The core business makes private networks easier to deploy and govern, while Aperture and Border0 take Tailscale into AI access and privileged infrastructure—two markets with bigger security budgets and much heavier competition. This profile looks at what customers are buying today, where the next leg of growth could come from and what the public evidence still can’t tell us.
These are selected Tailscale case studies, not audited results or a measure of what the average customer should expect. Still, they help explain how the product spreads: it removes the VPN tickets, slow onboarding and constant access administration that technical teams already dislike. A developer can start with one live problem, and if the network holds up, IT and security have a practical reason to standardize it, add controls and bring more of the company onto the same service.
The Products Driving Tailscale’s Business
Core Tailscale appears to be the product that pays today. It creates an encrypted private network among approved users, devices, servers and services, with identity based policy deciding what can connect. Developers can get started without rebuilding the company network; as use grows, IT and security can add centralized administration, device posture, logs and tighter access controls. Tailscale’s client, command line tool and relay server code are open source, but the hosted coordination server is proprietary. That coordination service distributes public keys and access rules, while customer traffic normally moves directly between endpoints or through encrypted relays. Tailscale Raises $230M To Power Identity-First Networking looked at why this model could pressure conventional VPN and firewall products.
The pricing supports the same bottom up motion. Tailscale currently lists a free Personal plan, Standard at US$8 per user per month, Premium at US$18 and custom Enterprise terms, with paid plans adding provisioning, device posture, administrative roles, network flow logs, regional routing and support. The cost of trying the product is low; the account becomes more valuable as more people, devices and company controls move onto it.
Revenue is the important missing number. Tailscale doesn’t publish it, and the outside estimates aren’t close enough to treat as fact. GetLatka puts 2025 revenue at US$45.2 million, although it says the figure is modelled and that management wasn’t interviewed. Northmetric estimates US$60.1 million in current annual recurring revenue with medium confidence, relying partly on an assumed 54,000 paying customers—well above BetaKit’s July 2026 report of nearly 40,000 paid business clients. Taken together, the estimates point to a company with real commercial scale, but they don’t establish Tailscale’s actual revenue.
Aperture is the move into AI access and cost control. Sitting between approved users or agents and AI model providers, it centralizes credentials while applying access rules, usage visibility and spending limits. That puts platform, security and AI infrastructure teams squarely in the buyer group. AI Agents Enter Governed Financial Workflows explains why permissions, approved tools and audit records matter once agents touch regulated work. Existing Tailscale networks could give Aperture a useful distribution advantage, but the product remains in beta and is currently available without extra cost during testing. Six users are included, with additional access handled through the company; usage, paid conversion and final pricing haven’t been published.
Border0 moves Tailscale into privileged infrastructure access. It governs sensitive connections to servers, databases, Kubernetes environments and internal applications, adding approval workflows, session recording and audit visibility. Those capabilities put Tailscale in front of security, compliance and operations buyers—not just the teams managing everyday network access. After acquiring Border0 in March 2026, Tailscale began connecting the product to its identity and networking layer, although the combined offering remains in beta. Adoption, revenue and final packaging haven’t been disclosed, so Border0 is best viewed as a credible expansion route rather than a proven second engine.
Competition, Regulation And Market Pressure
Tailscale now overlaps with secure networking, identity security, privileged access and AI gateways. Each move opens another budget, but it also brings the company up against much larger security platforms with broader bundles, established enterprise sales teams and far more acquisition firepower.
Large security platforms are buying identity.Palo Alto Networks completed its acquisition of CyberArk in February 2026, adding privileged access and identity security to a platform that already spans network, cloud and security operations. CrowdStrike agreed to acquire SGNL for continuous identity controls, while Zscaler agreed to acquire Symmetry Systems for data and AI access visibility. Buyers are clearly paying for identity and access control, but they may increasingly prefer to buy it inside a larger security contract.
SASE rivals have more capital and enterprise reach.Netskope’s September 2025 IPO raised approximately US$992 million and valued the company at about US$9.6 billion on a fully diluted basis. Netskope, Zscaler, Cloudflare and Palo Alto Networks can bundle network access with wider security products and sell through established enterprise teams. Tailscale’s counter is that technical users can adopt its product before a large security procurement begins, although that advantage could narrow as buyers consolidate more of their security spending with fewer vendors.
Open source keeps the paid product honest. Tailscale identifies Headscale as an independent alternative to its proprietary coordination server, which means a capable technical team can self host that layer. The subscription therefore has to keep earning its place through reliability, administration, policy, support and company controls—not connectivity alone.
Easy adoption doesn’t remove enterprise budget friction. A Tailscale commissioned survey of 1,000 technology leaders found that 42% cited workflow or integration disruption when security upgrades were delayed, while one third cited an unclear business case. Customer results give Tailscale’s sales team concrete savings to work with, but a company wide deployment still needs an owner, a budget and proof that another security vendor can be retired or avoided.
What Makes Tailscale Different In Summer 2026
Tailscale’s edge starts with how it gets in. A developer or infrastructure team can solve a live networking problem without waiting for a company wide migration; if the product works, IT and security can add policy, device controls, logs and support around a network that people are already using. Reported results from Instacart, Cribl, Corelight and Positron give that approach substance beyond the usual product pitch. It also places Tailscale across several areas in the NCFA Financial Innovation Map, including digital identity, cyber resilience, AI governance and enterprise infrastructure.
The next act is harder because Aperture and Border0 ask those customers to trust Tailscale with AI access and privileged infrastructure, where the budgets are larger and the incumbents are stronger. Nearly 40,000 paid business clients and 2.5 million active devices give Tailscale a meaningful starting point; what isn’t public yet is whether either product is creating meaningful new revenue.
The Company Intelligence Snapshot follows the funding, customer growth and product decisions that brought Tailscale to this point.
NCFA Company Intelligence Snapshot
Tailscale
Identity based secure connectivity for businesses, infrastructure, AI workloads and privileged access
Last updated Jul 21, 2026
Company At A Glance
Founded2019 by Avery Pennarun, David Carney, David Crawshaw and Brad Fitzpatrick
BaseToronto founded, fully distributed team
StatusPrivate, Series C
FundingUS$275M raised across seed, Series A, Series B and Series C financing
ProductsBusiness VPN, remote access, workload connectivity, Aperture AI gateway and Border0 privileged access
TechnologyWireGuard based encrypted mesh networking with identity controlled access
CustomersDevelopers, IT teams, security teams, enterprises, AI companies and infrastructure operators
Business ModelFree personal access with paid business and enterprise subscriptions
Milestones
Select a milestone to follow how Tailscale expanded from mesh networking into a wider access platform
1Launch2019–Apr 2020
2Remote Work DemandNov 2020
3Series BMay 2022
4Enterprise ScaleMar 2024–Jan 2025
5Series CApr 2025
6Access PlatformFeb–Jul 2026
Milestone 1
Tailscale Launches A Simpler Private Network (2019–Apr 2020)
Tailscale was founded in 2019 to reduce the complexity of connecting people, devices and services across the internet. Its first generally available product combined WireGuard encryption, identity and direct connections without requiring companies to rebuild their existing networks.
Company
TailscaleA Canadian founded secure networking company
Stage
LaunchGeneral availability arrived in April 2020
Capital
US$3M SeedLed by Heavybit with Uncork Capital and others
Markets
GlobalRemote teams, cloud infrastructure and personal networks
Customers
Developers FirstIndividuals and technical teams could start without enterprise deployment
Competition
Simpler VPNDirect encrypted connections reduced reliance on central VPN concentrators
Additional Company Data
WireGuard supplied the encrypted data layer
Identity replaced manual IP based access rules
The open source client helped technical buyers inspect and adopt the product
A free personal plan supported bottom up distribution
Why This Milestone Matters
Rather than begin with a top down security sale, Tailscale gave developers a faster way to connect private infrastructure and let working networks make the case for wider adoption.
Milestone 2
Remote Work Accelerates Demand (Nov 2020)
Tailscale raised a US$12 million Series A led by Accel as remote work increased demand for secure access across distributed teams. The company used the financing to expand its product and team while customers adopted private networks across more devices and environments.
Company
TailscaleSecure networking built for distributed teams
Stage
Early GrowthUsage expands after general availability
Capital
US$12MSeries A led by Accel
Markets
Remote WorkAccess across home, office and cloud environments
Customers
Distributed TeamsDevelopers, operators and early enterprise users
Competition
Fast DeploymentUsers could install Tailscale without replacing their physical network
Additional Company Data
Remote work turned secure access into an operating requirement
Accel joined Heavybit and Uncork Capital as a major investor
The company expanded support across common operating systems
Early enterprise deployments tested larger network requirements
Why This Milestone Matters
The Series A arrived as remote work turned private access into an everyday operating problem. The opportunity was no longer just developer convenience; distributed companies needed a network they could administer at scale.
Milestone 3
US$100 Million Funds Enterprise Expansion (May 2022)
Tailscale raised a US$100 million Series B led by CRV and Insight Partners. The round gave the company capital to expand engineering, customer support and commercial adoption while retaining the free personal product that drove referrals and bottom up use.
Company
TailscaleA product led network and security company
Stage
ExpansionEngineering and commercial capacity increase
Capital
US$100MSeries B led by CRV and Insight Partners
Markets
EnterprisePrivate access across cloud, office and remote infrastructure
Customers
Technical BuyersDevelopers introduced the product before wider company deployment
Competition
Product Led SecurityEase of use became part of the security proposition
Additional Company Data
Total disclosed financing reached US$115 million
Paid seat growth supported a larger business customer base
The company kept free personal access as a distribution channel
Capital supported a longer investment horizon for network infrastructure
Why This Milestone Matters
US$100 million gave Tailscale time to build enterprise depth without closing the free door that brought users in, preserving the model’s central tension: easy individual adoption followed by paid company controls.
Milestone 4
Business Adoption Doubles In Ten Months (Mar 2024–Jan 2025)
Tailscale EnterpriseBusiness networking and access controls
Stage
ScalePaid company adoption accelerates
Capital
Recurring RevenueBusiness subscriptions support the commercial model
Markets
Multiple IndustriesTechnology, finance, manufacturing, healthcare and AI
Customers
10,000+Business customers reported in January 2025
Competition
Bottom Up AdoptionUsers could validate the product before a company wide purchase
Additional Company Data
Paying teams passed 5,000 in March 2024
Business customers passed 10,000 by January 2025
More than half of the first 5,000 customers arrived in the preceding year
Enterprise features supported larger and regulated organizations
Why This Milestone Matters
Doubling from 5,000 paying teams to more than 10,000 business customers in ten months showed that bottom up use could convert into company spending. Developers weren’t a side audience; they were part of the route to market.
Milestone 5
Series C Backs A Larger Platform Ambition (Apr 2025)
Tailscale raised a US$160 million Series C led by Accel with participation from CRV, Insight Partners, Heavybit and Uncork Capital. The financing valued the company at approximately US$1.5 billion and brought total disclosed funding to US$275 million.
Company
TailscaleIdentity based connectivity at global company scale
Stage
Series CProduct and engineering expansion
Capital
US$160MApproximately US$1.5B valuation
Markets
Global InfrastructureEnterprise, cloud, edge, IoT and AI environments
Customers
Businesses And BuildersLarge organizations alongside developers and personal users
Competition
Identity LayerThe network becomes a base for additional access products
Additional Company Data
Total disclosed financing reached US$275 million
Accel returned to lead the growth round
The company planned to expand engineering and product teams
AI workloads became a stated customer and product priority
Why This Milestone Matters
The Series C funded a broader ambition, giving Tailscale room to build more security and access products around networks its customers had already deployed rather than stopping at VPN replacement.
Milestone 6
Aperture And Border0 Extend The Access Platform (Feb–Jul 2026)
Tailscale launched Aperture to control AI model access, credentials, usage and cost, then acquired Border0 to add privileged infrastructure access and session auditing. Both products use Tailscale identity and private connectivity as their operating base.
Company
Tailscale PlatformConnectivity, AI access and privileged access
Stage
Product ExpansionNew security products build on the existing network
Capital
Acquisition And BuildBorder0 joins while Aperture develops internally
Markets
AI And PAMModel gateways and privileged infrastructure sessions
Customers
Security And Platform TeamsAdministrators need control without slowing technical users
Competition
Platform BreadthTailscale competes for more of the access and control stack
Additional Company Data
Whether Aperture converts from beta use into paid enterprise adoption
How quickly Border0 becomes native inside the Tailscale administration experience
How far Tailscale expands beyond connectivity without adding the complexity it originally removed
Why This Milestone Matters
Aperture and Border0 are Tailscale’s first serious attempts to sell beyond the core network. Access to existing customers should help, although both products face different buyers and stronger incumbents; paid adoption will tell us whether Tailscale has a platform or a successful network with two promising adjacencies.
Frequently Asked Questions About Tailscale
What is Tailscale?
Tailscale is a secure networking platform connecting users, devices, servers and services through encrypted, identity-controlled networks. It uses WireGuard for encryption and a coordination layer for identity, discovery and policy. Traffic generally travels directly between endpoints rather than through a central VPN concentrator.
Who founded Tailscale?
Tailscale was founded in 2019 by Avery Pennarun, David Carney, David Crawshaw and Brad Fitzpatrick. Pennarun is chief executive and Carney is chief strategy officer. The company was founded in Toronto and operates as a fully distributed organization.
Is Tailscale a Canadian company?
Tailscale was founded in Toronto and is widely described as a Canadian-founded company. Its team is fully distributed, and the company serves customers globally.
How much funding has Tailscale raised?
Tailscale has raised US$275 million in disclosed financing: a US$3 million seed round, US$12 million Series A, US$100 million Series B and US$160 million Series C. Accel, CRV, Insight Partners, Heavybit and Uncork Capital are among its investors.
What is Tailscale’s valuation?
Tailscale was valued at approximately US$1.5 billion with its April 2025 Series C. Because it is privately held, this financing valuation is not a continuously updated market value. A later financing, secondary transaction or acquisition could establish a different valuation.
Tailscale uses a freemium subscription model. Its Personal plan is free, while Standard and Premium are priced per user and Enterprise pricing is negotiated. Aperture is currently in beta, and Tailscale has not disclosed how much revenue Aperture or Border0 contributes.
Does Tailscale disclose its revenue?
Tailscale does not publish official revenue or audited financial results. GetLatka and Northmetric publish estimates, but those figures are modelled rather than company reported and should not be treated as confirmed revenue.
What is Aperture by Tailscale?
Aperture is an AI access gateway designed to control which users and agents reach AI models, centralize provider credentials, observe model usage and manage cost. It remains in public beta, so eventual pricing, adoption and business contribution are not publicly established.
What did Border0 add to Tailscale?
Border0 joined Tailscale in March 2026, bringing controlled SSH, Kubernetes, database and remote-administration access into its product range, along with session recording and audit visibility. Tailscale said Border0 was already integrated with its network, identities and policies. Financial terms were not disclosed.
Who competes with Tailscale?
The list changes by use case. Core Tailscale competes with VPN, zero trust network access and software defined networking products, as well as self hosted WireGuard alternatives. Aperture faces AI gateway vendors. Border0 puts Tailscale into privileged access management, where large security platforms already compete.
Is Tailscale profitable?
Tailscale does not publicly disclose whether it is profitable. Revenue, margins, cash burn and audited financial results remain private.
Information notice: Private-company estimates are identified and attributed. Information may change after the stated update date. This content is provided for informational purposes only and does not constitute investment, financial or legal advice.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
The notice is most useful as a compliance review tool. Firms can compare their written controls, operating practices, and supporting records against the deficiencies and effective practices identified by securities regulators. The guidance is particularly relevant for smaller and medium sized firms that may not have dedicated cybersecurity teams.
What It Does In Practice
The notice organizes cybersecurity readiness around five areas that regulators examined under section 11.1 of National Instrument 31-103:
written cybersecurity policies and procedures
employee cybersecurity training
cybersecurity risk assessments and controls
oversight of third party service providers
written and tested incident response plans
The review found useful benchmarks. 8% of firms had no written cybersecurity policies, while 55% had policies that needed improvement. Twenty one per cent provided no employee cybersecurity training. Forty five per cent completed risk assessments that could have been stronger, and 12% had no documented assessment during the review period.
Third party oversight was one of the clearest weaknesses. All examined firms used service providers with access to systems or data, but 62% had no documentation or limited documentation supporting their cybersecurity oversight. The CSA expects firms to complete and document due diligence before onboarding a provider and repeat that review throughout the relationship.
The guidance identifies information firms should assess, including data storage, encryption, access controls, patch management, incident notification, subcontractors, operating jurisdictions, and shared responsibility in cloud environments. It also recommends maintaining a complete vendor register and reviewing current SOC 2 or similar reports where available.
Incident preparedness also receives detailed attention. Fifteen per cent of firms had no written incident response plan. Among firms with a plan, 53% needed stronger procedures and 63% should have tested their plans more regularly. The notice describes tabletop exercises and simulated attacks as practical ways to test whether people, processes, and technical controls work together during an incident.
Who Gets Value
The primary audience is firms registered as dealers, advisers, portfolio managers, investment fund managers, exempt market dealers, and restricted portfolio managers. Chief compliance officers, directors, technology leaders, privacy professionals, and internal audit teams can use the notice to organize a control review and identify missing documentation.
Boards and senior executives can also use it to test whether cybersecurity oversight is tied to clear responsibilities, regular reporting, and evidence that controls operate as intended. Written policies alone aren’t enough when actual practices, testing schedules, or access controls differ from the documented process.
Cybersecurity consultants, legal advisers, insurance providers, managed service providers, and software vendors can use the findings to better understand the records and evidence registered firms may need during a regulatory review.
Strengths And Limits
The notice is strong because it combines regulatory expectations with observed deficiencies, percentages, effective practices, and practical takeaways. It covers both governance and technical controls, including multifactor authentication, encryption, backups, access rights, patching, email filtering, endpoint protection, and activity logging.
It also makes documentation a central requirement. Firms should be able to show when policies were reviewed, who completed training, how risks were assessed, what vendor due diligence occurred, and when incident plans or backup recovery procedures were tested.
The guidance does not create a complete technical cybersecurity standard, and it doesn’t replace obligations under privacy, securities, corporate, or other applicable laws. Expectations also vary with the firm’s size, operating complexity, client information, service provider reliance, and exposure to cyber risk.
Firms should therefore use the notice as a regulatory gap assessment and evidence checklist, then supplement it with appropriate legal advice, technical standards, testing, and controls suited to their operations.
Key Resources
CSA Staff Notice 33-322 (cybersecurity examination findings and guidance for registered firms)
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
July 20, 2026 | NCFA Market Activity | Cybersecurity And Fraud, Artificial Intelligence And Data, Risk Compliance And Regtech
Former SentinelOne Leaders Build A Control Layer For Agentic Software
On July 20, 2026, Neo emerged from stealth with US$100 million in combined seed and Series A financing from Andreessen Horowitz, Bessemer Venture Partners, Craft Ventures and Merlin Ventures.
The Boston cybersecurity company was founded in 2025 by Nick Warner, Shlomi Salem and Eran Shirazi. Note that it's unrelated to Calgary based Neo Financial. Warner previously served as SentinelOne president and COO, Salem led detection engineering and threat research at SentinelOne, and Shirazi previously co-founded EasySend after leading vulnerability research in Israel’s Unit 8200.
Neo is building what it calls an agentic software control layer. The platform gives security teams an inventory of AI agents, AI enabled applications, plugins, extensions, MCP servers and traditional software that has gained agentic capabilities. It then maps permissions, attributes actions and applies policy before software reaches sensitive data or systems.
The company plans to use the financing to expand engineering and go to market operations. Neo hasn't disclosed revenue, customer counts, named customers, valuation or the allocation between its seed and Series A rounds.
Agents Can Operate Inside Trusted Permissions
Enterprise security was built around human users, known applications and recognizable data flows. AI agents can act differently. They may inherit a user’s permissions, call several tools, reach files and credentials, communicate with other agents and continue operating without a conventional interface.
That means risky activity may not even resemble a conventional intrusion. An agent can use valid credentials and approved applications while still exporting too much data, reading a secret, pushing code or initiating an action that exceeds the authority its operator intended to grant. NCFA’s analysis of AI agents gaining identity and wallet access shows how quickly this issue reaches financial APIs and real infrastructure.
Neo’s platform combines four functions. It finds AI software, checks what it can access, shows who or what is behind each action, and lets security teams allow, block or pause that action for approval.
Threat's aren't limited to deliberately malicious agents. ShadowLeak demonstrated how hidden instructions could manipulate an AI agent and expose private information without a user clicking a malicious link.
Its Neoverse knowledge base maps the capabilities, risks and behaviour of agentic software before it enters an enterprise environment. Neo says enforcement occurs natively at the endpoint, where the software can intercept tool calls, API access, credential reads and data transfers before the action is completed.
Competition Is Forming Around Agentic Security
Neo combines software inventory, posture intelligence, attribution and endpoint enforcement across agentic and traditional applications.
Check Point is developing a wider AI security control plane covering employee AI use, AI applications and agentic systems.
SailPoint is extending identity governance to AI agents and other non-human identities.
Existing endpoint security providers already control devices, files and processes, but may not yet map the permissions and chained actions occurring inside agentic software.
Cloud and application security companies can govern models, APIs and data access, creating a competitive question around whether customers will buy a separate agentic control layer or expect existing security platforms to absorb the function.
Financial Institutions Will Need Authority Maps For Agents
Banks and other regulated organizations will need more than a list of approved AI tools. They need to know which person authorized an agent, what credentials it inherited, which systems it can call, what information it can export and when human approval is mandatory.
Neo’s opportunity is to show who or what can access each system and enforce clear limits on what they can do. Its challenge is that endpoint, identity, cloud and network security companies are all pursuing parts of the same problem. Large institutions may prefer one more specialized control layer, or they may demand that existing suppliers add agent governance to products already deployed across the organization.
Financial institutions are adopting AI while remaining accountable for privacy, cybersecurity, third party risk, operational resilience and auditability. An agent that can access customer information, initiate a payment, change code or communicate externally will need authority limits that security, risk and compliance teams can understand.
Neo has the capital and founding team to compete early, but the category is still forming. Enterprise adoption, integration depth and the quality of its policy enforcement will matter more than the size of the launch financing.
Talking Point
Will enterprises buy a dedicated control layer for agentic software, or will endpoint, identity and cloud security providers absorb the function before the category becomes independent?
NCFA Company Intelligence Snapshot
Neo
Agentic software inventory, attribution and real time policy control for enterprise security teams
Last updated Jul 20, 2026
Company At A Glance
Founded2025 by Nick Warner, Shlomi Salem and Eran Shirazi
HeadquartersBoston, United States
StatusPrivate
Capital / FundingUS$100M across seed and Series A financing
InvestorsAndreessen Horowitz, Bessemer Venture Partners, Craft Ventures and Merlin Ventures
ProductsNeo platform and Neoverse agentic software knowledge base
CustomersEnterprise SecOps teams; named customers not publicly disclosed
Public LaunchJuly 20, 2026
DisclosureRevenue, valuation and round allocation not publicly disclosed
Milestones
Select a milestone to follow Neo’s development
1Formation2025
2Platform Build2025–2026
3Neoverse2025–2026
4Public LaunchJul 2026
Milestone 1
Founding Team Assembles (2025)
Nick Warner, Shlomi Salem and Eran Shirazi founded Neo in 2025 to build security controls for enterprise software gaining autonomous and agentic capabilities.
Company
Neo SecurityEnterprise cybersecurity company focused on agentic software
Stage
FormationExperienced operators assemble before the public launch
Capital
Early Institutional BackingSeed and Series A allocation not publicly disclosed
SecOps TeamsLarge organizations adopting AI enabled software
Competition
Operator ExperienceFounders previously built and scaled enterprise security companies
Additional Company Data
Warner previously served as SentinelOne president and COO
Salem led detection engineering and threat research at SentinelOne
Shirazi previously co-founded EasySend
The company is unrelated to Canada’s Neo Financial
NCFA Perspective
Neo begins with founders who have built cybersecurity products and commercial organizations before. That lowers some execution risk, but it does not yet establish enterprise adoption.
Milestone 2
Agentic Software Control Platform Built (2025–2026)
Neo developed an endpoint control layer that discovers AI enabled software, assesses permissions and configuration, attributes actions and enforces policy before activity reaches sensitive systems or data.
Company
Neo PlatformInventory, posture, attribution and enforcement
Stage
Product BuildControl layer developed before public launch
Capital
Venture FundedCombined prelaunch financing later disclosed at US$100M
Markets
AI Enabled EnterprisesEndpoints, browsers, identities and applications
Customers
Security OperationsTeams governing human and non-human activity
Competition
Runtime ControlPolicy applied before an agent completes an action
Additional Company Data
Discovers agents, models, extensions, plugins and MCP servers
Maps permissions, identities, configurations and data access
Attributes actions to a human, agent, application or identity
Can allow, block or hold activity for approval
NCFA Perspective
Neo is joining discovery with enforcement. That is commercially stronger than another inventory dashboard, provided the controls work across the applications and workflows enterprises actually use.
Milestone 3
Neoverse Knowledge Layer Developed (2025–2026)
Neo built Neoverse as a continuously updated knowledge base of agentic software capabilities, risks and behaviour. The intelligence feeds inventory classification, posture assessment and policy decisions inside the platform.
Company
NeoverseAgentic software knowledge base
Stage
Knowledge LayerSoftware capabilities and risk profiles mapped continuously
Capital
Product InvestmentResearch and engineering support platform intelligence
Markets
Agentic SoftwareModels, agents, extensions, applications and MCP servers
Customers
Enterprise Security TeamsOrganizations assessing software before and after deployment
Competition
Software IntelligenceRisk context added to inventory and enforcement
Additional Company Data
Neoverse is included with every Neo deployment
It maps capabilities, risks and behaviour across agentic software
The knowledge base supports software classification and policy creation
Neo has not disclosed an independently verified scale figure for the database
NCFA Perspective
Neoverse could become a defensible asset if Neo keeps pace with rapid changes in models, applications, extensions and agent frameworks.
Milestone 4
US$100M Public Launch From Stealth (Jul 2026)
Neo emerged from stealth on July 20, 2026 with US$100 million in combined seed and Series A financing and a public product built around real time control of agentic software.
Company
NeoAgentic Software Control company
Stage
Public LaunchCommercial expansion begins after stealth development
Capital
US$100MCombined seed and Series A financing
Markets
Global EnterpriseOrganizations adopting AI enabled and autonomous software
Customers
Large EnterprisesNamed customers not publicly disclosed
Competition
Category FormationEndpoint, identity, cloud and AI security vendors converge
Additional Company Data
Andreessen Horowitz and Bessemer Venture Partners backed the company
Craft Ventures and Merlin Ventures also participated
Capital will support engineering and go to market hiring
Revenue, valuation, customer count and financing allocation remain undisclosed
NCFA Perspective
The launch capital gives Neo room to build quickly. The central question is whether enterprises will buy a separate agentic control layer or expect existing security suppliers to add the capability.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
July 11, 2026 | NCFA Fintech Whisperer | Risk Compliance And Regtech, Digital Assets Blockchain And Tokenization, Payments And Money Movement, Wealth Investing And Trading, Capital Markets Infrastructure And Funding, Competition And Market Structure, Digital Banking And BaaS, Lending Consumer Credit And BNPL, Regulation And Policy, Identity Privacy And Data Governance Cybersecurity Fraud And Financial Crime
July 15, 2026, United Kingdom / Singapore / Global
Standard Chartered standardized its global infrastructure on a software defined private cloud using VMware Cloud Foundation to support critical banking services across 54 markets.
Approximately 70% of the bank’s global infrastructure footprint already operates on the new architecture.
The platform embeds zero trust security into the infrastructure layer and reduces infrastructure deployment time from weeks to one day.
Private cloud remains a production architecture for regulated banks that need consistent control across countries and critical workloads. The 70% deployment gives other banks a concrete benchmark for weighing resilience, security, workload portability and regulatory oversight when deciding which systems belong in private environments and which can run with hyperscalers.
July 17, 2026, Marshall Islands / United States / Global
BitGo Bank & Trust will provide qualified custody and off exchange settlement for USDM1, a dollar denominated sovereign bond issued natively onchain by the Republic of the Marshall Islands.
USDM1 is structured under New York law, backed 1:1 by U.S. Treasuries and available to institutions on Stellar, Ethereum and Solana.
Eligible clients can deploy USDM1 to connected venues around the clock with T+0 settlement without transferring the asset onto an exchange.
The structure places sovereign issuance, Treasury backing, regulated custody and continuous settlement inside one institutional collateral workflow. It gives banks, dealers and custodians a concrete test of how tokenized sovereign instruments could support secured finance while reducing intraday exposure and prefunding requirements.
CSA Consultation Paper 51-406 opens a 120 day review of how Canadian public companies are regulated, with comments accepted until November 13, 2026.
The consultation asks whether venture and non-venture issuer status should be determined differently to support more proportionate requirements.
The CSA is considering whether some venture issuers should receive relief from parts of International Financial Reporting Standards.
The paper also examines private placement hold periods, material change reporting and how U.S. reforms to reporting, disclosure and capital raising should influence Canada.
More than 10% of eligible companies have adopted the CSA’s voluntary semi-annual reporting framework, while recent Listed Issuer Financing Exemption changes have generated significant financing activity.
The review extends beyond one exemption or reporting rule. It connects the semi-annual reporting pilot and higher LIFE financing limits to the cost of staying public, the information investors receive and Canada’s ability to compete for issuers and capital.
Ontario committed to join Canada’s national securities regulatory passport system following discussions among federal, provincial and territorial finance ministers.
Under the passport system, a market participant obtains a decision from its principal regulator that applies across participating jurisdictions under harmonized laws.
Ontario has been the only jurisdiction outside the system and currently uses an interface that can require a separate Ontario Securities Commission decision; implementation timing has not been announced.
Ontario’s commitment could remove a longstanding layer of duplicated review for issuers and registrants operating nationally. The operational test is whether full participation reduces filing cost and approval time without weakening investor protection. It also delivers the coordinated model sought in earlier calls for Ontario to adopt passport.
Grove committed a US$500 million warehouse facility to finance institutional loans originated and serviced by Galaxy Digital.
The senior secured loans may use BTC and ETH as collateral, including staked ETH, with assets held by Anchorage Digital and BitGo.
The facility uses USDS capital, defined eligibility requirements, concentration limits and continuous loan to value monitoring through independent price feeds.
The facility brings a familiar credit structure into institutional digital asset lending at substantial scale. It places onchain liquidity closer to loan origination and gives the market a clearer test of how stablecoin capital, qualified custody and crypto collateral can support structured credit.
Reuters reported that Stripe and Advent International submitted a joint offer of US$60.50 per share for PayPal, valuing the company at more than US$53 billion.
The proposal is backed by approximately US$50 billion in committed bank financing and would give Stripe and Advent equal ownership of PayPal.
PayPal, Stripe and Advent declined to comment, PayPal had not responded to the proposal when it was reported, and there is no certainty that an agreement will result.
A combined Stripe and PayPal would connect merchant processing, consumer checkout, Venmo and stablecoin distribution under one ownership structure. Even without a transaction, the bid tests whether control of merchant acceptance and consumer distribution will become a defining advantage across wallets, agentic commerce and digital payments.
ConnectOne Bank is building multiple commercial lending agents on nCino’s Agentic Operating System.
The deployment targets frontline efficiency across commercial lending workflows rather than one isolated task.
nCino positions the system as an operating layer for agents working across lending data, processes and institutional controls.
Commercial lending agents are entering regulated bank workflows at the operating system level. Their value will depend on whether banks can reduce manual work while keeping credit judgment, accountability and exception handling under institutional control.
Blockchain.com partnered with Polymarket to add prediction market access inside its app for users in eligible markets.
Users will be able to use assets already held in their Blockchain.com accounts to open and manage event positions without a separate wallet connection or deposit process.
Blockchain.com said it serves more than 43 million verified users across more than 70 jurisdictions, giving Polymarket a large new distribution channel.
Prediction markets are becoming a standard feature inside crypto trading apps. Wider distribution could increase participation and liquidity, while raising sharper questions about eligibility, market integrity and the trust controls surrounding prediction markets.
Alipay+ integrated with Argentina’s Transferencias 3.0 national QR payment network through Latin American payment technology provider PVS.
International travellers using participating Alipay+ wallets will be able to scan the QR codes already displayed by millions of Argentine merchants.
Alipay+ connects more than 50 wallets and banking apps representing 2 billion user accounts with 150 million merchants globally, with the Argentine service launching in phases.
Argentina is turning a domestic interoperable QR standard into an international acceptance layer without requiring merchants to replace their checkout technology. It gives Canadian operators a useful comparator as Canada opens payment infrastructure to more PSPs and credit unions while developing instant payment access, shared acceptance and stronger operating controls.
Thredd joined Visa’s Agentic Ready programme to help issuers support payments initiated by AI agents.
The processor said its platform provides tokenisation, authentication and fraud capabilities needed for agent initiated transactions.
Zilch is among the first issuers using the platform to support agent initiated payments in Europe.
Agentic commerce is reaching the issuer processing layer. Delegated authority, transaction controls, authentication and dispute handling are becoming core payment functions rather than responsibilities left only to agents and merchants.
Stable launched StablePay, a mobile app for instant USDT transfers using phone numbers, email addresses or QR codes.
The self custody service removes the need for users to manage blockchain accounts, gas fees or separate wallet connections.
Stable said the app is already supporting peer payments, cross border remittances and international payroll, with a built in feature for earning yield on USDT.
StablePay packages payment, custody and yield inside one consumer experience. Its traction will show whether simplified stablecoin products can win users beyond crypto markets while meeting the compliance expectations attached to global payments and yield.
Emirates NBD went live on Partior’s multicurrency blockchain clearing and settlement network.
The bank completed a live USD transaction with J.P. Morgan acting as settlement bank and beneficiary bank.
Corporate and institutional clients can now send real time USD payments to beneficiary accounts held at J.P. Morgan, with additional currencies and bank connections planned.
This is live bank settlement rather than another proof of concept. Partior now has a regional deployment that can test whether continuous liquidity, faster finality and programmable treasury services improve cross border banking at production scale.
The European Central Bank selected 36 payment service providers from more than 50 applicants to participate in the digital euro pilot.
The 12 month pilot is scheduled to begin during the second half of 2027 using a beta version of the digital euro across the ECB and 19 national central banks.
The programme will test online and offline person to person payments, merchant acceptance, software point of sale and ecommerce transactions with banks, payment firms and selected merchants.
The digital euro has entered a new implementation stage. Attention now turns from policy design toward operational readiness, participant integration and whether the pilot demonstrates that public digital money can work alongside existing payment networks.
JCB and Circle signed a memorandum of understanding to explore USDC payments across JCB's merchant network.
The collaboration will examine cross border payments, merchant acceptance and settlement using stablecoin infrastructure.
The initiative builds on JCB's existing digital payment work with Japanese banking and technology partners.
Stablecoin adoption is expanding beyond crypto native platforms into established payment networks. The next phase will depend on merchant acceptance, operational integration and regulatory treatment across major consumer payment markets.
Siam Commercial Bank became the first financial institution client to go live with Citi's integrated 24/7 USD Clearing and Citi Token Services solution.
The service enables near real time cross border USD payments at any time of day using tokenized deposits within Citi's regulated banking network.
The first live transaction transferred U.S. dollars between Citi in London and Siam Commercial Bank in Thailand during the U.S. holiday weekend, demonstrating continuous cross border payment capability.
The industry is beginning to demonstrate how tokenized deposits can support continuous cross border payments inside regulated banking networks. Alongside Swift’s bank ledger work with RBC and TD, the next measure is how quickly live services spread across institutions and payment corridors.
FIS joined Anthropic’s Project Glasswing and is actively testing the Mythos 5 frontier model against its own systems.
FIS operates software that clears payments, transfers money and runs core banking for thousands of financial institutions worldwide.
The controlled security initiative is separate from FIS’s commercial AI agent partnership with Anthropic and focuses on identifying vulnerabilities in critical software infrastructure.
Frontier AI is entering the security testing layer of widely shared banking and payment infrastructure. The initiative extends AI security across mixed banking systems into controlled testing of critical financial software. Banks and infrastructure providers will need clear controls for model access, finding validation, remediation ownership and disclosure as advanced models identify vulnerabilities faster than conventional security teams can process them.
CSA Staff Notice 33-322 reports findings from a focused compliance examination of 73 registered firms.
The review examined policies, employee training, risk assessments, controls, third party oversight and incident response planning.
CSA staff identified gaps across the firms reviewed and issued practical guidance intended to scale across small, medium and large registrants.
Cybersecurity expectations are becoming more concrete through examination findings rather than high level principles alone. Registered firms now have a clearer basis for testing governance, third party controls and incident readiness before the next compliance review.
INETCO added agentic AI investigation capabilities to BullzAI for banks, payment processors and other financial institutions.
The agents collate transaction data, triage alerts, prioritize high risk cases and provide explainable scores and recommendations for fraud teams.
The capability uses a proprietary model deployed within the customer environment and improves through supervised human feedback.
Fraud operations are beginning to automate the investigation layer, not only transaction detection. The practical value will come from cutting case backlogs while preserving analyst control, explainability and sensitive payment data inside the institution.
ENISA released a maturity model and downloadable assessment tool for SMEs that manufacture or supply products with digital elements covered by the Cyber Resilience Act.
The model evaluates governance, security by design, risk management, vulnerability management, product lifecycle practices and cybersecurity skills.
An accompanying survey of 194 organizations across 31 countries found that 66% knew about the Act, while practical understanding, incident response and product lifecycle readiness remained limited.
Canadian fintech and software vendors selling covered products into Europe need operational evidence behind their compliance claims. The model gives customers and partners a common way to examine product security maturity as the Act’s vulnerability reporting requirements begin in September 2026 and its main obligations approach.
FATF found that 83% of surveyed jurisdictions, 91 of 109, had passed legislation implementing the Travel Rule, up from 73% in 2025.
However, 55 of those 91 jurisdictions had not issued findings or directives or taken Travel Rule related supervisory or enforcement action.
FATF reported that a Cambodia based financial services conglomerate laundered at least US$4 billion between August 2021 and January 2025, including at least US$37 million linked to North Korean cyber thefts.
Travel Rule adoption is advancing faster than supervision and enforcement. Crypto firms, banks and compliance providers need stronger counterparty screening, interoperable originator and beneficiary data, offshore VASP controls, and escalation procedures for stablecoins and unhosted wallet exposure.
FINTRAC updated its advisory for Canadian reporting entities following the Financial Action Task Force’s June plenary.
Bosnia and Herzegovina and Iraq were added to the FATF list of jurisdictions under increased monitoring, while Algeria and Namibia were removed after completing their action plans.
Canadian reporting entities must account for connections to monitored jurisdictions when assessing geographic risk, applying controls and determining whether suspicious transaction reports are required.
Transactions connected to the Democratic People’s Republic of Korea and Iran remain subject to specific Canadian directives covering high risk treatment, identity verification, source of funds or virtual currency, beneficial ownership, recordkeeping and sanctions evasion controls.
The advisory also preserves enhanced requirements and reporting considerations for Myanmar, Russia, Afghanistan, Islamic State controlled areas and transactions connected to the Middle East.
The update requires banks, fintechs, payment companies, money services businesses and virtual asset firms to review country risk classifications, transaction monitoring rules and correspondent banking controls. Grey list status should inform a risk based assessment rather than automatic rejection of every transaction, while Canadian ministerial directives create specific mandatory treatment for designated jurisdictions.
The Bank of England, PRA and FCA began joint oversight of the first Critical Third Parties designated by HM Treasury.
The regime covers Amazon Web Services, Google Cloud, Microsoft and Oracle services that support the UK financial system.
Designated providers must manage risks to critical services, communicate with regulators during major incidents and support system level resilience.
Direct supervision of major technology providers changes where operational resilience responsibility sits. Financial firms still own their outsourcing risk, but the largest shared dependencies now face regulatory scrutiny at source.
FINMA regulated AMINA Bank integrated Mesh’s verified deposit technology directly into its online banking platform.
Clients will be able to select a wallet provider, verify ownership and deposit stablecoins or other digital assets through connections spanning more than 300 wallets and providers.
The deposit capability will soon become available to AMINA clients, with withdrawals, payouts and simplified wallet verification during onboarding planned as later additions.
Regulated crypto banking still breaks at the point where customers must prove ownership of external wallets. Embedding verification into deposit authorization can reduce manual address checks while preserving compliance controls. Banks considering similar connections will need clear responsibility for wallet screening, transaction monitoring, sanctions controls and failed transfers.
Interest free Buy Now Pay Later products are now regulated by the Financial Conduct Authority, covering providers including Klarna, PayPal and Clearpay.
Providers must conduct affordability checks before extending credit and give consumers clearer information during checkout.
Consumers gain enforceable refund protections for faulty goods, access to the Financial Ombudsman Service and support before debt collection when experiencing financial difficulty.
BNPL now operates as supervised consumer credit across the customer journey. Providers serving the UK need affordability, disclosure, complaints, refunds and collections controls that work inside merchant checkout flows. Canadian policymakers and lenders have a live comparator for testing whether product specific safeguards can protect consumers while preserving short term payment flexibility.
HM Treasury opened a 12 week consultation containing 42 questions on payment services and electronic money regulation, with responses due October 6, 2026.
The proposals create common regulated activities for traditional and tokenised payments, bring certain stablecoins into the payments perimeter and require firms to obtain permission for tokenised payment services.
The consultation addresses agentic payment consent, authentication and liability alongside variable recurring payment access, commercial Open Banking pricing and expanded FCA supervision.
One consultation connects digital money, AI agents and Open Banking to the same operating rulebook. Payment firms need to test which permissions, safeguarding models, access rights and liability controls their products would require. Canadian regulators can compare this integrated approach with separate domestic work on stablecoins, consumer driven banking and Real Time Rail implementation.
Austria’s Administrative Court confirmed that statistically calculated political affinities are special categories of personal data protected under Article 9 of the GDPR.
The profiles covered approximately 2.2 million people and were stored and partly sold to third parties without consent or another applicable exception.
The court set the administrative fine at €13 million and confirmed that group wide annual revenue could be considered when determining the penalty.
The decision extends sensitive data protection beyond information people expressly provide to conclusions generated about them. Fintechs using behavioural analytics, customer segmentation, alternative data or AI models must consider whether inferred attributes can create heightened privacy obligations even when the underlying inputs appear ordinary.
The Dutch Data Protection Authority published GDPR guidance for organizations developing generative AI models or taking responsibility for putting them into use.
The guidance addresses lawful grounds, indirect collection, training data and how personal information is managed, cleaned, enriched, retained and protected.
A separate implementation checklist asks organizations purchasing or using generative AI to first determine whether they can achieve their purpose without processing personal information.
The guidance brings privacy decisions into AI procurement and development before deployment. Financial institutions and fintechs using customer information with generative AI will need to justify why personal data is necessary, identify their legal role and preserve evidence across training, vendor selection, implementation and ongoing use.
Faster Finance Needs Faster Control
This week’s developments share one operating pattern. BitGo and Galaxy place tokenized assets inside collateral and lending. Alipay+, Partior and Citi connect domestic payment access with international distribution. FIS, the CSA and FATF reinforce the control layer required to run these systems safely at speed. For Canadian operators, the strategic question is which layer they truly control. Distribution without settlement access creates dependency. Automation without governance creates liability. Tokenization without custody, liquidity and legal certainty stays experimental. Durable businesses will own a useful layer, meet its control burden and connect cleanly to the rest.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
July 17, 2026 | NCFA Insight | Regulation And Policy, Wealth Investing And Trading, Risk Compliance And Regtech
FCA Finfluencer Enforcement And Canada’s Regulatory Position
On July 9, 2026, the UK Financial Conduct Authority reported the results of its finfluencer enforcement campaign. A coordinated week of action involving 9 international regulators produced 3 arrests, 6 criminal proceedings, 11 warning or cease and desist letters, 50 warning alerts and 650 social media takedown requests.
Canadian regulators weren’t watching from the sidelines. The Alberta Securities Commission, Autorité des marchés financiers, British Columbia Securities Commission and Ontario Securities Commission participated in the June 2025 operation. Earlier analysis asked whether finfluencers were facing a crackdown or clearer regulation.
The FCA’s latest figures show that enforcement has now become repeatable. Investigators can identify illegal content, connect creators to products and firms, request platform removals, issue public warnings and escalate selected cases into criminal proceedings.
The scale of the FCA’s supporting operation is just as relevant. During 2025, it issued 2,329 warnings about unauthorized or potentially fraudulent firms, compared with 2,240 in 2024. It secured 17 criminal convictions involving fraud, insider dealing, money laundering and data protection offences. Twelve people paid a combined £1.77 million in market abuse fines for market abuse.
Technology is improving that capacity. FCA automation reduced the handling time for simpler supervisory cases from as much as 4 hours to about 6 minutes on average. That doesn’t automate consequential decisions. It clears routine work so investigators can spend more time on repeat promoters, hidden compensation, unauthorized firms and cross border distribution.
What The Enforcement Data Reveals
The 650 takedown requests are the most commercially relevant number. Arrests attract attention, but removing hundreds of accounts and posts targets distribution. Illegal promotions lose value when creators can’t reach an audience, acquire leads or direct followers to a trading platform.
The FCA can examine multiple parties within one campaign. A creator may publish the content, a financial firm may pay for it, an affiliate network may track referrals and a platform may distribute it. The underlying product can then lead investigators to an unauthorized operator or regulated firm with weak approval controls.
Criminal proceedings provide the upper end of that response. The FCA accused 3 people charged after the 2025 operation of promoting high risk contracts for difference without authorization. Each faces an allegation of communicating an invitation to engage in investment activity contrary to section 21 of the UK Financial Services and Markets Act.
The April 2026 second global week of action showed how quickly the system had expanded. Seventeen regulators participated. The FCA requested the removal of 120 accounts and identified 1,267 illegal financial advertisements that reached at least 2,338,372 accounts. People or firms already listed on its Warning List accounted for 66% of those advertisements.
That 66% figure exposes a persistent enforcement problem. Many promoters aren’t unknown actors. They continue publishing after regulators have already identified the related firm, person or offer. Effective supervision therefore depends on account removal, repeat offender monitoring and platform cooperation, not warnings alone.
The FCA also secured a guilty plea, began criminal proceedings against 2 more people, issued 34 new warning alerts and updated 14 existing warnings during the April operation. Coordination now combines prosecution, surveillance, education and content removal rather than treating each promotion as an isolated post.
Canada Has Rules, Research And Active Cases
Canada’s legal foundation is already in place. In December 2025, the CSA and CIRO published Staff Notice 31-369, which explains how securities law applies to finfluencers, issuers and registered firms. The practical requirements appear in Canada’s finfluencer guidance.
The guidance doesn’t create a separate licence for creators. It examines the activity itself. A creator may need registration when they provide investment advice as a business, facilitates trades, arranges referrals or connects paid subscribers to copy trading. General market commentary may qualify for an exemption, but creators must still disclose financial interests and other conflicts clearly and on time.
Compensation also changes the compliance analysis. Cash payments, securities, affiliate income, referral fees and free products can establish a commercial relationship. A disclaimer such as “not financial advice” doesn’t cancel the substance of a recommendation, the creator’s compensation or the transaction being encouraged.
Responsibility extends beyond the creator. Registered firms must supervise people acting on their behalf, address referral arrangements, retain records and review relevant communications. Issuers remain responsible for paid investor relations activity and promotional claims made for their benefit. The joint staff notice applies the same principles to AI generated content and digital personas.
The investor evidence explains why regulators are paying attention. An OSC study of 655 Canadian retail investors found that 35% had made a financial decision based on finfluencer content. Those who acted on it were 12.2 times more likely to report being scammed on social media and 2.3 times more likely to have experienced a significant investment loss.
The OSC also ran a simulated investment experiment involving 1,465 Canadians. After viewing a promotional social media post, 38% bought the featured asset. Only 8% of the control group did the same. The full findings and behavioural differences appear in the finfluencer effect on Canadian investors.
Canada has also produced direct enforcement results. In September 2025, the Alberta Securities Commission imposed sanctions on James Domenic Floreani and Jayconomics Inc. for promoting 4 issuers through YouTube, X and Patreon without clearly disclosing that they published the content on behalf of those issuers.
The respondents received a $30,000 administrative penalty, $10,185.10 in costs and 2 year restrictions covering investor relations activity, public securities promotion and securities or derivatives advice.
British Columbia added a preventive layer during the April 2026 operation. The BCSC issued 14 compliance letters to YouTubers and other promoters who had discussed publicly traded B.C. companies. It also referred to an active proceeding alleging that sponsored issuer promotions weren’t disclosed clearly.
How Canadian Enforcement Could Develop
The FCA operates a national financial promotions regime and can report one consolidated set of arrests, warnings, takedowns and prosecutions. Provincial and territorial authorities administer Canadian securities regulation, while CIRO supervises investment dealers, mutual fund dealers and regulated marketplaces.
Canadian action may therefore appear as several provincial cases, coordinated review periods, issuer investigations, warning letters and firm supervision rather than one national enforcement tally. That can make the activity look smaller even when regulators review the same creators, platforms and promotional networks.
The operating implications are already clear.
Issuers need to know who promotes their securities and how they compensate those people
Dealers and fintech platforms need approval, monitoring and record keeping controls for creator campaigns
Affiliate arrangements require the same scrutiny as traditional referrals
Creators need to separate education from recommendations and disclose commercial interests where followers can actually see them
Platforms are also becoming part of the enforcement process. When regulators can connect warnings to hundreds of removal requests, account access becomes a compliance dependency. Firms using social media for distribution can’t treat the creator’s channel as an independent marketing asset beyond their control.
Canada doesn’t need to duplicate the FCA’s structure to produce comparable enforcement. Its regulators are already participating in the same international operations, applying national guidance and using provincial proceedings. The open question is whether those actions will become visible as a coordinated Canadian program or remain distributed across separate regulators and cases.
Talking Point
Will Canada’s finfluencer guidance support coordinated enforcement across provinces, platforms and firms, or will separate cases continue defining the compliance boundary?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA engages with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
July 13, 2026 | NCFA Market Activity | Cybersecurity And Fraud, Artificial Intelligence And Data, Banking And Credit
Agentic Threat Detection Across Mixed Banking Systems
On June 25, 2026, Jack Henry expanded its Google Cloud collaboration to develop agentic AI security for banks and credit unions. The U.S. banking technology provider serves about 7,400 community financial institutions and plans to combine Google Security Operations, Gemini Enterprise Agent Platform, and Mandiant Consulting across Google Cloud, other cloud services, and on-premises systems.
The deal is less about access to an advanced model than the work required to deploy one inside a bank. Security evidence is spread across user accounts, devices, applications, networks, and cloud services. Analysts must connect those records quickly enough to determine whether an alert is harmless or part of an attack. Smaller institutions often lack the security teams and integration capacity to do that across several enterprise products.
The divide and conquer commercial logic of the deal is Google brings the models, security software, and threat expertise. While Jack Henry brings the bank relationships and operating knowledge required to put them to work.
AI Agents Cut Investigation Time
Google Security Operations collects security data from across an institution’s systems and connects related alerts into an investigation. Its Triage and Investigation Agent can retrieve evidence, apply threat intelligence, assess likely causes, and explain its findings.
Google says the agent has processed more than five million alerts and reduced a typical 30-minute manual investigation to about 60 seconds. Those are Google product results, not outcomes reported by Jack Henry customers.
The operating gain comes from completing the early investigation before an analyst steps in. Instead of opening several products, finding related records, and rebuilding the sequence of events, the analyst receives an assembled case with supporting evidence and a proposed response.
Sensitive actions still require clear limits and human oversight. Google can pair AI investigations with fixed playbooks and require approval before isolating a device, disabling an account, or blocking traffic. Jack Henry hasn’t said where it will draw those boundaries, how customers will audit agent decisions, or what happens when an automated recommendation is wrong.
Release timing, pricing, implementation requirements, and the first participating institutions also remain undisclosed, so the announcement is good on tech direction but light on adoption or performance figures inside an operating bank.
Mandiant Consulting adds threat modelling, security assessments, and red team testing. That work tests the design before attackers do. Gemini handles reasoning, while Google Security Operations provides the data and investigation tools.
Jack Henry must make the combined service fit each institution’s systems, controls, and support model. That integration is the difficult part.
Jack Henry Owns The Banking Integration
A bank could buy Google’s security products directly. It would still need to connect the right data, define agent permissions, build response procedures, satisfy audit requirements, and decide who remains accountable for each action.
Jack Henry already operates inside that environment. Its core processing, digital banking, payments, lending, and operational products support institutions that rarely replace critical systems. It also manages hosted and on-premises deployments that a cloud provider may not control.
The companies began working together in 2022 on cloud data, reporting, and integration services. Security extends that relationship into a product Jack Henry can configure around each customer and deliver through an existing technology and support contract.
That could make AI security another banking software service rather than a separate enterprise purchase. Core providers already control the connections, implementation work, and customer access needed to distribute agents at scale.
Security specialists still compete on detection quality, threat intelligence, and response tools. CrowdStrike and Palo Alto Networks are adding agents to their products, while Fiserv offers managed cybersecurity services and is developing AI capabilities. Jack Henry competes from a different position. Its advantage is knowing how community institutions run and where security tools must connect.
Google gains a route into thousands of regulated institutions without implementing its products one bank at a time. Jack Henry can add a service whose value depends on its knowledge of each customer’s systems and operating requirements.
This is where enterprise AI economics become clearer. Foundation models can be sourced from a small group of large providers. The commercial asset is access to the workflow where the model can complete useful work under controlled permissions.
That favours software companies with deep customer integration. Fintech founders don’t need to build a foundation model, but a general AI interface won’t be enough. TD’s AI loan decisioning deployment shows why the value comes from placing verification and decision tools inside an active lending workflow. A specialized process, regulated decision, proprietary dataset, or difficult integration gives an agent work that an incumbent can’t easily reproduce.
Canadian Banks Face The Same Deployment Test
Jack Henry hasn’t announced a Canadian release, but the deployment problem is familiar. Canadian regulated AI workshops have identified vendor dependence, data quality, model validation, and accountability as barriers to production use.
Access to a capable model isn’t the constraint. Banks need to connect it to existing systems without losing control of data, permissions, decisions, or operational risk. National Bank’s Sardine deployment follows that reality by embedding external device intelligence and risk scoring into retail, commercial, and wealth operations.
The Canada AI Consortium is working on common controls for models, agents, users, and enterprise systems. Its use cases differ from Jack Henry’s security project, but the operating requirement is the same: agents need restricted access, visible decisions, and accountable people.
For Canadian banks and fintechs, the commercial challenge is solving those controls inside regulated workflows. Products that leave the integration and governance work to the bank may struggle to progress beyond a pilot.
Talking Point
As foundation models become easier to replace, will banking software competition depend less on who owns the AI and more on who controls the workflows where agents can act?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
July 4, 2026 | NCFA Fintech Whisperer | Artificial Intelligence And Data, Lending Consumer Credit And BNPL, Digital Assets Blockchain And Tokenization, Cybersecurity Fraud And Financial Crime, SME Finance And Business Banking, Capital Markets And Market Infrastructure, Policy Regulation And Governance, Risk Compliance And Regtech, Data Privacy And Governance
July 7, 2026, European Union / European Economic Area
The European Data Protection Board adopted draft Guidelines 03/2026 for public consultation, with feedback accepted until October 30, 2026.
The guidelines cover private organizations that collect personal data from external internet sources to train or fine tune generative AI systems.
The draft addresses legal basis, purpose limitation, transparency, accuracy and data minimization, alongside source exclusions, collection criteria, filtering and anonymization or pseudonymization.
AI training data now carries an auditable collection burden across source choice, legal basis, sensitive data and model output controls. Canadian fintechs using European personal data should map what is scraped, why it is needed, who controls the processing and how records can be filtered or removed before consultation language becomes supervisory practice.
MAS proposed changes to the Code on Collective Investment Schemes to support a wider range of retail fund products through a more streamlined authorisation process.
A proposed Alternative Funds Appendix would create a dedicated framework for innovative fund types with product specific safeguards and enhanced disclosure requirements.
MAS said it aims to establish regulatory guardrails for most new fund types within about three months, after which similar funds could be authorised in about three weeks if they meet the same requirements.
Fund innovation depends on regulatory speed as well as product design. Asset managers, exchanges, fintechs, wealth platforms and regulators should watch how dedicated approval pathways and product specific guardrails influence the pace of retail investment innovation without reducing investor protection.
Swift said its blockchain ledger is ready for initial use after nine months of development with international financial institutions.
Seventeen banks across six continents are preparing to pilot live cross border transactions using tokenised deposits with 24/7 payment availability.
The shared ledger connects bank issued tokenised deposits while final settlement continues through existing systems, preserving established compliance, credit and risk controls.
Swift is testing whether tokenized deposits can extend today's banking infrastructure into always available cross border payments without replacing existing settlement systems. The pilot results will provide an early benchmark for bank led tokenized payment networks.
The CFTC will stay CME’s self certified contract that would have allowed 24/7 crude oil futures trading.
The agency said CME sought self certification while the CFTC was already seeking public comment on whether standard futures contracts should extend to 24/7 trading.
The CFTC will review the product filings under its approval authority before deciding whether the contracts comply with commodity law and CFTC rules.
Always on market design is moving beyond crypto. Exchanges, brokers, clearing firms, liquidity providers, risk teams and regulators should watch how 24/7 trading changes oversight, operations, margin, surveillance and market resilience.
Equifax signed a definitive agreement to acquire Círculo de Crédito for a $750 million enterprise value.
Círculo de Crédito serves more than 1,700 customers and has 2 billion tradelines covering 80 million validated identities.
Equifax said the acquisition expands its credit bureau, alternative data, identity, fraud prevention and financial inclusion capabilities in Mexico.
Credit infrastructure is consolidating around data depth, identity coverage and alternative underwriting. Lenders, fintechs, credit bureaus, SME finance platforms and regulators should watch how alternative data, fraud controls and AI assisted decisioning affect credit access for thin file borrowers and small businesses.
The Securities and Futures Commission requires internet brokers and licensed virtual asset trading platform operators to use phishing resistant authentication for client login and device binding.
Firms must stop using one time passwords for these functions and may use passkeys or cryptographically bound devices instead.
Large internet brokers are expected to comply immediately, while all covered firms must implement the controls by July 8, 2027.
Hong Kong is replacing a widely used authentication method across online securities and regulated virtual asset trading. Brokers and platforms also need stronger monitoring, client notifications and incident response procedures, while senior management may be held accountable for losses caused by inadequate controls.
Open Banking Limited published its first twice-yearly Payments Fraud Monitor using data from six banking groups and eleven brands representing more than 60% of UK open banking payment volume.
Approximately one in 6,000 open banking payments was fraudulent during 2025, compared with one in 2,500 payments across the wider industry.
Open banking recorded a higher fraud rate by value at 0.035%, compared with 0.026% across the industry. Its average fraudulent transaction was £785, versus £266 for the wider benchmark.
The fraud rate by volume increased to 0.024% in the first quarter of 2026, or approximately one payment in 4,200. Authorized Push Payment fraud represented more than two-thirds of reported cases.
Variable Recurring Payments recorded a 0.007% fraud rate, compared with 0.026% for single immediate payments. App-authenticated journeys also produced lower fraud rates than browser-authenticated journeys, although app fraud was growing faster.
The findings connect payment design directly to fraud exposure, customer friction and trust. Lower fraud by transaction count is encouraging, but higher losses by value and rising first-quarter fraud show why scale requires stronger authentication, transaction risk data and coordinated controls. These operating results add important context to the UK’s payment milestone and Canada’s trust framework.
The European Commission introduced an action plan combining advanced AI model evaluation, cybersecurity resilience and European AI capacity.
The Commission and ENISA will develop a blueprint for secure access to advanced AI systems and a testing platform for critical sectors, including finance.
The plan adds an EU Grand Challenge for AI cybersecurity and connects implementation across the AI Act, DORA, NIS2, the Cyber Resilience Act and the Cyber Solidarity Act.
Financial institutions and technology providers will gain a structured environment for testing AI security tools against European requirements. Firms serving the European market should prepare to demonstrate model safety, operational resilience and secure deployment before advanced systems enter critical financial operations.
The European Systemic Risk Board warned that frontier AI models could increase systemic cyber risks across the EU financial system.
Frontier AI models may increase the speed, scale and sophistication of cyber attacks against financial institutions and infrastructure.
The ESRB welcomed an ECB Banking Supervision letter to significant euro area banks setting expectations for AI related cyber threats.
AI cyber risk is now a financial stability issue. Banks, fintechs, payment firms, infrastructure operators, software vendors and supervisors should watch how AI vulnerability discovery, third party concentration, open source dependencies and cyber resilience planning become part of financial sector oversight.
Circle received final approval from the Office of the Comptroller of the Currency to establish First National Digital Currency Bank, which will operate as Circle National Trust.
The national trust bank will operate under direct OCC oversight and offer fiduciary digital asset custody services for Circle and its affiliates when it opens.
The approved charter also supports future management of the USDC Reserve and possible custody services for a limited number of banks and other regulated financial institutions.
Circle's trust charter places a major stablecoin issuer inside the U.S. federal banking framework. The pace of implementation, custody adoption and any future expansion into reserve management will show whether trust banks become the preferred operating model for regulated stablecoin infrastructure.
Latvijas Banka’s Supervision Committee decided to issue Nodu Digital a crypto asset service licence and a payment institution licence.
The crypto asset licence permits exchanges between crypto assets and funds and transfers of crypto assets for clients, while the payment licence permits payments and transfers to payment accounts.
Nodu is the tenth company licensed by Latvijas Banka under MiCA and can provide its authorized crypto asset services across the European Union through cross border notification.
The paired licences let one regulated provider connect crypto conversion, asset transfers, conventional payments and payment accounts. Firms pursuing similar models across Europe will need to determine when MiCA authorization must be combined with payment permissions as their products cross from digital assets into fiat payment execution.
Ripple received full Markets in Crypto-Assets Crypto Asset Service Provider authorization from Luxembourg’s CSSF.
The licence allows Ripple to offer regulated digital asset services across all 30 European Economic Area markets.
Ripple said the approval supports its custody, payments and stablecoin activity in Europe under the MiCA framework.
MiCA is becoming a market access gate for global digital asset firms. Banks, payment companies, custodians, stablecoin issuers, exchanges and compliance teams should watch how full EU authorizations shape cross-border crypto services, institutional distribution and regulated stablecoin infrastructure.
Eltropy opened applications for an early access program that lets fintech companies build and distribute AI agents to more than 750 credit unions and community banks using its platform.
Accepted firms receive access to Eltropy’s agent operating system, lab environments, compliance and security documentation, development support and a route to distribution after certification.
The program is the first phase of a governed marketplace where institutions can use agents built by Eltropy, fintech partners or their own teams under common privacy, governance, escalation and audit controls.
Eltropy is turning agentic banking into a platform market rather than a closed vendor product. The commercial question is whether shared controls, integrations and distribution can make specialized financial agents easier for smaller institutions to adopt.
Lightworks, Scotiabank, Sun Life and TELUS launched the AI Consortium to build and govern shared AI control infrastructure in Canada.
The first program is the Agentic Control Plane, which gives enterprises visibility and control across models, agents, users and inference pipelines.
The release says the Agentic Control Plane is already running in production in regulated environments and processes more than two trillion tokens per month across member organizations.
Regulated AI adoption needs control infrastructure, not only models. Banks, insurers, telecoms, fintechs and compliance teams should watch how agent oversight, inference monitoring, shared IP and enterprise control planes become part of Canadian AI governance.
The FCA published the Mills Review on the long-term impact of AI on retail financial services through 2030 and beyond.
The review examines consumer behaviour, competition, fraud, financial inclusion, market structure and regulatory readiness.
The FCA said AI adoption may create risks around fraud, identity abuse, algorithmic bias, opaque decisions, consumer agency, concentration and resilience.
AI in retail finance is becoming a competition, consumer protection and fraud issue at the same time. Banks, fintechs, wealth platforms, insurers, lenders and compliance teams should prepare for AI agents, personalization, delegation, identity controls and new forms of consumer harm.
Klarna submitted applications to the Utah Department of Financial Institutions and the FDIC to establish Klarna Bank USA.
The proposed entity would be a Utah-chartered industrial bank and wholly owned subsidiary of Klarna Inc., subject to approval.
Klarna said a banking licence would bring payments, savings, credit and merchant services closer to its own operating model.
Large fintechs are testing direct charter strategies again. Lenders, BNPL firms, embedded finance platforms, banks, investors and regulators should watch whether major payment and credit firms choose bank partnerships, owned charters or hybrid models for the next stage of regulated growth.
An international FCA action against illegal financial promotions resulted in three arrests, six criminal proceedings and 650 social media takedown requests.
The regulator secured 17 criminal convictions and fined firms about £14.4 million for transaction reporting failures and control weaknesses during the year.
AI automation reduced the average handling time for simpler supervisory cases from as much as four hours to about six minutes.
Regulators are increasing both the reach and speed of financial misconduct enforcement. Firms now face faster detection, coordinated action across jurisdictions and far less time to correct weak promotion, reporting and compliance controls.
Conclusion
This week’s intelligence points to a more mature phase of financial innovation. Stablecoins are entering regulated banking structures, tokenized deposits are nearing live payment use, regulators are setting terms for continuous markets, and AI governance is becoming a practical operating requirement. In Canada, the Real Time Rail rules, PSP access model and planned Q4 launch show how domestic payment modernization is entering the same execution stage. Advantage will favour institutions that can combine trust, regulatory readiness and delivery at scale.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. 
