Karsten Wenzlaff, Advisor
August 26th, 2025
Cybersecurity | Aug 19, 2025

Image: Freepik/DC Studio
After years of delay, Canada is finally moving forward on cybersecurity legislation. The previous Bill C-26 stalled after critics raised concerns around due process and transparency issues with sweeping ministerial powers, unclear compliance costs, and provisions that would have allowed the government to rely on “secret evidence” in court challenges.
Now a newly introduced Bill C-8 An Act Respecting Cyber Security with the controversial secret evidence clause removed and the introduction of stronger oversight, make it more acceptable to industry stakeholders and politically viable. The legislation creates a new compliance regime with enforceable standards for critical infrastructure operators, including the banking system, and introduces penalties for non-compliance. For fintechs, the implications extend well beyond checklists and into how firms manage partnerships, payments, and cross-border data.
Bill C-8 arrives alongside the Bank of Canada's supervision of payment service providers (PSPs) under the Retail Payment Activities Act on September 8, 2025. Wallets, transfer apps, and other fintech PSPs must register, meet operational requirements, and demonstrate risk and security controls. The alignment of Bill C-8 with this deadline raises the bar for cyber resilience across the fintech ecosystem.
Even if most fintechs are not directly listed under the new Critical Cyber Systems Protection Act, regulated banks and clearing systems will be. These institutions will port obligations onto their fintech partners through contracts, audits, and certifications. OSFI’s Guideline B-13 on technology and cyber risk requires federally regulated institutions to govern third-party risks, test resilience, and maintain continuous monitoring, so we can expect those same requirements to flow into fintech vendor and partner assessments.
Payments Canada has also emphasized that national systems such as Lynx are critical infrastructure requiring robust cyber resilience. For fintechs integrated with those rails, resilience is no longer optional. It has become a business differentiator that impacts customer trust and competitive positioning.
Policy analysis suggests that Bill C-8 could influence EU–Canada data adequacy assessments, critical for fintechs handling European customer data or operating cross-border platforms. A compliance strategy that includes strong governance and privacy readiness will put Canadian fintechs in a better position to scale globally. For fintechs, compliance is only the minimum floor. Continues monitoring and governance should be the program.
Bill C-8 is a structural change in how Canada is approaching digital security. For fintechs, it means cyber readiness is inseparable from growth, compliance, and trust.
Those that move early to align with the expectations of both regulators and banking partners will not only meet compliance demands, but also stand out in a crowded marketplace. Canada’s fintech sector has an opportunity to turn these new rules into a foundation for competitive strength in a global digital economy.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
AI Ethics | Aug 15, 2025

Image: Freepik AI
A Reuters investigation into Meta’s AI content standards has revealed internal guidelines that allowed the company’s chatbots to have interactions with children, generate racially demeaning content, and produce false medical information if a disclaimer was included.
The 200-plus page policy called, "GenAI: Content Risk Standards", applied to chatbots across Facebook, Instagram, and WhatsApp. Meta confirmed the document was authentic and said some sections have now been removed. Meta described the controversial examples as “erroneous and inconsistent” with its policies, but admitted its enforcement was inconsistent.
Reuters reviewed internal policy materials that included Meta chatbot guideline examples related to children and examples related to race. These outlined scenarios the company considered acceptable and unacceptable under its AI behaviour standards.
The leaked rules have triggered a bipartisan backlash in Washington. As reported by Reuters on the U.S. Senate response, Republican senators Josh Hawley and Marsha Blackburn have called on congress to investigate, linking the AI ethics gap to the Kids Online Safety Act (KOSA). The bill would require platforms to take stronger measures to protect minors. Democratic senators Ron Wyden and Peter Welch also condemned the policies. Wyden argued that Section 230 protections for online platforms should not apply to generative AI chatbots. Welch said the findings show the urgent need for enforceable AI safeguards.
Canada introduced a Voluntary Code of Conduct for generative AI in September 2023 that includes commitments to safety testing, fairness, transparency, human oversight, and privacy protection. These commitments aim to prevent the kind of harm seen in Meta’s internal examples, but the code isn't legally binding, and no AI specific enforcement exists until the proposed Artificial Intelligence and Data Act is passed. So until then, it means that AI guardrails in Canada is largely up to companies to self police and public pressure, unless existing laws such as the Criminal Code or hate speech provisions are triggered.
Unchecked AI rules can allow GenAI outputs that many see as ethically unacceptable. Canadian fintechs, AI developers, and digital platforms should build stronger, enforceable guardrails before regulators step in.
With the U.S. now advancing legislation like KOSA, Canadian companies could soon face a higher ethics bar at home and abroad.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Banking Policy | Aug 12, 2025

AI generated image of financial exclusion
On August 7, 2025, the White House issued an executive order aimed at ending “politicized or unlawful” debanking. The order directs U.S. regulators to ensure that banks cannot deny service based on political views, religious beliefs, or lawful industry participation, including cryptocurrency. It's the highest profile intervention in U.S. banking in decades and could influence how other jurisdictions handle access to financial services. In Canada, let us not forget the swift debanking of key persons related to the trucker convoy debacle only a few years ago.
Federal banking regulators are to remove “reputational risk” from examination manuals within 180 days. All decisions to deny or close accounts must be based on looking at each customer’s situation on its own, using facts rather than opinions, and assessing real financial and compliance risks instead of relying on broad labels or assumptions.
Regulators must review past cases of account closures or denials within 120 days and take corrective actions, including fines, consent orders, or reinstatement of clients. The Small Business Administration is tasked with urging lenders to reinstate borrowers affected by unlawful debanking. The Office of the Comptroller of the Currency has already updated its materials to comply.
Supporters of the order point to documented cases where lawful businesses, advocacy groups, or individuals lost access to banking without clear justification. Critics argue banks must retain the ability to consider reputational factors when managing compliance obligations under anti-money laundering and counter-terrorist financing laws. A Financial Times analysis notes that crypto companies have been prominent among those alleging discrimination, alongside political organizations and religious nonprofits.
While Canada has not adopted similar measures (yet), there are high profile cases revealing parallels, such as in 2022 when former-PM Trudeau invoked the Emergencies Act to freeze more than 76 bank accounts worth $3.2 million CAD tied to the Freedom Convoy. The Federal Court later ruled this unconstitutional, and the decision is under appeal.
In another reported case, a trucker convoy lawyer said that her Royal Bank of Canada account was closed after small cryptocurrency transactions. Crypto business operators have also described difficulty maintaining accounts, though no comprehensive national data exists.
Canadian banks operate under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and oversight from the Office of the Superintendent of Financial Institutions. Reputational risk is explicitly considered in supervisory frameworks. Consumers are entitled to open personal bank accounts unless specific conditions apply, and must be given written reasons for refusal under the Access to Basic Banking Services Regulations. Complaints can be escalated to the Financial Consumer Agency of Canada or the Ombudsman for Banking Services and Investments, but there is no mandated systemic review or reinstatement process.
| Feature | United States (Post-EO) | Canada |
| Stance on Debanking | Prohibits ideological or industry-based debanking | No federal rule prohibiting ideological or lawful industry debanking |
| “Reputational Risk” | Removed from regulatory supervision criteria | Integral to OSFI guidance and AML compliance |
| Remediation Process | Regulator-led review, possible fines, reinstatement | Individual complaints through FCAC or Ombuds |
| Transparency | Mandated objective, individualized reasoning for account decisions | Written refusal required, but criteria remain broad |
The U.S. executive order aims to reduce bias in access to financial services which should not be denied based on lawful activity or beliefs. For fintech and crypto entrepreneurs, the change should make banking access more predictable and less influenced by subjective judgments. While Canada’s regulatory approach emphasizes prudence and reputational safeguards, it may need to review these protections that remain at the expense of inclusion and competitiveness.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
IP Policy and Competition | August 7, 2025
Image: FreepikOn August 6, 2025, there's an inspiring OpEd in the Financial Post by Jim Hinton and Alexis Conrad, who argued that Canada’s sovereignty is being eroded not by military threats but by the loss of control over its intellectual property. They warn in today's economy it's no longer about "flags, borders, boots on the ground" that define national strength but rather it's the intangibles, such as the source code, algorithms patents, and digital infrastructure that strengthen global leverage and competitiveness, and Canada's current approach to IP is giving it away faster than innovators can build them.
Prime Minister Mark Carney has committed to raising defence spending to $150 billion annually by 2035. But Canada still lacks a framework to retain the intellectual property created through public investment. More than 50 % of university-developed IP ends up in foreign hands, often with no commercial benefit to Canadian firms. Patent office filings show transfers of Canadian-invented technology from Dalhousie to Tesla and from the University of Toronto to Google. Researchers from 50 Canadian universities co-authored work with Chinese military related scientists between 2005 and 2022. Foreign ownership of Canadian inventions and patents has tripled since 2001, now accounting for 56 % of the total.
Canada’s first major contract under the new defence strategy for an arctic radar system valued at $6.5 billion was awarded to an Australian firm. Although there may not be an exact equivalent defence supplier in Canada, there was no public evidence showed that Canadian options were seriously considered. In cleantech, a Burnaby-based carbon capture pioneer Svante is considering a move to the U.S. after being excluded from Canada’s clean tech tax credits. These examples show that public funding and procurement are not aligned with long-term national control.
ElevateIP is a federal initiative created to help startups protect and manage intellectual property, but it lacks key structural elements. It does not require Canadian IP ownership or tie support to procurement or national priorities. It does not coordinate with university tech transfer or public research institutions. It does not track the outcomes of supported IP. As a result, it helps educate founders on IP strategy but offers no protection against IP loss or foreign transfer.
The challenges raised by this article are highly relevant to fintech. Canadian fintech companies often rely on proprietary algorithms, transaction infrastructure, digital identity systems, and embedded financial technologies that qualify as intellectual property. But there is no policy ensuring that publicly supported fintech innovation remains in Canadian control. Many early-stage fintechs are spun out of university labs or supported by public accelerators. Without clear ownership conditions or commercialization requirements, they face the same risks as cleantech and AI firms via acquisition or licensing by larger foreign organizations that ultimately repatriate value outside of Canada.
Fintech IP is also foundational to digital sovereignty. Payments, lending, credit scoring, open banking infrastructure, compliance automation, and digital asset platforms depend on core IP and data control. If these are owned abroad, Canada risks falling behind on financial inclusion, global competitiveness, and platform security.
Public funding that supports fintech innovation without securing ownership or commercialization rights fails to build long term value at home.
Countries like the U.S., South Korea, and Finland have updated their strategies to secure domestic IP and use procurement as a growth lever. Canada still relies on outdated models. Innovation without ownership means financing someone else’s economy. Canada must close the policy gaps between research, funding, procurement, and commercialization if it wants to retain control of its own innovation pipeline and competitiveness.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
August 7, 2025

Image: Freepik/DC Studio
Running a cleaning company today involves more than just keeping homes and offices spotless. With many businesses using digital tools to schedule appointments, send invoices, and manage customer information, it’s important to stay alert to cybersecurity threats.
Even small businesses like cleaning services can become targets for hackers. Fortunately, there are simple steps you can take to protect your company, your clients, and your reputation.
Here are some practical cybersecurity best practices tailored to cleaning companies.
Weak or reused passwords are one of the most common ways hackers gain access to business systems. Every account should have a strong password made up of a combination of letters, numbers, and symbols. Avoid using obvious words like "password" or "123456."
To make things easier and more secure, consider using a password manager. These tools help create and store strong passwords so you don’t have to remember them all.
In addition, always enable two-factor authentication (2FA) where possible. This adds an extra step to logging in, such as entering a code sent to your phone. Even if someone gets your password, 2FA can stop them from getting into your account.
Cybercriminals often look for weaknesses in outdated software to break into systems. That’s why it’s important to keep all your devices and applications updated. This includes your phones, computers, cleaning management apps, and any other software you use for scheduling or payments.
Turn on automatic updates so you’re always protected with the latest security patches. This simple habit can protect your business from serious risks.
Every business collects and stores important information. If that data is lost due to a virus, cyberattack, or technical issue, it could severely affect your operations.
Make sure to back up your business data regularly. This includes client contact lists, invoices, appointment history, and payroll information. Store your backups in the cloud or on an external hard drive kept in a secure location. It’s also a good idea to test your backups occasionally to ensure they work properly in case you need to restore your files.
Your employees are your first line of defense against cyber threats. A team member who accidentally clicks on a harmful link or opens a suspicious attachment could compromise your entire system.
Provide basic cybersecurity training for your staff. Teach them how to recognize phishing emails, avoid downloading unknown files, and use strong passwords. Make cybersecurity a regular part of your company’s training, even if your team is small. The more informed your staff is, the better protected your business will be.
If you run your business from an office or even from home, make sure your Wi-Fi network is protected. Use a strong password that’s different from the default one provided by your internet service provider. Choose WPA2 or WPA3 encryption to keep your network secure.
Avoid sharing your main Wi-Fi password with clients or guests. If needed, set up a separate guest network for non-business use. This helps prevent unauthorized access to sensitive information.
Not every employee needs access to every system or piece of data. Giving limited access reduces the risk of accidental or intentional misuse of information.
Review your systems and assign permissions based on each person’s role. For example, cleaners don’t need access to financial records, and part-time staff might not need full access to customer databases. Also, be sure to remove access immediately when someone leaves your company.
Antivirus software helps detect and remove threats like viruses, malware, and ransomware. A firewall adds another layer of protection by blocking unauthorized access to your network.
Choose a reputable antivirus program and keep it up to date. Most modern operating systems include built-in security tools, but adding a reliable third-party solution can offer extra peace of mind. Make sure firewalls are turned on for all devices connected to your business network.
Even with strong protections in place, no system is 100 percent secure. That’s why having a basic incident response plan is important. If your systems are hacked or your data is compromised, you need to know what steps to take.
Create a simple plan that outlines what to do if your business faces a cybersecurity problem. This should include who to contact for IT support, how to access your backups, and how to communicate with clients if necessary. Planning ahead can minimize damage and help your business recover more quickly.
Cybersecurity may not be the first thing that comes to mind when running a cleaning company, but it’s becoming more important every day. As more clients expect digital communication, online booking, and electronic payments, protecting your systems and data is part of running a responsible, modern business.
Taking a few basic steps to improve your cybersecurity can help you avoid costly disruptions, protect your customers’ trust, and keep your business running smoothly. You don’t need to be a tech expert to stay secure, just start with the basics and build from there.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Public Markets | Aug 1, 2025

Image: Freepik/ijeab
According to a Reuters report, President Donald Trump has begun private talks with the heads of the largest US banks about how to return Fannie Mae and Freddie Mac to the public markets. These two companies (government sponsored enterprises with private shareholders), which guarantee most American mortgages, have been under government control since the 2008 financial crisis.
Trump has had meetings with bank CEOs, the discussions include executives such as Jamie Dimon from JPMorgan Chase, David Solomon from Goldman Sachs, and Brian Moynihan from Bank of America. The White House is gathering proposals on how a stock offering for Fannie and Freddie could work if the companies are moved out of federal conservatorship.
Fannie Mae and Freddie Mac were taken over by the US government during the 2008 financial crisis when losses in the housing market threatened to bring them down. Since then they have returned to profitability and repaid the funds that the US Treasury provided at the time.
Trump has said on Truth Social that he wants to explore ways to bring these companies back to the stock market while keeping some form of government guarantee for the mortgage market. Fannie (FNMA) and Freddie (FMCC) shares have surged 8.72% and 14.8% respectively after news of the bank meetings.
How these companies are handled will have a direct effect on investors, banks, and taxpayers. A public stock offering could return value to shareholders and possibly reduce the taxpayer risk that comes with government control. At the same time, if guarantees remain in place, taxpayers could still carry some exposure to future losses.
The Federal Housing Finance Agency, which oversees Fannie Mae and Freddie Mac, has said that the companies will remain in conservatorship for now. Any plan to sell stock or change their status would need approval from the President and would likely be debated in Congress.
These changes are not just about the United States. Canadian pension funds, banks, and other institutions invest in American mortgage backed securities that are tied to Fannie Mae and Freddie Mac. A change in their structure could affect the value of these investments and may influence how Canadian regulators look at housing finance and risk management.
It is also possible that US mortgage reform could shift how capital markets treat housing assets, which in turn may influence borrowing costs and investor strategies across North America.
The talks with the banks are at an early stage. In the coming months the White House is expected to receive detailed proposals from these financial institutions. From there, a plan could be developed that would outline whether there will be a public stock sale, how much government support would remain, and the timeline for any transition.
Canadian investors and policy makers will be watching these developments closely. The scale of Fannie Mae and Freddie Mac makes any change in their structure important well beyond US borders.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |