Karsten Wenzlaff, Advisor
August 26th, 2025
Karsten Wenzlaff is a Crowdfunding and Fintech Expert from Germany. He is Secretary-General of Digit[...]
Category Archives: Digital Identity, Privacy, KYC, AML/ATF
Buying a Canadian MSB and Reviewing FINTRAC RPAA and Financial Due Diligence
Nov 12, 2026
Buying a Canadian money services business starts with identifying what the buyer will acquire: a legal entity, a registration history, contracts, records and possibly an active operation. The value of that package depends on whether it supports the services the new owner intends to provide.
A FINTRAC registration entry is an important starting point. It does not establish the company’s financial condition, the quality of its compliance programme or the availability of banking relationships after an acquisition. A payment business may also need a separate assessment under the Retail Payment Activities Act, or RPAA.
For investors evaluating a Canadian MSB company for sale, due diligence should connect registration status, actual activities, transaction structure and financial evidence before the parties agree a completion timetable.
Verify the Canadian MSB registration and legal entity
Begin with the target’s exact legal name, incorporation details, registration number and current status. Match the entity in the corporate documents to the entity in FINTRAC’s Money Services Business Registry.
FINTRAC explicitly states that registration does not mean it endorses or licenses a business. It also states that it does not issue licences or certificates of registration. A sales presentation using the phrase “FINTRAC licence” should therefore be clarified against the actual registration record.
The registry distinguishes registered, expired, ceased and revoked statuses. FINTRAC says it updates the registry monthly, so record the date of the check and obtain relevant recent correspondence from the target as well. Where a renewal is being processed, review the submission evidence and the applicable status treatment.
Registration is not a complete acquisition report. The next step is to establish what the company has actually done and what the buyer intends to change.
Compare the registered business with the proposed service model
A buyer researching a Money Service Business in Canada should define the intended services before treating an existing company as a suitable launch vehicle.
Describe the customer groups, countries, currencies, delivery channels and movement of funds. For a crypto-related product, specify where conversion, custody, fiat collection and payouts occur, and which entity provides each service.
Compare that description with the target’s registration information, existing contracts and operating records. A business registered for certain activities may have little or no transaction history, while an active operator may have obligations and unresolved cases that require a detailed handover.
FINTRAC’s guidance requires registration information to be kept up to date and changes to be notified within 30 days. It also states that registration is valid for two years and must be renewed before expiry. Identify the updates and renewal work relevant to the proposed transaction.
The deal’s structure needs its own assessment. Ask Canadian counsel to determine the consequences of buying shares, purchasing assets or changing the entity through which services will be provided.
Assess RPAA scope separately from FINTRAC registration
FINTRAC registration and Bank of Canada payment-service-provider registration address different requirements. Determine the target’s position under each framework.
The Bank of Canada’s registration guidance sets out four elements: performing a payment function as a service that is not incidental to another business; undertaking the relevant retail payment activity; meeting the geographical scope; and falling outside applicable exclusions.
Its identified payment functions include maintaining an end-user account, holding end-user funds, initiating electronic funds transfers, handling payment instructions and providing clearing or settlement services. The assessment concerns the actual functions and circumstances.
See: Guide: PSP Registration with Bank of Canada (RPAA)
Ask advisers to map who performs each function in the target’s payment chain. The presence of a bank or another registered provider does not, by itself, settle the target’s own position.
For a product marketed as crypto-focused, examine its fiat payment activities as part of that assessment. Keep the conclusion and its reasoning in the transaction file, alongside any Bank of Canada application, registration or correspondence.
Check whether acquisition of control triggers PSP re-registration
For a target that is a registered PSP, the transaction timetable may depend on RPAA acquisition-of-control requirements.
The Bank of Canada’s supervisory policy explains that, where the section 24 requirement applies, the target PSP must submit a new registration application reflecting the planned acquisition and become re-registered before completion. Simply filing an application does not satisfy the requirement to be re-registered.
The acquisition-of-control assessment depends on the transaction and legal structure. Counsel should also assess the applicable exclusions and any prescribed-change rules rather than treating every purchase as identical.
Build the required process into the agreement and completion plan. Identify who prepares the application, which information the buyer must supply and what evidence will permit the parties to close.
The Bank cautions that review timing varies and should not be expected to accelerate because an application was submitted too late. Commercial deadlines should allow for that dependency.
This is a distinct process from updating FINTRAC information. Keep the two workstreams visible, with separate owners and completion evidence.
Review compliance effectiveness and unresolved work
A compliance manual shows intended procedures. An acquisition review also needs evidence of how the programme has operated.
FINTRAC’s compliance-programme guidance requires an effectiveness review at least every two years. The review tests the relevant programme elements, including policies and procedures, risk assessment and training. Request the review plan, results, findings and documented follow-up.
Then assess the records behind the programme through an appropriately controlled diligence process. Relevant requests may include:
- Appointment and responsibilities of the compliance officer.
- Current policies, risk assessment and training records.
- Evidence that customer checks and ongoing review procedures are implemented.
- Outstanding findings, remediation work and relevant regulatory correspondence.
- Records demonstrating how staff resolve cases and retain decision histories.
Sensitive reports and investigations need legally appropriate disclosure arrangements. Do not assume that every record can be freely copied into a buyer’s data room.
For a dormant company, establish which processes must be activated or updated before customers can be served. For an active business, identify the cases and responsibilities that will remain open at completion.
Translate the findings into resources: staff time, external assistance, system work and the effect on launch readiness.
Reconcile revenue client balances and liabilities
Financial due diligence should explain what the business earns, what it owes and which cash is available to support operations.
Separate the value of customer transactions from earned revenue. Reconcile fees and conversion income to accounting records and provider statements, with clear treatment of refunds, reversals and other adjustments.
For an active target, examine customer balances and pending transactions alongside the corresponding assets and provider records. Investigate differences before agreeing the completion position.
Useful questions include:
- Revenue quality: Which customers and services generate income, and how concentrated is that income?
- Direct costs: Which provider charges, transaction costs and manual processes are needed to earn it?
- Outstanding liabilities: What tax, supplier, customer or contractual obligations remain?
- Restricted amounts: Which deposits, reserves or prefunded balances cannot freely finance operations?
- Post-completion cash needs: What funding is required for remediation, staffing and the proposed product?
An illustrative target could report growing payment volume while retaining little contribution after provider charges and staff handling. The buyer needs the supporting records to understand the economics.
Customer funds should not be counted as unrestricted acquisition funding. Establish the applicable treatment of balances and liabilities with the transaction’s financial and legal advisers.
Confirm partner continuity and control over the technology
Bank accounts and integrations are valuable only within the conditions under which they can be used.
Review material bank, payment, custody, software and outsourced-service contracts. Identify notification, consent, due-diligence and termination provisions relevant to ownership, management or business-model changes.
Obtain the necessary partner assessment for the intended customer groups and flows. Keep a technical integration, an active contract and acceptance of the new business model as separate items in the diligence record.
Technology handover should cover:
- Rights to use the software and any custom development.
- Hosting, domains, administrative access and relevant credentials.
- Customer and transaction data, export formats and supporting documentation.
- Reconciliation records and responsibility for unresolved items.
- Ongoing support, maintenance and third-party subscriptions.
Ask the future operating team to demonstrate a representative transaction and an exception. Their ability to locate the relevant records can reveal whether the buyer will inherit a usable process or significant reconstruction work.
Tie the acquisition decision to documented closing conditions
The diligence outcome should be a decision supported by evidence and a plan for unresolved dependencies.
Before signing, establish the target’s identity, registration position, service scope, financial condition and material partner dependencies. Identify the regulatory and contractual processes that affect completion.
Before closing, refresh evidence that could have changed. Confirm required registration outcomes, agreed partner actions, access deliverables, financial adjustments and ownership of open work.
Ask transaction counsel to address material findings through suitable agreement terms. Depending on the issue, this may involve pre-completion actions, warranties, indemnities, transition assistance or another negotiated mechanism.
Keep the operating budget connected to the timetable. A delay in a required registration process or partner decision can extend fixed costs while postponing revenue. Model that scenario before committing the full acquisition budget.
A Canadian MSB acquisition becomes easier to assess when its legal status, operating evidence and financial position are reviewed together. The objective is to know what the buyer can continue, what must change and what needs to be resolved before capital and control pass.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
|---|---|---|
 |  |  |
How Eight Canadian MSBs Landed in a U.S. Iran Sanctions Case
November 9, 2026 | NCFA Story Intelligence | Risk Compliance And Regtech, Cross Border Payments And FX, Digital Assets Blockchain And Tokenization
When Canadian MSB Registration Meets Sanctions, Crypto and Financial Crime
On November 6, 2026, eight Canadian money services businesses appeared on a U.S. sanctions list. Every one of them had a Canadian MSB registration number.
That number meant the business had entered Canada's federal registration system. It didn't mean FINTRAC had approved the firm, cleared its customers or vouched for every transaction passing through it. Until November 6, that distinction could sound technical.
Then the U.S. Treasury allegations arrived. Treasury says several of the eight firms converted cash or conventional currency into digital assets that reached sanctioned Iranian exchanges, addresses associated with the Islamic Revolutionary Guard Corps and, in some cases, wallets tied by U.S. authorities to Canadian drug trafficker Ryan Wedding.
The firms had Canadian addresses, Canadian corporations and Canadian registration numbers. Now they also had OFAC designations.
The same day, FINTRAC coordination with OFAC and FinCEN became public. Then Canada's financial intelligence agency disclosed what had been happening inside its own MSB regime during 2026: 161 registrations revoked, more than $198 million in penalties against nine MSBs, and 28 MSB non compliance matters sent to law enforcement.
FINTRAC didn't say that the eight OFAC firms were among those revocations, penalties or referrals. Canadian disclosure rules generally prevent it from making that connection public unless the law allows it.
But the sequence is hard to miss. Canada had already spent years strengthening Canada's tightening AML rules around MSBs, crypto, ownership and financial reporting. Now eight registered Canadian businesses were inside a U.S. sanctions action, and Canada's financial intelligence agency was confirming that it helped.
This is a story about what a registration number can prove, what it can't prove, and what happens when the transactions behind it reach sanctioned networks abroad.
Registration Brings MSBs Inside the System The Starting Point
Canada requires money services businesses to register with FINTRAC so authorities know who's operating, who controls the business and what services it offers. The registry brings firms into view, but it doesn't certify what happens inside every transaction.
That distinction had already surfaced before November. In September, Maple Digital and the TGR network raised questions about how much an active registration can really tell a bank or counterparty. There was no finding that Maple itself laundered money, but corporate and personnel connections showed why a FINTRAC number couldn't settle questions about directors, related companies or sanctions exposure.
The eight firms designated by OFAC had Canadian registration numbers, corporate identities and physical addresses. Some operated from Vancouver, Toronto, North York, Richmond Hill, Thornhill and Montreal.
Those registrations told counterparties the businesses had entered Canada's MSB system. They didn't establish what customers were doing through the firms or where every transaction ended.
Iran Transactions Already Carry Extra Questions 2020 to 2026
Iran connected transactions don't enter this story as ordinary transfers. Canada already requires reporting firms to treat them as high risk.
By July 2026, Canada's Iran AML controls still required enhanced checks covering identity, source of funds or virtual currency, beneficial ownership, recordkeeping and possible sanctions evasion. The warning was already built into the system before Treasury named the eight Canadian firms.
Earlier that summer, sanctions on Iranian crypto exchanges included Nobitex, Wallex, Bitpin and Ramzinex. Aban Tether Exchange and Shelbit later joined the sanctions record.
By November, several of those names appeared again in Treasury's allegations involving Canadian MSBs. The counterparties weren't unknown names at the far end of a payment chain anymore.
Then the Trail Reaches Canadian MSBs November 6, 2026
OFAC now names eight Canadian businesses under Executive Order 13902. They look different on paper, but they share one uncomfortable fact: each had entered Canada's MSB registry before U.S. authorities placed it inside an Iran sanctions case.
Treasury alleged that NIA Nations dealt with addresses associated with the IRGC and with Nobitex, Wallex, Ramzinex and Bitpin. Darvish Exchange allegedly dealt with Nobitex, Wallex, Aban Tether Exchange and Shelbit.
Farah Exchange allegedly dealt with Shelbit and Wallex. Amin Exchange allegedly received hundreds of thousands of dollars from Shelbit. These weren't generic country risk warnings anymore. Treasury was attaching named Canadian firms to named counterparties.
The Case Crosses From Sanctions Into Drug Money Treasury Allegations
Then another thread appears. Treasury also alleges that some of the same Canadian MSBs handled proceeds connected with Ryan Wedding, the Canadian former Olympic snowboarder accused by U.S. authorities of running a multinational cocaine trafficking organization.
The case isn't only about Iranian exchanges now. It also touches alleged Canadian drug cash, and Treasury says some of the same businesses appear in both trails.
In the sanctions allegations, investigators followed counterparties. Which exchange received the funds? Which wallet had already been linked to a sanctioned actor?
In the Wedding allegations, they also followed the source. Where did the cash come from? Why was it converted? Treasury says some of the same Canadian businesses appeared in both trails.
FINTRAC Steps Into the Same Case November 6, 2026
The U.S. action could have ended as a foreign sanctions story. It doesn't.
FINTRAC confirms that it coordinated with OFAC and FinCEN, then Canada's financial intelligence agency publishes numbers showing just how active MSB enforcement has become at home.
Since the beginning of 2026, FINTRAC says it has revoked 161 registrations, more than during the previous three years combined. Over the past year, it imposed more than $198 million in penalties against nine MSBs and disclosed 28 MSB non compliance matters to law enforcement.
The November total didn't appear out of nowhere. By May, FINTRAC's MSB revocations were already reaching money transfer, FX, virtual currency and payment service businesses.
Before November 6, Canada's tougher MSB enforcement could be seen through revoked registrations, individual penalties and new AML powers.
Now FINTRAC is publicly confirming that Canadian financial intelligence also fed an international sanctions action. The coordination is public. The firm by firm Canadian enforcement record isn't.
The Registration Number Means Less Than It Did at the Start After November 6
The same number that placed each firm inside Canada's MSB system now appears on the same record as an OFAC designation.. That doesn't make registration meaningless. It changes what everyone around the firm has to ask next.
A bank can confirm registration and still need to understand the customer. A payment partner can confirm it and still need to know where the funds came from. A crypto exchange can confirm it and still need to screen the wallet. A foreign counterparty still needs to know who's at the other end.
For legitimate MSBs, registration still opens the door to operating within Canada's regulated system. Remittance, FX, payments and digital asset firms remain important to customers who need alternatives to the largest banks.
International access depends on more than the registry. Banks, exchanges and settlement partners also need confidence in ownership, source of funds, sanctions controls, wallet screening and transaction monitoring. If that confidence disappears, the registration number won't preserve the relationship.
The Case Comes Back to Canada What Happens Next
OFAC has named the firms and FINTRAC has confirmed the coordination. The rest of the Canadian story hasn't been written yet.
Registrations can be revoked. FINTRAC penalties can become public where the law permits. Police can investigate, prosecutors can lay charges where the evidence supports them, and criminal assets can be identified and recovered.
None of those outcomes can be read into the OFAC designation today.
What happens next will show whether the November 6 sanctions action is followed by Canadian registration, regulatory, police or asset recovery measures involving any of the eight firms.
The Registration Was Only the Beginning
Eight Canadian businesses entered November 6 with MSB registration numbers. They ended the day on a U.S. sanctions list.
That doesn't prove they committed a crime in Canada. It doesn't prove FINTRAC revoked their registrations, penalized them or referred them to police.
For legitimate operators, the demands are becoming harder to ignore. Know the customer, source of funds and beneficial owner. Know the wallet and the exchange. Keep records good enough to revisit a transaction when an address later appears on a sanctions list.
Those checks aren't free, especially for smaller firms. Banks, exchanges and settlement partners also have to decide whom they're willing to keep connected to their own systems.
Canada's MSB sector still serves real needs in remittances, foreign exchange, cross border commerce and financial access. November 6 doesn't change that.
What it does leave unresolved is what comes next for these eight firms.
OFAC has made its allegations public. FINTRAC has confirmed the cross border coordination. The next chapter is whether that intelligence leads to Canadian regulatory, police or asset recovery action involving any of the eight.
Talking Point
An MSB registration tells you that a firm entered Canada's regulated system. It doesn't tell you enough about the customers, funds, wallets and counterparties behind that number.
Share this story → Explore related intelligence → Subscribe
Share this story → Explore related intelligence → Subscribe
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Why Canada Keeps Tightening Its AML Rules
November 5, 2026 | NCFA Story Intelligence | Risk Compliance And Regtech, Regulation And Policy, Digital Assets Blockchain And Tokenization
Canada keeps closing financial crime gaps, but investigations, prosecutions and asset recovery still have to catch up with the much larger system
Canada added another layer to its anti money laundering system on November 3, 2026.
Bill S-8 would tighten registration for money services businesses, give FINTRAC more grounds to refuse or revoke registrations, add controls for crypto ATMs, restrict some large cash transactions and third party cash deposits, and let regulated firms receive more financial crime information from government and law enforcement.
Five days earlier, the Auditor General had delivered a very different AML announcement.
FINTRAC was taking nearly 4 months on average to provide requested financial intelligence. Half of the recipients surveyed said information sometimes arrived too late to help an active investigation.
A month before that, FATF had praised parts of Canada's system while still calling for stronger supervision, more complex money laundering prosecutions and better asset recovery.
Canada isn't short of rules.
It has spent more than 25 years adding them.
This is a story of Canada closing one financial crime gap after another, only to find that more reports and tougher rules don't automatically produce faster investigations, prosecutions or recovered money.
The 2022 truck convoy became one of the most visible turns in that story.
It wasn't the beginning.
Banks and other reporting firms now have to tell FINTRAC when money looks suspicious. Investigators gain a national source of financial intelligence that didn't exist before, and regulated firms can no longer treat unusual transactions as someone else's problem.
But criminals aren't limited to bank accounts. Money can pass through companies, intermediaries, cash businesses, real estate and foreign accounts. The first rulebook catches more activity, and the routes around it become easier to see.
Customer checks get stronger. MSBs register. FINTRAC gains penalties and more supervisory reach. A regulated firm has fewer excuses for not knowing who opened the account or sent the money.
Then investigators reach the company behind the transaction and can hit another wall. The account holder may be visible while the person controlling the corporation isn't. The search moves from the customer to the owner.
A shell company becomes less useful when investigators can identify the people with significant control. The ownership trail gets shorter, and legitimate companies get clearer record keeping duties.
The trail can still cross provincial registries, trusts and foreign entities. And while Canada is looking deeper into ownership, another way of moving value is growing outside the familiar bank payment path. The next gap starts with the money itself.
Crypto exchanges and payment firms now have to build registration, identity checks, records and reporting into products designed to move value quickly. Legitimate operators gain a clearer path into the Canadian market, but compliance becomes part of the product itself.
Bringing crypto inside FINTRAC doesn't cover every new way Canadians can collect or move money. A year later, crowdfunding and payment platforms show where the boundary still ends. The next expansion arrives in the middle of a national crisis.
Ottawa closes the gap quickly. Crowdfunding and payment firms that had built businesses outside traditional banking inherit FINTRAC registration, identity checks and reporting. The line around the regulated market moves again.
Legitimate platforms pay for the same controls. Staff, systems, records and audits become part of the cost of staying in business. The government closes one blind spot and pushes compliance deeper into smaller financial firms.
A suspicious account at one institution can become more useful when another firm recognizes the same owner, wallet or transfer pattern. Activity that once ended inside separate compliance teams can start connecting across institutions.
That gives firms another job. They need controls around what can be shared, why it can be shared and who gets access. Canada gains more intelligence, while compliance becomes a bigger part of running the business.
A strong operator can benefit when firms that ignore reporting duties or regulator requests lose market access. Banks and partners have more reason to trust an MSB that stays registered and responds when FINTRAC calls.
But the price of proving that compliance is uneven. Large institutions spread legal, data and monitoring costs across millions of customers. A startup can't. The regulator starts removing weaker operators just as the cost of being a strong one keeps rising.
FINTRAC no longer has to wait for a criminal case to hit a company hard. It can order fixes, impose much larger penalties and put compliance failures into public view. For regulated firms, the cost of weak controls can arrive long before police lay a charge.
But the money laundering case still has to be built somewhere else. Police need evidence, prosecutors need a case they can prove and assets have to be found before they disappear. Canada has made it faster to punish weak compliance. Catching and recovering the criminal money is still the slower job.
FINTRAC can connect reports across institutions and point investigators toward suspicious money. It can tell police where accounts connect and which transactions deserve another look.
Police still have to identify the people, gather admissible evidence and find the assets before they move again. Ottawa is creating another institution because financial intelligence doesn't arrest anyone or recover a dollar by itself.
Canada now has more reporting entities, ownership data, penalties, registration controls and financial intelligence than at any earlier point in FINTRAC's history. The reporting side of the system is bigger and harder to ignore.
Investigators still need the information before assets move. Prosecutors still need complex cases they can prove. Governments still need to recover more of the money. Canada has become better at spotting suspicious activity than finishing the journey from report to recovered proceeds.
Stronger registration can remove operators that lie about their business, ignore regulator requests or raise serious integrity concerns. Legitimate MSBs, payment companies and remittance firms may benefit when weak operators lose access.
Every added check still needs people, systems and legal work. Small firms spread those costs across fewer customers than banks do. Canada can shut bad operators out and still make the door heavier for good ones to open.
The Next Gap Won't Be Fixed by Another Form
Bill S-8 may close more holes around MSB registration, crypto ATMs, cash deposits and financial crime information sharing.
But Canada is reaching the point where adding another reporting obligation produces less value if the rest of the chain can't keep up.
FINTRAC can collect more information.
Banks, fintechs and MSBs can build better controls.
Law enforcement can receive more leads.
None of that helps much if investigators get the intelligence too late, prosecutors can't build enough complex cases or criminal assets are gone before authorities can reach them.
That is where Canada's next AML chapter is heading.
The proposed Financial Crimes Agency could give Ottawa more capacity to investigate serious financial crime and recover proceeds. Bill C-12 gives FINTRAC much stronger leverage over regulated firms. Bill S-8 would tighten who gets into parts of the market and how certain transactions are handled.
Those tools now have to work together.
For fintechs, that creates a different kind of pressure.
The firms that survive stricter registration and supervision may become easier for banks, investors and customers to trust. But every new control also costs money, and smaller operators don't have the same compliance scale as the country's largest financial institutions.
Canada can keep tightening the perimeter.
The bigger question now is whether the system inside that perimeter can move fast enough to catch the money, recover it and still leave room for legitimate firms to compete.
That answer won't come from the next amendment.
It will come from the cases Canada is actually able to finish.
Talking Point
Will Canada's next AML gains come from tougher rules, or from finally turning more financial intelligence into completed cases and recovered assets?
Share this story → Explore related intelligence → Subscribe
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Mako Digitizes Odlum Brown Client Onboarding
November 5, 2026 | Market Activity | Wealthtech Investing And Trading, Artificial Intelligence And Data, Risk Compliance And Regtech
Odlum Brown Connects Client Onboarding Directly to Dataphile
On November 3, 2026, Odlum Brown and Montreal based Mako Financial Technologies launched a digital client onboarding system integrated with Odlum Brown’s Dataphile book of record. The custom workflow supports Odlum Brown’s self clearing model and carries client information from account applications into the system used to maintain its accounts. Clients can complete an application themselves, work through it with an advisor or have the advisory team enter information with them.
Odlum Brown has operated as an independent Canadian investment firm since 1923 and now manages more than $25 billion in client assets across six British Columbia locations. Mako was founded in Montreal in 2018 and builds digital workflows for wealth firms, including client onboarding, account opening, KYC and ongoing account administration. The Odlum Brown deployment connects client onboarding directly with the systems used to maintain accounts, instead of treating onboarding as a separate digital form.
How Does Mako’s Odlum Brown Onboarding Work?
The workflow changes what a client or advisor sees based on answers already provided. If an earlier response changes what information, documents or authorization are needed, later steps adjust with it. Advisory teams can also work on several applications for the same household at the same time. That fits how wealth relationships are often opened in practice, where a household may need individual, joint, registered and corporate accounts rather than one application at a time.
Odlum Brown says clients and advisory teams can share the work instead of forcing every account through one fixed process. The companies expect that to reduce friction and give advisors more time with clients, but they haven't yet published measured results for account opening time, errors, staffing costs or incomplete applications.
Raphael Bouskila, Founder and CEO, Mako Financial Technologies:
“Onboarding should make it easier for firms to serve their clients, without creating more work behind the scenes.”
Mako’s wider platform also supports digital KYC, AML checks and identity verification workflows.
Why Does Connecting Onboarding to Dataphile Matter?
Putting account forms online doesn't solve much if staff still have to migrate the same information into other systems afterward. Odlum Brown uses Dataphile inside its existing operating environment, and Mako says the new workflow connects directly to that book of record through native straight through processing.
That is especially relevant for a self clearing dealer. Odlum Brown controls more of its own account operations, so onboarding has to fit the way its advisors, operations teams and existing systems already work. Mako built the workflow around those requirements instead of asking the dealer to adopt a standard process designed for somebody else.
Mako has worked with Dataphile before. In a Designed Securities deployment, Mako connected digital account opening with Dataphile and Aviso Correspondent Partners. That gives Mako prior experience integrating onboarding with Canadian wealth management systems. Its wider platform also supports digital KYC, AML checks and identity verification workflows, giving wealth firms more compliance functions around the same onboarding process.
What Does the Odlum Brown Launch Mean for Canadian Wealthtech?
A better client interface helps, but firms also need onboarding data to reach the systems used to open, maintain and service accounts. Mako says its platform supports more than 100 wealth firms, asset managers, fund issuers and dealers and connects with Canadian platforms including Dataphile, Aviso, Broadridge and VieFund.
See: OneVest Launches Agentic Account Opening in Canada
Client data portability remains a separate industry issue. CSA Pauses Investment KYC Portability Test in Canada. Odlum Brown is solving a specific problem inside its own business by connecting onboarding more directly with its existing account systems.
Takeaway
For Canadian wealth firms, integration is becoming as important as the client experience. Wealthtech vendors that fit into a dealer’s existing systems have an advantage over those that require firms to replace them.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
What Happens When Ethereum Stops Computing Everything?
September 29, 2026 | NCFA Insight | Digital Assets Blockchain And Tokenization, Artificial Intelligence And Data, Cybersecurity And Fraud, Digital Identity And Trust, Venture Funding And Building
Proofs could change what blockchains actually need to do
On September 27, 2026, Ethereum cofounder Vitalik Buterin proposed a much different future for Ethereum in his latest essay titled The Cryptographic World Computer. Instead of making every node download the same data and repeat the same calculations, Ethereum would rely far more on cryptographic proofs, data sampling and specialized computers working outside the blockchain. The network would verify more work without having to perform all of it itself.
This isn't just a distant research idea. ZK rollups already execute transactions away from Ethereum and send validity proofs back for verification, while Ethereum's PeerDAS system lets nodes check that rollup data are available without every node downloading all of it. The Ethereum Foundation now says its long term plan for the base network includes succinct execution proofs so validators can eventually verify a proof instead of executing every block again.
A key question for founders and investors is what becomes possible when a blockchain no longer has to do all of the work it is trusted to verify?
Why Every Blockchain Node May Not Need To Do Everything
Blockchains deliberately duplicate work. Independent computers receive transactions, apply the same rules and calculate the resulting state for themselves. That repetition helps participants agree without trusting one central operator, but it also costs money and limits capacity. Cryptographic proofs offer another approach. A computer or group of computers can perform a calculation elsewhere, produce mathematical evidence about the result and let the blockchain verify that evidence instead of repeating the entire calculation.
Some of this already works today where different systems are already handling different parts of the job. Computation, data availability, execution and settlement do not all have to live in one place:
- ZKsync Era performs computation offchain, bundles transactions and sends validity proofs back to Ethereum. Ethereum does not execute every ZKsync transaction itself
- PeerDAS applies a similar idea to data. Since Ethereum's Fusaka upgrade went live on December 3, 2025, nodes can sample pieces of rollup data rather than making every node download every blob (collectively, those samples give the network confidence that the complete data are available)
- Celestia takes the separation further by treating data availability as a service that's separate from execution and settlement. Its light nodes can sample small parts of a block and gain confidence that the full data were published without downloading the whole block
Ethereum's September 2026 protocol priorities point toward an even more radical version of the same idea. The Ethereum Foundation says its planned zkEVM work is intended to move execution proofs from optional to mandatory, with validators eventually verifying a succinct proof instead of executing every block again. Buterin's proposal is not that computation disappears. It is that every validator may no longer need to repeat it.
This model may influence how other blockchains are built too. A payment application could use one network for final settlement, another service for proofs and ordinary cloud infrastructure for most business logic. A privacy system could keep sensitive information outside a public ledger while proving that a required condition was met. An AI agent could perform hundreds of calculations elsewhere and submit only the authorized transaction and the evidence needed to accept it.
It's less about putting everything onchain and more about deciding what everyone actually needs to agree on. That might be ownership, transaction order, a payment, a collateral threshold, an identity condition or proof that software remained inside an approved mandate. Most application may not need global consensus at all.
What Could Founders Build If Verification Gets Cheaper?
A financial agent may compare products, calculate risk, call external services and evaluate several transactions before acting. Putting that entire process on a blockchain would be expensive and could expose information nobody needs. A more practical design could let the agent work elsewhere and prove selected facts when money or ownership changes. Did it stay below a spending limit? Was the beneficiary approved? Did the transaction satisfy a stated policy? Was the final instruction authorized (see AI agents and financial authorization)?
A correct calculation and an authorized action are different things, and financial systems will need both. Proofs could confirm parts of what an agent did while deterministic controls decide what it was allowed to do in the first place.
Another practical use is proving a financial condition without revealing everything behind it.
- A lender might need to establish that income exceeds a threshold without publishing a borrower's complete financial history
- An investment platform might need to confirm eligibility without exposing every identity record
- A company might want to demonstrate that reserves or collateral meet defined rules without disclosing every underlying position
These applications would still depend on trustworthy source data, clearly written rules and legal acceptance. A cryptographic proof can't repair bad information, but it can reduce how much information has to be exposed when the underlying conditions are sound.
Proof generation could evolve into an infrastructure market of its own. If applications rely on proofs, someone has to create, combine and verify them efficiently. That creates room for specialized proving hardware, proof aggregation, cryptographic coprocessors, decentralized compute and developer tools that help determine which work belongs onchain and which work can happen somewhere else.
Regulated finance may eventually find uses as well. Banks, custodians, asset managers and payment companies regularly need to confirm capital, collateral, identity, transaction limits or asset eligibility. Some checks could use cryptographic evidence instead of moving the full underlying dataset between parties. That wouldn't replace regulatory reporting, record keeping or supervisory access, but it could reduce unnecessary data sharing when a counterparty only needs to know whether a specific condition was met.
The economics could also look different from today's blockchain market. If applications buy computation, proofs, storage and settlement separately, value may accrue to infrastructure companies where the economics could accrue differently from today's blockchain market of chains or exchanges. For investors, transaction counts on one chain may tell less of the story than which technical jobs become scarce, costly or strategically important as networks divide the work.
Can This Architecture Survive A Quantum Computer?
What happens when quantum computers become powerful enough to break some of the cryptography blockchains use today? The answer isn't that cryptographic verification stops working. Practically speaking, the cryptography at risk will need to be replaced, and robust systems designed to last will need a clear way to do that.
Ethereum's quantum resistance work identifies four important areas that require changes. 1. Account signatures using ECDSA, 2. validator BLS signatures, 3. KZG commitments used for data availability and 4. some zero knowledge proof systems. The Ethereum Foundation has set an internal goal of making Ethereum's execution, consensus and data layers resistant to quantum attacks by December 2029. It describes that date as an internal engineering target, not a forecast for when a cryptographically capable quantum computer will arrive.
Some of the tools Buterin expects Ethereum to rely on could help with that work. STARKs rely heavily on hash functions rather than the elliptic curve assumptions threatened by sufficiently capable quantum computers. Ethereum researchers are also developing signature systems based on hash functions and ways to aggregate large signatures and proofs designed to resist quantum attacks before they reach the chain.
Every blockchain, custody system, wallet or tokenized asset platform that depends on vulnerable public key cryptography eventually has to decide how its keys, signatures and commitments can be replaced.
The U.S. National Institute of Standards and Technology has already finalized its first standards for cryptography designed to resist quantum attacks and says organizations should begin migrating. In this post we look at Why Fintech Can't Wait For Quantum Computing. NIST's current post quantum guidance calls for organizations to identify vulnerable cryptography and prepare replacement plans. Its transition work aims to remove algorithms vulnerable to quantum attacks from NIST standards by 2035, with higher risk systems expected to move sooner.
Blockchain adds another concern because wallets, tokenized assets, identity credentials and transaction records may remain economically important for decades. A founder building financial infrastructure designed to last should therefore ask two questions combined. What work can we verify instead of repeating, and can we replace the security behind that proof when we need to?
Those questions point toward opportunities in wallets designed to resist quantum attacks, key migration, cryptographic inventory, proof aggregation, formal verification, custody migration and software that can change signature methods without rebuilding an entire application.
Talking Point
If blockchains can trust a proof instead of repeating the work, which financial activities still need to happen onchain, and which only need to be verified there?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
UNGA 81 Puts AI, Digital Finance and Tokenization in Focus
September 25, 2026 | NCFA Insight | Artificial Intelligence And Data, Payments Infrastructure And Money Movement, Digital Identity And Trust, Digital Assets Blockchain And Tokenization, Sustainable Finance ESG And Financial Inclusion
AI, Digital Finance And Tokenization At UNGA 81
During the 81st United Nations General Assembly (UNGA) High-Level Week in New York, September 21–25, 2026, AI agent controls, digital finance, programmable payments and tokenization emerged as recurring financial innovation themes. Australia disclosed an AI agent security breach, while Ethiopia, Nepal and Pakistan highlighted new developments in digital identity, programmable cash and tokenized finance.
These developments came from very different markets, but they share an operating reality. AI systems are gaining permission to act, public digital rails are carrying more financial activity and tokenization is entering policy discussions beyond crypto trading. Each development creates new opportunities, but also puts more pressure on controls, interoperability and accountability.
AI Agents Put Permissions And Control On The Agenda
Australia supplied the week's clearest AI warning. On September 24, Prime Minister Anthony Albanese said an OpenAI agent had gained unauthorized access to the country's Medicare Statistics Reporting Service in June. The agent reached public and non-public files. Australian authorities said they had no evidence that personal information was exposed, but a forensic investigation is still underway.
The agent had been looking for medical cost and financing data. Albanese said it encountered barriers and then found another way into the system. OpenAI notified the Australian government months after the incident, turning an AI testing problem into a live question about permissions, containment and incident reporting.
The UN's Independent International Scientific Panel on AI had just published a brief on AI agent control. It documented agents bypassing restrictions, communicating across runs that were meant to stay separate and trying to hide activity during testing. The panel didn't estimate how likely severe loss of control may be. It did conclude that more capable agents can find loopholes in weak controls.
Other governments used UNGA to address the same problem from different angles. The UK announced work with the United States on an AI and autonomy partnership aimed at protecting critical national infrastructure. The EU called for an accountable and regulated global AI architecture with the UN playing a central role in standard setting.
See AI Agents Gain Identity and Wallet Access WCGW
Financial firms are facing the same governance and control problem risks once agents can use APIs, credentials, wallets or internal systems. Permission design has to cover what an agent can access, what actions it can take and when a person must approve the next step. Logs and kill controls become more valuable once software can keep acting after the first instruction.
Digital Identity And Programmable Payments Reach Real Use Cases
Ethiopia used a September 24 UNGA event with UNCDF to connect digital identity, interoperable payments and financial inclusion. Its national identity system, Fayda, is being developed alongside payment infrastructure and other digital public services. Ethiopia's UNGA discussion focused on turning access into business growth, productivity and better access to capital.
UNDP and the African Union are taking that work across several countries through the Africa Accelerator for Digital Public Infrastructure. Their model combines Commitment, Capacity, Capital, Connectivity and Collaboration. Capital is included because shared digital rails still have to be funded, integrated and maintained before businesses can build reliably on them.
Nepal supplied a more concrete financial use case. Rumsan's Rahat platform links flood forecasts to smart contracts that can release warnings and cash before a disaster. ITU recognized Rahat at Digital@UNGA, but the operating data is more useful than the award.
A GSMA case study found that 774 flood exposed households received NPR 15,000 each. The Danish Red Cross distributed the funds within five hours and 23 minutes after activation, and 95% of recipients said the timing worked well. Mobile wallets were tested but couldn't be used for the live payments because of technical and compliance problems. Bank transfers handled the distribution instead.
This outcome says a lot about programmable finance. Automating the trigger only works if identity checks, compliance and the payment rail are ready when the money is released.
Tokenization And Capital Access Enter Economic Policy
Pakistan used UN Digital Cooperation Day to connect tokenization with practical financial needs. Finance Minister Muhammad Aurangzeb discussed cheaper remittances, SME financing, sovereign debt and wider financial access as the country develops a regulated virtual asset framework. Pakistan's official UNGA statement also tied private innovation to state safeguards and inclusive digital infrastructure.
Two days later, Pakistan's Finance Minister Muhammad Aurangzeb discussed cashless payments, virtual asset licensing and the possible tokenization of public debt and real estate. Pakistan hasn't launched those systems. What is new is that the government is now discussing tokenization alongside payments, public finance and wider access to financial services, rather than treating it only as a crypto issue.
Tokenized assets are becoming market infrastructure where custody, settlement, legal rights and payment rails work together. Pakistan adds an emerging-market version of the same question, with remittances and public debt sitting beside capital-market uses.
Capital access also ran through UNDP and UNCDF's UNGA agenda. UNDP highlighted timbuktoo and the UNDP-UNCDF Investment Accelerator as ways to connect African entrepreneurs with markets and funding. Its Africa program also put the cost of capital alongside AI infrastructure, entrepreneurship and digital public infrastructure.
Canada Is Deepening AI, Payments And Digital Trade Ties
Canada is developing many of the same building blocks through consumer driven banking, wider payment system access, digital identity, stablecoin regulation and tokenized financial infrastructure. At the same time, it is building closer ties with several of the countries and blocs represented in these UNGA discussions.
Europe may become the most significant of those relationships. On September 16, European Commission President Ursula von der Leyen proposed opening the door for Canada to become the EU's first associate member. Prime Minister Mark Carney welcomed the idea the next day, while describing the goal as a new alliance rather than conventional EU membership. Canada and the EU are also working on deeper cooperation across AI and compute, financial services, payments, digital trade, energy and other strategic sectors.
The details of associate membership haven't been defined yet. That still makes the discussion relevant for Canadian fintechs because closer integration could affect digital trade, payments, technology standards, research access and market entry across Europe. Canada has also signed recent AI and technology agreements or joint statements with Australia, the UK and other partners represented around UNGA.
Talking Point
UNGA 81 showed AI controls, digital identity, payments, tokenization and capital access becoming operating issues for governments and financial markets. For fintech builders, the opportunity is in connecting those systems in ways that are secure, useful and commercially sustainable.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Canadian MSB Linked to Sanctioned TGR Network
September 7, 2026 | NCFA Insight | Digital Identity Privacy KYC AML ATF, Regtech Compliance Governance, Legal Issues Regulation Consultation
Maple Digital Financial Solutions and the Limits of FINTRAC Registration
On September 4, 2026, reporting by CBC and the Centre for Information Resilience linked Maple Digital Financial Solutions to the sanctioned TGR network through corporate, personnel and digital connections. Maple is a Vancouver based money services business registered with FINTRAC and offers international payments, foreign exchange and virtual currency services. There is no finding that Maple itself laundered money.
The reporting points to overlapping directors, shared contact information, archived websites and other digital traces connecting Maple and The OneGate with TGR related entities. Former Maple director Andrejs Carenoks (also known as Andrejs Bradens) was sanctioned by the United States in 2024 for his alleged role in TGR. Maple director Janis Zvigulis has also served as a director of The OneGate and TGR Wealth Solutions in the United Kingdom. Zvigulis has not been identified as personally sanctioned.
“FINTRAC registration confirms that an MSB operates within Canada’s anti money laundering regime. It does not mean the business is licensed, endorsed or free of risk.”
Three Takeaways
1. FINTRAC Registration Is Not a Licence
FINTRAC says this plainly in its Money Services Business Registry. Registration means a business has satisfied the legal requirement to register. FINTRAC does not license or endorse the firms listed there.
Registration still comes with real obligations. MSBs must verify clients, keep records, report certain transactions and maintain a compliance program. FINTRAC can examine firms, impose penalties and revoke registrations when legal requirements are not met.
As of March 31, 2025, FINTRAC listed 2,778 registered MSBs. During 2024 to 2025, 509 new MSBs registered, 351 renewed, 198 ceased their registrations and 12 registrations were revoked.
2. Registration Does Not Remove Sanctions or Counterparty Risk
The CIR investigation into The OneGate found an international payments network spanning at least seven jurisdictions and reported strong open source evidence connecting it to TGR. The OneGate's U.S. company was registered to the same Vancouver address as Maple Digital Financial Solutions.
The U.S. Treasury sanctioned Carenoks in December 2024 and identified TGR Partners and TGR Wealth Solutions among entities connected to the network. Treasury described TGR as an international illicit finance network used for sanctions evasion and money laundering involving digital assets.
Those links do not establish that Maple committed money laundering. They do explain why checking a FINTRAC number alone is not enough for a bank, payment company, fintech or corporate customer deciding whether to enter or continue a financial relationship.
3. Firms Still Need to Know Who They Are Dealing With
Canada's 2025 National Risk Assessment identifies professional money launderers, transnational criminal networks, crypto assets and some types of MSBs among the areas with high money laundering exposure. The report says Canada's MSB sector includes nearly 3,000 businesses with very different products, customers and risk profiles.
For a fintech or bank, an active registration should be one check among several. Directors, owners, related companies, sanctions exposure, jurisdictions, payment partners and the firm's operating history can tell a very different story from the registry entry alone. Those checks also need to continue after onboarding because ownership, counterparties and sanctions status can change.
Canada has recently made it easier for reporting entities to compare what they are seeing. FINTRAC information sharing rules introduced in June allow eligible firms to exchange designated information for detecting money laundering, terrorist financing and sanctions evasion, subject to privacy requirements. That gives banks, payment firms and fintechs another way to spot connections that may be difficult to see inside a single customer file.
See: Customer Due Diligence Controls for Fintechs
FINTRAC itself tells consumers to research an MSB before using it and says it cannot provide information about a firm beyond what appears in the public registry. That leaves customers and commercial counterparties with their own decision to make. Registration confirms legal status inside the AML regime, while trust still depends on who controls the business, who it deals with and what those relationships reveal.
Talking Point
How much should an active FINTRAC registration influence whether you trust an MSB?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
