Karsten Wenzlaff, Advisor
August 26th, 2025
Karsten Wenzlaff is a Crowdfunding and Fintech Expert from Germany. He is Secretary-General of Digit[...]
Category Archives: Cyber Security, Quantum, Hacks, Fraud Alerts, Risks, InsurTech
Reddit Lawsuit Puts Anthropic’s AI Claims Under Review
AI | June 9, 2025
Image: Freepik
Reddit’s Lawsuit Tests Anthropic’s Promise of Responsible AI
On June 4, 2025, Reddit filed a lawsuit against Anthropic, alleging that the AI tech system conducted more than than 100,000 unauthorized data scraping events since last July, violating Reddit's user terms. It comes at a time when Anthropic is expanding the reach of Claude, its AI model family, across enterprise and government sectors. The legal, ethical, and commercial stakes are high.
Key Insights
- Legal Fight Over Data Use - Reddit claims Anthropic extensively scraped its platform to train Claude without a licensing agreement or user privacy safeguards. Unlike OpenAI and Google, which entered into formal agreements with Reddit, Anthropic allegedly bypassed compliance systems designed to manage post deletions and data controls. The lawsuit was filed in California and accuses Anthropic of breach of contract, unjust enrichment, trespassing, and unfair competition.
See: Anthropic CEO’s Radical Vision for Humanity
- Claude's Rapid Expansion - Anthropic has moved quickly to commercialize Claude through enterprise partnership integrations with platforms such as Amazon Web Services and Databricks. Its Claude 4 model competes directly with ChatGPT and Gemini, and its Claude Gov model now supports U.S. national security applications. As of June 2025, Claude is embedded in tools from finance to customer service, including Amazon’s reengineered Alexa.
- OpEd, Policy Influence - On June 5, Anthropic CEO Dario Amodei published an oped in the New York Times criticizing a proposed 10-year moratorium on state-level AI regulation in the U.S. (part of the 'One Big, Beautiful Bill'). Instead, he advocated for robust federal guardrails including transparency requirements and safety evaluations. Amodei's policy position as a pro-governance AI firm comes at a time when his company is facing allegations of contractual breach and ignoring privacy norms. This dichotomy is a growing situation where AI firms call for policy while quietly cut corners on platform data rights. Reddit's lawsuit challenges the credibility and public stance that Anthropic has on AI ethics and user privacy.
See: Amazon’s $4B Boost to Anthropic Strengthens AI Alliance
- Data Risks and Compliance Concerns - An April 2, 2025 security review of Claude's plugin system called the Model Context Protocol (MCP) audit, found it could be used to steal passwords or run harmful commands if not properly protected. The report warned that this tool, which allows Claude to interact with outside software, might let attackers trick the model into taking unsafe actions. These risks highlight the need for stronger safety checks when AI tools can access other systems.
Closing Outlook
Reddit's lawsuit is a critical test of Anthropic’s values and the public credibility of responsible AI branding. As Claude advances deeper into sensitive sectors like national security, it'll be more important than ever to define what real accountability with regards to data use looks like, and for Claude/Amodei to deliver on his ethical promise.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
|---|---|---|
 |  |  |
ChatGPT Creator Tells Us What Is Coming Next
AI | June 9, 2025
Image: Ilya Sutskever at University of Toronto convocation June 6, 2025 via Youtube
Ilya Sutskever Warns AI Will Surpass Human Intelligence and Change Work, Value, and Survival
On June 6, 2025 at the University of Toronto’s convocation, Ilya Sutskever, cofounder of OpenAI and lead innovator of ChatGPT, delivered a powerful message while accepting an honorary degree in Doctor of Science (actually his fourth UoT degree). He warned that artificial intelligence (AI) is quickly advancing to a point where it will do everything humans can do, and we're not ready for what comes next.
“The Brain Is a Biological Computer”
Once a machine can learn anything a person can learn, no task is out of reach. This idea is central to Sutskever’s argument that AI will eventually match all human abilities. “We have a brain, and the brain is a biological computer… So why can't a digital brain do the same things?”
The End of Work as We Know It
“The day will come when AI will do all of the things that we can do, not just some of them, but all of them.”
The timeline is uncertain but the direction is clear. Whether it takes 3, 5 or 10 years, general purpose AI will change how the economy functions and how people define and measure productivity.
See: The Rise and Implications of a New AI Software Workforce
Sutskever warns that even efforts to retrain workers may fall short because as technology marches forward, the very jobs people train for could vanish before they are ready to take them on.
“Many will find that the new job they were training for no longer exists by the time they finish retraining.”
He also said that while some will turn to universal basic income but it may not hold up because people may be seen as no longer economically productive.
The Future of Human Value
Sutskever predicts two long-term outcomes. If humans find a way to offer lasting value, we may be treated as companions to AI systems. If not, we risk becoming irrelevant or extinct.
“In the best-case scenario, humanity will become like pets or the microbiome of artificial intelligence. In the worst-case scenario, humanity will become obsolete or even extinct.”
The Challenge of a Lifetime
“The challenge that AI poses is the greatest challenge of humanity ever. And overcoming it will bring the greatest reward.”
He stresses that the response cannot be passive. Every person and institution will need to participate in what this technology becomes.
See: Should Fintechs Design for People or AI Agents?
“Accept reality as it is, try not to regret the past, and try to improve the situation.”
Meeting this moment requires emotional resilience. He says people should remain focused on the present instead of looking backward and encouraged others to adopt the same mindset.
How Canada Should Respond to the Coming AI Disruption
Sutskever’s speech is measured insight into the future, and governments, industry, innovators globally need to take his message as a direct challenge to act now (if you're not already sweating the pace of change in 2025). At NCFA Canada, we believe his message carries the kind of disruption that financial leaders must (anticipate and) respond to with urgency.
See: Global Open Finance Lessons for Canada’s Rulebook
Canada cannot afford to be unprepared. While the changes can be guided with responsible AI efforts, they seemingly cannot be stopped, and so we must act with urgency to be prepared as new AI powered systems will influence financial markets, education, investment models, employment pathways, human mobility and more. the fintech sector needs to become more agile, more connected, and more willing to build for what's coming next.
"Innovating and adapting at the speed of AI development means building solutions and platforms that help people create value alongside AI, not behind or beneath it. It also means designing incentives and safeguards that match the reality of a hybrid workforce where humans and machines co-exist, and to embolden the leadership and collaboration needed to work together to solve problems." Craig Asano, NCFA
Outlook
Canada cannot rely on other jurisdictions to define what safe and responsible AI looks like, and Canadian fintechs and institutions should play a direct role in developing policies, models, and frameworks that ensure AI serves the public interest.
See: AI Concierge Tech and the Future of Finance
This is not just a technology issue. It is a national competitiveness issue. It is also a question of whether we will help define the rules of the future or simply be beholden to them.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Responding to U.S. Financial Risk with Canadian Strength
Innovation Strategy | May 30, 2025
Image: Freepik/jannoon028
Canada Must Lead With Bold Innovation as U.S. Finance Shows Cracks
On May 31, 2025 the Economist ran an article called, "American finance always unique is now uniquely dangerous' unveiling how America’s financial system has evolved into a source of global instability. Private capital giants are creating a new class all to themselves and changing markets, powered by scale, opacity, and political uncertainty. For Canada, it's both a warning and more importantly our strategic moment. Instead of copying the American finance model, Canada can define it's own but strengthening capital independence by building trust-first finance, and accelerating high impact innovation with homegrown channels and tools.
A Fragile and Changing Superpower, Sends a Strong Signal
The article explains how U.S. firms like Apollo, BlackRock, Blackstone, Citadel, and Jane Street have grown at unprecedented rates:
- Three private market giants now manage 2.6 trillion dollars in assets. That is nearly five times more than a decade ago
- Apollo lent $200 billion in 2024 alone. That outpaces new loan growth from major U.S. banks
- Jane Street’s trading revenue in 2024 matched Morgan Stanley’s
These firms operate at speed and scale, are highly interconnected and deeply exposed to volatility. They are providing the capital that fuels the economy, but are also increasing systemic risk. The Economist article points out that in the next crisis, investors may just wake up to a financial system they no longer recognize. Instead of looking at what this expressly means for America, let's turn our focus to what it means for Canada.
Canada’s Strategic Opportunity
Instead of emulating what's unfolding in U.S. financial markets with a dose of more regulation, Canada can lead by building a financial model that is more open, independent, and focused on real impact and outcomes. Five areas of focus stand out:
1. Mobilize Domestic Capital with Purpose
Canada already has strong public institutions that support innovation. BDC, the Strategic Innovation Fund, NRC IRAP, and superclusters like DIGITAL are doing important work. But from seeing how the innovation economy operates first hand for years, these efforts often move in parallel, not in sync, so capital doesn't always reach the ventures that it should.
See: How Fintechs Are Unlocking Value in Private Markets
Canada needs a unified capital deployment strategy that links public funds, pension capital, credit unions, and private investors to the frontier innovations, such as AI, advanced fintech, clean energy, quantum computing, and digital infrastructure. What often seems missing is not just the capital or the infrastructure but national coordination, faster decision making, and larger bold scale.
New tools are needed, such as public-private innovation funds, industry specific capital acceleration platforms, and patient capital vehicles too that are designed to support mid to longer term commercial growth. Instead of launching more pilots, Canada must focus on coast to coast deployment frameworks and national collaboration that get more capital into the hands productive Canadian founders building the future.
2. Build Trust-Based Capital Markets
Trust and transparency are two o f Canada’s greatest financial strengths but it only really matters when the rules are clear, the channels and processes are coordinated, and the government supports the program, then investors understand and are more open to participating.
Canada’s experience with equity crowdfunding is a good example of what happens when the above does not happen. Despite strong public and sector interest, fragmented provincial rules were rolled out, delaying adoption and making it difficult for platforms to operate nationally. Costs and confusion rose, and participation stalled. Even after the rules were unified under National Instrument 45-110 in 2021, much of the early momentum was lost, and it took years of slower growth to finally get wind in the sails and establish new milestones (a testament to a few dedicated and innovative entrepreneurs).
Even the best ideas need clear frameworks and national coordination to encourage public trust and participation. Everyday investors sit on the sidelines when the process is confusing or inconsistent.
See: UK Launches PISCES to Modernize Capital Markets
This same risk applies to newer models like tokenized assets, which have the potential to bring more transparency and better tracking to private markets. These tools only work if they are supported by smart, unified policy frameworks that offer investors clarity and confidence.
Canada does not need more regulation. It needs simpler, better aligned systems that connect investors and innovators in a way that builds confidence at every level.
3. Focus Innovation on Real World Impact
Canada should direct innovation capital to sectors that solve urgent national challenges. This includes enabling fintech to scale small business lending, improve insurance access, close affordable housing gaps, support clean energy transitions, and improve public service delivery by way of examples. The goal is not just economic return but national capacity building. Growth capital should help deliver long term social and economic value in Canada.
Achieving this means aligning investment programs, public procurement, and partnership models with outcomes that matter to Canadians. It also helps ensure that successful Canadian innovations are commercialized and scaled at home, not forced abroad due to lack of local support.
4. Build Sovereign Digital Infrastructure
For innovation to scale safely and securely, Canada must invest in its own digital foundations. This includes national infrastructure for real time rails and modern payments, open banking/finance, digital identity, and interoperable data access. These systems are strategic. As global finance becomes more centralized and politicized, Canada needs open, Canadian-controlled infrastructure that supports innovation without dependency on foreign platforms or proprietary systems.
See: CSA Expands LIFE Exemption to Boost Public Capital Raising
With the right digital infrastructure strategy in place, Canadian fintech and digital companies can grow on their own terms, compete globally, and deliver public value with greater trust and resilience.
5. Stay Open and Independent
Canada’s financial system should remain open to global capital but it shouldn't be overly dependent or reliant on any one market or political cycle. Diversifying capital sources, building a Canada-first tech capacity, and expanding international partnerships will help domestic innovators can grow on Canadian terms. Strategic independence is a competitive advantage.
Why It Matters
The U.S. financial system is evolving quickly and funding innovation at scale in new ways, with new risks creating instability.
See: Larry Fink’s 2025 Fintech Vision for Capital Markets
Canada should not be overly reliant on the U.S. for capital. It should focus on building a domestic model that backs Canadian innovators with capital, trust, strategic focus, and a clear national purpose. It is time to stop chasing someone else’s model and start shaping our own.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Coinbase Breach Days Before S&P 500 Listing Milestone
Crypto | May 20, 2025
Image from Coinbase announcement
$400M Coinbase Hack Exposes Risk Days Before S&P 500 Milestone
Just days before Coinbase is set to become the first crypto-native company added to the S&P 500, the largest crypto exchange in the United States disclosed a serious security breach on May 15, 2025 that could cost up to $400 million in damages and reimbursements. This is a growing vulernability in fintech and it's not related to flawed code or a broken firewall, but people on the inside working for the company.
Extortion and Coinbase's Response
On May 11, attackers sent Coinbase a ransom demand for $20 million in Bitcoin, but Coinbase refused to pay. Instead, they issued a public statement offering a $20 million bounty for information leading to the attackers’ arrests. In an SEC filing, Coinbase estimated that the financial cost of the data breach hack would be between $180-400 million for 'remediation costs and voluntary customer reimbursements'.
According to Coinbase, the attack began when 'rogue overseas support agents' (aka contracted customer support workers) were bribed by criminals. The corrupt insiders granted access to Coinbase’s internal systems, allowing attackers to gather customer names, emails, addresses, phone numbers, and even photos of passports and driver’s licenses.
See: Coinbase Buys Deribit for $2.9B to Lead Crypto Derivatives
The Verge also confirmed that some impacted customers lost funds after being tricked into sending crypto to the attacker’s fraudulent wallet addresses. Attackers used their personal data to impersonate Coinbase staff to target the victims. Coinbase has committed to paying them back.
Coinbase has since fired all of the compromised support workers and launched a new U.S.-based customer service hub. Law enforcement investigations are ongoing.
Industry Lessons
Outsourcing is an added risk given that lower paid overseas support agents with access to internal back-end systems can be bribed. Attackers are looking for customer data to support their social engineering scams to defraud victims. Cybersecurity must be approached beyond just technical risks, especially given that insider risks are often overlooked when developing compliance and risk mitigation programs.
Outlook
Coinbase’s inclusion in the S&P 500 took place on Monday May 19, 2025, marking a significant milestone for the crypto sector. It is replacing Discover Financial Services, which is being acquired by Capital One. According to Ainvest, moving Coinbase to the S&P will trigger up to $16 billion in inflows from index-tracking funds and institutional investors.
See: The Day the Platform Went Dark. A Cyber Resilience Story
However, the breach overshadows the achievement, now facing lawsuits from affected customers and working to repair trust in its rand. Just at the moment of unprecedented visibility.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Ethereum Targets $1 Trillion in Security Upgrades
Crypto Security | May 16, 2025
Image from Ethereum 1TS announcement
Ethereum Launches $1 Trillion Security Push to Protect Global On-Chain Assets
On May 14, 2025, the Ethereum Foundation anounced a $1 Trillion Dollar Security (1TS) Initiative, a long term project to strengthen the security of the entire Ethereum ecosystem to support a future where trillions of dollars in value could move on-chain. The reality is that security isn't just a technical issue. It is the single biggest barrier to mainstream adoption of Web3, and Ethereum knows it.
See: Fintechs Face Rising SaaS Security Risks, JPMorgan CISO
Today, Ethereum is responsible for more than 50 percent of all total value locked (TVL) in decentralized finance platforms, already securing over $400 billion in on-chain assets. However a rise of exploits and protocol breaches unveil how fragile Ethereum's infrastructure actually is so the 1TS project aims to reinforce it.
How Big Is the Security Problem?
In 2024, hackers stole over $1.8 billion across crypto platforms with Ethereum-based DeFi applications accounting for more than half of the total losses. Despite improvements in protocol security, new vulnerabilities continue to be exploited at scale, such as:
- $290 million at PlayDapp lost after attackers exploited access controls to mint unauthorized tokens
- $97 million stolen at Muchables by a rogue developer through a smart contract backdoor
- $80 million at Orbit Chain was drained from an Ethereum bridge used for cross-chain transfers
- $55 million at Radiant Capital was lost through an access control flaw in Ethereum-based lending contracts
Notably the above figures don't include the growing number of targeted phishing campaigns, wallet drainers, and socially engineered scams that increasingly use AI to impersonate trusted actors and to slay 'pig butchering'. Collectively, these exploits show that Ethereum's security environment still has a way to go. For many prospective users and certainly institutions, the constant threat of permanent asset loss is a significant barrier to adoption and long term trust.
Goals and Leadership of 1TS
1. Map the risk. The Ethereum Foundation is conducting a full-stack vulnerability analysis, including risks in wallets, smart contract tooling, L2 infrastructure, consensus layer code, and even DNS and internet infrastructure.
2. Fund what matters. 1TS will identify the highest priority attack surfaces and fund long term solutions. These could include upgrades to client software, fuzz testing, formal verification, or developer tooling that requires and enforces safer default settings.
See: Spot Ethereum ETFs Debut in the U.S. (Without Staking)
3. Communicate clearly. The final goal is to make Ethereum’s security infrastructure easier to understand, and to establish transparent benchmarks and metrics that will allow users, enterprises, and governments to compare the safety of Ethereum’s ecosystem to other financial systems.
The 1TS initiative is being led by Fredrik Svantes, Ethereum Protocol Security Lead, and Josh Stark, part of the Ethereum Foundation’s core leadership. They are joined by several other well known people from the security ecosystem, all bringing deep experience in incident response, smart contract audits, and secure protocol design.
What to Get Involved?
The Ethereum Foundation is opening the initiative to input from the community. Anyone can share suggestions, flag concerns, or apply to collaborate by completing this form or to discuss, reach out to the team directly by email at trilliondollarsecurity@ethereum.org.
Outlook
If Ethereum wants to be the financial base layer for billions of people, it needs a security model at least as robust as global banking systems. The Trillion Dollar Security Initiative is welcomed and necessary to get to the next step. It is about showing regulators, institutions, and the public that Ethereum and all the companies and transactions that feed off of the ecosystem can scale safely.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Brutal Kidnappings Target French Crypto Figures
Crypto | May 16, 2025
Image: Freepik/Wirestock
Wave of Crypto Kidnappings Shakes France’s Fintech Sector and Global Reputation
A series of violent kidnappings has rocked France’s crypto sector, prompting emergency government action and raising global concern about the country’s safety for fintech entrepreneurs. On May 13, 2025, masked men tried to abduct the pregnant daughter of Pierre Noizat, co-founder of French Bitcoin exchange Paymium, along with her toddler. The attack took place on a busy street in Paris and was captured on video. The victims screams drew help from passer-byes including a shopkeeper who threw a fire extinguisher at the attackers white van, ultimately stopping the abduction. The woman’s husband was also beaten during the struggle. Although the kidnapping was botched, it was the third high profile incident involving French crypto figures in less than 6 months.
See: Anatomy of Rising Deepfake Scams in Crypto and Fintech
Earlier in May, the father of a Paris-based crypto entrepreneur was abducted while walking his dog. His kidnappers severed a finger and sent the video to his son while demanding a ransom between €5 million and €7 million. The man was rescued three days later, and according to reports, at least five suspects were arrested.
On January 21, 2025, David Balland, co-founder of Ledger, and his partner were kidnapped at their home in central France. Balland was also violently attacked during his captivity and was later found with one finger missing.
A National Emergency for Crypto Safety
French Interior Minister Bruno Retailleau called an emergency meeting with fintech and crypto leaders on May 16, 2025. He promised stronger cross-border enforcement, police support for targeted families, and security checks at the homes of crypto executives.
Eric Larchevêque, Co-founder Ledger’s co-founder:
"In last 12 months saw 50 attacks around the world targeting people involved in cryptocurrency. Of those, 14 were in France. There’s a real problem.”
See: $4.3M in Crypto Scams Triggers Operation Avalanche
Security experts blame a mix of high crypto visibility, blockchain transparency, and weak personal data privacy. Many French founders still live locally and have families in public roles. Some have posted wallet addresses or wealth milestones online and inadvertently turning themselves into targets.
Global Fintech Perception at Risk
France has worked hard to attract and support crypto innovation, welcoming startups under its MiCA licensing regime and positioning Paris as a global hub for Web3 development. But these crimes are now threatening to reverse that progress, and according to Sifted, multiple companies have already started relocating key staff and executives abroad due to physical security risks.
The crypto community is now pushing for digital identity protection tools, anonymized ownership registries, and encrypted communication channels for founders and executives. Some are turning to private security firms and changing daily routines to avoid patterns.
Conclusion
The violet kidnappings is a reputational crisis for France's innovation economy and a wake-up call to high profile fintech and crypto founders globally. The French government, must now prove that it can protect its most promising entrepreneurs before the damage is long reaching.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Fintechs Face Rising SaaS Security Risks, JPMorgan CISO
Cybersecurity | May 14, 2025
Image: Freepik/DC Studio
Third-party Integration Flaws Are Exposing Fintechs to Spreading Attacks
Patrick Opet, JPMorgan Chase’s Chief Information Security Officer, has dropped a rare public warning that the modern SaaS (Software-as-a-service) model is enabling cyberattacks and embedding systemic risk into the global economy. His message is that the security architecture is breaking down, and software providers are not doing enough to fix it. Below are some urgent quotes from his discourse and why they matter for Canadian fintechs, investors, and regulators.
5 Select Quotes From Opet's Letter
1. “SaaS has become the default... embedding concentration risk into global critical infrastructure.”
Many fintechs are using the same core SaaS vendors for payments, data, and automation, exposing them to a single point of failure. If one of these vendors is compromised, the effects can spread fast like wild fire on a dry summer's night. For fintech startups, the risks may be inherited without full visibility.
See: India Biometric Data Breach Highlights Cybersecurity Risks
2. “Over the past three years, our third-party providers experienced a number of incidents... requiring us to act swiftly and decisively.”
Canadian fintechs with lean security teams need contingency plans for third party supplier compromise and must monitoring vendor behaviour or risk the full wrath of a serious attack that will disrupt operations, result in data theft or leakage, fraud and financial loss, regulatory and legal exposure, reputational damage and even cascading or 'fourth party' risks. Even a global bank must isolate vendors during incidents. Read OSFI's Guidance here: Third-Party Risk Management Guideline.
3. “Fierce competition among software providers has driven prioritization of rapid feature development over robust security.”
Security is often sacrificed for speed. Fintechs should require vendors to provide (1) strong and secure default settings, (2) regular third-party audits, and proof or evidence of strong internal security programs such as SOC 2 Type II or ISO/IEC 27001 certification.
See: Perplexity’s Security Flaws A Red Flag for Industry
4. “Modern integration patterns dismantle essential boundaries... relying on overly simplified interactions between third-party services and firms’ sensitive internal resources.”
OAuth tokens and API integrations are often misused, allowing third and unwanted parties to access internal systems. Without strong segmentation and logging, attackers can move quickly once access is gained. Microsoft Threat Intelligence recently confirmed state actors are now targeting common SaaS apps to infiltrate customers.
5. “The most effective way to begin change is to reject these integration models without better solutions.”
Canadian fintechs should ensure procurement policies require secure integration design, advanced authorization models, and greater transparency from vendors. Startups should reference the Canadian Center for Cybersecurity Top 10 IT Security Actions for implementation guidance.
What This Means for Canadian Fintechs
SaaS brought convenience and speed but also concentrated risk across fintech infrastructure. For smaller Canadian firms who often lack internal security engineering, the consequences of a poorly or unsecured SaaS integration can be severe. This warning should not be ignored.
See: New Cyber Threats Financial Service Firms Need to Know
Fintech leaders should:
- Audit all third-party SaaS integrations especially those with read or write access to sensitive systems. The CSA's Staff Notice 33-321 offers baseline expectations for registrants
- Require vendors to support multi-factor authentication, token expiration, and role-based access controls
- Push for data residency transparency and vendor dependency disclosures, including fourth-party services
- Include security breach notification clauses in service agreements
- Explore secure options such as customer-managed encryption keys, confidential computing, and bring your own cloud models
Final Thought
OSFI and the CSA have made it clear that third party oversight is now a priority, so fintechs can expect questions on cybersecurity controls and operational resilience during regular reviews. SaaS is here to stay but without stronger default security and safer integrations and oversight, it'll remain a growing liability.
See: Can Cloned Voices Crack Bank Security? Need to Know
Fintech startups and scale-ups cannot rely on vendors to lead. Security must be a shared responsibility across the ecosystem, and it begins with better architecture, more transparency, and smarter procurement.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
