July 20, 2026 | NCFA Market Activity | Cybersecurity And Fraud, Artificial Intelligence And Data, Risk Compliance And Regtech
Former SentinelOne Leaders Build A Control Layer For Agentic Software
On July 20, 2026, Neo emerged from stealth with US$100 million in combined seed and Series A financing from Andreessen Horowitz, Bessemer Venture Partners, Craft Ventures and Merlin Ventures.
The Boston cybersecurity company was founded in 2025 by Nick Warner, Shlomi Salem and Eran Shirazi. Note that it's unrelated to Calgary based Neo Financial. Warner previously served as SentinelOne president and COO, Salem led detection engineering and threat research at SentinelOne, and Shirazi previously co-founded EasySend after leading vulnerability research in Israel’s Unit 8200.
Neo is building what it calls an agentic software control layer. The platform gives security teams an inventory of AI agents, AI enabled applications, plugins, extensions, MCP servers and traditional software that has gained agentic capabilities. It then maps permissions, attributes actions and applies policy before software reaches sensitive data or systems.
The company plans to use the financing to expand engineering and go to market operations. Neo hasn't disclosed revenue, customer counts, named customers, valuation or the allocation between its seed and Series A rounds.
Agents Can Operate Inside Trusted Permissions
Enterprise security was built around human users, known applications and recognizable data flows. AI agents can act differently. They may inherit a user’s permissions, call several tools, reach files and credentials, communicate with other agents and continue operating without a conventional interface.
That means risky activity may not even resemble a conventional intrusion. An agent can use valid credentials and approved applications while still exporting too much data, reading a secret, pushing code or initiating an action that exceeds the authority its operator intended to grant. NCFA’s analysis of AI agents gaining identity and wallet access shows how quickly this issue reaches financial APIs and real infrastructure.
Neo’s platform combines four functions. It finds AI software, checks what it can access, shows who or what is behind each action, and lets security teams allow, block or pause that action for approval.
Threat's aren't limited to deliberately malicious agents. ShadowLeak demonstrated how hidden instructions could manipulate an AI agent and expose private information without a user clicking a malicious link.
Its Neoverse knowledge base maps the capabilities, risks and behaviour of agentic software before it enters an enterprise environment. Neo says enforcement occurs natively at the endpoint, where the software can intercept tool calls, API access, credential reads and data transfers before the action is completed.
Competition Is Forming Around Agentic Security
Neo combines software inventory, posture intelligence, attribution and endpoint enforcement across agentic and traditional applications.
Check Point is developing a wider AI security control plane covering employee AI use, AI applications and agentic systems.
SailPoint is extending identity governance to AI agents and other non-human identities.
Existing endpoint security providers already control devices, files and processes, but may not yet map the permissions and chained actions occurring inside agentic software.
Cloud and application security companies can govern models, APIs and data access, creating a competitive question around whether customers will buy a separate agentic control layer or expect existing security platforms to absorb the function.
Financial Institutions Will Need Authority Maps For Agents
Banks and other regulated organizations will need more than a list of approved AI tools. They need to know which person authorized an agent, what credentials it inherited, which systems it can call, what information it can export and when human approval is mandatory.
Neo’s opportunity is to show who or what can access each system and enforce clear limits on what they can do. Its challenge is that endpoint, identity, cloud and network security companies are all pursuing parts of the same problem. Large institutions may prefer one more specialized control layer, or they may demand that existing suppliers add agent governance to products already deployed across the organization.
Financial institutions are adopting AI while remaining accountable for privacy, cybersecurity, third party risk, operational resilience and auditability. An agent that can access customer information, initiate a payment, change code or communicate externally will need authority limits that security, risk and compliance teams can understand.
Neo has the capital and founding team to compete early, but the category is still forming. Enterprise adoption, integration depth and the quality of its policy enforcement will matter more than the size of the launch financing.
Talking Point
Will enterprises buy a dedicated control layer for agentic software, or will endpoint, identity and cloud security providers absorb the function before the category becomes independent?
NCFA Company Intelligence Snapshot
Neo
Agentic software inventory, attribution and real time policy control for enterprise security teams
Last updated Jul 20, 2026
Company At A Glance
Founded2025 by Nick Warner, Shlomi Salem and Eran Shirazi
HeadquartersBoston, United States
StatusPrivate
Capital / FundingUS$100M across seed and Series A financing
InvestorsAndreessen Horowitz, Bessemer Venture Partners, Craft Ventures and Merlin Ventures
ProductsNeo platform and Neoverse agentic software knowledge base
CustomersEnterprise SecOps teams; named customers not publicly disclosed
Public LaunchJuly 20, 2026
DisclosureRevenue, valuation and round allocation not publicly disclosed
Milestones
Select a milestone to follow Neo’s development
1Formation2025
2Platform Build2025–2026
3Neoverse2025–2026
4Public LaunchJul 2026
Milestone 1
Founding Team Assembles (2025)
Nick Warner, Shlomi Salem and Eran Shirazi founded Neo in 2025 to build security controls for enterprise software gaining autonomous and agentic capabilities.
Company
Neo SecurityEnterprise cybersecurity company focused on agentic software
Stage
FormationExperienced operators assemble before the public launch
Capital
Early Institutional BackingSeed and Series A allocation not publicly disclosed
SecOps TeamsLarge organizations adopting AI enabled software
Competition
Operator ExperienceFounders previously built and scaled enterprise security companies
Additional Company Data
Warner previously served as SentinelOne president and COO
Salem led detection engineering and threat research at SentinelOne
Shirazi previously co-founded EasySend
The company is unrelated to Canada’s Neo Financial
NCFA Perspective
Neo begins with founders who have built cybersecurity products and commercial organizations before. That lowers some execution risk, but it does not yet establish enterprise adoption.
Milestone 2
Agentic Software Control Platform Built (2025–2026)
Neo developed an endpoint control layer that discovers AI enabled software, assesses permissions and configuration, attributes actions and enforces policy before activity reaches sensitive systems or data.
Company
Neo PlatformInventory, posture, attribution and enforcement
Stage
Product BuildControl layer developed before public launch
Capital
Venture FundedCombined prelaunch financing later disclosed at US$100M
Markets
AI Enabled EnterprisesEndpoints, browsers, identities and applications
Customers
Security OperationsTeams governing human and non-human activity
Competition
Runtime ControlPolicy applied before an agent completes an action
Additional Company Data
Discovers agents, models, extensions, plugins and MCP servers
Maps permissions, identities, configurations and data access
Attributes actions to a human, agent, application or identity
Can allow, block or hold activity for approval
NCFA Perspective
Neo is joining discovery with enforcement. That is commercially stronger than another inventory dashboard, provided the controls work across the applications and workflows enterprises actually use.
Milestone 3
Neoverse Knowledge Layer Developed (2025–2026)
Neo built Neoverse as a continuously updated knowledge base of agentic software capabilities, risks and behaviour. The intelligence feeds inventory classification, posture assessment and policy decisions inside the platform.
Company
NeoverseAgentic software knowledge base
Stage
Knowledge LayerSoftware capabilities and risk profiles mapped continuously
Capital
Product InvestmentResearch and engineering support platform intelligence
Markets
Agentic SoftwareModels, agents, extensions, applications and MCP servers
Customers
Enterprise Security TeamsOrganizations assessing software before and after deployment
Competition
Software IntelligenceRisk context added to inventory and enforcement
Additional Company Data
Neoverse is included with every Neo deployment
It maps capabilities, risks and behaviour across agentic software
The knowledge base supports software classification and policy creation
Neo has not disclosed an independently verified scale figure for the database
NCFA Perspective
Neoverse could become a defensible asset if Neo keeps pace with rapid changes in models, applications, extensions and agent frameworks.
Milestone 4
US$100M Public Launch From Stealth (Jul 2026)
Neo emerged from stealth on July 20, 2026 with US$100 million in combined seed and Series A financing and a public product built around real time control of agentic software.
Company
NeoAgentic Software Control company
Stage
Public LaunchCommercial expansion begins after stealth development
Capital
US$100MCombined seed and Series A financing
Markets
Global EnterpriseOrganizations adopting AI enabled and autonomous software
Customers
Large EnterprisesNamed customers not publicly disclosed
Competition
Category FormationEndpoint, identity, cloud and AI security vendors converge
Additional Company Data
Andreessen Horowitz and Bessemer Venture Partners backed the company
Craft Ventures and Merlin Ventures also participated
Capital will support engineering and go to market hiring
Revenue, valuation, customer count and financing allocation remain undisclosed
NCFA Perspective
The launch capital gives Neo room to build quickly. The central question is whether enterprises will buy a separate agentic control layer or expect existing security suppliers to add the capability.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
July 11, 2026 | NCFA Fintech Whisperer | Risk Compliance And Regtech, Digital Assets Blockchain And Tokenization, Payments And Money Movement, Wealth Investing And Trading, Capital Markets Infrastructure And Funding, Competition And Market Structure, Digital Banking And BaaS, Lending Consumer Credit And BNPL, Regulation And Policy, Identity Privacy And Data Governance Cybersecurity Fraud And Financial Crime
July 15, 2026, United Kingdom / Singapore / Global
Standard Chartered standardized its global infrastructure on a software defined private cloud using VMware Cloud Foundation to support critical banking services across 54 markets.
Approximately 70% of the bank’s global infrastructure footprint already operates on the new architecture.
The platform embeds zero trust security into the infrastructure layer and reduces infrastructure deployment time from weeks to one day.
Private cloud remains a production architecture for regulated banks that need consistent control across countries and critical workloads. The 70% deployment gives other banks a concrete benchmark for weighing resilience, security, workload portability and regulatory oversight when deciding which systems belong in private environments and which can run with hyperscalers.
July 17, 2026, Marshall Islands / United States / Global
BitGo Bank & Trust will provide qualified custody and off exchange settlement for USDM1, a dollar denominated sovereign bond issued natively onchain by the Republic of the Marshall Islands.
USDM1 is structured under New York law, backed 1:1 by U.S. Treasuries and available to institutions on Stellar, Ethereum and Solana.
Eligible clients can deploy USDM1 to connected venues around the clock with T+0 settlement without transferring the asset onto an exchange.
The structure places sovereign issuance, Treasury backing, regulated custody and continuous settlement inside one institutional collateral workflow. It gives banks, dealers and custodians a concrete test of how tokenized sovereign instruments could support secured finance while reducing intraday exposure and prefunding requirements.
CSA Consultation Paper 51-406 opens a 120 day review of how Canadian public companies are regulated, with comments accepted until November 13, 2026.
The consultation asks whether venture and non-venture issuer status should be determined differently to support more proportionate requirements.
The CSA is considering whether some venture issuers should receive relief from parts of International Financial Reporting Standards.
The paper also examines private placement hold periods, material change reporting and how U.S. reforms to reporting, disclosure and capital raising should influence Canada.
More than 10% of eligible companies have adopted the CSA’s voluntary semi-annual reporting framework, while recent Listed Issuer Financing Exemption changes have generated significant financing activity.
The review extends beyond one exemption or reporting rule. It connects the semi-annual reporting pilot and higher LIFE financing limits to the cost of staying public, the information investors receive and Canada’s ability to compete for issuers and capital.
Ontario committed to join Canada’s national securities regulatory passport system following discussions among federal, provincial and territorial finance ministers.
Under the passport system, a market participant obtains a decision from its principal regulator that applies across participating jurisdictions under harmonized laws.
Ontario has been the only jurisdiction outside the system and currently uses an interface that can require a separate Ontario Securities Commission decision; implementation timing has not been announced.
Ontario’s commitment could remove a longstanding layer of duplicated review for issuers and registrants operating nationally. The operational test is whether full participation reduces filing cost and approval time without weakening investor protection. It also delivers the coordinated model sought in earlier calls for Ontario to adopt passport.
Grove committed a US$500 million warehouse facility to finance institutional loans originated and serviced by Galaxy Digital.
The senior secured loans may use BTC and ETH as collateral, including staked ETH, with assets held by Anchorage Digital and BitGo.
The facility uses USDS capital, defined eligibility requirements, concentration limits and continuous loan to value monitoring through independent price feeds.
The facility brings a familiar credit structure into institutional digital asset lending at substantial scale. It places onchain liquidity closer to loan origination and gives the market a clearer test of how stablecoin capital, qualified custody and crypto collateral can support structured credit.
Reuters reported that Stripe and Advent International submitted a joint offer of US$60.50 per share for PayPal, valuing the company at more than US$53 billion.
The proposal is backed by approximately US$50 billion in committed bank financing and would give Stripe and Advent equal ownership of PayPal.
PayPal, Stripe and Advent declined to comment, PayPal had not responded to the proposal when it was reported, and there is no certainty that an agreement will result.
A combined Stripe and PayPal would connect merchant processing, consumer checkout, Venmo and stablecoin distribution under one ownership structure. Even without a transaction, the bid tests whether control of merchant acceptance and consumer distribution will become a defining advantage across wallets, agentic commerce and digital payments.
ConnectOne Bank is building multiple commercial lending agents on nCino’s Agentic Operating System.
The deployment targets frontline efficiency across commercial lending workflows rather than one isolated task.
nCino positions the system as an operating layer for agents working across lending data, processes and institutional controls.
Commercial lending agents are entering regulated bank workflows at the operating system level. Their value will depend on whether banks can reduce manual work while keeping credit judgment, accountability and exception handling under institutional control.
Blockchain.com partnered with Polymarket to add prediction market access inside its app for users in eligible markets.
Users will be able to use assets already held in their Blockchain.com accounts to open and manage event positions without a separate wallet connection or deposit process.
Blockchain.com said it serves more than 43 million verified users across more than 70 jurisdictions, giving Polymarket a large new distribution channel.
Prediction markets are becoming a standard feature inside crypto trading apps. Wider distribution could increase participation and liquidity, while raising sharper questions about eligibility, market integrity and the trust controls surrounding prediction markets.
Alipay+ integrated with Argentina’s Transferencias 3.0 national QR payment network through Latin American payment technology provider PVS.
International travellers using participating Alipay+ wallets will be able to scan the QR codes already displayed by millions of Argentine merchants.
Alipay+ connects more than 50 wallets and banking apps representing 2 billion user accounts with 150 million merchants globally, with the Argentine service launching in phases.
Argentina is turning a domestic interoperable QR standard into an international acceptance layer without requiring merchants to replace their checkout technology. It gives Canadian operators a useful comparator as Canada opens payment infrastructure to more PSPs and credit unions while developing instant payment access, shared acceptance and stronger operating controls.
Thredd joined Visa’s Agentic Ready programme to help issuers support payments initiated by AI agents.
The processor said its platform provides tokenisation, authentication and fraud capabilities needed for agent initiated transactions.
Zilch is among the first issuers using the platform to support agent initiated payments in Europe.
Agentic commerce is reaching the issuer processing layer. Delegated authority, transaction controls, authentication and dispute handling are becoming core payment functions rather than responsibilities left only to agents and merchants.
Stable launched StablePay, a mobile app for instant USDT transfers using phone numbers, email addresses or QR codes.
The self custody service removes the need for users to manage blockchain accounts, gas fees or separate wallet connections.
Stable said the app is already supporting peer payments, cross border remittances and international payroll, with a built in feature for earning yield on USDT.
StablePay packages payment, custody and yield inside one consumer experience. Its traction will show whether simplified stablecoin products can win users beyond crypto markets while meeting the compliance expectations attached to global payments and yield.
Emirates NBD went live on Partior’s multicurrency blockchain clearing and settlement network.
The bank completed a live USD transaction with J.P. Morgan acting as settlement bank and beneficiary bank.
Corporate and institutional clients can now send real time USD payments to beneficiary accounts held at J.P. Morgan, with additional currencies and bank connections planned.
This is live bank settlement rather than another proof of concept. Partior now has a regional deployment that can test whether continuous liquidity, faster finality and programmable treasury services improve cross border banking at production scale.
The European Central Bank selected 36 payment service providers from more than 50 applicants to participate in the digital euro pilot.
The 12 month pilot is scheduled to begin during the second half of 2027 using a beta version of the digital euro across the ECB and 19 national central banks.
The programme will test online and offline person to person payments, merchant acceptance, software point of sale and ecommerce transactions with banks, payment firms and selected merchants.
The digital euro has entered a new implementation stage. Attention now turns from policy design toward operational readiness, participant integration and whether the pilot demonstrates that public digital money can work alongside existing payment networks.
JCB and Circle signed a memorandum of understanding to explore USDC payments across JCB's merchant network.
The collaboration will examine cross border payments, merchant acceptance and settlement using stablecoin infrastructure.
The initiative builds on JCB's existing digital payment work with Japanese banking and technology partners.
Stablecoin adoption is expanding beyond crypto native platforms into established payment networks. The next phase will depend on merchant acceptance, operational integration and regulatory treatment across major consumer payment markets.
Siam Commercial Bank became the first financial institution client to go live with Citi's integrated 24/7 USD Clearing and Citi Token Services solution.
The service enables near real time cross border USD payments at any time of day using tokenized deposits within Citi's regulated banking network.
The first live transaction transferred U.S. dollars between Citi in London and Siam Commercial Bank in Thailand during the U.S. holiday weekend, demonstrating continuous cross border payment capability.
The industry is beginning to demonstrate how tokenized deposits can support continuous cross border payments inside regulated banking networks. Alongside Swift’s bank ledger work with RBC and TD, the next measure is how quickly live services spread across institutions and payment corridors.
FIS joined Anthropic’s Project Glasswing and is actively testing the Mythos 5 frontier model against its own systems.
FIS operates software that clears payments, transfers money and runs core banking for thousands of financial institutions worldwide.
The controlled security initiative is separate from FIS’s commercial AI agent partnership with Anthropic and focuses on identifying vulnerabilities in critical software infrastructure.
Frontier AI is entering the security testing layer of widely shared banking and payment infrastructure. The initiative extends AI security across mixed banking systems into controlled testing of critical financial software. Banks and infrastructure providers will need clear controls for model access, finding validation, remediation ownership and disclosure as advanced models identify vulnerabilities faster than conventional security teams can process them.
CSA Staff Notice 33-322 reports findings from a focused compliance examination of 73 registered firms.
The review examined policies, employee training, risk assessments, controls, third party oversight and incident response planning.
CSA staff identified gaps across the firms reviewed and issued practical guidance intended to scale across small, medium and large registrants.
Cybersecurity expectations are becoming more concrete through examination findings rather than high level principles alone. Registered firms now have a clearer basis for testing governance, third party controls and incident readiness before the next compliance review.
INETCO added agentic AI investigation capabilities to BullzAI for banks, payment processors and other financial institutions.
The agents collate transaction data, triage alerts, prioritize high risk cases and provide explainable scores and recommendations for fraud teams.
The capability uses a proprietary model deployed within the customer environment and improves through supervised human feedback.
Fraud operations are beginning to automate the investigation layer, not only transaction detection. The practical value will come from cutting case backlogs while preserving analyst control, explainability and sensitive payment data inside the institution.
ENISA released a maturity model and downloadable assessment tool for SMEs that manufacture or supply products with digital elements covered by the Cyber Resilience Act.
The model evaluates governance, security by design, risk management, vulnerability management, product lifecycle practices and cybersecurity skills.
An accompanying survey of 194 organizations across 31 countries found that 66% knew about the Act, while practical understanding, incident response and product lifecycle readiness remained limited.
Canadian fintech and software vendors selling covered products into Europe need operational evidence behind their compliance claims. The model gives customers and partners a common way to examine product security maturity as the Act’s vulnerability reporting requirements begin in September 2026 and its main obligations approach.
FATF found that 83% of surveyed jurisdictions, 91 of 109, had passed legislation implementing the Travel Rule, up from 73% in 2025.
However, 55 of those 91 jurisdictions had not issued findings or directives or taken Travel Rule related supervisory or enforcement action.
FATF reported that a Cambodia based financial services conglomerate laundered at least US$4 billion between August 2021 and January 2025, including at least US$37 million linked to North Korean cyber thefts.
Travel Rule adoption is advancing faster than supervision and enforcement. Crypto firms, banks and compliance providers need stronger counterparty screening, interoperable originator and beneficiary data, offshore VASP controls, and escalation procedures for stablecoins and unhosted wallet exposure.
FINTRAC updated its advisory for Canadian reporting entities following the Financial Action Task Force’s June plenary.
Bosnia and Herzegovina and Iraq were added to the FATF list of jurisdictions under increased monitoring, while Algeria and Namibia were removed after completing their action plans.
Canadian reporting entities must account for connections to monitored jurisdictions when assessing geographic risk, applying controls and determining whether suspicious transaction reports are required.
Transactions connected to the Democratic People’s Republic of Korea and Iran remain subject to specific Canadian directives covering high risk treatment, identity verification, source of funds or virtual currency, beneficial ownership, recordkeeping and sanctions evasion controls.
The advisory also preserves enhanced requirements and reporting considerations for Myanmar, Russia, Afghanistan, Islamic State controlled areas and transactions connected to the Middle East.
The update requires banks, fintechs, payment companies, money services businesses and virtual asset firms to review country risk classifications, transaction monitoring rules and correspondent banking controls. Grey list status should inform a risk based assessment rather than automatic rejection of every transaction, while Canadian ministerial directives create specific mandatory treatment for designated jurisdictions.
The Bank of England, PRA and FCA began joint oversight of the first Critical Third Parties designated by HM Treasury.
The regime covers Amazon Web Services, Google Cloud, Microsoft and Oracle services that support the UK financial system.
Designated providers must manage risks to critical services, communicate with regulators during major incidents and support system level resilience.
Direct supervision of major technology providers changes where operational resilience responsibility sits. Financial firms still own their outsourcing risk, but the largest shared dependencies now face regulatory scrutiny at source.
FINMA regulated AMINA Bank integrated Mesh’s verified deposit technology directly into its online banking platform.
Clients will be able to select a wallet provider, verify ownership and deposit stablecoins or other digital assets through connections spanning more than 300 wallets and providers.
The deposit capability will soon become available to AMINA clients, with withdrawals, payouts and simplified wallet verification during onboarding planned as later additions.
Regulated crypto banking still breaks at the point where customers must prove ownership of external wallets. Embedding verification into deposit authorization can reduce manual address checks while preserving compliance controls. Banks considering similar connections will need clear responsibility for wallet screening, transaction monitoring, sanctions controls and failed transfers.
Interest free Buy Now Pay Later products are now regulated by the Financial Conduct Authority, covering providers including Klarna, PayPal and Clearpay.
Providers must conduct affordability checks before extending credit and give consumers clearer information during checkout.
Consumers gain enforceable refund protections for faulty goods, access to the Financial Ombudsman Service and support before debt collection when experiencing financial difficulty.
BNPL now operates as supervised consumer credit across the customer journey. Providers serving the UK need affordability, disclosure, complaints, refunds and collections controls that work inside merchant checkout flows. Canadian policymakers and lenders have a live comparator for testing whether product specific safeguards can protect consumers while preserving short term payment flexibility.
HM Treasury opened a 12 week consultation containing 42 questions on payment services and electronic money regulation, with responses due October 6, 2026.
The proposals create common regulated activities for traditional and tokenised payments, bring certain stablecoins into the payments perimeter and require firms to obtain permission for tokenised payment services.
The consultation addresses agentic payment consent, authentication and liability alongside variable recurring payment access, commercial Open Banking pricing and expanded FCA supervision.
One consultation connects digital money, AI agents and Open Banking to the same operating rulebook. Payment firms need to test which permissions, safeguarding models, access rights and liability controls their products would require. Canadian regulators can compare this integrated approach with separate domestic work on stablecoins, consumer driven banking and Real Time Rail implementation.
Austria’s Administrative Court confirmed that statistically calculated political affinities are special categories of personal data protected under Article 9 of the GDPR.
The profiles covered approximately 2.2 million people and were stored and partly sold to third parties without consent or another applicable exception.
The court set the administrative fine at €13 million and confirmed that group wide annual revenue could be considered when determining the penalty.
The decision extends sensitive data protection beyond information people expressly provide to conclusions generated about them. Fintechs using behavioural analytics, customer segmentation, alternative data or AI models must consider whether inferred attributes can create heightened privacy obligations even when the underlying inputs appear ordinary.
The Dutch Data Protection Authority published GDPR guidance for organizations developing generative AI models or taking responsibility for putting them into use.
The guidance addresses lawful grounds, indirect collection, training data and how personal information is managed, cleaned, enriched, retained and protected.
A separate implementation checklist asks organizations purchasing or using generative AI to first determine whether they can achieve their purpose without processing personal information.
The guidance brings privacy decisions into AI procurement and development before deployment. Financial institutions and fintechs using customer information with generative AI will need to justify why personal data is necessary, identify their legal role and preserve evidence across training, vendor selection, implementation and ongoing use.
Faster Finance Needs Faster Control
This week’s developments share one operating pattern. BitGo and Galaxy place tokenized assets inside collateral and lending. Alipay+, Partior and Citi connect domestic payment access with international distribution. FIS, the CSA and FATF reinforce the control layer required to run these systems safely at speed. For Canadian operators, the strategic question is which layer they truly control. Distribution without settlement access creates dependency. Automation without governance creates liability. Tokenization without custody, liquidity and legal certainty stays experimental. Durable businesses will own a useful layer, meet its control burden and connect cleanly to the rest.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
July 17, 2026 | NCFA Insight | Regulation And Policy, Wealth Investing And Trading, Risk Compliance And Regtech
FCA Finfluencer Enforcement And Canada’s Regulatory Position
On July 9, 2026, the UK Financial Conduct Authority reported the results of its finfluencer enforcement campaign. A coordinated week of action involving 9 international regulators produced 3 arrests, 6 criminal proceedings, 11 warning or cease and desist letters, 50 warning alerts and 650 social media takedown requests.
Canadian regulators weren’t watching from the sidelines. The Alberta Securities Commission, Autorité des marchés financiers, British Columbia Securities Commission and Ontario Securities Commission participated in the June 2025 operation. Earlier analysis asked whether finfluencers were facing a crackdown or clearer regulation.
The FCA’s latest figures show that enforcement has now become repeatable. Investigators can identify illegal content, connect creators to products and firms, request platform removals, issue public warnings and escalate selected cases into criminal proceedings.
The scale of the FCA’s supporting operation is just as relevant. During 2025, it issued 2,329 warnings about unauthorized or potentially fraudulent firms, compared with 2,240 in 2024. It secured 17 criminal convictions involving fraud, insider dealing, money laundering and data protection offences. Twelve people paid a combined £1.77 million in market abuse fines for market abuse.
Technology is improving that capacity. FCA automation reduced the handling time for simpler supervisory cases from as much as 4 hours to about 6 minutes on average. That doesn’t automate consequential decisions. It clears routine work so investigators can spend more time on repeat promoters, hidden compensation, unauthorized firms and cross border distribution.
What The Enforcement Data Reveals
The 650 takedown requests are the most commercially relevant number. Arrests attract attention, but removing hundreds of accounts and posts targets distribution. Illegal promotions lose value when creators can’t reach an audience, acquire leads or direct followers to a trading platform.
The FCA can examine multiple parties within one campaign. A creator may publish the content, a financial firm may pay for it, an affiliate network may track referrals and a platform may distribute it. The underlying product can then lead investigators to an unauthorized operator or regulated firm with weak approval controls.
Criminal proceedings provide the upper end of that response. The FCA accused 3 people charged after the 2025 operation of promoting high risk contracts for difference without authorization. Each faces an allegation of communicating an invitation to engage in investment activity contrary to section 21 of the UK Financial Services and Markets Act.
The April 2026 second global week of action showed how quickly the system had expanded. Seventeen regulators participated. The FCA requested the removal of 120 accounts and identified 1,267 illegal financial advertisements that reached at least 2,338,372 accounts. People or firms already listed on its Warning List accounted for 66% of those advertisements.
That 66% figure exposes a persistent enforcement problem. Many promoters aren’t unknown actors. They continue publishing after regulators have already identified the related firm, person or offer. Effective supervision therefore depends on account removal, repeat offender monitoring and platform cooperation, not warnings alone.
The FCA also secured a guilty plea, began criminal proceedings against 2 more people, issued 34 new warning alerts and updated 14 existing warnings during the April operation. Coordination now combines prosecution, surveillance, education and content removal rather than treating each promotion as an isolated post.
Canada Has Rules, Research And Active Cases
Canada’s legal foundation is already in place. In December 2025, the CSA and CIRO published Staff Notice 31-369, which explains how securities law applies to finfluencers, issuers and registered firms. The practical requirements appear in Canada’s finfluencer guidance.
The guidance doesn’t create a separate licence for creators. It examines the activity itself. A creator may need registration when they provide investment advice as a business, facilitates trades, arranges referrals or connects paid subscribers to copy trading. General market commentary may qualify for an exemption, but creators must still disclose financial interests and other conflicts clearly and on time.
Compensation also changes the compliance analysis. Cash payments, securities, affiliate income, referral fees and free products can establish a commercial relationship. A disclaimer such as “not financial advice” doesn’t cancel the substance of a recommendation, the creator’s compensation or the transaction being encouraged.
Responsibility extends beyond the creator. Registered firms must supervise people acting on their behalf, address referral arrangements, retain records and review relevant communications. Issuers remain responsible for paid investor relations activity and promotional claims made for their benefit. The joint staff notice applies the same principles to AI generated content and digital personas.
The investor evidence explains why regulators are paying attention. An OSC study of 655 Canadian retail investors found that 35% had made a financial decision based on finfluencer content. Those who acted on it were 12.2 times more likely to report being scammed on social media and 2.3 times more likely to have experienced a significant investment loss.
The OSC also ran a simulated investment experiment involving 1,465 Canadians. After viewing a promotional social media post, 38% bought the featured asset. Only 8% of the control group did the same. The full findings and behavioural differences appear in the finfluencer effect on Canadian investors.
Canada has also produced direct enforcement results. In September 2025, the Alberta Securities Commission imposed sanctions on James Domenic Floreani and Jayconomics Inc. for promoting 4 issuers through YouTube, X and Patreon without clearly disclosing that they published the content on behalf of those issuers.
The respondents received a $30,000 administrative penalty, $10,185.10 in costs and 2 year restrictions covering investor relations activity, public securities promotion and securities or derivatives advice.
British Columbia added a preventive layer during the April 2026 operation. The BCSC issued 14 compliance letters to YouTubers and other promoters who had discussed publicly traded B.C. companies. It also referred to an active proceeding alleging that sponsored issuer promotions weren’t disclosed clearly.
How Canadian Enforcement Could Develop
The FCA operates a national financial promotions regime and can report one consolidated set of arrests, warnings, takedowns and prosecutions. Provincial and territorial authorities administer Canadian securities regulation, while CIRO supervises investment dealers, mutual fund dealers and regulated marketplaces.
Canadian action may therefore appear as several provincial cases, coordinated review periods, issuer investigations, warning letters and firm supervision rather than one national enforcement tally. That can make the activity look smaller even when regulators review the same creators, platforms and promotional networks.
The operating implications are already clear.
Issuers need to know who promotes their securities and how they compensate those people
Dealers and fintech platforms need approval, monitoring and record keeping controls for creator campaigns
Affiliate arrangements require the same scrutiny as traditional referrals
Creators need to separate education from recommendations and disclose commercial interests where followers can actually see them
Platforms are also becoming part of the enforcement process. When regulators can connect warnings to hundreds of removal requests, account access becomes a compliance dependency. Firms using social media for distribution can’t treat the creator’s channel as an independent marketing asset beyond their control.
Canada doesn’t need to duplicate the FCA’s structure to produce comparable enforcement. Its regulators are already participating in the same international operations, applying national guidance and using provincial proceedings. The open question is whether those actions will become visible as a coordinated Canadian program or remain distributed across separate regulators and cases.
Talking Point
Will Canada’s finfluencer guidance support coordinated enforcement across provinces, platforms and firms, or will separate cases continue defining the compliance boundary?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA engages with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
July 13, 2026 | NCFA Market Activity | Cybersecurity And Fraud, Artificial Intelligence And Data, Banking And Credit
Agentic Threat Detection Across Mixed Banking Systems
On June 25, 2026, Jack Henry expanded its Google Cloud collaboration to develop agentic AI security for banks and credit unions. The U.S. banking technology provider serves about 7,400 community financial institutions and plans to combine Google Security Operations, Gemini Enterprise Agent Platform, and Mandiant Consulting across Google Cloud, other cloud services, and on-premises systems.
The deal is less about access to an advanced model than the work required to deploy one inside a bank. Security evidence is spread across user accounts, devices, applications, networks, and cloud services. Analysts must connect those records quickly enough to determine whether an alert is harmless or part of an attack. Smaller institutions often lack the security teams and integration capacity to do that across several enterprise products.
The divide and conquer commercial logic of the deal is Google brings the models, security software, and threat expertise. While Jack Henry brings the bank relationships and operating knowledge required to put them to work.
AI Agents Cut Investigation Time
Google Security Operations collects security data from across an institution’s systems and connects related alerts into an investigation. Its Triage and Investigation Agent can retrieve evidence, apply threat intelligence, assess likely causes, and explain its findings.
Google says the agent has processed more than five million alerts and reduced a typical 30-minute manual investigation to about 60 seconds. Those are Google product results, not outcomes reported by Jack Henry customers.
The operating gain comes from completing the early investigation before an analyst steps in. Instead of opening several products, finding related records, and rebuilding the sequence of events, the analyst receives an assembled case with supporting evidence and a proposed response.
Sensitive actions still require clear limits and human oversight. Google can pair AI investigations with fixed playbooks and require approval before isolating a device, disabling an account, or blocking traffic. Jack Henry hasn’t said where it will draw those boundaries, how customers will audit agent decisions, or what happens when an automated recommendation is wrong.
Release timing, pricing, implementation requirements, and the first participating institutions also remain undisclosed, so the announcement is good on tech direction but light on adoption or performance figures inside an operating bank.
Mandiant Consulting adds threat modelling, security assessments, and red team testing. That work tests the design before attackers do. Gemini handles reasoning, while Google Security Operations provides the data and investigation tools.
Jack Henry must make the combined service fit each institution’s systems, controls, and support model. That integration is the difficult part.
Jack Henry Owns The Banking Integration
A bank could buy Google’s security products directly. It would still need to connect the right data, define agent permissions, build response procedures, satisfy audit requirements, and decide who remains accountable for each action.
Jack Henry already operates inside that environment. Its core processing, digital banking, payments, lending, and operational products support institutions that rarely replace critical systems. It also manages hosted and on-premises deployments that a cloud provider may not control.
The companies began working together in 2022 on cloud data, reporting, and integration services. Security extends that relationship into a product Jack Henry can configure around each customer and deliver through an existing technology and support contract.
That could make AI security another banking software service rather than a separate enterprise purchase. Core providers already control the connections, implementation work, and customer access needed to distribute agents at scale.
Security specialists still compete on detection quality, threat intelligence, and response tools. CrowdStrike and Palo Alto Networks are adding agents to their products, while Fiserv offers managed cybersecurity services and is developing AI capabilities. Jack Henry competes from a different position. Its advantage is knowing how community institutions run and where security tools must connect.
Google gains a route into thousands of regulated institutions without implementing its products one bank at a time. Jack Henry can add a service whose value depends on its knowledge of each customer’s systems and operating requirements.
This is where enterprise AI economics become clearer. Foundation models can be sourced from a small group of large providers. The commercial asset is access to the workflow where the model can complete useful work under controlled permissions.
That favours software companies with deep customer integration. Fintech founders don’t need to build a foundation model, but a general AI interface won’t be enough. TD’s AI loan decisioning deployment shows why the value comes from placing verification and decision tools inside an active lending workflow. A specialized process, regulated decision, proprietary dataset, or difficult integration gives an agent work that an incumbent can’t easily reproduce.
Canadian Banks Face The Same Deployment Test
Jack Henry hasn’t announced a Canadian release, but the deployment problem is familiar. Canadian regulated AI workshops have identified vendor dependence, data quality, model validation, and accountability as barriers to production use.
Access to a capable model isn’t the constraint. Banks need to connect it to existing systems without losing control of data, permissions, decisions, or operational risk. National Bank’s Sardine deployment follows that reality by embedding external device intelligence and risk scoring into retail, commercial, and wealth operations.
The Canada AI Consortium is working on common controls for models, agents, users, and enterprise systems. Its use cases differ from Jack Henry’s security project, but the operating requirement is the same: agents need restricted access, visible decisions, and accountable people.
For Canadian banks and fintechs, the commercial challenge is solving those controls inside regulated workflows. Products that leave the integration and governance work to the bank may struggle to progress beyond a pilot.
Talking Point
As foundation models become easier to replace, will banking software competition depend less on who owns the AI and more on who controls the workflows where agents can act?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
July 4, 2026 | NCFA Fintech Whisperer | Artificial Intelligence And Data, Lending Consumer Credit And BNPL, Digital Assets Blockchain And Tokenization, Cybersecurity Fraud And Financial Crime, SME Finance And Business Banking, Capital Markets And Market Infrastructure, Policy Regulation And Governance, Risk Compliance And Regtech, Data Privacy And Governance
July 7, 2026, European Union / European Economic Area
The European Data Protection Board adopted draft Guidelines 03/2026 for public consultation, with feedback accepted until October 30, 2026.
The guidelines cover private organizations that collect personal data from external internet sources to train or fine tune generative AI systems.
The draft addresses legal basis, purpose limitation, transparency, accuracy and data minimization, alongside source exclusions, collection criteria, filtering and anonymization or pseudonymization.
AI training data now carries an auditable collection burden across source choice, legal basis, sensitive data and model output controls. Canadian fintechs using European personal data should map what is scraped, why it is needed, who controls the processing and how records can be filtered or removed before consultation language becomes supervisory practice.
MAS proposed changes to the Code on Collective Investment Schemes to support a wider range of retail fund products through a more streamlined authorisation process.
A proposed Alternative Funds Appendix would create a dedicated framework for innovative fund types with product specific safeguards and enhanced disclosure requirements.
MAS said it aims to establish regulatory guardrails for most new fund types within about three months, after which similar funds could be authorised in about three weeks if they meet the same requirements.
Fund innovation depends on regulatory speed as well as product design. Asset managers, exchanges, fintechs, wealth platforms and regulators should watch how dedicated approval pathways and product specific guardrails influence the pace of retail investment innovation without reducing investor protection.
Swift said its blockchain ledger is ready for initial use after nine months of development with international financial institutions.
Seventeen banks across six continents are preparing to pilot live cross border transactions using tokenised deposits with 24/7 payment availability.
The shared ledger connects bank issued tokenised deposits while final settlement continues through existing systems, preserving established compliance, credit and risk controls.
Swift is testing whether tokenized deposits can extend today's banking infrastructure into always available cross border payments without replacing existing settlement systems. The pilot results will provide an early benchmark for bank led tokenized payment networks.
The CFTC will stay CME’s self certified contract that would have allowed 24/7 crude oil futures trading.
The agency said CME sought self certification while the CFTC was already seeking public comment on whether standard futures contracts should extend to 24/7 trading.
The CFTC will review the product filings under its approval authority before deciding whether the contracts comply with commodity law and CFTC rules.
Always on market design is moving beyond crypto. Exchanges, brokers, clearing firms, liquidity providers, risk teams and regulators should watch how 24/7 trading changes oversight, operations, margin, surveillance and market resilience.
Equifax signed a definitive agreement to acquire Círculo de Crédito for a $750 million enterprise value.
Círculo de Crédito serves more than 1,700 customers and has 2 billion tradelines covering 80 million validated identities.
Equifax said the acquisition expands its credit bureau, alternative data, identity, fraud prevention and financial inclusion capabilities in Mexico.
Credit infrastructure is consolidating around data depth, identity coverage and alternative underwriting. Lenders, fintechs, credit bureaus, SME finance platforms and regulators should watch how alternative data, fraud controls and AI assisted decisioning affect credit access for thin file borrowers and small businesses.
The Securities and Futures Commission requires internet brokers and licensed virtual asset trading platform operators to use phishing resistant authentication for client login and device binding.
Firms must stop using one time passwords for these functions and may use passkeys or cryptographically bound devices instead.
Large internet brokers are expected to comply immediately, while all covered firms must implement the controls by July 8, 2027.
Hong Kong is replacing a widely used authentication method across online securities and regulated virtual asset trading. Brokers and platforms also need stronger monitoring, client notifications and incident response procedures, while senior management may be held accountable for losses caused by inadequate controls.
Open Banking Limited published its first twice-yearly Payments Fraud Monitor using data from six banking groups and eleven brands representing more than 60% of UK open banking payment volume.
Approximately one in 6,000 open banking payments was fraudulent during 2025, compared with one in 2,500 payments across the wider industry.
Open banking recorded a higher fraud rate by value at 0.035%, compared with 0.026% across the industry. Its average fraudulent transaction was £785, versus £266 for the wider benchmark.
The fraud rate by volume increased to 0.024% in the first quarter of 2026, or approximately one payment in 4,200. Authorized Push Payment fraud represented more than two-thirds of reported cases.
Variable Recurring Payments recorded a 0.007% fraud rate, compared with 0.026% for single immediate payments. App-authenticated journeys also produced lower fraud rates than browser-authenticated journeys, although app fraud was growing faster.
The findings connect payment design directly to fraud exposure, customer friction and trust. Lower fraud by transaction count is encouraging, but higher losses by value and rising first-quarter fraud show why scale requires stronger authentication, transaction risk data and coordinated controls. These operating results add important context to the UK’s payment milestone and Canada’s trust framework.
The European Commission introduced an action plan combining advanced AI model evaluation, cybersecurity resilience and European AI capacity.
The Commission and ENISA will develop a blueprint for secure access to advanced AI systems and a testing platform for critical sectors, including finance.
The plan adds an EU Grand Challenge for AI cybersecurity and connects implementation across the AI Act, DORA, NIS2, the Cyber Resilience Act and the Cyber Solidarity Act.
Financial institutions and technology providers will gain a structured environment for testing AI security tools against European requirements. Firms serving the European market should prepare to demonstrate model safety, operational resilience and secure deployment before advanced systems enter critical financial operations.
The European Systemic Risk Board warned that frontier AI models could increase systemic cyber risks across the EU financial system.
Frontier AI models may increase the speed, scale and sophistication of cyber attacks against financial institutions and infrastructure.
The ESRB welcomed an ECB Banking Supervision letter to significant euro area banks setting expectations for AI related cyber threats.
AI cyber risk is now a financial stability issue. Banks, fintechs, payment firms, infrastructure operators, software vendors and supervisors should watch how AI vulnerability discovery, third party concentration, open source dependencies and cyber resilience planning become part of financial sector oversight.
Circle received final approval from the Office of the Comptroller of the Currency to establish First National Digital Currency Bank, which will operate as Circle National Trust.
The national trust bank will operate under direct OCC oversight and offer fiduciary digital asset custody services for Circle and its affiliates when it opens.
The approved charter also supports future management of the USDC Reserve and possible custody services for a limited number of banks and other regulated financial institutions.
Circle's trust charter places a major stablecoin issuer inside the U.S. federal banking framework. The pace of implementation, custody adoption and any future expansion into reserve management will show whether trust banks become the preferred operating model for regulated stablecoin infrastructure.
Latvijas Banka’s Supervision Committee decided to issue Nodu Digital a crypto asset service licence and a payment institution licence.
The crypto asset licence permits exchanges between crypto assets and funds and transfers of crypto assets for clients, while the payment licence permits payments and transfers to payment accounts.
Nodu is the tenth company licensed by Latvijas Banka under MiCA and can provide its authorized crypto asset services across the European Union through cross border notification.
The paired licences let one regulated provider connect crypto conversion, asset transfers, conventional payments and payment accounts. Firms pursuing similar models across Europe will need to determine when MiCA authorization must be combined with payment permissions as their products cross from digital assets into fiat payment execution.
Ripple received full Markets in Crypto-Assets Crypto Asset Service Provider authorization from Luxembourg’s CSSF.
The licence allows Ripple to offer regulated digital asset services across all 30 European Economic Area markets.
Ripple said the approval supports its custody, payments and stablecoin activity in Europe under the MiCA framework.
MiCA is becoming a market access gate for global digital asset firms. Banks, payment companies, custodians, stablecoin issuers, exchanges and compliance teams should watch how full EU authorizations shape cross-border crypto services, institutional distribution and regulated stablecoin infrastructure.
Eltropy opened applications for an early access program that lets fintech companies build and distribute AI agents to more than 750 credit unions and community banks using its platform.
Accepted firms receive access to Eltropy’s agent operating system, lab environments, compliance and security documentation, development support and a route to distribution after certification.
The program is the first phase of a governed marketplace where institutions can use agents built by Eltropy, fintech partners or their own teams under common privacy, governance, escalation and audit controls.
Eltropy is turning agentic banking into a platform market rather than a closed vendor product. The commercial question is whether shared controls, integrations and distribution can make specialized financial agents easier for smaller institutions to adopt.
Lightworks, Scotiabank, Sun Life and TELUS launched the AI Consortium to build and govern shared AI control infrastructure in Canada.
The first program is the Agentic Control Plane, which gives enterprises visibility and control across models, agents, users and inference pipelines.
The release says the Agentic Control Plane is already running in production in regulated environments and processes more than two trillion tokens per month across member organizations.
Regulated AI adoption needs control infrastructure, not only models. Banks, insurers, telecoms, fintechs and compliance teams should watch how agent oversight, inference monitoring, shared IP and enterprise control planes become part of Canadian AI governance.
The FCA published the Mills Review on the long-term impact of AI on retail financial services through 2030 and beyond.
The review examines consumer behaviour, competition, fraud, financial inclusion, market structure and regulatory readiness.
The FCA said AI adoption may create risks around fraud, identity abuse, algorithmic bias, opaque decisions, consumer agency, concentration and resilience.
AI in retail finance is becoming a competition, consumer protection and fraud issue at the same time. Banks, fintechs, wealth platforms, insurers, lenders and compliance teams should prepare for AI agents, personalization, delegation, identity controls and new forms of consumer harm.
Klarna submitted applications to the Utah Department of Financial Institutions and the FDIC to establish Klarna Bank USA.
The proposed entity would be a Utah-chartered industrial bank and wholly owned subsidiary of Klarna Inc., subject to approval.
Klarna said a banking licence would bring payments, savings, credit and merchant services closer to its own operating model.
Large fintechs are testing direct charter strategies again. Lenders, BNPL firms, embedded finance platforms, banks, investors and regulators should watch whether major payment and credit firms choose bank partnerships, owned charters or hybrid models for the next stage of regulated growth.
An international FCA action against illegal financial promotions resulted in three arrests, six criminal proceedings and 650 social media takedown requests.
The regulator secured 17 criminal convictions and fined firms about £14.4 million for transaction reporting failures and control weaknesses during the year.
AI automation reduced the average handling time for simpler supervisory cases from as much as four hours to about six minutes.
Regulators are increasing both the reach and speed of financial misconduct enforcement. Firms now face faster detection, coordinated action across jurisdictions and far less time to correct weak promotion, reporting and compliance controls.
Conclusion
This week’s intelligence points to a more mature phase of financial innovation. Stablecoins are entering regulated banking structures, tokenized deposits are nearing live payment use, regulators are setting terms for continuous markets, and AI governance is becoming a practical operating requirement. In Canada, the Real Time Rail rules, PSP access model and planned Q4 launch show how domestic payment modernization is entering the same execution stage. Advantage will favour institutions that can combine trust, regulatory readiness and delivery at scale.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
June 27, 2026 | NCFA Fintech Whisperer | Payments And Market Infrastructure, Digital Assets Blockchain And Tokenization, Capital Markets And Market Infrastructure, Artificial Intelligence And Data, Risk Compliance And Regtech, Wealth And Asset Management
Swift is developing a payments scheme for faster, more predictable and more transparent international payments for consumers and SMEs.
The framework includes upfront fee and FX transparency, full-value delivery, efficient last-mile processing and end-to-end transaction visibility.
Swift said the scheme is being built with early adopter banks and more than 40 banks globally.
Cross border payments are getting clearer operating standards for retail and SME use cases. Banks, payment firms, remittance providers, fintechs and SME platforms should watch how fee disclosure, FX transparency, delivery certainty and last-mile processing become competitive requirements.
NAPAS, Liquid Group and VietinBank launched a QR payment connection that lets users of participating Singapore payment applications pay merchants in Vietnam.
Transactions are processed in real time through VietQRGlobal with automatic conversion between Singapore dollars and Vietnamese dong.
VietinBank serves as the settlement bank, and the initial rollout is expected to reach about 5 million users through Liquid Group’s Singapore partner network.
The connection gives Singapore users direct access to Vietnam’s domestic QR acceptance network without requiring merchants to install separate terminals. Singapore becomes the fourth ASEAN market and sixth jurisdiction connected to NAPAS, with outbound payments from Vietnam to Singapore planned later in 2026.
Worldline, ING and Visa completed a live end-to-end agentic payment transaction in Europe.
The transaction combined AI agent purchasing, ING authorization, Visa payment infrastructure and biometric authentication.
The companies said the demonstration shows agent-driven commerce can operate within existing payment and authentication frameworks.
Agentic payments are moving into live financial infrastructure. Banks, payment networks, merchants, PSPs, AI providers and fraud teams should watch how consent, authentication, agent identity and liability controls evolve for AI-initiated transactions, including the broader question of whether fintechs should design for people or AI agents.
Nuvei completed a live agentic commerce proof of concept with Visa, Arvato Systems and Kings and Priests.
The transaction allowed a merchant AI agent to initiate a purchase and complete payment inside the agent using a tokenized Visa credential and live Visa rails.
Nuvei said its agentic payments strategy will support protocol compatibility, Know Your Agent controls, agent risk scoring, network certifications and a developer sandbox.
Agentic commerce needs payment controls that work inside the buying flow. Merchants, payment networks, fintechs, issuers, fraud teams and AI platforms should watch how tokenized credentials, spend limits, approved categories, agent identity and audit trails define the next payment interface. NCFA's Financial Innovation Map tracks agent commerce infrastructure as an emerging opportunity.
Payments Canada said the Real-Time Rail By-law and RTR Rules have received all required approvals.
The By-law and Rules come into force on Aug. 24, 2026 and establish the core legal framework for Canada’s real-time payment system.
Payments Canada said the legal framework supports safety, efficiency and resilience ahead of the RTR’s planned Q4 2026 launch.
Canada’s instant payments system now has the legal foundation needed for launch preparation. Banks, payment service providers, fintechs, merchants and compliance teams should track how RTR rules, access, fraud controls, ISO 20022 messaging and 24/7 operations change payment product design and competition.
The Bangko Sentral ng Pilipinas identified financial securities settlement and large value cross border payments as potential wholesale CBDC applications.
The Project Agila report found that distributed ledger technology could support greater automation, faster processing and lower transaction costs.
The BSP said Project Agila will guide its CBDC Roadmap and future work on high value CBDC use cases.
Wholesale CBDC work is concentrating on settlement infrastructure rather than retail money. Central banks, banks, market infrastructure firms, custodians and payment providers should watch how tokenised settlement, securities delivery and cross border liquidity use cases shape the next phase of central bank money innovation.
The Bank of Canada reminded registered payment service providers of their ongoing reporting obligations under the Retail Payment Activities Act.
PSPs came under Bank of Canada supervision and must report material incidents, significant operational changes, new retail payment activities, registration information changes, acquisitions of control and annual reporting information.
The Bank said PSPs that do not meet reporting requirements may be in violation of the RPAA and subject to enforcement action.
Canada's retail payments regime is shifting from registration into active supervision. PSPs, fintechs, payment processors, compliance teams and investors should track how incident reporting, safeguarding information, annual reports and PSP Connect submissions become part of the operating cost of regulated payment activity.
The Government of Canada pre published proposed Consumer Driven Banking Regulations to implement the Consumer Driven Banking Act and launched a 60 day public consultation.
The proposed regulations establish requirements for participant accreditation, technical standards, common rules, assessment fees, supervision and national security.
The framework is intended to support secure consumer permissioned data sharing and reduce reliance on screen scraping as implementation begins in stages.
Canada's open banking framework is entering the implementation phase. Banks, fintechs, payment service providers, credit unions and technology providers should prepare for accreditation, technical integration and operational requirements as consumer driven banking moves toward production. See NCFA's Open Banking in Canada opportunity brief for the market gaps, adoption signals and infrastructure questions this framework is meant to address.
Bridge secured Crypto-Asset Service Provider authorisation under MiCA and an Electronic Money Institution licence in Luxembourg.
The dual authorisation covers all 27 EU member states and supports stablecoin services for European businesses and users.
Bridge said the licences enable named IBANs, euro accounts, custom EUR-backed stablecoins, payouts and stablecoin-based settlement use cases.
Stablecoin payment firms are building through combined cryptoasset and e-money permissions. Fintechs, banks, treasury teams, payment providers and stablecoin issuers should watch how MiCA, EMI licences, IBAN access and euro stablecoin services define regulated market entry in Europe.
Wealthsimple introduced DEX trading inside its app, giving eligible users access to a wider range of on-chain tokens than its curated centralized crypto list.
When a user makes a first DEX trade, Wealthsimple creates a self-custody wallet, and trades execute through a third-party DEX aggregator.
Wealthsimple says DEX assets are not covered by insurance, do not share the same regulatory oversight as centralized crypto assets, and are outside centralized crypto purchase and loss limits.
Regulated retail crypto platforms are adding on-chain access while changing how custody, disclosure, risk controls and investor responsibility work. Brokers, crypto platforms, wallets, regulators and compliance teams should watch how self-custody DEX trading inside mainstream apps affects token access, suitability controls, tax reporting and Canadian crypto regulation and investor safeguards.
AscendEX ceased operating on July 1 after entering the end of Europe’s MiCA transitional period without authorization. It also cited additional financial and operational pressures.
The exchange stopped new accounts, deposits, trading, swaps, staking, lending and promotional services. Remaining account access is limited to withdrawals and other account exit functions.
Update: AscendEX paused automated withdrawals on July 6 and placed every request under manual review, without assuring customers when requests would be completed or how much would be returned.
The company said a counterparty failed to complete a strategic transaction intended to provide liquidity. AscendEX is assessing its financial position and acknowledged that unresolved balances could become subject to an insolvency or similar process.
The case combines a licensing exit with a failed liquidity transaction, withdrawal uncertainty and possible insolvency. Regulators and users can assess the effectiveness of the wind down through access to account records, withdrawal processing, financial disclosure and the treatment of unreturned balances. Canada’s registered crypto platforms operate under different rules. The same questions apply to custody, liquidity, capital, governance and orderly customer exits. NCFA’s comparison of MiCA and UK crypto rules explains how demanding authorization standards can favour firms with stronger operating infrastructure.
FalconX received Markets in Crypto-Assets authorization to expand regulated institutional digital asset services across the European Union and European Economic Area.
The authorization supports institutional trading, custody, prime brokerage and related digital asset services under the MiCA framework.
FalconX said the approval expands its regulated operating footprint for institutional clients across Europe.
MiCA is becoming the operating gateway for institutional digital asset firms. Trading firms, custodians, prime brokers, exchanges, asset managers and compliance teams should watch how authorization under a harmonized EU framework expands regulated cross-border crypto services.
Robinhood launched the public mainnet of Robinhood Chain, a Layer 2 blockchain built with Arbitrum for financial services and tokenized real world assets.
The company introduced stock tokens through Robinhood Wallet in more than 120 countries, with 24/7 trading and DeFi use cases such as lending and collateral, subject to jurisdiction limits.
Robinhood also announced onchain lending through Robinhood Earn, expanded perpetual futures in Europe, Canada availability through Coinsquare, and upcoming agentic crypto trading for eligible US users.
Retail investing is extending into onchain financial infrastructure. Brokers, crypto platforms, wallets, custodians, exchanges, wealth platforms and regulators should watch how tokenized equities, Layer 2 networks, onchain lending and AI directed trading reshape product access, market supervision and investor protection.
The Bank of England and FCA set out how they will jointly regulate systemic stablecoin issuers under the UK stablecoin regime.
The approach explains how supervisory responsibilities will be allocated, how FCA rules interact with Bank requirements and how transition arrangements will apply when an issuer becomes systemic.
The document also addresses stablecoin issuers that may be recognized as systemic at launch, where an issuer is likely to operate at systemic scale from the outset.
Stablecoin regulation is starting to look like payment system supervision. Issuers, banks, custodians, payment firms, exchanges and compliance teams should watch how systemic designation, transition planning and cross-regulator supervision affect market access for regulated digital money.
The FCA set out rules for crypto firms that support buying, trading, holding, custody, stablecoins, intermediation and staking.
The framework includes financial resilience, capital, stress testing, market integrity, insider trading, market manipulation and stablecoin standards.
Firms can apply for authorisation between Sept. 30, 2026 and Feb. 28, 2027, before the mandatory regime takes effect on Oct. 25, 2027.
The UK crypto market is getting a clearer operating perimeter. Crypto platforms, custodians, stablecoin issuers, intermediaries and staking firms should prepare for authorisation, capital planning, market conduct controls and compliance standards that bring crypto closer to mainstream financial regulation.
Open Standard announced Open USD, a stablecoin for global money movement backed by more than 140 participating businesses.
The model offers zero cost minting and redemption, no artificial volume limits, reserve earnings for partners, and collaborative governance through Open Standard.
Participating firms include major payment networks, banks, fintechs, technology platforms, crypto firms and commerce companies.
Stablecoin competition is shifting toward scale, governance and distribution. Banks, payment networks, wallets, merchants, fintechs and stablecoin issuers should watch whether shared economics, partner governance and broad platform participation become a stronger model for digital money adoption.
STOKR secured Crypto Asset Service Provider and Payment Institution licences in Luxembourg ahead of MiCAR's July 1, 2026 enforcement deadline.
The licences allow STOKR to operate across all 27 EU member states under a single harmonised framework.
The authorisations support crypto asset custody, transfers, payment transactions, credit transfers, standing orders and stablecoin settlement for tokenized securities.
Tokenized securities need regulated payment and custody rails, not only issuance technology. Asset managers, administrators, custodians, stablecoin providers and tokenization platforms should watch how CASP and payment licences shape the full transaction lifecycle from subscription to redemption and payout.
BNY expanded its relationship with Circle by adding USDC to BNY's Digital Asset Custody platform.
The service allows institutional clients to store, transfer, mint and burn USDC through BNY.
BNY said the capability supports institutional stablecoin custody, settlement and treasury operations.
Institutional stablecoin adoption is becoming part of regulated banking infrastructure. Banks, custodians, asset managers, payment firms and stablecoin issuers should watch how custody, minting, redemption and settlement services expand across institutional digital asset workflows.
Geoswift and SKUx announced a partnership to develop a programmable stablecoin commerce network connecting digital assets, traditional finance and real world commerce.
The network combines Geoswift's stablecoin settlement, liquidity and compliance infrastructure with SKUx item level controls inside point of sale systems.
SKUx said its SKUPay technology is already embedded in an estimated 50% of major US grocery and big box point of sale systems.
Stablecoin payments are starting to connect settlement with spending controls. Merchants, payment networks, wallets, stablecoin issuers, compliance teams and fintechs should watch how programmable rules, item level controls and point of sale integration expand programmable stablecoin payments in commerce.
The Monetary Authority of Singapore and industry partners published Safeguards for Agentic Finance at Runtime.
The SAFR approach focuses on policy-bound execution, real-time validation, auditability and interoperability for AI agents in finance.
Use cases include agent-assisted payments, treasury operations, wealth and advisory workflows, compliance review and client engagement.
Agentic finance needs controls at the point of action. Banks, fintechs, payment firms, wealth platforms and compliance teams should watch how agent identity, authority, escalation, audit trails and transaction limits become core requirements for AI systems that can act on behalf of users.
Bank of England Deputy Governor Sarah Breeden said agentic AI could reshape finance across cyber risk, trading, payments and commerce.
The speech warned that AI agents could amplify cyber vulnerabilities, market volatility and operational risks as financial systems operate more autonomously.
Breeden said existing technology neutral regulatory frameworks may not be sufficient because current frameworks were not built for autonomous agents.
Agentic finance is becoming a supervisory design question. Banks, fintechs, payment systems, trading firms, AI vendors and regulators should watch how consent, liability, agent identity, market controls, cyber resilience and accountability standards develop as autonomous systems enter financial workflows.
The UK bond consolidated tape began operating through ETS Connect UK, combining post-trade data from UK trading venues and over-the-counter markets into a single source.
The FCA said the launch makes the UK the first jurisdiction outside North America to implement a bond consolidated tape.
The regulator will monitor data quality, completeness and timeliness as market coverage expands.
Market transparency increasingly depends on shared data infrastructure. Exchanges, trading venues, fixed income dealers, market data providers, asset managers and regulators should watch how consolidated bond market data improves price discovery, execution quality and market oversight.
The FSTB and HKMA concluded the first phase of a review on distributed ledger technology use in Hong Kong fixed income markets.
The review found Hong Kong’s legal and regulatory environment is sufficiently flexible for tokenised bond issuance.
The next phase will examine legal changes for electronic execution, DLT record keeping, possession and transfer of tokenised fixed income instruments.
Tokenised capital markets need legal certainty as much as technology. Issuers, investors, custodians, exchanges, fund managers and regulators should watch how bond issuance, record keeping, settlement and transfer rules adapt as fixed income markets move onto distributed ledger infrastructure.
The FCA proposed targeted changes to its enforcement policies, including extending its financial penalty framework to cryptoasset market abuse.
The consultation also proposes higher minimum penalties for the most serious individual market abuse cases, updated hardship thresholds and greater flexibility in settlement decisions.
Comments are open until Aug. 10, 2026.
Crypto regulation is expanding beyond market access into enforcement. Cryptoasset firms, trading venues, brokers, compliance teams and market participants should prepare for enforcement policies that increasingly align digital asset markets with established financial market conduct standards.
The EU Anti-Money Laundering Authority issued an advisory note on money laundering and terrorist financing risks linked to the end of the MiCAR transitional period.
The note warns that unauthorized virtual asset service providers may exit, customer relationships may transfer or end, and activity may concentrate among authorized crypto asset service providers.
AMLA urged supervisors and firms to monitor customer migration, transaction flows, suspicious activity and risk changes as MiCAR implementation reaches the July 1, 2026 deadline.
Crypto regulation can create financial crime pressure during market transition. CASPs, VASPs, banks, payment firms, exchanges and compliance teams should watch how licensing deadlines, customer migration and supervisory coordination affect AML controls across Europe.
The Financial Conduct Authority proposed a simplified investment disclosure regime to help consumers better understand the costs and charges associated with investing.
The proposal replaces overlapping disclosure requirements with a single framework covering investment products, distribution and advice, while supporting the Consumer Composite Investments regime due to take effect in June 2027.
The FCA's consumer research found only 6% of existing disclosure documents were written in plain English, reinforcing the need for shorter, clearer and more comparable information.
Investment regulation increasingly focuses on communication as well as compliance. Asset managers, wealth platforms, advisers, fintechs and product manufacturers should prepare for disclosure requirements that prioritize clarity, comparability and consumer understanding alongside regulatory obligations.
The CFTC proposed data reporting requirements for certain event contracts listed on designated contract markets and swap execution facilities.
The proposal would add a new Covered Event Contracts section to Part 16 of CFTC regulations.
The proposal requests comment on reporting, surveillance, trader identifying information and burdens for markets, intermediaries and traders.
Event contract regulation is moving from listing debates into market surveillance and data reporting. Prediction markets, exchanges, brokers, compliance teams and regulators should watch how reporting rules shape the boundary between derivatives, event markets, gambling and retail speculation.
Conclusion
The strongest fintech companies don't wait for certainty. They recognize patterns early, build where demand is growing and stay ready when regulation catches up. That's the value of watching the evidence, not just the headlines. NCFA offers various curated resources to help founders and investors stay current on developments that impact fintech markets, subscribe to NCFA weekly newsletter updates, view the latest fintech insights, industry research, or launch into emerging financial innovation opportunities.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
July 3, 2026 | NCFA Insight | Cybersecurity And Fraud, Digital Identity And Trust, Risk Compliance And Regtech, Payments And Money Movement, Digital Assets Blockchain And Tokenization, Artificial Intelligence And Data
Post-Quantum Planning Starts Before The Threat Arrives
Governments are no longer treating post-quantum cryptography as a research topic. They're now publishing migration plans.
On June 22, 2026, the White House issued an order on advanced cryptographic attacks, including the risk that adversaries collect encrypted data today so they can decrypt it later. The same day, a separate White House order advanced U.S. quantum innovation across computing, sensing, networking, applications, and industry partnerships.
That combination is the useful development marker for fintech. Governments are funding quantum capability while also pushing organizations to prepare for the security risk that follows.
The financial sector doesn't need to know the exact year a cryptographically relevant quantum computer arrives before it starts planning. Long time customer data, payment credentials, digital identity systems, API certificates, custody systems, vendor software, archived records, and cryptographic keys may remain sensitive for years.
Quantum readiness is therefore becoming an operating requirement. Not someday. Now.
The practical message is this. Start with awareness, find where cryptography is used, assess risk, plan migration, and work with vendors before deadlines become urgent.
Today's Encryption Protects Tomorrow's Data
The hardest quantum risk is not only future system compromise. It is long term data.
Financial institutions protect account records, payments data, identity documents, loan files, custody records, private market documents, insurance records, tax files, transaction histories, and compliance archives. Some of that data must stay confidential for years or decades.
That creates the harvest now, decrypt later problem. An attacker can collect encrypted data now and wait for stronger decryption capability later.
For fintechs, this impacts the planning window. A company doesn't need to be systemically important to hold sensitive data. A payments provider, open banking intermediary, wallet provider, identity service, lending platform, wealthtech app, regtech vendor, or crypto custodian may all depend on cryptography that was never designed for a quantum era.
You Can't Upgrade Cryptography You Haven't Found
Post quantum migration starts with discovery.
Most organizations know they use TLS, certificates, signing keys, databases, cloud services, APIs, authentication systems, payment connections, and vendor platforms. Fewer have a current inventory of which cryptographic algorithms protect each system, which assets must remain confidential long term, and which vendors control the upgrade path.
That's why cryptographic inventory keeps appearing across official guidance.
A fintech should be able to answer basic questions:
Where are RSA, elliptic curve cryptography, key exchange, signatures, and certificates used?
Which customer data must remain confidential for more than five, ten, or twenty years?
Which APIs, identity tools, custody systems, payment rails, and cloud services depend on vulnerable algorithms?
Which vendors control cryptographic updates?
Which systems can support crypto agility without a major rebuild?
Who owns the roadmap: security, compliance, engineering, risk, procurement, or the board?
Without that inventory, migration plans become guesswork.
Every Vendor Becomes Part Of The Migration
Fintech security is rarely managed by one company anymore.
A single product may rely on cloud hosting, identity verification, payment processors, data aggregators, card issuing platforms, custodians, wallet technology, fraud systems, CRM tools, analytics software, email providers, certificate authorities, and outsourced compliance systems.
A fintech can upgrade its own code and still remain exposed through a vendor that cannot explain its cryptographic dependencies. Banks and credit unions face the same issue in reverse. They may need to ask whether fintech partners can support post quantum requirements before onboarding, renewing, or expanding contracts.
The procurement question changes from "is this vendor secure today?" to "can this vendor survive a cryptographic transition without disrupting our product, customers, or regulatory obligations?"
Where Quantum Risk Already Exists
Quantum readiness touches more than cybersecurity teams.
In payments, cryptography protects authentication, transaction integrity, messaging, API connections, certificates, and sensitive account data.
In digital identity, it protects credentials, signatures, documents, device binding, verification records, and trust chains.
In crypto and digital assets, it touches wallets, custody, private keys, signing systems, transaction authorization, smart contract administration, and institutional key management. BTQ's quantum safe Bitcoin and stablecoin roadmap highlights one approach to preparing digital asset infrastructure for post quantum cryptography.
In open banking, it affects API security, consent records, data sharing, third party access, and customer authentication.
In capital markets, it touches trading access, fund administration, investor records, tokenized securities, transfer agency, data rooms, reporting, and long term documents.
In AI and data systems, it affects model access, training data, confidential records, synthetic data pipelines, and secure data exchange.
That breadth is why the topic belongs with executives, product leaders, compliance teams, boards, and investors, not only cryptography specialists.
Canada Has A Public Roadmap, But Fintech Needs Its Own
Canada's Cyber Centre roadmap gives public sector organizations a starting point. It also gives fintech and financial services leaders useful guidance that migration will take planning, governance, technical discovery, budgets, and coordination.
Canada doesn't yet have a full financial sector post quantum mandate comparable to a hard compliance deadline, but that statement should not create comfort.
Canadian fintechs operate in a global market. They sell into banks, credit unions, enterprises, governments, insurers, capital markets, payment networks, and regulated financial institutions. Their buyers may start asking post quantum questions before Canadian rules require formal answers.
A fintech that can show cryptographic inventory, vendor readiness, migration planning, and crypto agility may have an advantage in enterprise sales. A fintech that cannot answer basic questions may face longer diligence, higher security friction, or blocked procurement.
The Next Security Products Aren't Quantum Computers
The near term opportunity is not building quantum computers. It's helping financial organizations prepare for the cryptographic transition. Quantum Bridge's USD $8M raise shows Canadian capital already backing deployment ready quantum safe security for finance, telecom, government, and defence.
Product opportunities include:
cryptographic inventory and discovery tools
certificate and key lifecycle automation
crypto agility platforms
PQC testing environments
vendor cryptography questionnaires and evidence systems
identity modernization for quantum safe credentials
custody and wallet security upgrades
API and payment connection readiness testing
regtech reporting for quantum readiness
board and risk dashboards for cryptographic exposure
These opportunities are practical because they map to work financial firms already need to do. They need to know what they use, what they protect, which systems carry the highest risk, which vendors control dependencies, and how migration can happen without breaking production systems.
These are the kinds of tools that belong on NCFA's Financial Innovation Map, such as identity, payments, custody, regtech, data governance, and cyber resilience.
Preparation Starts Before The Deadline
Quantum readiness won't arrive as a single upgrade.
Organizations will need inventories, test environments, migration sequencing, vendor commitments, product changes, audit evidence, customer communications, and fallback plans. Some systems will be easy to update. Others will depend on old software, hardware limits, contracts, third party platforms, or regulatory approvals.
That's why waiting for a precise quantum break date is the wrong approach for operators. Ask yourself, your team, your leadership this simpler question, "If a regulator, bank partner, insurer, enterprise buyer, or board asked tomorrow where vulnerable cryptography sits in the business, could the company answer?"
For many fintechs, the honest answer is probably no. So that's the opening to start.
Takeaway: Post quantum cryptography isn't a distant science fiction story anymore. It's becoming part of how financial organizations prove they can protect data, manage vendors, maintain trust, and keep critical services running through the next security transition.
Talking Point
If post quantum readiness starts with knowing where cryptography lives, should fintech due diligence now include a cryptographic inventory before major bank, payments, custody, or identity partnerships?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer to peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: [www.ncfacanada.org](http://www.ncfacanada.org)
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. 
