Karsten Wenzlaff, Advisor
August 26th, 2025
AI | Aug 21, 2025
Image: Freepik/Rawpixel.com
On August 20, 2025, Forbes revealed that Elon Musk’s xAI had published hundreds of thousands of Grok chatbot conversations that became searchable on Google without warning. The exposed chats ranged from personal medical questions and passwords to instructions for creating drugs, malware, and even a plan to assassinate Musk himself.
The problem was related to Grok’s “share” button. When users clicked it, the platform generated a unique URL that was publicly crawlable by search engines. There was no disclaimer or safeguard, and ultimately private exchanges and shared personal information would immediately be published and available online. TechCrunch reporting confirmed that thousands of Grok conversations containing sensitive data are indexed on Google.
Among the published material were uploaded spreadsheets, text documents, and conversations disclosing names, personal details, and at least one password. Experts noted that xAI’s approach mirrored and exceeded a failed OpenAI experiment last month in July 2025, when ChatGPT briefly allowed chats to be discoverable before pulling back after user backlash.
Opportunists are already exploiting Grok’s share function to manipulate Google search results, proving that careless design choices can spawn entirely new risks.
The Grok and ChatGPT leaks illustrate the absolute need for privacy by design and transparent governance in AI. For fintech and financial services, the implications are massive given that trust is foundational.
If users believe that their conversations or sensitive data could be exposed online without consent, it will only hinder AI adoption and long term growth. With global media and regulators now scrutinizing the exposure, the lesson is clear: innovation cannot come at the expense of trust.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Cybersecurity | Aug 19, 2025

Image: Freepik/DC Studio
After years of delay, Canada is finally moving forward on cybersecurity legislation. The previous Bill C-26 stalled after critics raised concerns around due process and transparency issues with sweeping ministerial powers, unclear compliance costs, and provisions that would have allowed the government to rely on “secret evidence” in court challenges.
Now a newly introduced Bill C-8 An Act Respecting Cyber Security with the controversial secret evidence clause removed and the introduction of stronger oversight, make it more acceptable to industry stakeholders and politically viable. The legislation creates a new compliance regime with enforceable standards for critical infrastructure operators, including the banking system, and introduces penalties for non-compliance. For fintechs, the implications extend well beyond checklists and into how firms manage partnerships, payments, and cross-border data.
Bill C-8 arrives alongside the Bank of Canada's supervision of payment service providers (PSPs) under the Retail Payment Activities Act on September 8, 2025. Wallets, transfer apps, and other fintech PSPs must register, meet operational requirements, and demonstrate risk and security controls. The alignment of Bill C-8 with this deadline raises the bar for cyber resilience across the fintech ecosystem.
Even if most fintechs are not directly listed under the new Critical Cyber Systems Protection Act, regulated banks and clearing systems will be. These institutions will port obligations onto their fintech partners through contracts, audits, and certifications. OSFI’s Guideline B-13 on technology and cyber risk requires federally regulated institutions to govern third-party risks, test resilience, and maintain continuous monitoring, so we can expect those same requirements to flow into fintech vendor and partner assessments.
Payments Canada has also emphasized that national systems such as Lynx are critical infrastructure requiring robust cyber resilience. For fintechs integrated with those rails, resilience is no longer optional. It has become a business differentiator that impacts customer trust and competitive positioning.
Policy analysis suggests that Bill C-8 could influence EU–Canada data adequacy assessments, critical for fintechs handling European customer data or operating cross-border platforms. A compliance strategy that includes strong governance and privacy readiness will put Canadian fintechs in a better position to scale globally. For fintechs, compliance is only the minimum floor. Continues monitoring and governance should be the program.
Bill C-8 is a structural change in how Canada is approaching digital security. For fintechs, it means cyber readiness is inseparable from growth, compliance, and trust.
Those that move early to align with the expectations of both regulators and banking partners will not only meet compliance demands, but also stand out in a crowded marketplace. Canada’s fintech sector has an opportunity to turn these new rules into a foundation for competitive strength in a global digital economy.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
AI Ethics | Aug 15, 2025

Image: Freepik AI
A Reuters investigation into Meta’s AI content standards has revealed internal guidelines that allowed the company’s chatbots to have interactions with children, generate racially demeaning content, and produce false medical information if a disclaimer was included.
The 200-plus page policy called, "GenAI: Content Risk Standards", applied to chatbots across Facebook, Instagram, and WhatsApp. Meta confirmed the document was authentic and said some sections have now been removed. Meta described the controversial examples as “erroneous and inconsistent” with its policies, but admitted its enforcement was inconsistent.
Reuters reviewed internal policy materials that included Meta chatbot guideline examples related to children and examples related to race. These outlined scenarios the company considered acceptable and unacceptable under its AI behaviour standards.
The leaked rules have triggered a bipartisan backlash in Washington. As reported by Reuters on the U.S. Senate response, Republican senators Josh Hawley and Marsha Blackburn have called on congress to investigate, linking the AI ethics gap to the Kids Online Safety Act (KOSA). The bill would require platforms to take stronger measures to protect minors. Democratic senators Ron Wyden and Peter Welch also condemned the policies. Wyden argued that Section 230 protections for online platforms should not apply to generative AI chatbots. Welch said the findings show the urgent need for enforceable AI safeguards.
Canada introduced a Voluntary Code of Conduct for generative AI in September 2023 that includes commitments to safety testing, fairness, transparency, human oversight, and privacy protection. These commitments aim to prevent the kind of harm seen in Meta’s internal examples, but the code isn't legally binding, and no AI specific enforcement exists until the proposed Artificial Intelligence and Data Act is passed. So until then, it means that AI guardrails in Canada is largely up to companies to self police and public pressure, unless existing laws such as the Criminal Code or hate speech provisions are triggered.
Unchecked AI rules can allow GenAI outputs that many see as ethically unacceptable. Canadian fintechs, AI developers, and digital platforms should build stronger, enforceable guardrails before regulators step in.
With the U.S. now advancing legislation like KOSA, Canadian companies could soon face a higher ethics bar at home and abroad.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Banking Policy | Aug 12, 2025

AI generated image of financial exclusion
On August 7, 2025, the White House issued an executive order aimed at ending “politicized or unlawful” debanking. The order directs U.S. regulators to ensure that banks cannot deny service based on political views, religious beliefs, or lawful industry participation, including cryptocurrency. It's the highest profile intervention in U.S. banking in decades and could influence how other jurisdictions handle access to financial services. In Canada, let us not forget the swift debanking of key persons related to the trucker convoy debacle only a few years ago.
Federal banking regulators are to remove “reputational risk” from examination manuals within 180 days. All decisions to deny or close accounts must be based on looking at each customer’s situation on its own, using facts rather than opinions, and assessing real financial and compliance risks instead of relying on broad labels or assumptions.
Regulators must review past cases of account closures or denials within 120 days and take corrective actions, including fines, consent orders, or reinstatement of clients. The Small Business Administration is tasked with urging lenders to reinstate borrowers affected by unlawful debanking. The Office of the Comptroller of the Currency has already updated its materials to comply.
Supporters of the order point to documented cases where lawful businesses, advocacy groups, or individuals lost access to banking without clear justification. Critics argue banks must retain the ability to consider reputational factors when managing compliance obligations under anti-money laundering and counter-terrorist financing laws. A Financial Times analysis notes that crypto companies have been prominent among those alleging discrimination, alongside political organizations and religious nonprofits.
While Canada has not adopted similar measures (yet), there are high profile cases revealing parallels, such as in 2022 when former-PM Trudeau invoked the Emergencies Act to freeze more than 76 bank accounts worth $3.2 million CAD tied to the Freedom Convoy. The Federal Court later ruled this unconstitutional, and the decision is under appeal.
In another reported case, a trucker convoy lawyer said that her Royal Bank of Canada account was closed after small cryptocurrency transactions. Crypto business operators have also described difficulty maintaining accounts, though no comprehensive national data exists.
Canadian banks operate under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and oversight from the Office of the Superintendent of Financial Institutions. Reputational risk is explicitly considered in supervisory frameworks. Consumers are entitled to open personal bank accounts unless specific conditions apply, and must be given written reasons for refusal under the Access to Basic Banking Services Regulations. Complaints can be escalated to the Financial Consumer Agency of Canada or the Ombudsman for Banking Services and Investments, but there is no mandated systemic review or reinstatement process.
| Feature | United States (Post-EO) | Canada |
| Stance on Debanking | Prohibits ideological or industry-based debanking | No federal rule prohibiting ideological or lawful industry debanking |
| “Reputational Risk” | Removed from regulatory supervision criteria | Integral to OSFI guidance and AML compliance |
| Remediation Process | Regulator-led review, possible fines, reinstatement | Individual complaints through FCAC or Ombuds |
| Transparency | Mandated objective, individualized reasoning for account decisions | Written refusal required, but criteria remain broad |
The U.S. executive order aims to reduce bias in access to financial services which should not be denied based on lawful activity or beliefs. For fintech and crypto entrepreneurs, the change should make banking access more predictable and less influenced by subjective judgments. While Canada’s regulatory approach emphasizes prudence and reputational safeguards, it may need to review these protections that remain at the expense of inclusion and competitiveness.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |