Karsten Wenzlaff, Advisor
August 26th, 2025
Karsten Wenzlaff is a Crowdfunding and Fintech Expert from Germany. He is Secretary-General of Digit[...]
Category Archives: Cyber Security, Quantum, Hacks, Fraud Alerts, Risks, InsurTech
Canada’s Encryption Fight Tests Fintech Trust And Trade
May 8, 2026 | NCFA Insight | Regulation And Policy, Cybersecurity And Fraud, Artificial Intelligence And Data
Lawful Access Collides With Modern Security Architecture
On May 7, 2026, Apple and Meta warned that Canada’s Bill C-22 could weaken encryption, pushing a long running lawful access debate back into the spotlight. The bill reaches far beyond Silicon Valley politics. It touches the same infrastructure that supports digital banking, fintech apps, cloud platforms, AI systems, wallets, fraud detection, secure communications, and identity verification.
What started as a policing and national security issue increasingly looks like a broader fight over cybersecurity, digital trust, and how governments regulate access to modern technology systems.
What Bill C-22 Actually Does
Bill C-22 creates a lawful access framework for electronic service providers operating in Canada.
Part 1 updates investigative powers related to subscriber information and transmission data.
Part 2 creates the Supporting Authorized Access to Information Act, which would require certain providers to maintain operational and technical capabilities that allow them to comply with lawful access requests under existing Criminal Code or CSIS Act authorities.
The scope is broad. The bill applies to electronic service providers involved in creating, storing, processing, transmitting, receiving, or making information available electronically. That definition reaches beyond telecom networks and traditional internet providers. Depending on regulations and ministerial orders, the framework could affect cloud providers, messaging platforms, device ecosystems, AI infrastructure, payment systems, digital identity platforms, and fintech companies handling sensitive customer information.
Why Ottawa Is Pushing The Bill
The government argues that Canada’s investigative framework no longer matches modern communications technology. Public Safety Canada says current lawful access rules still reflect a 1995 voice telephony environment, even though investigations now involve encrypted messaging systems, cloud services, internet platforms, and cross border digital infrastructure.
The FBI, RCMP, and other law enforcement agencies have long referred to encrypted communications and inaccessible digital evidence as the “going dark” problem.
Investigators increasingly struggle to access information tied to organized crime, online fraud, ransomware, terrorism, child exploitation, and financial crime because modern services collect less accessible data or use strong encryption that even the provider cannot access directly.
See: Real Time Rail Puts Canada’s Productivity Test In Focus
The Canadian Association of Chiefs of Police publicly supported the legislation and argued that police need updated tools to investigate serious crimes in digital environments. Justice Canada also says the bill would allow judges to authorize requests for subscriber information or transmission data from foreign telecommunications or social media providers where there are reasonable grounds to suspect an offence and the information would help the investigation.
The fraud backdrop strengthens the government’s case politically. Competition Bureau Canada reported CAFC data showing Canadians lost more than $704 million to fraud in 2025, while only 5% to 10% of fraud gets reported. Reported losses since 2022 have surpassed $2.4 billion.
The Encryption Fight Is The Real Flashpoint
Critics argue the proposed solution risks weakening the same security architecture modern digital systems depend on. Reuters reported that Apple warned the bill could allow Canada to “force companies to break encryption by inserting backdoors.”
Meta argued the legislation could force providers to weaken encryption protections or undermine zero knowledge systems designed so providers themselves cannot access customer data.
Public Safety Canada disputes that interpretation. Government officials say the legislation would not require providers to create a “systemic vulnerability” in encryption systems, which is now at the center of the debate.
The problem is technical as much as legal. Security engineers often argue that once a system preserves exceptional access for any party, it creates a potential weak point that can eventually attract criminals and and insider abuse.
For fintechs and financial institutions, it's the same strong encryption that protects account credentials, wallet keys, transaction approvals, secure communications, and increasingly AI workflows that may soon handle sensitive financial tasks autonomously.
The UK Risk And Outcome
The UK offers an important lesson for Canada. Earlier this year, Apple removed Advanced Data Protection for new UK users after government pressure around encrypted cloud access. Apple later stated that UK users would no longer have access to the feature and said, “we have never built a backdoor or master key.”
The UK outcome shows how a lawful access demand can expand into a wider cybersecurity and trade problem. Instead of settling the issue, Apple’s feature rollback intensified scrutiny from privacy advocates, security experts, and U.S. officials concerned about government access to encrypted cloud data.
Canada could face the same kind of fallout if Bill C-22 leaves companies unclear about what they may be forced to build, disclose, weaken, or keep secret under future access orders.
Trade Pressure And Digital Sovereignty
Timing isn't great. Canada is already dealing with pressure around digital sovereignty, platform regulation, AI governance, and trade relations with the United States.
In June 2025, Canada rescinded its Digital Services Tax to restart trade negotiations with the U.S. The CUSMA review is an active pressure point for companies operating across borders through cloud infrastructure, data systems, and digital financial services.
Europe is moving differently. The European Commission imposed the first Digital Markets Act penalties in April 2025, including €500 million against Apple and €200 million against Meta. Meanwhile, the Trump administration has taken a more defensive posture toward American technology firms facing foreign digital regulation, including ordering U.S. diplomats to push back against foreign data sovereignty rules.
That leaves Canada to balance a convergence of pressure around public safety expectations, cybersecurity concerns, platform dependence, trade risk, and digital sovereignty ambitions.
Who Could Feel The Impact
Large platforms will likely absorb the first round of scrutiny. The second order effects may matter more for fintech operators and infrastructure providers.
Fintechs, digital identity companies, crypto wallet providers, cloud based banking platforms, AI finance systems, payment processors, fraud vendors, and regulated financial institutions could all face pressure around compliance architecture, data retention, encryption design, and cross jurisdiction operational requirements.
The cost may not appear immediately through direct enforcement. It may emerge through audits, vendor obligations, insurance requirements, infrastructure redesign, compliance overhead, or changes to how secure systems get built and marketed in Canada.
See: Anthropic Mythos Redraws AI Cyber Risk Boundaries
Encryption is key to financial infrastructure. Customer trust, cybersecurity resilience, fraud prevention, and digital competitiveness now all depend heavily on whether secure systems remain genuinely secure.
A Better Compromise Is Still Possible
Does Canada need to choose between ineffective investigations and weakened encryption for everyone?
A better version of the bill would be more precise. It should clearly say which companies can receive access orders, protect end to end encryption and zero knowledge systems, require independent technical review before any order is approved, and give companies a real way to challenge orders that put security at risk.
The core dispute is not whether courts can authorize lawful investigations. It is whether governments should be able to force companies to preserve technical access inside systems designed specifically to remove that access. That is the fight at the centre of the global encryption debate.
Talking Point
Encryption is foundational infrastructure for finance, AI, communications, identity, and cloud systems. Canada’s challenge is no longer simply how to access digital evidence. It's how to modernize investigations without creating weaker systems that undermine cybersecurity, trust, and long term digital competitiveness.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
|---|---|---|
 |  |  |
NCFA Weekly Fintech Intelligence Apr 25-May 1, 2026
May 1, 2026 | NCFA Fintech Whisperer Weekly Intelligence | Digital Assets Blockchain And Tokenization, Payments And Market Infrastructure, Regulation And Policy, Capital Markets And Market Infrastructure
Image: Freepik
This live weekly NCFA intelligence page tracks financial technology developments that significantly affect how fintechs build, sell, raise capital, and operate under scrutiny. Coverage prioritizes Canada and includes global events that directly influence competitive conditions, market access, and execution realities across fintech sectors. This page will be updated throughout the week with market movers in a live format and then each week we'll close the prior week's contents in prep for the upcoming week, and continue on a rolling basis. (Missed prior week's Fintech Whisperer? (December 6-12, 2025, December 13-19, 2025, January 1-9, 2026, January 10-16, 2026, January 17-23, 2026, January 24-30, 2026, January 31-February 6, 2026, February 7-13, 2026, February 14-20, 2026, February 21-27, 2026, February 28-March 6, 2026, March 7-13, 2026, March 14-20, 2026, March 21-27, 2026, March 28-April 3, 2026, April 4-10, 2026, April 11-17, 2026, April 18-24, 2026).
Weekly Fintech Market Intelligence Apr 25 - May 1, 2026
Open Banking Open Finance And Data Sharing
FCA Publishes Assessment For Open Banking Standards Body
May 1, 2026, United Kingdom
- The FCA publishes KPMG’s independent assessment of proposals to lead the establishment of a future open banking standards setting body.
- The assessment supports industry decision making on a standards body capable of becoming the Future Entity, subject to future legislation.
- The FCA expects industry to set out next steps promptly and plans to publish another KPMG report on how the Future Entity could be operationalized.
Open banking is moving from policy design into standards governance. The next control point is who sets the technical, data, consent, and implementation standards that banks, fintechs, and payment firms will have to build against.
Risk Compliance And Regtech
APRA Calls For Step Change In AI Risk Governance
Apr 30, 2026, Australia
- APRA publishes an industry letter after reviewing AI use across banking, insurance, and superannuation.
- AI adoption is moving into operational and customer facing uses while governance, accountability, and assurance remain behind deployment speed.
- The review identifies board literacy gaps, third party dependence, embedded AI in vendor systems, weak contingency planning, and fragmented assurance across cyber, privacy, procurement, data, and operational risk.
- Existing prudential standards already apply, with regulated entities expected to close control gaps before AI use expands further.
AI governance is now part of prudential supervision. Banks, insurers, super funds, and vendors need evidence that AI systems can be explained, challenged, monitored, and shut down without breaking critical operations.
Canada Targets Crypto ATMs And MSBs In Spring Update
Apr 28, 2026, Canada
- Canada proposes to ban crypto ATMs and tighten rules for money services businesses used in fraud, money laundering, sanctions evasion, and terrorist financing.
- The update proposes $352.7M over five years and $82.1M ongoing to stand up the Financial Crimes Agency, plus funding for prosecutors and Finance Canada.
- FINTRAC revoked 84 MSB registrations in March 2026, and the update proposes stronger registration controls, criminal record checks, and new powers to stop non compliant operators from re entering the system.
- The National Anti Fraud Strategy advances a multi sector framework across finance, telecom, and digital platforms.
Canada is moving financial crime policy closer to the access points where fraud enters the system. Crypto ATMs, MSBs, account funding, and platform coordination now sit inside the same risk conversation. For fintech operators, the message is practical: faster finance needs stronger onboarding, monitoring, reporting, and partner controls. Weak compliance is becoming a market access problem, not just a regulatory issue.
Regulation And Policy
CSA Removes Some Personal Data Fields From NI 33-109 Filings
Apr 30, 2026, Canada
- The CSA publishes Coordinated Blanket Order 33-930 as interim relief from requirements to submit or update certain personal information under NI 33-109.
- The order exempts eye colour, hair colour, height, weight, and citizenship information from specified Form 33-109F4 and change notice requirements.
- The relief takes effect on May 1, 2026 and is intended to remain in place until NI 33-109 is amended, with Ontario expiry limits noted in the CSA notice.
CSA is removing unnecessary personal data from registration filings before the formal rule amendment is complete. Registrants, dealers, advisers, and compliance vendors should update onboarding, change notice, and filing workflows to reduce data collection and privacy risk.
FCA Opens ESG Ratings Reporting Pilot Ahead Of New Regime
Apr 28, 2026, United Kingdom
- The FCA invites ESG rating providers expected to fall under UK regulation to join a voluntary regulatory reporting pilot.
- Providers must express interest by May 13, 2026, with the pilot intended to test data availability, accessibility, and proportional reporting requirements.
- The FCA links the pilot to CP25/34 on ESG ratings regulation, while noting the pilot does not indicate final policy.
ESG ratings regulation is moving from consultation into reporting design. Data providers, asset managers, platforms, and compliance teams should watch what information the FCA tests now, because today’s pilot data fields can become tomorrow’s supervisory evidence.
Bundesbank President Pushes Digital Euro For Payments Sovereignty
Apr 28, 2026, Europe
- Bundesbank President Joachim Nagel frames digital payments as critical infrastructure and links the digital euro to Europe’s strategic autonomy.
- Cash accounts for 24% of euro area day to day payment value in 2024, while the share of merchants not accepting cash has tripled to 12% over three years.
- About two thirds of European card payments are processed by large U.S. payment providers, reinforcing the dependency risk behind the digital euro agenda.
- Nagel says the digital euro legislative process can be concluded by the end of 2026.
Europe’s digital euro case is now less about payment choice and more about infrastructure control. Banks, wallets, processors, and fintechs should watch how legal tender status, offline payments, privacy, and private sector distribution are built into the final framework.
Mercury Receives OCC Conditional Approval For National Bank
Apr 27, 2026, United States
- Mercury receives conditional OCC approval to establish Mercury Bank, N.A. as a national bank headquartered in Utah.
- Mercury serves more than 300,000 businesses and individuals, generates more than $650M in annualized revenue, and has 4 years of GAAP profitability.
- The company still needs remaining OCC requirements, FDIC approval, and Federal Reserve approval before Mercury Bank can launch.
- Mercury says a bank charter would support Zelle, expanded lending, faster money movement, and more direct control over payments infrastructure.
Mercury’s conditional approval shows how fintech infrastructure is moving closer to regulated bank ownership. The test now is execution: capital planning, compliance controls, risk governance, deposit insurance approval, payments operations, and regulator confidence.
Payments And Money Movement
Brazil Restricts Virtual Assets In Regulated eFX Settlement
Apr 30, 2026, Brazil
- Banco Central do Brasil issues Resolution BCB No. 561, updating rules for electronic foreign exchange payment and international transfer services.
- The rule requires eFX provider settlement with foreign counterparties to use foreign exchange transactions or non resident real accounts, and prohibits virtual assets in that settlement flow.
- The same framework expands eFX use to transfers tied to financial and capital market investments in Brazil or abroad.
Brazil is drawing a clear line inside regulated cross border payment infrastructure. eFX providers get broader investment related use cases, but crypto and stablecoins stay outside the supervised settlement flow between providers and foreign counterparties.
Visa Expands Stablecoin Settlement Pilot To Nine Blockchains
Apr 30, 2026, United States
- Visa adds five blockchains to its global stablecoin settlement pilot, expanding supported networks to nine.
- The pilot now supports Arc, Base, Canton, Polygon, and Tempo, alongside Avalanche, Ethereum, Solana, and Stellar.
- Visa says the pilot reached a $7B annualized stablecoin settlement run rate, up 50% quarter over quarter.
Stablecoin settlement is moving deeper into card network infrastructure. Visa’s multi chain expansion gives issuers and acquirers more settlement options while keeping a global payment network as the common operating layer.
Ant International Opens Agentic Mobile Protocol For AI Commerce
Apr 27, 2026, Malaysia
- Ant International introduces Agentic Mobile Protocol for AI agent payments across digital wallets, banking apps, super apps, mobile portals, and wearable devices.
- The protocol is open sourced and designed to connect AI platforms, merchants, agent builders, and LLMs to digital wallet users through secure mobile interfaces.
- AMP includes delegated payment authority, Know Your Agent controls, agent trust ratings, cross-device compatibility, and agent-to-agent settlement for nano transactions.
- Ant International says Alipay+ connects more than 40 wallet partners, 1.8B user accounts, and 150M merchants globally.
AI commerce is moving beyond card rails into wallets, super apps, banking interfaces, and wearable devices. Payment providers now need agent controls, authentication, settlement, and audit trails built directly into mobile workflows.
Capital Markets And Funding
Canada Launches First National Sovereign Wealth Fund
Apr 27, 2026, Canada
- The federal government announced the Canada Strong Fund as Canada’s first national sovereign wealth fund, with an initial federal contribution of $25B.
- The fund will invest alongside private capital in strategic Canadian projects and companies, including clean and conventional energy, critical minerals, agriculture, infrastructure, advanced manufacturing, and telecommunications.
- The Department of Finance backgrounder says the fund will focus primarily on equity investments, operate as an arm’s length Crown corporation, and pursue market rate commercial returns.
- The government will consult on a retail investment product that lets Canadians invest directly in the fund, with upside participation and protected initial invested capital.
Canada is creating a new public capital vehicle that blends nation building, private co investment, and retail participation. For fintechs, dealers, platforms, and wealth firms, the key watch item is the retail product design: distribution, disclosure, capital protection, eligibility, liquidity, and how ordinary Canadians gain access to strategic national investments.
FCA Consults On Changes To IPO Research Rules
Apr 27, 2026, United Kingdom
- The FCA proposes removing the 7 day delay before connected IPO research can be published.
- The consultation also proposes removing rules that require firms to give independent analysts the same information as their own research analysts.
- The FCA says the 2018 rules have not increased unconnected research and have added cost, risk, and complexity to the IPO process.
- The CP26/14 consultation closes on May 29, 2026.
The FCA is trying to reduce friction in UK listings. Issuers, banks, advisers, and research teams should watch this closely because research timing affects IPO execution, investor education, and how competitive London looks beside other listing venues.
Digital Assets Blockchain And Tokenization
CLARITY Act Yield Deal Puts Stablecoin Rewards Back In Play
May 1, 2026, United States
- Sens. Thom Tillis and Angela Alsobrooks released compromise language on stablecoin yield for the digital asset market structure bill.
- The text would ban rewards on stablecoin balances that are economically or functionally equivalent to interest bearing bank deposits.
- The compromise tries to preserve rewards tied to bona fide activity while addressing bank concerns about deposit flight.
- Coinbase Chief Policy Officer Faryar Shirzad says the compromise preserves rewards based on real platform and network usage, and Brian Armstrong replies “Mark it up,” signalling Coinbase support for moving the bill to committee.
The stablecoin yield fight is moving from a hard stop to a narrower fight over rewards design. Stablecoin issuers, exchanges, wallets, and banks should watch whether Congress draws the line around deposit like yield, activity based rewards, and who gets to define the difference.
SEC Publishes NYSE Texas Filing For Tokenized Securities Trading
Apr 30, 2026, United States
- The SEC publishes NYSE Texas’s rule filing to adopt Rule 7.39 and related changes enabling trading of securities in tokenized form during DTC’s tokenization pilot.
- The filing lets eligible participants select a tokenization flag at order entry, with NYSE Texas sending the tokenization preference to DTC after execution.
- Eligible tokenized securities trade on the same order book as traditional securities with the same execution priority, CUSIP, trading symbol, shareholder rights, and privileges.
- NYSE Texas keeps core exchange mechanics unchanged, including order types, routing, sessions, connectivity, pricing, and market data treatment.
Tokenized equities are being routed into existing U.S. market structure rather than a parallel venue. That makes the DTC pilot more important: the operating question is no longer whether tokenized securities can trade, but how clearing, settlement, custody, controls, and shareholder rights fit inside the national market system.
Cari And Tassat Advance U.S. Bank Tokenized Deposit Network
Apr 30, 2026, United States
- Cari partners with Tassat and will incorporate selected Tassat technologies and expertise into its tokenized deposit network.
- Cari’s MVP launched in March with design partner banks including First Horizon, Huntington, KeyCorp, M&T Bank, Old National, and SouthState.
- Eight additional banks have committed to join ahead of production launch later this year, with hundreds of institutions in active discussions.
- Tassat says its infrastructure has settled more than $2.5T to date.
Bank led tokenized deposits are moving from experiments toward shared network infrastructure. The signal is not only the technology transfer. It is the bank roster, production launch timing, and push to keep always on settlement inside the regulated deposit perimeter.
MoonPay Korea And Woori Bank Build KRW Stablecoin Infrastructure
Apr 30, 2026, South Korea
- MoonPay Korea signs its first banking MOU with Woori Bank to support bank led won backed stablecoin infrastructure.
- The work covers global distribution, cross border settlement, wallet access, and currency conversion for Korea’s emerging KRW stablecoin market.
- The consortium will explore use cases across remittances, merchant settlements, institutional payments, and cross border financial activity.
- MoonPay says it serves more than 30M customers across 180 countries and supports more than 500 enterprise customers.
Korea is moving bank led stablecoin infrastructure toward cross border distribution and wallet access. Stablecoin providers, banks, and payment firms should watch whether KRW backed settlement becomes a regulated bridge between domestic bank money and global digital commerce.
FCA Publishes Guidance And Rules For Fund Tokenisation
Apr 30, 2026, United Kingdom
- The FCA publishes guidance on how firms can use distributed ledger technology within existing rules for fund tokenisation.
- New rules add an optional Direct to Fund model that lets investors deal directly with a fund, whether traditional or tokenised.
- The FCA cites the UK asset management market as around 2,600 firms managing £16.5T for UK and global clients.
Simon Walls, Executive Director of Markets, Financial Conduct Authority
“Tokenisation has the potential to play an important role in asset management, and its adoption will be driven by firms and investors. We have focused on delivering what the market has asked for: a clear, practical framework that provides confidence in how fund tokenisation can operate within our rules, both now and into the future.”
AIMCo Discloses Strategy Holding In Q1 2026 Filing
April 29, 2026, Canada
- Alberta Investment Management Corporation's Q1 2026 Form 13F disclosed a holding of 1,382,000 Strategy shares.
- The filing reported a market value of approximately US$172.5 million at quarter end.
- The position provides indirect Bitcoin exposure through Strategy's corporate treasury model within a conventional public equity portfolio.
Institutional Bitcoin adoption is expanding through public equity as well as direct digital asset holdings. Pension funds, asset managers, banks and capital markets participants should watch whether listed Bitcoin treasury companies become a common route for regulated institutions seeking digital asset exposure within existing investment mandates.
Computershare And Securitize Bring Tokenized Shares To U.S. Issuers
Apr 29, 2026, United States
- Computershare and Securitize agree to let U.S. listed companies offer tokenized shares alongside traditional equity.
- The model keeps Computershare as transfer agent and lets issuers offer blockchain based ownership while preserving shareholder rights such as voting and dividends.
- Computershare serves more than 25,000 clients worldwide and supports companies representing about 58% of the S&P 500.
- Securitize has more than $4B in tokenized real world assets under management as of Apr 2026.
Tokenized equities are moving into the transfer agent layer. That matters because shareholder records, voting, dividends, and issuer controls are the plumbing that separates real tokenized securities from synthetic exposure or offshore wrappers.
FIS Launches Lyriq Platform For Bank Issued Digital Money
Apr 29, 2026, United States
- FIS launches Lyriq, a platform that lets banks issue, manage, and settle their own digital money, including tokenized deposits and digital currencies, while keeping deposits on bank balance sheets.
- Lyriq integrates with existing core banking systems, supports 24/7 settlement, and uses transactions that complete fully or fail cleanly.
- The platform is entering limited availability after seven digital currency proofs of concept with financial institutions globally.
- FIS says Lyriq includes compliance, identity verification, access controls, and auditability inside the platform infrastructure.
Bank issued digital money is moving closer to core banking infrastructure. Lyriq gives banks a way to run tokenized deposit style money flows with controls, auditability, settlement finality, and core integration built in from the start.
OKX BlackRock And Standard Chartered Launch Tokenized Collateral Framework
Apr 28, 2026, Global
- OKX, BlackRock, and Standard Chartered launch a framework that lets qualified clients use BlackRock’s BUIDL tokenized short term U.S. Treasury fund as yield bearing trading collateral.
- Standard Chartered provides regulated custody, creating a G SIB backed off exchange tokenized collateral framework.
- The framework supports both on exchange margin and off exchange collateral, allowing institutional clients to keep earning yield while using tokenized Treasury exposure in trading workflows.
Tokenized Treasury funds are moving from passive yield products into active collateral infrastructure. Exchanges, custodians, asset managers, and institutional trading desks now have a working model for combining yield, margin, custody, and counterparty risk controls in one operating stack.
Conclusion
This week is about ownership of core financial infrastructure. Canada introduced a sovereign wealth fund. Fintechs pursued bank charters. Global banks, exchanges, transfer agents, payment networks, and core processors advanced tokenized deposits, fund tokenization, tokenized shares, stablecoin settlement, and AI agent payments. These initiatives are about control: who owns the account, who controls settlement, who keeps custody, who sets the rules, and who earns the economics when financial assets and payments become programmable.
NCFA offers various curated resources to help founders and investors stay current on developments that impact fintech markets, subscribe to NCFA weekly newsletter updates, view a rundown of current fintech news and insights, or dive into the latest fintech industry research.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Datavault AI Targets Canadian CyberCatch In $136.8M Deal
May 1, 2026 | NCFA Fintech Market Activity | Risk Compliance And Regtech, Artificial Intelligence And Data
AI Driven Compliance And Cyber Risk Platform
On May 1, 2026, Datavault AI and CyberCatch announce a binding letter of intent for Datavault AI to acquire 100% of CyberCatch in an all stock transaction structured as a court approved plan of arrangement under the Business Corporations Act (British Columbia).
The proposed deal values CyberCatch at about CAD $136.8 million (CAD $5.11 per share). CyberCatch shareholders would hold about 7.52% of the combined company, with Datavault AI shareholders holding about 92.48% on a non fully diluted basis.
CyberCatch CYBE is listed on the TSX Venture Exchange and OTCQB US Venture Market, focuses on continuous compliance and AI driven cyber risk testing. Its platform uses generative AI to assess whether controls are in place, then uses agentic AI to simulate attack scenarios and produce a Cyber Breach Score. The model is built around continuous validation rather than periodic audit cycles.
See: Anthropic Mythos Redraws AI Cyber Risk Boundaries
Timing aligns with rising demand for continuous security assurance. The release cites Gartner estimates that global information security spending will reach $240 billion in 2026, while AI driven security could grow to $160 billion by 2029 (up from $49 billion 2025). IBM’s 2025 Cost of a Data Breach report places the average U.S. breach at $10.22 million and the global average at $4.44 million.
Regulatory pressure is picking up. The U.S. Department of Defense started rolling out its CMMC program on Nov 10, 2025, and stricter certification requirements are expected to expand in 2026 across about 220,000 contractors and suppliers. CyberCatch aligns its platform with widely used standards such as CMMC 2.0, NIST, ISO 27001, HIPAA, and PCI.
There’s also a growing focus on future security risks. As computing power increases, current encryption methods may become easier to break. CyberCatch is working on quantum resistant encryption, and signs like Google’s 2029 timeline for upgrading its systems show that companies are starting to prepare now.
Nathaniel T. Bradley, CEO, Datavault AI:
“Cybersecurity is no longer a separate stack from data and AI - it is the precondition for both. CyberCatch's continuous compliance platform is expected to provide another strategic advantage by adding to DataValue®, DataScore®, and the IDE® a real-time risk and compliance signal at every node of our quantum-secured edge fleet, from federal contractors to enterprise data customers.”
For Datavault AI, the transaction adds a compliance layer to its broader data, edge computing, and tokenization infrastructure. The company positions CyberCatch as a way to deliver real time assurance across regulated environments, including fintech, healthcare, energy, and defence.
See: AI Security Models Create A Patch Overload Crisis
CyberCatch brings a Canadian public market cybersecurity and regtech platform into a U.S. AI infrastructure strategy.
The transaction is subject to a definitive agreement, due diligence, board approvals, CyberCatch shareholder approval, British Columbia court approval, Nasdaq approval, TSX Venture Exchange approval, and other customary closing conditions. The parties have agreed to a 45 day exclusivity period.
Talking Point
Will continuous, AI driven compliance become a required layer for regulated industries, or will firms continue relying on periodic audits that do not reflect real time risk?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
MIT AI Risk Repository For Fintech Governance
Apr 29, 2026 | NCFA Resource | Artificial Intelligence And Data, Risk Compliance And Regtech
AI Risk Taxonomy For Audits And Controls
The MIT AI Risk Repository is an open database created by researchers at MIT to bring structure to AI risk. It compiles more than 1,700 documented risks from 74 existing frameworks and studies into a single system. The aim is practical. AI risk guidance exists, but it is scattered and inconsistent across sources. This repository organizes it into a shared taxonomy, with links that show how risks connect and compound across systems.
See: Age Checks Become Digital Compliance Infrastructure
In practice, this gives teams a consistent way to map risk across AI systems.
- A lending team can trace where bias or model drift may affect credit decisions
- A fraud team can test how detection gaps might cascade into losses
- Compliance teams can align internal reviews to a shared structure instead of stitching together multiple frameworks
- It brings product, engineering, and risk teams onto the same page as firms scale AI into production and face tighter audit expectations, similar to how financial institutions approach model risk management in production environments
Who Gets Value
Teams already running AI in production will get the most from this. If you’re operating models in lending, fraud, onboarding, or customer support, it gives you a structured way to think about risk across systems. Larger fintechs and financial institutions dealing with audit and regulatory pressure will find it useful quickly. Early stage teams without deployed models will likely find it heavy and not immediately relevant.
Strengths And Limits
The strength here is structure. It turns fragmented AI risk concepts into something teams can actually use, and the causal links add depth that most frameworks miss. At the same time, it does not rank risks by likelihood or impact, and it does not translate directly into controls or regulatory compliance. Some classifications reflect interpretation across sources, and emerging risks may not be fully captured. Teams still need to apply judgment and build their own control layer on top.
Key Resources
Repository Homepage (AI risk overview and navigation)
Full Risk Database (AI risk dataset for audits)
Causal Taxonomy (AI risk relationships mapping)
Domain Taxonomy (AI risk classification framework)
Research Paper (AI risk methodology and design)
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Canada’s Economic Update Tightens Fintech Operating Model
Apr 28, 2026 | NCFA Insight | Risk Compliance And Regtech, Digital Assets Blockchain And Tokenization, Open Banking Open Finance And Data Sharing, Payments And Market Infrastructure, Capital Markets And Funding
Canada Links Competition With Tighter Controls Across Fraud, Payments, and Financial Access
On Apr 28, 2026, the Government of Canada released its Spring Economic Update key measures. For fintech and financial institutions, a deeper and more integrated operating model is now taking form across fraud, payments, digital assets, banking fees, data access, and capital formation. Canada wants more competition in financial services, but not at the cost of weak controls. The update points to a more disciplined market where firms can win through lower costs, faster rails, better data access, and stronger fraud prevention (at least that's the strategic read).
François Philippe Champagne, Minister of Finance and National Revenue, Government of Canada:
“From geopolitical shifts to supply chain disruptions to rapid technological breakthroughs, including in artificial intelligence, the world is changing quickly and Canada must adapt to thrive.”
Fraud To The Center of Financial Policy
The update treats fraud as a structural weakness in the financial system, not just a policing problem. Canada will establish the Financial Crimes Agency as a dedicated federal body for serious and complex financial crime, with police powers, civilian leadership, specialized personnel, and an asset recovery mandate.
The funding is material. Ottawa proposes $352.7 million over five years and $82.1 million ongoing for the agency, plus $46.2 million over five years for the Public Prosecution Service of Canada and $19.6 million over five years for the Department of Finance Canada.
See: AI Security Models Create A Patch Overload Crisis
For fintechs, banks, platforms, and payment firms, this raises the bar. Fraud controls now need to work across onboarding, funding, transactions, identity, communications, reporting, and recovery. A good product experience will not carry a weak risk model.
Crypto ATMs Face Federal Ban
The clearest digital asset measure is the proposed crypto ATM ban. Annex 2 goes further than a policy signal. It proposes amendments to the Proceeds of Crime Money Laundering and Terrorist Financing Act and regulations to make it a criminal offence to operate a cryptocurrency automated teller machine.
Crypto ATMs connect cash to crypto quickly with limited friction, and can move scam proceeds outside the banking system before recovery becomes realistic. CBC reported that Canada has nearly 4,000 crypto ATMs, the most per capita in the world, and that some smaller deposits require only a phone number when under $1,000.
It's a targeted intervention of digital assets at what the government feels is the weakest access point. Serious crypto firms, custodians, exchanges, and tokenized finance builders should take note. Regulatory pressure will always look to where where money enters, exits, and escapes oversight.
MSBs Tighter Registration And Oversight
The update recognizes that money services businesses support remittances, currency exchange, digital payments, competition, and inclusion. It also says criminals increasingly abuse MSBs for money laundering, terrorist financing, sanctions evasion, and fraud.
FINTRAC revoked the registration of 84 MSBs in March 2026 alone. Ottawa now proposes new Ministerial Directive powers, expanded authority for FINTRAC to refuse or revoke MSB registration, measures to prevent non compliant MSBs from re registering, more criminal record checks, action on shelf MSBs, and better visibility into what services each MSB actually provides.
See: BoC RPAA Annual Reporting Reminder For PSPs
This resets the perimeter. MSBs are now seen as critical risk gateways that can no longer just sit at the edge of the system as light infrastructure. This will help strong operators over time because weak competitors will find it harder to hide behind registration status alone.
Banking Fees Get Capped And Challenged
The update links competition policy directly to household financial costs. New NSF fee rules cap charges at $10, down from $45 to $50, with expected consumer savings of more than $600 million annually. Ottawa also intends to consult on prohibiting investment account transfer fees at federally regulated financial institutions. Those fees currently cost Canadians an average of $150 per transfer.
Fee friction has long protected incumbent economics. Lower caps and easier switching reward firms that use better data, real time balance checks, clearer pricing, and lower operating costs. Fintechs should treat this as a product opening opportunity.
Open Banking And Payments Rules Align
The update keeps consumer driven banking as part of Canada's competition agenda. It says amendments to complete the Consumer Driven Banking Act have passed, giving consumers greater control over their finances.
Annex 2 also points to related amendments involving the Retail Payment Activities Act, the Payment Clearing and Settlement Act, the Consumer Driven Banking Act, and the Stablecoin Act as part of Bank of Canada cost recovery consolidation.
See: Bank Of Canada Signals Open Banking Timing Risk
Read this as infrastructure alignment. Canada is preparing the back office of regulation for a more digital financial system.
Retail Investment Access Expands Through Public Markets
The Canada Strong Fund creates another fintech touchpoint. Ottawa describes it as a national investment initiative focused mainly on equity investments in strategic Canadian projects and companies. The government also intends to offer Canadians a widely accessible retail investment product tied to the fund.
Canada wants citizens to participate directly in national growth assets while protecting initial invested capital. If Canadians can invest in strategic projects through a national vehicle, how directly competitive will it be and what role will regulated online investment platforms, exempt market dealers, wealthtech firms, and investor education tools play?
Controls Tighten Across Financial System
Canada is finally becoming more competitive, albeit with a much tighter control layer. Fraud enforcement gets funding and focus. Crypto ATMs face prohibition. MSBs face deeper scrutiny. Banking fees face compression. Open banking remains active. Payments, stablecoins, and data access move into more coordinated oversight. Retail capital access gets a new public investment model.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Age Checks Become Digital Compliance Infrastructure
Apr 28, 2026 | NCFA Insight | Risk Compliance And Regtech
Image: Freepik
Child Safety, Age Assurance, and AI Access Controls
On Apr 26, 2026, the CBC reported that Premier Wab Kinew announced at a weekend fundraiser that Manitoba plans to restrict youth access to social media and AI chatbots.
At the time of publishing, an official government release, bill or consultation paper wasn't available so treat this as early insight rather than a confirmed regulatory event (just yet). The stronger proof is already visible in global policy patterns, so it's only a matter of time.
Australia’s social media minimum age rules took effect on Dec 10, 2025, and eSafety reported that platforms had removed access to 4.7 million under 16 accounts across Australia by mid December 2025.
In Europe, the European Commission has published minor protection guidelines under the Digital Services Act, and the European Parliament has backed a minimum age of 16 for access to social media, video sharing platforms, and AI companions.
Given the trajectory and potential risks of AI, the debate isn't just about doom scrolling any more. It's fuelling a compliance market for age assurance, safer design, and AI access controls.
Social Media Bans Open The Door
Australian government's rules put responsibility on age restricted platforms to take reasonable steps, not on parents to police every account. So age restrictions and assurance are now an infrastructure issue. A checkbox, self declared birth date, or parental reminder won't satisfy regulators when millions of accounts need to be assessed, restricted, or removed.
See: CSA and CIRO Set Clear Rules for Finfluencers
Children can get pulled into endless feeds, autoplay videos, harmful recommendations, bullying, sexual exploitation, self harm content, eating disorder content, and late night scrolling that cuts into sleep. That's why social media is getting the attention from lawmakers first. The bigger question for fintech and digital identity comes next. Once governments make platforms check age, the same requirement can spread to other digital services used by minors.
The EU Builds The Age Assurance Layer
The EU hasn't implemented a social media ban on age just yet, but it's building the infrastructure that could support stricter controls. On July 14, 2025, the European Commission released an age verification app prototype under the Digital Services Act. The Commission says the app would let users prove they are over 18 when accessing restricted adult content while keeping control of other personal information, including their exact age and identity.
The Commission’s age verification page says the solution was technically ready for implementation as of Apr 15, 2026. The blueprint also gives platforms a practical build plan. It covers the technical specs, system design, data connections, and open source code needed to support age checks. Age assurance now has to protect children without creating a new privacy problem. Platforms need a trusted age signal. Users should not have to share a full identity file just to prove they meet an age limit.
AI Companions Raise The Risk Level
The clearest policy clue comes from Europe’s treatment of AI companions. On Nov 26, 2025, the European Parliament voted 483 in favour, 92 against, and 86 abstentions on a non legislative report calling for a minimum age of 16 for social media, video sharing platforms, and AI companions, unless parents authorize access for users aged 13 to 16.
The same Parliament release cites research that 97% of young people go online every day, 78% of 13 to 17 year olds check their devices at least hourly, and one in four minors show problematic or dysfunctional smartphone use. It also cites 2025 Eurobarometer impact of digitalisation findings that more than 90% of Europeans see online child protection as urgent, including 93% for social media’s negative impact on mental health, 92% for cyberbullying, and 92% for restricting access to age inappropriate content.
See: Tragic Incident Highlights AI Chatbot Risks for Teens
Those numbers explain why AI gets pulled into the same debate. Doom scrolling rules target addictive design and harmful content discovery. AI companion rules target interaction, dependency, personalized responses, manipulation, and adult like conversations with minors. NCFA has already examined youth AI protection risks, including lawsuits involving generative AI and vulnerable users. Regulators are starting to connect age, vulnerability, consent, product design, and AI behaviour into one compliance problem.
Closing Outlook
The public debate may start with under 16 social media bans. The business reality runs deeper. Governments want digital services to know when a user is a child, adjust the experience, and prove that controls work. Age assurance is becoming part of digital trust infrastructure. AI makes the stakes higher because the product doesn't just offer access to content anymore. It talks back, adapts, remembers, and can build dependence. That's why kid risk now part of the compliance stack. Once age becomes a regulated access condition, the same logic can reach payments, gaming, lending, investing, AI assistants, marketplaces, app stores, and identity wallets.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
AI Security Models Create A Patch Overload Crisis
Apr 27, 2026 | NCFA Fintech Insight | Cybersecurity And AI Risk
Mythos Answers Why Banks And Fintechs Need Faster Cyber Governance
On April 21, 2026, Mozilla's Firefox team said early access to Anthropic’s Claude Mythos Preview helped identify 271 vulnerabilities in Firefox 150, after an earlier Anthropic collaboration with Opus 4.6 helped fix 22 security sensitive bugs in Firefox 148. It's a real world test Warning that AI has started to compress months of expert vulnerability research into a much shorter discovery cycle.
The deeper issue for financial services isn’t whether AI can find bugs. Mozilla’s post makes that answer fairly clear. The harder question is whether banks, fintechs, payment providers, cloud vendors, and critical infrastructure operators can test, rank, schedule, and deploy fixes fast enough once the bug volume rises?
Mythos Flips Limitation From Finding Bugs To Fixing Them
Security teams have always fought an unfair game. That is attackers only need one weakness while defenders have to protect the full surface. Mozilla’s Bobby Holley wrote that elite security researchers find bugs that fuzzers miss by reasoning through source code, and that computers “were completely incapable of doing this a few months ago, and now they excel at it.” He also wrote that Mythos Preview was “every bit as capable” as the best security researchers Mozilla has studied.
See: Anthropic Mythos Redraws AI Cyber Risk Boundaries
Limited human cyber security expertise no longer limits discovery in the same way. Once AI can reason through large codebases, the volume of known vulnerabilities rises quickly. Mozilla for example jumped from 22 bugs in Firefox 148 to 271 vulnerabilities in Firefox 150. Detection capacity jumps faster than operational capacity.
For fintechs, that means security teams may see more vendor alerts, more emergency updates, more dependency risk, and more pressure to patch without breaking customer facing systems. More discovery helps defenders, but only when organizations can practically execute on the risk.
Patch Speed Is Now A Board Level Risk
The Financial Times reported that companies with Mythos access want stronger joint defense across government and business, especially for hospitals, banks, utilities, and other critical infrastructure. It also reported that Microsoft, Fifth Third’s technology provider, has rolled out almost 150 software updates since Mythos’s release. Patching can affect numerous areas, such as customer access, payments, fraud controls, and vendor dependencies.
Financial infrastructure like core banking systems, payment gateways, and fraud engines operate on tight turnaround schedules and a bad patch or gap can interrupt service, leaving a known weakness open. And the tradeoff becomes harder when AI expands the queue of fixes beyond human capacity.
A 2026 analysis summarized on the Harvard Law School Forum on Corporate Governance found that Russell 3000 companies hit by significant cyber incidents underperformed the broader market by about 5% on average over three years. The study reviewed 176 unique cyber events from 2022 through 2024, and found that finance, banking, and health care accounted for more than half of reported incidents. That means board failures, patch delays, poor vendor oversight can damage shareholder value for years.
The old comfort of quarterly patch cycles won’t hold up well in a world where AI can surface hundreds of issues at once.
Unauthorized Users Accessed Mythos
Reuters reported on April 21 that unauthorized users accessed Mythos through what Anthropic described as a third party vendor environment. Anthropic said it was investigating the report and had no evidence that the access affected Anthropic systems.
If a tool can find bugs as well as top security experts, then that tool becomes a prime target. Anyone who gets access to it could shortcut months of work and go straight to weak points. That means security is no longer just about protecting your systems. It also includes controlling who can use these AI security tools, how they’re accessed, and what they can see across your vendors and environments.
Warnings from Palo Alto Networks point to where this could go. These tools may allow attackers to link multiple weaknesses together and automate attacks. That’s why the unauthorized access issue matters even without confirmed misuse. The real risk is that the capability itself could leak.
Treat Patch Governance As Infrastructure
Canadian fintechs don’t run everything themselves. They depend on cloud providers, banks, payment networks, identity services, and other vendors. That means they don’t control when fixes happen, but they still carry the risk if something goes wrong.
That puts pressure on knowing how vendors handle security. Fintech teams need to understand how quickly partners fix serious issues, how they report problems, and whether important updates get priority. Even smaller firms can push for clearer answers before relying on a vendor for critical services.
See: Cybersecurity Bill C8 Raises Fintech Security Bar
Regulators should pay attention too. AI can help find problems faster, but only if companies can act on that information in a coordinated way. If not, bigger firms with early access move ahead, while smaller ones fall behind. In Canada, where many fintechs depend on a few key providers, that gap could widen quickly.
Closing Thoughts
Mozilla believes there’s a limit to how many bugs exist, and that defenders may finally be able to find them all. That could happen over time. Right now, though, things will feel messy. More bugs will show up. Fix lists will get longer. Vendors will have to decide what to fix first. Leaders will have to choose between keeping systems running and fixing issues right away. For banks and fintechs, the edge will go to those who can move faster, work closely with partners, and handle frequent updates without disrupting customers, payments, or data.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
