technology and react the same way at once.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
November 9, 2026 | NCFA Story Intelligence | Risk Compliance And Regtech, Cross Border Payments And FX, Digital Assets Blockchain And Tokenization

On November 6, 2026, eight Canadian money services businesses appeared on a U.S. sanctions list. Every one of them had a Canadian MSB registration number.
That number meant the business had entered Canada's federal registration system. It didn't mean FINTRAC had approved the firm, cleared its customers or vouched for every transaction passing through it. Until November 6, that distinction could sound technical.
Then the U.S. Treasury allegations arrived. Treasury says several of the eight firms converted cash or conventional currency into digital assets that reached sanctioned Iranian exchanges, addresses associated with the Islamic Revolutionary Guard Corps and, in some cases, wallets tied by U.S. authorities to Canadian drug trafficker Ryan Wedding.
The firms had Canadian addresses, Canadian corporations and Canadian registration numbers. Now they also had OFAC designations.
The same day, FINTRAC coordination with OFAC and FinCEN became public. Then Canada's financial intelligence agency disclosed what had been happening inside its own MSB regime during 2026: 161 registrations revoked, more than $198 million in penalties against nine MSBs, and 28 MSB non compliance matters sent to law enforcement.
FINTRAC didn't say that the eight OFAC firms were among those revocations, penalties or referrals. Canadian disclosure rules generally prevent it from making that connection public unless the law allows it.
But the sequence is hard to miss. Canada had already spent years strengthening Canada's tightening AML rules around MSBs, crypto, ownership and financial reporting. Now eight registered Canadian businesses were inside a U.S. sanctions action, and Canada's financial intelligence agency was confirming that it helped.
This is a story about what a registration number can prove, what it can't prove, and what happens when the transactions behind it reach sanctioned networks abroad.
Canada requires money services businesses to register with FINTRAC so authorities know who's operating, who controls the business and what services it offers. The registry brings firms into view, but it doesn't certify what happens inside every transaction.
That distinction had already surfaced before November. In September, Maple Digital and the TGR network raised questions about how much an active registration can really tell a bank or counterparty. There was no finding that Maple itself laundered money, but corporate and personnel connections showed why a FINTRAC number couldn't settle questions about directors, related companies or sanctions exposure.
FINTRAC MSB registration rules make the boundary clear. Registration is not a licence, endorsement or certification.
A registration number confirms that a business met the legal requirements to enter the MSB registry. It doesn't certify every customer, counterparty, wallet, source of funds or sanctions control used by the firm.
FINTRAC can later revoke registration if a business becomes ineligible or fails to meet registration obligations.
The eight firms designated by OFAC had Canadian registration numbers, corporate identities and physical addresses. Some operated from Vancouver, Toronto, North York, Richmond Hill, Thornhill and Montreal.
Those registrations told counterparties the businesses had entered Canada's MSB system. They didn't establish what customers were doing through the firms or where every transaction ended.
Iran connected transactions don't enter this story as ordinary transfers. Canada already requires reporting firms to treat them as high risk.
By July 2026, Canada's Iran AML controls still required enhanced checks covering identity, source of funds or virtual currency, beneficial ownership, recordkeeping and possible sanctions evasion. The warning was already built into the system before Treasury named the eight Canadian firms.
FINTRAC's Iran directive requires reporting entities to treat transactions originating from or bound for Iran as high risk.
Firms must verify clients, examine the source of funds or virtual currency, establish the purpose of the transaction and obtain beneficial ownership or control information where required. They're also expected to pay particular attention to possible sanctions evasion.
Earlier that summer, sanctions on Iranian crypto exchanges included Nobitex, Wallex, Bitpin and Ramzinex. Aban Tether Exchange and Shelbit later joined the sanctions record.
By November, several of those names appeared again in Treasury's allegations involving Canadian MSBs. The counterparties weren't unknown names at the far end of a payment chain anymore.
OFAC now names eight Canadian businesses under Executive Order 13902. They look different on paper, but they share one uncomfortable fact: each had entered Canada's MSB registry before U.S. authorities placed it inside an Iran sanctions case.
1380079 BC Ltd, also identified as Amin Exchange Vancouver and Sarafi Amin. OFAC lists locations in North Vancouver and Montreal and MSB registration M23258996.
2397639 Ontario Ltd, operating as Farah Exchange in North York. OFAC lists MSB registration M19648033.
B Galaxy Inc, also identified as Cryptoyal and C Exchange, with addresses in North York and Thornhill. OFAC lists MSB registration N300001022.
CCC Inc, also identified through names including Ccurrency Exchange, Sarafi C, Cryptoyal and C Exchange. OFAC lists MSB registration N300000785.
Darvish Exchange, also identified as Kanata MD Inc and Canada Exchange, with Richmond Hill and North York addresses. OFAC lists MSB registration N300000169.
Diverse Trade Inc, operating as Million Exchange, Million Money Exchange and Millionex, with addresses in Richmond Hill, Toronto and Montreal. OFAC lists MSB registration M19315656.
NIA Nations Currency Ltd, also identified as NIA Exchange and NIA Nations Exchange, with Vancouver and North Vancouver addresses. OFAC lists MSB registration M21153461.
Top PC Technician Inc, also identified as 2840711 Ontario Inc, Amin Exchange Toronto and Aminex Toronto, with North York and Thornhill addresses. OFAC lists MSB registration M21487848.
OFAC's published TRON addresses also give exchanges and compliance teams blockchain identifiers associated with several of the designated firms.
Treasury alleged that NIA Nations dealt with addresses associated with the IRGC and with Nobitex, Wallex, Ramzinex and Bitpin. Darvish Exchange allegedly dealt with Nobitex, Wallex, Aban Tether Exchange and Shelbit.
Farah Exchange allegedly dealt with Shelbit and Wallex. Amin Exchange allegedly received hundreds of thousands of dollars from Shelbit. These weren't generic country risk warnings anymore. Treasury was attaching named Canadian firms to named counterparties.
Then another thread appears. Treasury also alleges that some of the same Canadian MSBs handled proceeds connected with Ryan Wedding, the Canadian former Olympic snowboarder accused by U.S. authorities of running a multinational cocaine trafficking organization.
The case isn't only about Iranian exchanges now. It also touches alleged Canadian drug cash, and Treasury says some of the same businesses appear in both trails.
Treasury says addresses associated with Million Exchange sent digital assets to addresses associated with the IRGC or terrorism. It also alleges that the business converted Canadian drug proceeds into digital assets.
Amin Exchange allegedly received funds from sanctioned Iranian exchange Shelbit and converted millions of dollars in Canadian drug cash into digital assets for transfer abroad.
Farah Exchange allegedly dealt with Shelbit and Wallex and sent digital assets to addresses associated with terrorism and to addresses Treasury connects with Wedding.
Treasury also says an address associated with CCC Inc received hundreds of thousands of dollars from terrorism associated addresses.
These are U.S. Treasury allegations. An OFAC designation isn't a criminal conviction.
In the sanctions allegations, investigators followed counterparties. Which exchange received the funds? Which wallet had already been linked to a sanctioned actor?
In the Wedding allegations, they also followed the source. Where did the cash come from? Why was it converted? Treasury says some of the same Canadian businesses appeared in both trails.
The U.S. action could have ended as a foreign sanctions story. It doesn't.
FINTRAC confirms that it coordinated with OFAC and FinCEN, then Canada's financial intelligence agency publishes numbers showing just how active MSB enforcement has become at home.
Since the beginning of 2026, FINTRAC says it has revoked 161 registrations, more than during the previous three years combined. Over the past year, it imposed more than $198 million in penalties against nine MSBs and disclosed 28 MSB non compliance matters to law enforcement.
The November total didn't appear out of nowhere. By May, FINTRAC's MSB revocations were already reaching money transfer, FX, virtual currency and payment service businesses.
A registration revocation removes a business from Canada's MSB registry. An administrative monetary penalty punishes regulatory violations, while a law enforcement disclosure gives police information that may support an investigation or prosecution.
None of those actions is a criminal conviction.
The $198 million total is also heavily concentrated in a few exceptional cases. The Cryptomus record FINTRAC penalty was about $176.96 million, accounting for most of the total.
FINTRAC says it generally can't identify firm specific compliance action unless public disclosure is legally permitted. The public record therefore does not establish that any of the eight OFAC designated firms are among the 161 revocations, nine penalized MSBs or 28 referrals.
Before November 6, Canada's tougher MSB enforcement could be seen through revoked registrations, individual penalties and new AML powers.
Now FINTRAC is publicly confirming that Canadian financial intelligence also fed an international sanctions action. The coordination is public. The firm by firm Canadian enforcement record isn't.
The same number that placed each firm inside Canada's MSB system now appears on the same record as an OFAC designation.. That doesn't make registration meaningless. It changes what everyone around the firm has to ask next.
A bank can confirm registration and still need to understand the customer. A payment partner can confirm it and still need to know where the funds came from. A crypto exchange can confirm it and still need to screen the wallet. A foreign counterparty still needs to know who's at the other end.
U.S. property and interests in property belonging to designated entities are blocked and must be reported to OFAC. U.S. persons are generally prohibited from dealing with designated entities unless an exemption or authorization applies.
Entities owned 50% or more by blocked persons can also be blocked under OFAC rules. Banks, exchanges and other counterparties can add the newly published names and wallet addresses to their sanctions screening.
That doesn't mean every Canadian bank is automatically required to close every relationship with an OFAC designated Canadian business. Obligations depend on the parties, transaction and applicable law.
For legitimate MSBs, registration still opens the door to operating within Canada's regulated system. Remittance, FX, payments and digital asset firms remain important to customers who need alternatives to the largest banks.
International access depends on more than the registry. Banks, exchanges and settlement partners also need confidence in ownership, source of funds, sanctions controls, wallet screening and transaction monitoring. If that confidence disappears, the registration number won't preserve the relationship.
OFAC has named the firms and FINTRAC has confirmed the coordination. The rest of the Canadian story hasn't been written yet.
Registrations can be revoked. FINTRAC penalties can become public where the law permits. Police can investigate, prosecutors can lay charges where the evidence supports them, and criminal assets can be identified and recovered.
None of those outcomes can be read into the OFAC designation today.
What happens next will show whether the November 6 sanctions action is followed by Canadian registration, regulatory, police or asset recovery measures involving any of the eight firms.
Eight Canadian businesses entered November 6 with MSB registration numbers. They ended the day on a U.S. sanctions list.
That doesn't prove they committed a crime in Canada. It doesn't prove FINTRAC revoked their registrations, penalized them or referred them to police.
For legitimate operators, the demands are becoming harder to ignore. Know the customer, source of funds and beneficial owner. Know the wallet and the exchange. Keep records good enough to revisit a transaction when an address later appears on a sanctions list.
Those checks aren't free, especially for smaller firms. Banks, exchanges and settlement partners also have to decide whom they're willing to keep connected to their own systems.
Canada's MSB sector still serves real needs in remittances, foreign exchange, cross border commerce and financial access. November 6 doesn't change that.
What it does leave unresolved is what comes next for these eight firms.
OFAC has made its allegations public. FINTRAC has confirmed the cross border coordination. The next chapter is whether that intelligence leads to Canadian regulatory, police or asset recovery action involving any of the eight.
An MSB registration tells you that a firm entered Canada's regulated system. It doesn't tell you enough about the customers, funds, wallets and counterparties behind that number.
Does the November 6 action show that Canada's AML system is becoming more effective across borders, or will the stronger proof come only when Canadian investigations and asset recovery follow?
Share this story → Explore related intelligence → Subscribe
Share this story → Explore related intelligence → Subscribe
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
November 9, 2026 | Last Updated: Nov 10, 2026 | NCFA Fintech Market Insight | Payments Infrastructure And Money Movement, Competition And Market Structure, Cybersecurity Fraud And Financial Crime

On November 9, 2026, Payments Canada launched Canada’s Real Time Rail, giving banks, credit unions and eligible payment firms a national system that can exchange, clear and settle payments in real time, 24 hours a day. Eight organizations are active at launch. RTR uses ISO 20022 messaging, makes settled funds available immediately and starts with centralized fraud controls built into the rail. Canadians won't suddenly see a new payment button. Interac e Transfer starts migrating onto RTR in 2027, major banks are still onboarding and participants need to build services customers can actually use.
What changes today is the infrastructure underneath Canadian payments. Qualified firms can now build on a domestic rail that settles continuously instead of waiting for traditional processing windows. That opens more room for faster payouts, better treasury tools, real time account transfers and new payment products, but the commercial value now depends on who turns access into something useful.
The first active participants are Wealthsimple, Questbank, Peoples Trust Company, Paramount Commerce, KOHO, DoBusiness.com, Digital Commerce Bank and Bank of America. Several are challengers or payment focused firms rather than Canada's largest banks. Payments Canada says the major Canadian financial institutions are onboarding in the coming months, so the opening group is the start of production, not the final market. Payments Canada also doesn't say all eight firms are offering identical customer services today. Being active on RTR means a firm has cleared the technical, operational, security and certification requirements for its role. Product availability and customer access still depend on what each participant has built and when it releases it.
Questbank President Rob Galaski called RTR a system that lets Canada's financial infrastructure operate “at the speed of everyday life.” Early access only becomes useful if participants turn it into faster payouts, lower payment friction or products customers prefer. The launch follows a broader opening of Canada's payment infrastructure. By October, 22 organizations had joined Payments Canada after membership eligibility widened, with 20 becoming eligible because federal reforms opened membership to regulated payment service providers, qualifying local credit unions and designated clearing houses.
Membership opens the door, but it doesn't grant automatic access to RTR. Firms still have to choose how they connect and settle. Some can connect directly to the RTR Exchange, while others can use service providers or settlement agents. NCFA's Real Time Rail rules and access guide maps those options and the regulatory, liquidity, fraud, testing and operating requirements behind them.
RTR doesn't replace Interac e Transfer. Interac remains the service Canadians know, while RTR provides the clearing and settlement infrastructure underneath it. Interac e Transfer transactions will begin migrating onto RTR in phases. Payments Canada's production schedule puts the first migration participants in Q1 2027, additional participants in Q2 and full transaction volumes for the initial launch phases in Q3. The consumer experience may therefore look familiar while the plumbing underneath changes.
Payments can settle continuously, including nights and weekends, and the receiving side can get immediate access to settled funds. For businesses, the bigger benefit may be knowing exactly when money has arrived instead of waiting for a batch cycle or banking day to close. ISO 20022 adds structured payment data to the transaction, so invoice numbers, remittance details and other standardized information can travel with the payment. That gives accounting platforms, treasury software, payroll providers and embedded finance firms better data for reconciliation and automated workflows.
Potential uses include supplier payments outside normal banking hours, payroll, insurance payouts, government disbursements, real time refunds, account to account commerce and faster merchant settlement. These are capabilities RTR can support, not a list of products already available on November 9. Business demand is already visible. Payments Canada says 60% of Canadian businesses in its research are ready to adopt real time payments, with cash flow forecasting and delays in sending or receiving money among the problems they want solved. Another 52% of consumers expressed interest and intent to use real time payments.
The potential economic gains are meaningful, but they depend on adoption. A C.D. Howe Institute model estimates cumulative savings over 10 years of between $5.3 billion and $14.5 billion. Lower processing costs, less cheque and cash use and reduced payment float drive much of that estimate. A separate C.D. Howe analysis estimates about $16 billion in cumulative economic gains under its initial model, with further gains possible if later functionality improves productivity.
Real time settlement gives fraud teams less time to stop a bad payment, so Payments Canada has made centralized fraud services part of the rail from launch. It says Canada is the first G7 country to launch a real time payment system with mandatory centralized fraud services from day one. That is Payments Canada's claim, and it doesn't mean RTR prevents fraud. The system launches with Confirmation of Payee for consumer accounts, a transaction safety score, a shared repository of fraud risks and indicators, and a fraud reporting and intelligence platform. Participants use those tools alongside their own authentication, monitoring and fraud controls.
Confirmation of Payee checks whether the recipient name matches the account information before a payment is sent. It can catch mistakes and some impersonation attempts, but it cannot establish that every recipient is legitimate. A customer can still be persuaded to send money to the intended account of a scammer. The Bank of Canada designated RTR a prominent payment system effective November 8, bringing it under formal Bank oversight for safety, resilience and continuity. The Bank also makes clear that its payment system oversight does not cover consumer protection, so RTR's launch doesn't settle who bears losses when fraud occurs.
For banks and fintechs, faster money raises the value of better identity checks, transaction monitoring and intervention before authorization. Fraud controls can't become an afterthought when settlement happens in seconds.
A Bank of Canada working paper published November 10 adds another dimension to that question. Its researchers find that centralized fraud controls can improve coordination between sending and receiving institutions, but centralization alone is not enough. Access pricing, transaction limits and who ultimately bears fraud losses can all change prevention incentives and who uses an instant payment rail. The research argues these choices need to be designed together rather than treated as separate consumer protection issues.
RTR gives qualified firms more ways to reach national payment infrastructure, but direct access comes with real cost. Direct participants need technical integration, liquidity, security, certification, fraud controls and continuous operations. Other firms can build through an RTR participant or use a settlement agent instead. The Bank of Canada RTR settlement account policy lets qualifying Payments Canada members, including eligible PSPs, apply for direct settlement access if they meet the required regulatory, financial and operational tests.
Firms with enough scale can gain more control over settlement instead of relying entirely on another financial institution. For many fintechs, though, the better business model may be to stay one layer above the rail. A payroll platform, marketplace, lender or treasury provider can use a participant to deliver real time payment features without becoming a direct settlement participant itself. Direct control only makes sense when the product or margin advantage is worth the added cost.
Early participants get time to learn before the wider market arrives. They can test workflows, fraud controls, liquidity and customer demand while other institutions are still onboarding. That head start won't last forever because Canada's largest banks bring enormous customer bases, deposits, payment volume and distribution when they connect. Payments Canada targets RTR availability to more than nine in 10 Canadian bank accounts by Q3 2027, so the numbers worth watching now are active participants, payment volumes, merchant adoption, fraud performance, product launches and the cost of using the rail.
RTR also arrives after a long build. Canada's real time payment program previously targeted 2022 and then mid 2023 before further testing, review and a 2024 restart. NCFA's financial infrastructure opening tracks how wider Payments Canada membership, new access rules and RTR gradually moved from policy into operation. The rail is finally running. From here, execution and adoption is more than another infrastructure milestone.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Oct 31, 2026 | Last Updated: Nov 12, 2026 | NCFA Fintech Whisperer | Artificial Intelligence And Data, Capital Markets Infrastructure And Funding, Cross Border Payments And FX, Cybersecurity Fraud And Financial Crime, Digital Assets Blockchain And Tokenization, Digital Banking And BaaS, Digital Identity And Trust, Insurance And Insurtech, Lending Consumer Credit And BNPL, Open Banking Open Finance And Data Sharing, Payments Infrastructure And Money Movement, Regulation And Policy, Risk Compliance And Regtech, SME Finance And Business Banking, Sustainable Finance ESG And Financial Inclusion, Treasury Liquidity And Cash Management, Wealthtech Investing And Trading

Image: Freepik
NCFA Fintech Whisperer tracks weekly fintech market intelligence that changes how financial markets operate. Coverage spans NCFA's full financial innovation taxonomy, with Canada first and global developments included when they materially affect rules, market access, competition, capital, technology adoption, distribution, risk or execution. We focus on changes that founders, investors, financial institutions, regulators and operators may need to act on, not simply what's making headlines. This page is updated throughout the week as material developments emerge, then closed and archived before the next weekly window begins.
Missed a prior week's Fintech Whisperer? Browse December 6 to 12, 2025, December 13 to 19, 2025, January 1 to 9, 2026, January 10 to 16, 2026, January 17 to 23, 2026, January 24 to 30, 2026, January 31 to February 6, 2026, February 7 to 13, 2026, February 14 to 20, 2026, February 21 to 27, 2026, February 28 to March 6, 2026, March 7 to March 13, 2026, March 14 to March 20, 2026, March 21 to March 27, 2026, March 28 to April 3, 2026, April 4 to 10, 2026, April 11 to 17, 2026, April 18 to 24, 2026, April 25 to May 1, 2026, May 2 to 8, 2026, May 9 to 15, 2026, May 16 to 22, 2026, May 23 to 29, 2026, May 30 to June 5, 2026, June 6 to June 12, 2026, June 13 to June 19, 2026, June 20 to June 26, 2026, June 27 to July 3, 2026, July 4 to July 10, 2026, July 11 to July 17, 2026, July 18 to July 24, 2026, July 25 to July 31, 2026, August 1 to August 7, 2026, August 8 to August 14, 2026, August 15 to August 21, 2026, August 22 to August 28, 2026, August 29 to September 4, 2026, September 5 to September 11, 2026, September 12 to September 18, 2026, September 19 to September 25, 2026, September 26 to October 2, 2026, October 3 to October 9, 2026, October 10 to October 16, 2026, October 17 to October 23, 2026, October 24-October 30, 2026.
Penny brings the practical test of financial AI into everyday accounts. Can a client see exactly what an agent plans to do before approving it? Wealthsimple is keeping confirmation in the transaction path, a useful response to AI agent authorization risks. Banks and fintechs competing here will need reliable permissions and clear records, not just a better chat interface.
Singapore wants financial firms to solve common AI deployment problems together instead of rebuilding every control separately. Vendors should watch the tools that emerge from BuildFin.ai and SafeFin.ai. Shared practices can make procurement easier, but they can also raise the minimum standard for selling AI into banks.
Project SAGE moves the agentic finance debate toward the control layer that determines whether financial agents can be trusted to act. Identity alone is not enough. Firms need to prove who delegated authority, what the agent can do and how that authority is revoked. Those questions sit at the centre of AI agent financial authorization and security.
Firms building AI tools for customer decisions will get a direct route to test designs with the regulator. That matters more than another broad statement on responsible AI. Applicants should arrive with specific decision flows, customer safeguards and evidence they can evaluate during the program.
For Canadian founders and early investors, exit taxation affects where companies are built and where proceeds get invested next. The proposed relief could make staying in Canada more attractive when a venture succeeds. But the eligibility rules will decide who actually benefits, especially founders, employees with equity and angels backing smaller deals. Until enacted, founders shouldn't price the proposed exemption into a transaction.
BitGo can now sell custody and financing together rather than leave institutions to connect several providers. That makes collateral eligibility, liquidation terms and counterparty exposure central buying decisions. Clients comparing BitGo's institutional custody services with its new trading desk should press for actual funding costs and settlement performance. The launch alone doesn't establish market share.
US exchanges now have a route to list equity perpetual futures within registered markets. Brokers can assess a product category many traders currently find offshore. But the business case depends on actual contracts, margins, clearing arrangements and liquidity. No exchange volume was announced, so this is a permission milestone rather than evidence of trading demand.
Tokenized public equities need more than trading and settlement. They also need reliable ownership records, corporate actions and voting rights. Broadridge is building those functions into the NYSE model before launch, extending the tokenized securities infrastructure layer already forming around regulated markets. Regulatory approval and issuer participation are the next proof points.
Financial institutions increasingly face a cost for every separate ledger connection. Consensys is selling a way to coordinate transactions while institutions keep control of their own networks. Buyers will need to test settlement finality, exception handling and integration cost before treating interoperability as solved.
The approved connection could let investors reach the digital gilt through two depositories instead of one. That gives banks and custodians a real interoperability problem to solve before issuance. They’ll need to test ownership records, settlement finality and investor access. A successful pilot could establish a useful model for digital government bond distribution, but no gilt has been issued yet.
A shared clearing house could give tokenized instruments access to familiar margin and default processes. That may be cheaper than running separate clearing arrangements. Members should test legal finality, collateral treatment and what happens when a digital transaction fails. Eurex has announced the design; live eligible products and actual clearing volumes remain the proof.
The proposed listing could give tZERO capital and a public market valuation for its regulated tokenization business. But the amount available depends on redemptions, financing and closing conditions. Investors should track cash actually delivered and trading activity across its platforms. **A signed SPAC deal is not a completed funding round.**
For active traders, a small fee change can matter across millions of shares. Dealers should model the cap alongside spreads and rebates, then confirm which provincial relief orders apply before changing routing. The November implementation brings the fee cap into actual execution costs for affected markets.
This expands BMO’s ability to connect Australian mining issuers with global institutional capital and advisory services. For smaller market participants, it raises the competitive standard for research, placement reach and cross border execution. The integration matters more than the acquisition headline.
Banks using Aquila could add currency coverage without building a separate payment connection for every corridor. That's commercially useful only if rates, compliance checks and failed payment handling work inside normal operations. Firms evaluating bank and cross border payment connections should compare actual execution costs and settlement times rather than count currencies on a slide.
A gift card seller has to keep suppliers funded even when customers pay in crypto and its suppliers expect local cash. Bitrefill is using stablecoins behind the scenes, not asking suppliers to change what they accept. That puts live evidence behind the cross border stablecoin supplier payments opportunity. The financial test is conversion cost, available liquidity and reliable delivery across more corridors.
Payment providers often need one bank for currency accounts and another provider for digital assets. RTGS.global is reducing that integration burden for eligible firms, although bank onboarding and market coverage still apply. Its value will depend on account approval, funding speed and costs across the banking and digital asset payment connections customers actually use.
The licence gives Razorpay a regulated route for cross border payment products and a clearer sales pitch to global platforms. Firms evaluating the service should check permitted flows, payout corridors, bank coverage and actual onboarding time rather than treating the licence as proof that every corridor is live.
The higher ceiling moves this rail beyond smaller remittance tickets and gives payment providers more room to serve larger consumer transfers without splitting them across transactions. The competitive question is whether instant card payouts can win volume from bank based cross border flows on cost, reliability and reach as cross border payment infrastructure becomes faster and more programmable.
Cross border QR acceptance could give Hong Kong bank and wallet users more ways to pay abroad without using a separate travel wallet. Providers should watch fees, currency conversion and participating banks. Merchant reach alone does not establish how much of that network a customer can actually use.
Texas adds another state where Navro can offer regulated payment services directly under its own permission. That makes licensing a sales advantage for firms managing payroll and international disbursements. Clients still need to check other state permissions, supported payout routes and bank arrangements. **One API does not mean one licence covers the entire US.**
Canadian MSB registration doesn't establish that a firm's transactions or customers are compliant. Banks, payment providers and crypto platforms need to check counterparties against sanctions lists, assess transaction exposure and keep stronger records of their decisions. The risk now extends beyond Canadian registration into international sanctions enforcement. The Canadian MSB sanctions case shows how these controls intersect.
The FCA is offering firms a route to test whether quantum systems outperform established financial crime tools before committing to expensive infrastructure. Interested compliance vendors need measurable detection questions and credible comparison data. This complements the earlier financial sector quantum readiness work, but the immediate opportunity is experimentation, not a production procurement mandate.
India has pulled payment security, cyber resilience, system audits and third party controls into one binding rulebook. That reduces uncertainty about which requirements govern when older instructions overlap. Payment firms now have a clearer compliance baseline across their own systems and the vendors they rely on. The operating burden reaches beyond internal technology because connected service providers also have to meet the required controls.
This is a bank payment authorization problem with a third party entry point. Payment firms can't judge resilience only by whether customer accounts were compromised. They also need controls over vendor permissions, treasury transactions and emergency transfer suspension. The cost becomes immediate when legitimate customer payments stop while the bank investigates. Arkéa's precise financial loss remains unconfirmed.
The business case for fraud AI is investigator time and better decisions, not simply faster generated explanations. Mashreq’s deployment puts those claims inside a bank control environment. Buyers should ask for measured investigation throughput, detection quality and evidence trails before extending automation.
This is a procurement and migration issue for banks long before quantum attacks become routine. Firms need to identify where vulnerable cryptography protects customer data, transactions and long lived records. Vendor contracts and implementation roadmaps are where the work becomes expensive.
A fraud report is more useful when it leads to a blocked account, disabled number or removed website. Maple Disruption brings the organizations controlling those channels into the same operation. Banks and fintechs should examine how quickly shared fraud intelligence reaches the team that can act. The real test is disruption achieved, not the number of participants.
BVNK gives payment providers a working route from dollars to stablecoin balances and back. It's useful for firms that need treasury and customer payouts without building four blockchain integrations themselves. The buying decision still comes down to liquidity, redemption and compliance costs. Those are the same operating constraints in NCFA's programmable stablecoin payments research.
Banks could still distribute digital money, but issuing it would require a different legal structure. That matters for licensing, reserves and who carries redemption obligations. Canadian wallets and PSPs also need clear treatment of foreign issuers, not just domestic products. NCFA's stablecoin regulatory guide tracks the existing framework while Ottawa works through the proposed amendments.
Institutional traders want exchange liquidity without giving one exchange control of their entire asset pool. Bitget is separating those functions, but clients still need to review collateral rights, liquidation instructions and settlement responsibility. The distinction matters alongside NCFA's crypto custody and exchange trust research. Keeping assets elsewhere is useful only when the legal and operational controls hold under stress.
The important step is that a major bank can send assets into custody and retrieve them through an operating connection. That is more useful than another memorandum of understanding. Institutions assessing regulated digital asset custody infrastructure will still want evidence of withdrawal reliability, segregation and collateral enforceability before expanding lending against these assets.
Restoring the reserve closes one immediate solvency gap, but it does not restore every withdrawal route. Users and trading firms still need to check liquidity, redemption channels and governance controls. The unresolved commercial issue is how a federated bitcoin product earns back confidence after a reserve failure.
Always available tokenized assets need an equally available cash leg. Hong Kong has connected both sides inside a regulated pilot, which makes settlement hours less of a constraint on treasury and tokenized fund activity. The commercial test is volume, participant growth and movement from pilot access toward production use in tokenized collateral and cash settlement.
Ireland is giving tokenization firms a more direct route into regulatory engagement while the supporting settlement and legal framework is still being built. That can surface custody, asset servicing and interoperability issues before firms scale them. The opportunity is shifting from issuance toward the regulated infrastructure around tokenized real world assets.
Tokenization firms need ways to reach regulated bank partners before they can prove demand. tConnect creates another entry point to test that fit. The useful measure will be projects that progress from collaboration into funded deployments, not how many firms attend.
The pause is a direct operating interruption for traders and liquidity providers relying on cross chain swaps. Those users need current chain status, outbound queue visibility and clear incident reports. An unexplained refund error also raises questions about how the protocol handles exceptional transactions under load.
Institutional custody clients now have another federally regulated option to evaluate when choosing where to hold digital assets. For Coinbase, the charter offers more direct control over its custody business and less dependence on separate state level arrangements. The competitive test is whether federal supervision helps Coinbase win more institutional assets and custody mandates. Banks and investment platforms should compare custody terms, segregation and supervisory protections rather than assume every trust charter offers the same services.
Eight sponsor banks give Synctera more capacity to match fintech programs with regulated banking partners rather than depend on one institution's appetite for risk. But the larger network also demands consistent controls across every bank relationship. Compliance quality is becoming a competitive requirement for banking infrastructure. That makes its earlier Cable compliance acquisition commercially important as the platform expands.
Higher deposit protection could make customers more comfortable keeping larger balances at smaller federally insured banks. That affects a bank's funding cost and its ability to compete for savings. The proposed changes could help challengers, but firms must explain the current coverage accurately until Parliament changes the law. Smaller banks may benefit most if stronger insurance coverage helps them compete for deposits.
Getting a banking licence is expensive before the first account opens. A clearer decision period could make financing a challenger bank more realistic, while the ownership changes may let growing banks retain strategic investors longer. The details matter. Canada's Budget 2026 financial competition analysis sets out the wider context, but applicants still need to meet prudential standards.
Revolut can now compete on deposits rather than relying only on its existing account and payment products. For incumbent banks, the pressure is immediate on savings pricing and mobile acquisition. For digital challengers, the licence shows how costly and valuable direct deposit capacity can be.
Thailand’s virtual bank contest is turning into a distribution and core technology test. CLICX brings banking, mobile and physical retail reach together, but readiness alone does not establish account growth. The first customer offers and their economics will tell competitors whether that combination works.
Buying a bank can give a lending platform more direct control of funding and products, but the approval process can disrupt the whole plan. OppFi’s withdrawal puts a price on regulatory uncertainty. Other fintech acquirers need credible alternatives while approval remains unresolved.
Banks now face a larger identity vendor combining onboarding, biometrics and fraud controls. That may reduce integration work, but a bigger provider can also command more pricing power. Buyers should compare approval accuracy, portability and contract terms before consolidating suppliers. The projected 200 million checks are useful scale context, not proof that the merger has improved results.
Amdocs has bought its way into the systems insurers use to administer policies, bill customers and settle claims. For EIS clients, the first questions are service continuity and integration cost. For competing vendors, the threat is a supplier that can combine core software with enterprise AI services. Actual insurer deployments will determine whether that combination pays off.
Data centre builders need insurance that spans power, construction, equipment and cyber exposures rather than isolated policies. Pooling underwriting capacity could make larger projects easier to finance, especially as AI raises infrastructure demand. The test is whether the facility offers useful terms and capacity once it opens.
Motor finance lenders can settle some claims before the wider redress process ends, but an early offer has to stand up to scrutiny. A poorly explained calculation can create another dispute. Firms should keep a clear record of the amount offered, the customer’s options and the effect on any open complaint. Faster resolution only helps when customers can understand the terms.
Accreditation is moving from legislation toward the application work firms must actually complete. Fintech applicants should test the proposed evidence requirements against their operating models now. The deadline is a chance to resolve costly ambiguity before onboarding and compliance processes become fixed.
The date finally gives payment teams a launch milestone they can plan around. For merchants and treasury operators, the value comes when their providers actually enable funds to arrive in seconds. Access still depends on testing, settlement arrangements and participant readiness. NCFA's RTR access rules guide shows why a system launch does not give every provider immediate access.
Pliant is making corporate payment infrastructure accessible to software agents, not just staff clicking through expense screens. That creates demand for clear limits, approvals and records of who authorized each instruction. Canadian firms already face these AI agent payment authority questions. The $80 million round funds expansion, while transaction controls and customer adoption will determine the product's value.
A recipient name that differs slightly from the bank's record can interrupt a legitimate payment or confuse a sender. Consistent matching gives banks a better chance to handle those cases without weakening fraud checks. PSPs should test character handling and near matches against real customer records, then measure false warnings and stopped payments. The rules work only when the customer experience is clear.
Ebury is preparing to sell instant Canadian payments through infrastructure it already uses abroad. That may shorten integration work, but customers cannot use an announcement to settle funds. The next milestones are access and testing under Canada’s RTR rules, followed by actual payment availability. Corporate clients should watch those dates before changing treasury processes.
The shift is from an AI assistant recommending a payment to software executing one under delegated authority. That turns spending limits, identity, revocation and transaction logs into core payment infrastructure. The same control questions are emerging across AI agent financial authorization and security.
Peak demand is where payment infrastructure becomes visible to a merchant. A provider that keeps checkout working during short bursts of traffic can directly influence completed sales, but the useful benchmark is measured performance rather than the integration itself. Transaction success, latency, conversion and processing economics will show whether the deployment strengthens Unlimit's position in India's competitive payments market.
OKX has given eligible US stablecoin holders a spending option without a separate manual cashout. The question is how the product handles conversion costs, availability and rewards once customers use it regularly. For payment firms, this adds another live case to the stablecoin card settlement market. It is not a Canadian card launch.
Bill S-8 would make registration harder for risky money services businesses and change how financial crime intelligence reaches regulated firms. Crypto ATM operators should review the proposed restrictions against their current licences and locations. Payment firms should examine what new information FINTRAC could demand. NCFA’s crypto ATM money laundering guidance offers background, but the bill is not yet law.
Crypto issuers and counsel now have more specific staff language to test against token design and disclosures. The guidance can narrow unanswered questions, but it is not legal immunity. Businesses should track which interpretations affect their product structures without presenting staff FAQs as binding law.
Singapore is attacking two barriers to insurance capital reaching infrastructure deals, expertise and capital cost. Insurers can assess the grant immediately, while asset managers should examine whether the proposed risk criteria fit the deals they can originate. The consultation could alter financing demand across infrastructure and securitized assets.
The implementation date turns the September rulebook into a balance sheet decision for affected banks. Clearing, custody, trading and financing teams can now price eligible activity against the final treatment. The distinction between tokenized deposits and crypto exposures remains important under Canada's OSFI 2027 crypto rules.
Quantum risk is becoming a technology planning issue long before a cryptographically relevant quantum computer arrives. Banks and payment firms need an inventory of the encryption they use, dependencies on vendors and a realistic replacement schedule. MAS is putting dates around that work rather than leaving quantum preparation as an open ended technology project. The timelines remain proposed while the consultation is open.
Banks don’t have a new AI rule to implement here. They do have a clearer view of the questions examiners may ask about consequential automated decisions. Can staff stop an agent? Who approved its authority? Can the bank explain a failure? Those are practical tests of AI agent authorization controls, even though the OCC guide imposes no new standards.
Moving fraud logic from engineering queues into the risk function can shorten the time between a new attack pattern and a production control. It also makes governance more important because rule changes can affect onboarding, approvals and declines immediately. The product will be more valuable if customers can show faster response without increasing false positives, exceptions or unexplained automated decisions.
The FCA is giving firms failure patterns they can test against now. Data lineage, change testing, AI inventories, conditional approvals and kill switch ownership all become concrete control questions rather than abstract governance principles. Similar issues are emerging across AI, programmable finance and financial crime regulation.
The merger puts regulated bank funding and embedded business lending under one owner. Liberis gains another way to fund offers delivered through its partners. Qred gains wider merchant distribution. Small businesses will judge the combination on approval times, price and repayment flexibility. Reach across 17 countries is valuable only if the lending economics hold up.
ESG ratings providers now have deadlines, not just broad calls for better disclosure. Firms selling ratings in the UK should review their conflicts controls, methodologies and customer explanations ahead of the June 2027 application window. Asset managers have work too. They need to know whether the ratings suppliers embedded in their products can meet the new standards before June 2028.
Tokenized deposits are becoming a treasury product for actual institutional customers, not just a bank demonstration. The commercial value rests on when money can move, how much liquidity must sit idle and what treasury systems can connect. Measured customer flows are the next test.
Clearing members can now use certain RMB bonds as margin instead of tying up as much cash. **More than RMB 400 million posted on day one** gives this a stronger operating basis than a policy proposal. The saving will depend on haircuts, custody charges and funding costs. Banks should measure the cash released, not just the amount of collateral accepted.
Wealthsimple could bring Canadian dollar digital assets to customers who would never open a crypto wallet themselves. CADD already exists, so this is a new distribution and reward announcement, not the launch of the stablecoin itself. NCFA covered CADD's original regulated issuance in May. The next test is how many clients use it for payments or cash management rather than simply collecting rewards.
Zero commission Canadian options put more pressure on trading fees, while faster order entry makes a difference for active clients. Direct indexing adds a tax planning product within accounts investors already use. The bigger competitive test is whether Wealthsimple can serve frequent traders without higher spreads or weaker execution. Its planned perpetual futures also bring suitability and leverage questions that matter as much as headline pricing.
Capital.com has permission to enter Singapore, but it still needs customers. The company plans to begin onboarding in 2027, so local brokers have time to prepare. Investors should compare the instruments, trading costs and safeguards actually offered at launch. Regulatory approval opens the market; it does not establish customer traction.
Canada’s RTR launch, proposed banking reforms and new digital asset rules make this a consequential week for financial innovation. Globally, firms are putting AI, tokenization and new payment infrastructure into practical use. For Canadian fintechs, the opportunity is in execution. Clearer rules, better access and products that solve real customer problems will determine who can compete and grow.
NCFA offers various curated resources to help founders and investors stay current on developments that impact fintech markets. Get the weekly Whisperer and related market intelligence through NCFA's newsletter, view the latest fintech news and insights, industry research, or launch into emerging financial innovation opportunities.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer to peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
November 5, 2026 | NCFA Story Intelligence | Risk Compliance And Regtech, Regulation And Policy, Digital Assets Blockchain And Tokenization

Canada added another layer to its anti money laundering system on November 3, 2026.
Bill S-8 would tighten registration for money services businesses, give FINTRAC more grounds to refuse or revoke registrations, add controls for crypto ATMs, restrict some large cash transactions and third party cash deposits, and let regulated firms receive more financial crime information from government and law enforcement.
Five days earlier, the Auditor General had delivered a very different AML announcement.
FINTRAC was taking nearly 4 months on average to provide requested financial intelligence. Half of the recipients surveyed said information sometimes arrived too late to help an active investigation.
A month before that, FATF had praised parts of Canada's system while still calling for stronger supervision, more complex money laundering prosecutions and better asset recovery.
Canada isn't short of rules.
It has spent more than 25 years adding them.
This is a story of Canada closing one financial crime gap after another, only to find that more reports and tougher rules don't automatically produce faster investigations, prosecutions or recovered money.
The 2022 truck convoy became one of the most visible turns in that story.
It wasn't the beginning.
FINTRAC Is Born and the Boundary Starts Moving 2000 to 2008
Canada's modern AML system begins in 2000. Parliament creates FINTRAC and requires suspicious transaction reporting and reporting of certain large movements of money. After the September 11 attacks, terrorist financing is added to the mandate. By 2006, Ottawa is already widening the system again with MSB registration, administrative penalties and broader compliance duties. FINTRAC is still young, but money is already finding routes the first rulebook didn't fully cover.
FINTRAC's institutional history traces the current system to legislation passed in 2000.
FINTRAC began receiving suspicious transaction reports and voluntary information in 2001. Terrorist financing was added after the Anti Terrorism Act.
Changes passed in 2006 introduced the MSB registration regime and gave FINTRAC authority to impose administrative monetary penalties. Registration came into force in 2008.
Canada starts expanding the system almost as soon as it builds it.
Banks and other reporting firms now have to tell FINTRAC when money looks suspicious. Investigators gain a national source of financial intelligence that didn't exist before, and regulated firms can no longer treat unusual transactions as someone else's problem.
But criminals aren't limited to bank accounts. Money can pass through companies, intermediaries, cash businesses, real estate and foreign accounts. The first rulebook catches more activity, and the routes around it become easier to see.
The First FATF Review Finds the Holes 2008 to 2016
FATF's 2008 review gives Canada's young system its first major international stress test. Ottawa gets credit for substantial reforms, but FATF still finds weaknesses in customer checks, supervision, beneficial ownership and FINTRAC's effectiveness. Canada spends the following years tightening many of those areas. By 2014, FATF removes Canada from regular follow up. Two years later, the next full review finds that some of the hardest problems weren't gone. They had moved deeper into the ownership and professional structures around the transaction.
The 2008 FATF evaluation called for stronger customer checks, more consistent supervision and better beneficial ownership information.
The 2016 evaluation found substantial progress but continued exposure through legal professionals and opaque companies and legal arrangements.
Lawyers couldn't simply be folded back into the same FINTRAC model either. A 2015 Supreme Court decision found that applying parts of the federal regime to legal counsel violated constitutional protections.
The financial system was becoming easier to monitor. Some of the people behind the money were still difficult to see.
Customer checks get stronger. MSBs register. FINTRAC gains penalties and more supervisory reach. A regulated firm has fewer excuses for not knowing who opened the account or sent the money.
Then investigators reach the company behind the transaction and can hit another wall. The account holder may be visible while the person controlling the corporation isn't. The search moves from the customer to the owner.
Canada Starts Naming the People Behind the Companies 2017 to 2019
Federal, provincial and territorial governments agree to improve beneficial ownership records and eliminate bearer shares. From June 2019, most federal corporations have to keep information on individuals with significant control. A numbered company can still stand between suspicious money and its owner, but investigators now have another record to pull when they start taking the structure apart.
The first federal requirement kept ownership information at the corporation.
That changes again in 2024. Most federal corporations must file information about individuals with significant control with Corporations Canada, and some of that information becomes publicly searchable.
It still isn't a complete Canadian system. Provincial and territorial corporate law means ownership information remains spread across jurisdictions.
FATF is still calling for progress toward a pan Canadian beneficial ownership system in 2026.
A shell company becomes less useful when investigators can identify the people with significant control. The ownership trail gets shorter, and legitimate companies get clearer record keeping duties.
The trail can still cross provincial registries, trusts and foreign entities. And while Canada is looking deeper into ownership, another way of moving value is growing outside the familiar bank payment path. The next gap starts with the money itself.
Crypto Opens Another Route for Value to Move 2020 to 2021
Virtual currency dealers and foreign MSBs serving Canadians come under FINTRAC requirements in 2020. Large virtual currency transaction reporting follows in 2021. Crypto is no longer treated as a separate financial world. If a business exchanges or transfers virtual currency for Canadians, the same questions about identity, source of funds and suspicious activity follow it there.
Crypto exchanges and payment firms now have to build registration, identity checks, records and reporting into products designed to move value quickly. Legitimate operators gain a clearer path into the Canadian market, but compliance becomes part of the product itself.
Bringing crypto inside FINTRAC doesn't cover every new way Canadians can collect or move money. A year later, crowdfunding and payment platforms show where the boundary still ends. The next expansion arrives in the middle of a national crisis.
The Convoy Turns a Gap Into Permanent Rules February to April 2022
The truck convoy makes another gap visible in real time. Ottawa invokes the Emergencies Act in February and temporarily brings crowdfunding platforms and certain payment providers under AML obligations. The emergency ends. The coverage gap doesn't. Two months later, Canada makes the change part of the ordinary system.
On April 27, 2022, new regulations permanently brought crowdfunding platforms and certain payment providers under FINTRAC as MSBs or foreign MSBs.
Registration, compliance programs, identity checks, record keeping and transaction reporting followed.
The federal explanation explicitly linked the change to crowdfunding and payment risks highlighted by the blockades.
The permanent rules also drew an immediate industry challenge over their scope, lack of consultation and compliance costs.
The convoy didn't start Canada's AML expansion. It exposed one channel the existing system hadn't fully captured.
Ottawa closes the gap quickly. Crowdfunding and payment firms that had built businesses outside traditional banking inherit FINTRAC registration, identity checks and reporting. The line around the regulated market moves again.
Legitimate platforms pay for the same controls. Staff, systems, records and audits become part of the cost of staying in business. The government closes one blind spot and pushes compliance deeper into smaller financial firms.
The Net Spreads Across More of Finance 2023 to 2025
The next expansion isn't built around one crisis. Mortgage businesses come under FINTRAC in 2024. Armoured car companies follow. In 2025, cheque cashers, factors, financing and leasing firms, title insurers and businesses serving private ATMs join them. Private information sharing between reporting entities also gets a legal route. By 2025, more than 38,000 businesses are inside FINTRAC's supervisory reach.
Canada's 2025 National Risk Assessment identifies vulnerabilities across payment providers, mortgage businesses, crypto assets, crowdfunding, real estate, MSBs and other sectors.
It also says criminals can exploit information gaps between reporting firms. Since March 2025, regulated entities can voluntarily share some personal information under approved codes of practice to detect money laundering, terrorist financing and sanctions evasion.
The system becomes less dependent on one firm spotting one suspicious transaction in isolation.
More businesses are now expected to recognize the same money from different sides.
A suspicious account at one institution can become more useful when another firm recognizes the same owner, wallet or transfer pattern. Activity that once ended inside separate compliance teams can start connecting across institutions.
That gives firms another job. They need controls around what can be shared, why it can be shared and who gets access. Canada gains more intelligence, while compliance becomes a bigger part of running the business.
FINTRAC Starts Throwing Firms Out 2025 to 2026
Then enforcement gets much harder to ignore. FINTRAC issued 6 notices of violation worth about $1 million in 2022 to 2023. In 2025 to 2026, it issued 35 notices worth more than $247 million. It also revoked 82 MSB registrations in one year, up from 12 the year before. A payments, FX, remittance or crypto firm can no longer treat registration as something it secures once and files away.
By May 2026, revocations were cutting across money transfer, FX, virtual currency and PSP businesses, including firms operating across several categories at once.
FINTRAC's 2025 to 2026 annual report confirms 82 MSB revocations and more than $247 million in notices of violation.
The escalation was already visible in Cryptomus's record penalty. FINTRAC imposed about $176 million after finding failures that included suspicious transaction and large virtual currency reporting.
Weak compliance can now threaten the economics of the company itself.
A strong operator can benefit when firms that ignore reporting duties or regulator requests lose market access. Banks and partners have more reason to trust an MSB that stays registered and responds when FINTRAC calls.
But the price of proving that compliance is uneven. Large institutions spread legal, data and monitoring costs across millions of customers. A startup can't. The regulator starts removing weaker operators just as the cost of being a strong one keeps rising.
Bill C-12 Makes Compliance Failures Much More Expensive March 26, 2026
Parliament gives FINTRAC much stronger enforcement tools. Maximum penalties rise sharply. Compliance orders become public. An entity that doesn't comply with an order can face a penalty of up to the greater of $30 million or 3% of global revenue. Ottawa can now hit weak controls much harder without waiting for police to prove a money laundering offence.
Bill C-12 received Royal Assent on March 26, 2026.
For prescribed violations, an entity can face a maximum penalty of $20 million. Aggregate maximums can also be tied to 3% of global revenue.
FINTRAC says the legislation increased some penalty limits by as much as 40 times.
A compliance failure can reach the boardroom long before it reaches a criminal courtroom.
FINTRAC no longer has to wait for a criminal case to hit a company hard. It can order fixes, impose much larger penalties and put compliance failures into public view. For regulated firms, the cost of weak controls can arrive long before police lay a charge.
But the money laundering case still has to be built somewhere else. Police need evidence, prosecutors need a case they can prove and assets have to be found before they disappear. Canada has made it faster to punish weak compliance. Catching and recovering the criminal money is still the slower job.
Ottawa Builds a New Agency for the Part FINTRAC Can't Do April 2026
A month later, Ottawa goes after that slower part. Bill C-29 proposes a Financial Crimes Agency to investigate serious and complex financial crime and help recover criminal proceeds. FINTRAC can find patterns and send intelligence. The new agency is meant to pick up the trail from there.
Bill C-29 was introduced April 27, 2026 and is now being considered by a House committee. The agency isn't operational yet.
The 2026 economic update put $352.7 million over five years and $82.1 million annually thereafter behind the proposed agency, alongside additional funding for specialized prosecutors and Finance Canada.
Its planned workforce includes police and civilian investigators, financial intelligence specialists and asset recovery experts.
Collecting more financial intelligence hasn't produced enough complex cases or recovered money on its own.
FINTRAC can connect reports across institutions and point investigators toward suspicious money. It can tell police where accounts connect and which transactions deserve another look.
Police still have to identify the people, gather admissible evidence and find the assets before they move again. Ottawa is creating another institution because financial intelligence doesn't arrest anyone or recover a dollar by itself.
Two Reviews Show Where the Money Is Still Escaping September to October 2026
By fall, Canada gets two report cards within a month. FATF finds a much stronger system with high quality financial intelligence, but still calls for better supervision, more complex money laundering prosecutions, stronger beneficial ownership coverage and more asset recovery. The Auditor General follows with a problem investigators can feel immediately. Useful intelligence isn't useful enough when it arrives months after police ask for it.
The 2026 FATF evaluation says Canada has a mature understanding of financial crime risk and produces high quality intelligence valued by law enforcement.
FINTRAC says FATF found its intelligence was used in 94% of the money laundering and criminal possession investigations reviewed by assessors.
The Auditor General's October 29 audit found that FINTRAC took nearly 4 months on average to provide intelligence when law enforcement flagged a concern.
Half of surveyed recipients said the information sometimes arrived too late to help an ongoing investigation.
The information can be valuable and still lose value while the money keeps moving.
Canada now has more reporting entities, ownership data, penalties, registration controls and financial intelligence than at any earlier point in FINTRAC's history. The reporting side of the system is bigger and harder to ignore.
Investigators still need the information before assets move. Prosecutors still need complex cases they can prove. Governments still need to recover more of the money. Canada has become better at spotting suspicious activity than finishing the journey from report to recovered proceeds.
Bill S-8 Tightens the Perimeter Again November 3, 2026
Five days after the Auditor General's report, Bill S-8 arrives with another set of controls. MSB registration would get tougher. Crypto ATM operators would face more checks and reporting. Some large cash activity would be restricted. Law enforcement could send more information back into regulated firms. Canada is still closing entry points while its newest reviews are pressing the system to do more with the information it already has.
Bill S-8 is proposed legislation. It isn't law.
The bill would require crypto ATM operators to verify every user's identity, keep transaction records and report each ATM transaction to FINTRAC within 15 days. It would cap a person's transactions at a crypto ATM at $1,000 within 24 hours.
It would prohibit certain third party cash deposits and restrict some cash payments, donations or deposits of $10,000 or more, subject to exemptions and regulations.
It would add new grounds for refusing or revoking MSB registrations, including false or misleading information, and give the Minister of Finance new review and direction powers tied to national security and financial system integrity.
Bill S-8 brings crypto ATM laundering risks back into the centre of the debate after FINTRAC had already documented the use of cash, money mules, private wallets and higher risk exchanges around the machines.
Another gap may close. The pressure on investigators, prosecutors and asset recovery doesn't disappear with it.
Stronger registration can remove operators that lie about their business, ignore regulator requests or raise serious integrity concerns. Legitimate MSBs, payment companies and remittance firms may benefit when weak operators lose access.
Every added check still needs people, systems and legal work. Small firms spread those costs across fewer customers than banks do. Canada can shut bad operators out and still make the door heavier for good ones to open.
Bill S-8 may close more holes around MSB registration, crypto ATMs, cash deposits and financial crime information sharing.
But Canada is reaching the point where adding another reporting obligation produces less value if the rest of the chain can't keep up.
FINTRAC can collect more information.
Banks, fintechs and MSBs can build better controls.
Law enforcement can receive more leads.
None of that helps much if investigators get the intelligence too late, prosecutors can't build enough complex cases or criminal assets are gone before authorities can reach them.
That is where Canada's next AML chapter is heading.
The proposed Financial Crimes Agency could give Ottawa more capacity to investigate serious financial crime and recover proceeds. Bill C-12 gives FINTRAC much stronger leverage over regulated firms. Bill S-8 would tighten who gets into parts of the market and how certain transactions are handled.
Those tools now have to work together.
For fintechs, that creates a different kind of pressure.
The firms that survive stricter registration and supervision may become easier for banks, investors and customers to trust. But every new control also costs money, and smaller operators don't have the same compliance scale as the country's largest financial institutions.
Canada can keep tightening the perimeter.
The bigger question now is whether the system inside that perimeter can move fast enough to catch the money, recover it and still leave room for legitimate firms to compete.
That answer won't come from the next amendment.
It will come from the cases Canada is actually able to finish.
Will Canada's next AML gains come from tougher rules, or from finally turning more financial intelligence into completed cases and recovered assets?
Has Canada reached the point where better enforcement matters more than another layer of AML rules?
Share this story → Explore related intelligence → Subscribe
How faster payments, AI, digital identity and fraud are changing the controls financial firms need before money moves.
How ownership, sanctions, foreign interference and financial crime are becoming connected parts of Canadian supervision.
Why Ottawa is connecting fraud prevention, information sharing and a new federal Financial Crimes Agency.
The 2022 rule change that permanently brought donation crowdfunding and certain payment providers into Canada's AML regime.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Oct 24, 2026 | Last Updated Nov 4, 2026 | NCFA Fintech Whisperer | Regulation And Policy, Capital Markets Infrastructure And Funding, Artificial Intelligence And Data, Cybersecurity Fraud And Financial Crime, Competition And Market Structure, Cross Border Payments And FX, Wealthtech Investing And Trading, Digital Banking And BaaS, Digital Assets Blockchain And Tokenization, Payments Infrastructure And Money Movement, Risk Compliance And Regtech, Sustainable Finance ESG And Financial Inclusion

Image: Freepik
NCFA Fintech Whisperer tracks weekly fintech market intelligence that changes how financial markets operate. Coverage spans NCFA's full financial innovation taxonomy, with Canada first and global developments included when they materially affect rules, market access, competition, capital, technology adoption, distribution, risk or execution. We focus on changes that founders, investors, financial institutions, regulators and operators may need to act on, not simply what's making headlines. This page is updated throughout the week as material developments emerge, then closed and archived before the next weekly window begins.
Missed a prior week's Fintech Whisperer? Browse December 6 to 12, 2025, December 13 to 19, 2025, January 1 to 9, 2026, January 10 to 16, 2026, January 17 to 23, 2026, January 24 to 30, 2026, January 31 to February 6, 2026, February 7 to 13, 2026, February 14 to 20, 2026, February 21 to 27, 2026, February 28 to March 6, 2026, March 7 to March 13, 2026, March 14 to March 20, 2026, March 21 to March 27, 2026, March 28 to April 3, 2026, April 4 to 10, 2026, April 11 to 17, 2026, April 18 to 24, 2026, April 25 to May 1, 2026, May 2 to 8, 2026, May 9 to 15, 2026, May 16 to 22, 2026, May 23 to 29, 2026, May 30 to June 5, 2026, June 6 to June 12, 2026, June 13 to June 19, 2026, June 20 to June 26, 2026, June 27 to July 3, 2026, July 4 to July 10, 2026, July 11 to July 17, 2026, July 18 to July 24, 2026, July 25 to July 31, 2026, August 1 to August 7, 2026, August 8 to August 14, 2026, August 15 to August 21, 2026, August 22 to August 28, 2026, August 29 to September 4, 2026, September 5 to September 11, 2026, September 12 to September 18, 2026, September 19 to September 25, 2026, September 26 to October 2, 2026, October 3 to October 9, 2026, October 10 to October 16, 2026, October 17 to October 23, 2026.
A shorter national deadline changes staffing, escalation and evidence requirements for dealer complaint teams. Firms that still rely on manual handoffs will have less room for delay. Compliance vendors also get a clearer design target for case routing, document collection and management reporting.
The FCA has converted a promotions case into a practical market exit. Offshore location doesn't protect a crypto platform from UK conduct rules when it still reaches UK customers. Exchanges, affiliates and distribution partners need controls that can prove where promotions land and who can still open or fund an account.
Tokenized collateral now has a defined supervisory route into central clearing. CCPs can design against that route, but approval will still turn on liquidity, custody, legal certainty and access during stress. That connects directly with NCFA’s work on tokenized assets becoming market infrastructure.
The UK equity tape now has a clearer business model and a harder resilience test. Trading venues and prospective tape operators need to price income sharing, service continuity and incident reporting together. Data coverage alone won’t win this market.
Cross border clearing works only when supervisors can rely on each other. This agreement gives Indian clearing corporations a clearer route into UK oversight while preserving the Bank of England’s financial stability role. The next test is whether recognition and access become easier in practice.
The implementation window is effectively over. Fund managers and distributors now need their liquidity controls, derivatives processes and authorization workflows ready for the November 1 rules. The value of the guidance is operational certainty before the new regime goes live.
Canada now has enough detail for firms to start building against the rulebook rather than policy direction. Issuers can model reserve composition, custody, redemption costs, reward structures and Bank of Canada registration now. Payment firms also need to map where stablecoin activity pulls them into RPAA oversight. NCFA's stablecoin regulatory framework tracks those layers together.
Tokenized markets can't run continuously on stale prices. Chainlink is closing that gap with a single pricing reference that stays available when the underlying exchange is shut. The commercial test is whether continuous data supports deeper weekend liquidity and broader use of traditional assets as onchain collateral.
Fund managers can now add a regulated digital issuance layer without replacing the service providers they already use. That lowers the cost of testing tokenized share classes and strengthens the case for tokenized assets as market infrastructure. Live issuance volume and distributor adoption are the next proof points.
Thailand is working to give crypto exchanges a route into regulated derivatives trading without forcing them to build separate businesses. That could lower expansion costs while bringing trading, clearing and risk controls under closer supervision. Combined with Thailand's recently finalized crypto ETF rules, the proposals give exchanges and investment firms more ways to serve investors. The next test is whether the final licensing requirements make commercial entry practical.
A shared ledger becomes more useful as both lenders and large borrowers join it. Goldman adds another major institutional node to 1Source and strengthens the case for replacing bilateral reconciliation with a common record. The next proof point is transaction volume and how quickly more counterparties stop running parallel comparison processes.
Tokenization has moved from DTCC’s roadmap into live depository infrastructure. Banks and asset managers can now test whether tokenized positions improve collateral use, liquidity or settlement while keeping the underlying DTC rights intact. NCFA’s crypto custody intelligence tracks the same shift toward regulated tokenized market infrastructure.
HKEX is pulling more fund distribution work onto shared infrastructure. That can reduce duplicated integrations across managers, distributors and transfer agents. The commercial test is whether the larger network lowers servicing cost and makes new fund distribution easier.
Archax is extending tokenized government debt from issuance into continuous institutional access. The firm has already demonstrated onchain delivery versus payment with tokenized cash. Now the question is whether euro investors use the product for treasury, collateral and liquidity management.
Public blockchain infrastructure is moving into institutional note issuance with regulated distribution attached. Mirae controls the instrument lifecycle while Marketnode provides the investor route. That fits the broader shift NCFA tracks in tokenized capital markets infrastructure.
Private market tokenization needs usable exits, not just digital ownership records. Pontoro is testing that problem with a live pool that combines liquid assets and private fund interests. NCFA has tracked the same liquidity constraint in tokenized asset liquidity infrastructure.
This pushes onchain funds beyond cash and credit into public equities. Janus Henderson already has more than $1 billion in onchain strategies, so distribution and servicing scale now matter more than proof of concept. The larger question is how quickly tokenized funds become normal market infrastructure.
Institutional DeFi has had a custody problem. Institutions often need assets to stay inside qualified custody, while lending protocols expect collateral to interact with onchain contracts. CustodySync creates a bridge between those control models. Usage will show whether that bridge can turn idle custodied assets into repeatable financing activity.
The commercial test for tokenized funds just changed. The question is no longer whether a regulated fund can be put on chain. It's whether investors will use continuous liquidity when the underlying portfolio still operates on conventional market hours. Spreads, market maker depth and off hours price gaps now become the metrics worth watching.
For venue operators, this is an access issue, not a documentation exercise. Firms serving Malaysian institutional flows need to know whether their platform, instruments and client model fall inside the approval perimeter before November 1. Banks and liquidity providers should be checking the venues they rely on at the same time.
This is where digital bond settlement on Pontes starts competing on infrastructure, not demos. The value is interoperability with markets institutions already use. Banks, custodians and issuers can now compare digital issuance with conventional settlement on liquidity, collateral mobility, operating cost and execution time.
This is distribution infrastructure attached to a large existing fund, not a sandbox asset. The Schroders tokenized money market fund approval provides another regulated institutional benchmark. The next proof point is whether tokenized access changes subscriptions, settlement, collateral use or investor reach. Fund managers should watch where wallet based access removes friction and where the conventional fund stack still does the heavy lifting.
AI is now changing the cost structure behind open finance connectivity. Powens is using agents inside production engineering while keeping human approval before release. For operators, the useful benchmark is whether faster connector maintenance improves uptime and coverage without weakening control evidence. NCFA’s open banking intelligence tracks those operating requirements.
The more important signal is operating expansion, not the financing round. Casap is moving agentic automation from one regulated workflow into several functions where decisions affect customers, losses and recovery. Financial institutions adopting similar systems need clear authority boundaries, exception handling and evidence for every automated action as AI agent financial authorization and security becomes an operating control.
Banks are setting the access rules before personal AI agents become a normal financial interface. Canada’s consumer driven banking system is built around permissioned data sharing, while agent access adds delegated authority and transaction control. Authentication, consent and liability now need a workable model for agents as well as people.
The scale makes endpoint access, service permissions and withdrawal authorization a board level control issue for digital asset platforms. The final technical account will matter more than early attack theories. Exchanges, custodians and infrastructure vendors should compare privileged access, transaction approval and emergency freeze controls against the failure path Binance ultimately confirms.
Quantum migration now has federal target dates, which turns a distant security issue into a planning deadline. Financial firms need cryptographic inventories, vendor commitments and replacement schedules before 2030 pressure arrives. NCFA’s post quantum planning analysis explains why the work has to start well before vulnerable systems fail.
App stores are payment gatekeepers, not just software distributors. South Korea's orders challenge the fees and restrictions that make competing payment systems harder to sell. Developers could gain more control over checkout costs and customer payments, while payment providers get a better chance to compete. The commercial test is whether Google and Apple implement the required changes without replacing old restrictions with new ones.
Prediction markets are now a jurisdiction fight over who controls access to federally regulated contracts. The outcome can change where platforms can operate and how state restrictions interact with CFTC registration. Canada is watching the same category develop through firms such as Verdx and its event contract dealer application.
Thai issuers now have firm deadlines to build emissions records, reporting controls and assurance processes that investors can check. That's commercial work for data providers, auditors and compliance software firms. Canada is taking a different approach with its voluntary green and transition taxonomy. Firms serving both markets will need to distinguish mandatory company disclosures from voluntary investment classifications. The immediate priority in Thailand is getting the data and controls ready before the first reporting year.
Connecting RTR and TIPS could give Canadian payment providers a faster, lower cost alternative to traditional international transfers. The commercial opportunity depends on who gets access, how foreign exchange works and what transactions cost. Firms preparing for Canada's Real-Time Rail access requirements should include European connectivity in their planning, but it's not a service they can offer customers yet.
Movantis is adding stablecoin settlement inside an existing payments network rather than launching a separate crypto product. With more than $60 billion in annual flow already on its infrastructure, even a narrow corridor can become meaningful quickly. NCFA’s programmable stablecoin payments opportunity tracks the same commercial shift toward settlement, treasury and payout infrastructure.
This is a live enterprise payment deployment rather than a partnership announcement. Flywire is being embedded inside a marketplace where cross border settlement, foreign exchange and reconciliation are part of the transaction flow. The next proof point is whether the integration lowers payment friction and cost at scale across complex B2B transactions.
Tokenized investing is moving from single assets into packaged portfolio products that can travel across wallets and chains. The early $40 million uptake gives Ondo more evidence than a typical launch. The next test is whether multi asset tokens attract sustained balances and repeat use beyond crypto native investors.
Canadian brokerage competition is moving from AI research tools into account connected workflows. Webull keeps final trade approval with the investor, but the assistant can now reach live balances, positions and order preparation. Questrade introduced a similar Canadian brokerage connection in July, giving the market two live models to compare.
The proposed transfer would consolidate another sponsor bank portfolio inside an institution already operating at material BaaS scale. Fintech partners will be watching program migration, risk appetite and service continuity because banking as a service partnerships depend as much on the regulated bank relationship as on the front end product.
This gives Canada a major test of whether a large incumbent can add a modern core without waiting for a full bank replacement program. Starting with Simplii gives CIBC a digital brand where product speed matters. Watch migration scope, product release cycles and whether the platform eventually expands deeper into CIBC's retail stack.
The charter gives Ripple a federally supervised operating base around reserves and custody, building on the earlier U.S. crypto trust charter approvals. The next test is execution. Institutions will be watching how quickly the bank becomes live capacity and whether Ripple can turn the charter into deeper relationships across payments, custody and capital markets.
The important change is distribution. Existing MetaMask users get Stellar access without installing another wallet, while Stellar gains a direct route into a large self custody user base. Usage will show whether easier access produces more balances, transfers and token activity.
Stablecoins and tokenized assets need deep markets after issuance. Curve gives Stellar a familiar liquidity engine without routing users through another chain. NCFA has tracked the same institutional requirement in tokenized asset liquidity infrastructure. Depth and spreads will determine whether this deployment becomes commercially important.
Banks can add Stellar assets without building another custody stack from scratch. That lowers integration cost and lets network choice depend more on the asset and client use case. NCFA’s crypto custody intelligence tracks why regulated custody and issuance controls are becoming core tokenized market infrastructure.
CADC now has a securities law distribution route that can reach Canada nationally through regulated and exempt participants. That gives wallets, trading platforms and financial institutions another domestic stablecoin model to assess alongside the proposed federal regime. NCFA's Canada stablecoin market entry analysis explains the broader issuer and infrastructure choices opening around these rules.
The live signal is custody access inside BNY's institutional control environment. That removes one practical barrier for firms that can use digital assets only through established custody, governance and operating processes. Adoption now depends less on whether custody exists and more on what institutions are permitted to do with the assets once held.
The operating change is runtime payment choice. An agent can select how money moves instead of following a payment rail fixed earlier in the workflow. That flexibility increases the importance of transaction limits, recipient validation and revocation because AI agent payment authorization now has to hold across several rails, not just one.
The integration reduces how many providers a Solana payments company has to stitch together before it can move money end to end. That makes network choice less important than reach, compliance and payout coverage. The commercial test is whether one orchestration layer can lower integration cost enough to pull more payment volume onto stablecoin rails.
Konek is taking account based payments into merchant distribution rather than waiting for a new national rail to create the use case. PayFacto gives Interac a practical channel into commerce where card economics already matter. NCFA's Canadian online payments analysis tracks how cards, wallets and bank payments are competing for that checkout.
WalletConnect gives Stellar another route into wallets and payment applications at large distribution scale. Merchant rollout in Bermuda still comes later, so adoption should be measured first through wallet connections and payment volume. The direction fits NCFA’s programmable payments opportunity around wallet access, settlement and merchant acceptance.
Authentication is becoming part of payment orchestration rather than another merchant integration. Adyen can now route an eligible shopper into device based authentication from inside its existing stack. Merchants should watch both conversion and fraud because the commercial win requires improvement on both.
This links stablecoin distribution, institutional settlement, treasury and financing inside one large trading group. The important test is usage. Watch settlement volume, treasury adoption and whether RLUSD becomes a working asset across Robinhood's institutional flows rather than another listed stablecoin.
This phase puts migration work into merchant roadmaps. PSPs and payment teams now have to decide when to update integrations, how long to support both rails and which new Wero functions justify moving early. The long overlap gives merchants breathing room, but it also creates a two year distribution contest for the providers handling the transition.
Faster intelligence only matters if it reaches the payment decision before funds move. The integration shortens the gap between a new risk signal and transaction screening while keeping policy configuration with the financial institution. That makes data freshness, alert quality and audit evidence key measures of whether AI and financial crime compliance actually improve in production.
Independent risk analysis is moving into the same environment where onchain capital is allocated. That can make vault selection and governance more comparable for institutions that need third party evidence before deploying funds. The next step is whether protocols and investment committees begin using the assessments as a formal control rather than optional information.
A$260 million turns weak AML controls into a board level cost. Financial firms should read the judgment as an operating warning on customer risk assessment, monitoring and program evidence. The penalty also raises the price of waiting until supervisory concerns become enforcement.
Tokenized assets become easier to scale when compliance rules can travel with the transaction instead of being checked in a separate manual process. Further is testing that model inside a regulated financial center. The critical proof point is whether institutions adopt the controls in live issuance and trading workflows.
OrigenLink changes the handoff between a bank and an alternative lender. Instead of losing a customer when the bank cannot make the loan, the institution can keep the relationship and add another credit path behind its own brand. That gives banks a way to expand SME lending without building every underwriting and servicing capability internally.
Construction finance exposes the working capital problem in unusually clear terms: businesses often have confirmed work but still need liquidity before invoices are paid. Flex Line adds another embedded credit option for that gap and extends the broader shift toward small business working capital and lending being delivered closer to the operating workflow.
Canada's proposed stablecoin rules would require 100% daily reserve backing, redemption within three business days and a maximum 1% redemption fee, with implementation targeted for fall 2027. Meanwhile, Ripple secured final OCC trust bank approval, BNY opened institutional custody for XRP and RLUSD, and Robinhood brought RLUSD into its trading infrastructure, reaching a platform with 28.6 million funded customers. Companies that control custody, distribution and settlement stand to gain.
Canada's challenge is to turn its regulatory framework into commercially viable infrastructure before global networks capture the market.
NCFA offers various curated resources to help founders and investors stay current on developments that impact fintech markets. Get the weekly Whisperer and related market intelligence through NCFA's newsletter, view the latest fintech news and insights, industry research, or launch into emerging financial innovation opportunities.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer to peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
October 30, 2026 | NCFA Story Intelligence | Digital Assets Blockchain And Tokenization, Cybersecurity And Fraud, Competition And Market Structure

On October 29, 2026, Binance suffered unauthorized withdrawals with an estimated US$6.3 billion impact, while Polymarket suffered a separate third party breach that forced its international prediction market to halt trading. Binance says the attack may have started with a compromised DevOps engineer’s laptop. Polymarket says one of its third party providers was compromised. The Binance hack and Polymarket breach aren’t known to be connected, but both exposed a similar weakness. Neither required the underlying blockchain to fail.
At Binance, the attacker reached systems capable of submitting withdrawal transactions. The exchange says it has found “no evidence of any wallet private key leak.” About US$3 billion has been frozen onchain, and Binance says customers won’t absorb the loss. Deposits are operating normally. Withdrawals remain paused while the exchange rebuilds parts of the withdrawal service.
Polymarket faced a different failure. Its international exchange entered cancel only mode at 2:05 p.m. ET, identified the compromised provider at 2:37 p.m., prepared to resume trading at 2:55 p.m. and marked the incident resolved at 3:05 p.m. Polymarket says “Anyone who has been impacted will be made whole.” The platform is operating again, but full reimbursement of every affected user hadn’t been independently confirmed at the latest verification cutoff.
Binance shows what can happen when attackers reach the systems that authorize money movement. Polymarket shows how hostile code can reach customers through software sitting between them and the market. In both cases, the financial rails could keep processing instructions after the instructions themselves had been compromised.
The Binance Hack Starts Before the Money Moves October 28 to 29
The theft looks almost instant in a headline. It wasn’t. TRM Labs says activity tied to the Binance operation began at least 36 hours before the main withdrawals. Its reconstruction found funding, testing and preparation before most of the money left in roughly 20 minutes starting around 20:05 UTC on October 29.1
TRM attributes the Binance hack with high confidence to North Korea’s TraderTraitor operation. Binance hasn’t made that attribution, and no public law enforcement finding had confirmed responsibility for this attack at the latest verification cutoff.
The money moved in minutes. The operation appears to have been prepared much earlier.
TRM says its assessment draws on onchain and offchain intelligence and similarities with earlier TraderTraitor operations. The firm points to advance preparation and transaction behaviour that it says match previous North Korea linked attacks.
There is history behind that assessment. In February 2025, the FBI formally attributed the US$1.5 billion Bybit theft to North Korea and identified the activity as TraderTraitor.2
That earlier attribution doesn’t prove who attacked Binance. Binance hasn’t identified the perpetrator. Until law enforcement reaches its own conclusion, North Korea remains an attributed assessment rather than a confirmed finding.
TRM estimates approximately US$6.36 billion moved from Binance wallets across ten blockchains. Elliptic independently calculates about US$6.43 billion.
Binance’s official estimate remains approximately US$6.3 billion. Different pricing times produce small differences, but all three calculations land around the same extraordinary number.
US$6.3 Billion Spreads Across Ten Blockchains October 29
Elliptic estimates roughly US$3.80 billion left through Ethereum based assets alone. Another 18,270 BTC worth about US$1.48 billion moved, together with hundreds of millions of dollars across Tron and other networks.3
This wasn’t one token leaving one wallet. Assets moved across different networks and different forms of money before Binance stopped withdrawals.
The recovery options split immediately. Stablecoin issuers could freeze supported tokens. Bitcoin and ether could be watched moving across public ledgers, but no issuer could switch them off.
The asset the attacker held started determining what Binance could get back.
Elliptic calculates US$3.80 billion on Ethereum, including about US$1.9 billion of USDT and US$823 million of USDC. It also identified 18,270 BTC worth about US$1.48 billion and roughly US$612.7 million of USDT on Tron.
Most of the stolen value therefore sat in a small number of large positions, but those positions didn’t carry the same recovery rights. Tether and Circle could intervene in their tokens. No company could impose the same freeze on native bitcoin.
Token prices can change the dollar value. The control rights don’t change with the price.
Binance Says the Private Keys Didn’t Leak October 29 to 30
Binance’s most surprising technical finding so far is what the attacker apparently didn’t steal. The exchange says it has found no evidence that wallet private keys leaked. Its initial investigation points instead to a compromised DevOps engineer’s laptop that may have opened access to a service container used to submit unauthorized withdrawals.
The investigation has since widened beyond one computer. Binance says the incident involved multiple factors and that its security team is tracing the complete attack path through the withdrawal system.4
Independent investigators go further. TRM believes Binance’s signing infrastructure was compromised. Elliptic reached a similar conclusion after examining signed withdrawals across several chains and prepared authorizations on Ethereum.
Binance has promised a full technical postmortem once the investigation is complete.
If the forensic reconstruction holds, the attacker didn’t need the keys. Reaching the machinery deciding what those keys should sign was enough.
NCFA saw a striking variation of the same problem only weeks earlier. How 4,000 BTC Left Liquid Network Without A Stolen Key showed how nearly an entire reported Bitcoin reserve could leave through an apparently valid process even when the obvious authorization key remained intact.
A compromised employee device can sit several steps away from a private key and still reach systems that decide which transactions get signed.
For an exchange, authorization controls become part of custody whether the private key leaks or not.
The Race to Freeze Billions Begins Minutes After the Theft
Once the withdrawals landed, the attacker started changing the asset mix. Stablecoins such as USDT and USDC can be frozen by their issuers under certain conditions. Bitcoin and ether can’t.
Elliptic estimates roughly US$786 million of stablecoins was converted before freezes took effect. Some swaps were completed at prices well below prevailing market value. Getting out appeared to matter more than getting a good price.
TRM separately traced large USDT conversions into ETH. It also found an attacker wallet using USDT as collateral in Aave to borrow ETH before controls tightened.
The attacker was willing to lose money to hold assets that were harder to stop.
Elliptic says the attacker’s main Ethereum wallet received stolen USDT at 20:24 UTC. Tether froze about US$1.18 billion of USDT 37 minutes later and then followed funds into additional attacker addresses.
Circle froze about US$823 million of USDC in the same main wallet soon afterward. Ripple, World Liberty Financial, Paxos, First Digital and other ecosystem participants also acted on supported assets.
By 08:00 UTC on October 30, Elliptic had independently verified about US$2.84 billion frozen. Binance later put the verified total at roughly US$3 billion. Attack speed and issuer response were competing in real time.
Tether, Circle and other issuers could immobilize supported balances while stolen assets were still moving.
Bitcoin and ether stayed visible but movable. Tracing the money and controlling the money were two different powers.
Frozen Crypto Isn’t Recovered Crypto October 30
The US$3 billion frozen figure sounds like half the money came back. It didn’t.
A frozen stablecoin balance may no longer be movable, but Binance doesn’t automatically possess it again. Returning the asset can still depend on issuer action, legal process and cooperation across companies and jurisdictions.
Investigators can also know exactly where bitcoin or ether sits without controlling it. Binance can separately replace assets from its own balance sheet even while stolen funds remain frozen or under attacker control.
Frozen, recovered and reimbursed are three different numbers.
NCFA visualization. Sources include Binance, Elliptic and TRM Labs. Frozen assets aren’t the same as recovered assets or customer reimbursement.
Binance Puts US$6.34 Billion Behind Customer Losses October 30
Binance then changes the financial story.
The exchange says it has allocated more than US$6.34 billion of company resources to cover the incident. About US$5 billion is already held in affected token assets. Binance says it is buying the remaining assets through market and over the counter channels so the replacement portfolio matches what was lost.5
Those figures don’t include the roughly US$3 billion already frozen.
Binance is replacing its asset position while the recovery effort continues separately. SAFU alone is far smaller than the incident, so protecting customers depends heavily on broader company resources.
A US$6.3 billion hack is now testing Binance’s liquidity, reserves and ability to absorb a loss without passing it to customers.
Estimated impact is about US$6.3 billion.
Company resources allocated exceed US$6.34 billion.
Matching affected tokens already held total about US$5 billion.
Remaining replacement purchases are roughly US$1.34 billion.
Frozen onchain stands at roughly US$3 billion and is separate from the company allocation.
The technical postmortem and updated Proof of Reserves are still pending. Those releases should show what failed, what changed and whether customer liabilities remain fully backed after remediation.
“Withdrawals remain paused while our team completes a security revamp.”
Binance says deposits are operating normally and expects withdrawals to resume within 48 hours. View the official Binance update.
Polymarket Breach Halts Trading for One Hour October 29
Polymarket’s breach followed a different path.
Its international exchange entered cancel only mode at 2:05 p.m. ET. At 2:37 p.m., Polymarket said a third party provider had been compromised and the issue was fixed. Trading was prepared for restart at 2:55 p.m., and the incident was marked resolved at 3:05 p.m.
Reuters identified the provider, through a source familiar with the matter, as DebugBear, a website performance monitoring company. DebugBear separately acknowledged its own security incident and advised customers using its Real User Monitoring product to remove the embedded code.6
Polymarket hasn’t publicly named the provider. Its international platform is now operational.
The exchange came back in an hour. Customer recovery took a different clock.
Security researchers recovered malicious JavaScript distributed through infrastructure linked to the compromised monitoring service. The code checked whether a Polymarket visitor was already logged in, then examined balances and prediction market positions.7
Depending on the account setup, the script could try to sell positions, transfer position tokens or move cryptocurrency. Researchers didn’t identify a routine whose central purpose was stealing a password, seed phrase or private key. The code reused authority already available inside the authenticated application.
One outside analysis traced the attack path through 710 deposit wallets and 731 addresses, while stressing that the address count doesn’t equal the number of victims. A customer could authenticate correctly and still encounter hostile software after login.
Polymarket hasn’t confirmed a final loss figure or victim count. Outside estimates range from about US$2.2 million to US$2.7 million.
Polymarket says affected users will be made whole. Full reimbursement hadn’t been independently verified at the latest cutoff.
Polymarket Is Hit Through a Vendor Again June to October 2026
October isn’t Polymarket’s first recent third party compromise.
In June, Polymarket confirmed that a compromised outside vendor allowed malicious code into its website for some users. The company acknowledged that funds were stolen and said victims would be refunded in full. Outside researchers estimated losses around US$3 million.8
Four months later, another outside service sits inside another loss event.
The company has also been moving deeper into regulated financial markets. Polymarket Earns Approval to Relaunch in the U.S. followed its return path after acquiring a regulated derivatives exchange and rebuilding access to the American market.
The business is becoming more institutional while its customer experience still depends on monitoring tools, browser code, authentication services and outside software.
Polymarket can decentralize parts of the market without decentralizing every dependency needed to reach it.
The Weak Point Moves Outside the Blockchain 2025 to 2026
The Binance hack and Polymarket breach are separate, but both cut through the old idea that crypto security is mainly about protecting a private key.
In February 2025, attackers stole roughly US$1.5 billion from Bybit. The FBI later attributed the theft to TraderTraitor. Investigators said the attack manipulated the approval process around a legitimate transaction rather than breaking Ethereum itself.
Now Binance says its wallet private keys appear intact while investigators examine the systems around transaction approval. Polymarket’s market also kept functioning while malicious web code allegedly reused authority inside logged in customer sessions.
The blockchain can keep doing exactly what it is told after the instruction itself has been compromised.
Founders and institutions building on digital assets can’t treat security as a wallet problem alone. Employee devices, access rights, transaction limits, supplier controls and approval workflows all sit inside the same chain of trust that protects the assets.
What the Binance Hack Means for Canada October 2026
Five days before the Binance and Polymarket incidents, Canada published proposed Stablecoin Regulations for consultation.
The proposed rules require covered issuers to maintain reserves at least equal to outstanding stablecoins at the end of each day, use qualified Canadian custodians and support redemption at par. They also add governance, risk management, data security, incident reporting, recovery and resolution requirements. Consultation closes December 23, 2026, with implementation intended for fall 2027.9
NCFA’s Canada Proposes Stablecoin Market Entry Rules examines the commercial choices created by that framework. The Binance hack makes one of those choices unusually visible. Stablecoin issuers weren’t passive observers after the theft. Their ability to freeze supported assets changed the recovery picture by billions of dollars.
Canada’s proposed rules don’t govern the Binance or Polymarket incidents, and there is no basis to claim they would have prevented either one.
Canadian banks, PSPs, wallets and fintechs still face the same operating questions. Who can authorize the transaction, who can stop it, which suppliers can touch it and who carries the loss when the control chain breaks?
Binance also carries unusual Canadian context. Binance Left Canada but the Fight Reached Supreme Court traced how the exchange’s Canadian exit became a wider fight over regulatory reach and company records. This security incident tests a different side of institutional credibility. Binance now has to show that its own controls can withstand a failure large enough to move billions.
Binance hasn’t finished proving the recovery works just because deposits are back. Withdrawals still have to resume without reopening the weakness that forced them to stop. The exchange also needs to show that replacement assets fully support customer liabilities after billions moved out. Its promised postmortem needs to explain how unauthorized withdrawals passed internal controls and what changed before the system reopened.
The updated Proof of Reserves will put numbers behind the customer protection promise. Binance says customers won’t absorb the loss. Reserve data can show whether the assets behind customer balances have actually been restored.
Polymarket isn’t finished once trading comes back either. Affected users still need to be fully reimbursed. Two third party compromises in four months also leave a harder question over the business. **How much outside software should be able to touch an authenticated customer session before the market itself becomes exposed?**
The Binance hack showed that a platform can lose billions without evidence that its private keys were stolen. Polymarket showed that a market can remain technically intact while hostile code reaches customers through a supplier. Stablecoin issuers then froze billions of dollars that native bitcoin and ether issuers couldn’t freeze because no such issuer exists. Binance’s own balance sheet became the backstop after those controls ran out.
That is where the competitive line in digital finance is moving.
The strongest platforms won’t be the ones that simply claim secure infrastructure. They’ll be the ones that can **limit what a compromised employee, supplier or software component can do, stop bad instructions before settlement, isolate losses quickly and carry the financial weight when prevention fails**.
Binance and Polymarket are now being measured on exactly that.
The blockchain may settle the transaction. Trust won’t come from the blockchain alone. It will depend on everything that happens before an instruction reaches the chain and everything a company can still do after something goes wrong.
How 4,000 BTC Left Liquid Network Without A Stolen Key
How nearly an entire reported Bitcoin reserve left through an apparently valid process even though the obvious authorization key remained intact.
Binance Left Canada but the Fight Reached Supreme Court
How Binance’s Canadian exit became a wider test of regulatory reach, company records and access to digital asset markets.
Polymarket Earns Approval to Relaunch in the U.S.
How Polymarket moved back toward regulated US market access after acquiring a licensed derivatives exchange.
Canada Proposes Stablecoin Market Entry Rules
Canada’s proposed rules put reserves, custody, redemption, data security and recovery directly into the stablecoin operating model.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
August 26th, 2025
January 4th, 2024
June 1st, 2021
September 9th, 2020
July 9th, 2018
January 3rd, 2018
September 25th, 2017
June 20th, 2017
May 10th, 2017
December 14th, 2016
NCFA Canada
Craig Asano
CEO and Executive Director
casano@ncfacanada.org
ncfacanada.org








