A mid-size alternative lender in Vilnius pulls company registry filings, marketplace pricing and sanctions lists into its underwriting model every night. None of it is illegal to read. Most of it becomes a liability the moment it is copied, stored and combined with something else. That gap between "publicly visible" and "lawfully processed" is where fintech compliance teams keep losing arguments with their own data science departments.
Public web data – company filings, marketplace listings, court dockets, sanctions databases, social media bios – has become a standard input for credit scoring, fraud detection, KYB and competitive pricing in financial services. In Meta Platforms v. Bright Data, a federal district court held that Bright Data had not breached Meta's terms of service by collecting data from logged-out pages, which was the specific conduct at issue. The ruling turned on Bright Data's particular conduct and its contractual relationship with Meta rather than establishing a general rule for scraping public websites. For a regulated entity, that distinction is not academic. A bank's third-party risk team, an EU DORA auditor or a state attorney general does not care whether the data was "technically public" if the collection method itself created exposure.
What "public" actually means under US and EU law
hiQ Labs v. LinkedIn is still the reference case for US practitioners, and it is more nuanced than the headlines from 2019 suggest. The Ninth Circuit held twice, first in 2019 and again on remand in 2022, that scraping data from pages open to any visitor does not amount to accessing a computer "without authorization" under the Computer Fraud and Abuse Act. That took the CFAA off the table as a criminal exposure for reading public pages. It did not end the case. hiQ and LinkedIn settled the remaining contract claims in 2022, and hiQ agreed to destroy the data it had already collected and pay damages, because its scraping still violated LinkedIn's user agreement. The lesson for a fintech legal team is specific: CFAA risk and contract risk are two separate questions, and winning on one does not close the other.
On the EU side, the CFAA question barely matters, because GDPR does not distinguish between public and private personal data. Article 4 defines personal data by whether it relates to an identifiable natural person, not by where it was found. A LinkedIn bio, a court filing with a defendant's name, or a marketplace seller profile with a real name attached all fall inside GDPR's scope the moment they are collected, and Article 6 still requires a lawful basis – legitimate interest is workable for adverse-media or fraud screening, but it requires a documented balancing test, not just a note in a Confluence page.
Where fintechs actually use this data
Four use cases account for most of the public-data traffic coming out of fintech data engineering teams. Alternative underwriting pulls e-commerce store metrics, invoice marketplaces and gig-platform ratings to score borrowers who lack conventional credit files – Kabbage and, later, Amex built entire product lines on this. AML and sanctions screening cross-references OFAC, EU and UN lists against onboarding data, refreshed daily because list updates are unscheduled. Competitive pricing intelligence in embedded finance and BNPL tracks merchant-facing rates across marketplaces to benchmark interchange and fee structures. Fraud and adverse-media screening checks court records, press mentions and social profiles as a secondary signal alongside device fingerprinting.
Not all four carry the same regulatory weight. The table below is the one compliance teams actually need before greenlighting a collection project, not a generic "data source" taxonomy.
Data source
Typical fintech use
Regulatory sensitivity
Main legal basis to check
Company registries (Companies House, EDGAR, EU BRIS)
KYB, beneficial ownership checks
Low to medium
Public register rules and applicable data protection law; filings may contain personal data of directors, officers, beneficial owners and other natural persons
Sanctions and PEP lists (OFAC, EU, UN)
AML/KYC screening
Low
Government-published, but update frequency and source authenticity matter
Terms of service and contract law; CFAA exposure may be lower for pages accessible without login (per hiQ v. LinkedIn)
Public social media profiles
Alternative credit signals, fraud indicators
Medium to high
GDPR/CCPA personal-data rules apply even if the profile is public
Court records and litigation databases
Adverse media, fraud investigation
High
Jurisdiction-specific rules on re-use of judicial data (varies widely, e.g. France's Article 33)
The technical side: building a collection pipeline that survives an audit
The engineering choices matter as much as the legal analysis, because a regulator or a bank's third-party risk assessor will ask for logs, not intentions. A defensible pipeline has five properties, and they map to concrete infrastructure decisions rather than policy statements.
Figure 1
Figure 1. Each control maps to an artifact a third-party risk assessor can actually inspect. The first four are described below; request logging is the fifth, and the one the practical takeaway returns to.
Rate limiting that respects the source, not just your own throughput budget
Reading a site's robots.txt crawl-delay directive and setting concurrency accordingly is a five-minute engineering task that changes the legal character of the whole program. A crawler hitting a company registry at 200 requests per second looks like a denial-of-service test to the target's security team, regardless of what the data is used for afterward. Most production fintech scrapers we've reviewed cap at 1 request per 2-4 seconds per domain, which keeps CPU load on the target negligible and avoids the WAF triggers that generate abuse complaints in the first place.
IP rotation for reliability, not for evasion
This is the point where proxy infrastructure choice stops being a procurement decision and starts being a compliance decision. Rotating through residential or datacenter IPs to maintain a stable success rate against rate limits is standard engineering practice. Rotating IPs specifically to re-access a source after being blocked for a terms-of-service violation is the fact pattern that turned hiQ's win on CFAA into a loss on contract claims. The distinction sounds semantic until an opposing counsel reconstructs your request logs during discovery.
Data minimization at ingestion, not at export
Filtering personal identifiers (names, emails, phone numbers, biometric-adjacent fields) before the data lands in a warehouse is materially cheaper than filtering it after ten analysts have already queried the raw table. A regex-and-NER pass at the collection layer, logged with a timestamp and a rule version, is the artifact a DPO can actually show an auditor.
Retention limits tied to the original purpose
GDPR's storage limitation principle (Article 5(1)(e)) and most US state privacy laws expect a defined retention period. "We keep everything indefinitely for model retraining" is the single most common finding in the DPIAs we've read for alt-data underwriting programs, and it is usually fixable with a 90-180 day rolling window plus a documented exception process for flagged accounts.
Infrastructure and vendor selection
Proxy and scraping infrastructure choice affects three things a compliance file will ask about: whether the vendor itself runs KYC on IP sourcing, whether the billing model matches your actual usage pattern (per-IP monthly vs. per-GB bandwidth), and whether the vendor's own terms indicate the network is ethically sourced rather than built from compromised devices.
Steady, low-volume monitoring jobs (registry checks, sanctions list refresh) where a fixed, auditable IP per data feed is easier to log than rotating bandwidth pools
Decodo (formerly Smartproxy)
Per GB, tiered
$2.00-$3.75/GB depending on volume
Mid-volume scraping across many source domains where bandwidth, not IP count, is the cost driver
Oxylabs
Per GB, sales-assisted
Roughly $8/GB at entry tier, KYC required before provisioning
Enterprises that want a vendor-side KYC record as part of their own third-party risk file
Bright Data
Per GB (PAYG or committed)
$8.40/GB PAYG residential, down to ~$3/GB committed; datacenter from ~$0.90/GB
Large, multi-region collection programs where volume discounts offset the higher entry rate
The billing model split matters more than the headline price. A sanctions-list refresh job that hits the same twelve government sources every night at a predictable, low volume is a poor fit for per-GB bandwidth pricing – you're paying for a metric (data transferred) that has almost nothing to do with your actual constraint, which is IP reputation and consistency of access over time. Vendors like Proxys.io bill per dedicated IP per month, which lines up better with that access pattern and makes cost forecasting for a fixed set of monitored sources straightforward. A marketplace-pricing crawl that touches thousands of product pages across dozens of domains is the opposite case: bandwidth is the real cost driver, and a per-GB model from Decodo, Oxylabs or Bright Data scales more predictably with that workload. Enterprises already running Oxylabs' or Bright Data's own KYC process may lean on that as one input to their own vendor risk assessment, though it doesn't substitute for one.
Figure 2
Figure 2. The two variables that move cost are how many domains a run touches and how much data it moves, not the headline price per unit. Per-IP and per-GB rates are quoted in different units and cannot be compared directly.
None of these vendors, including the ones with published ethics or KYC pages, remove the fintech's own obligation to define a lawful basis, log what was collected, and honor retention limits. The proxy layer solves an availability and reliability problem – consistent access to public pages without disproportionate load on the source – not a data protection problem.
When the current setup stops being fit for purpose
Three signals usually mean a proxy or scraping setup needs to change, independent of price. First, a rising block rate on sources with unchanged rate limits – that's an IP-reputation problem the vendor's pool has accumulated, not something a compliance policy fixes. Second, the compliance team asking for source-level access logs the engineering stack can't currently produce – that's a signal the collection layer needs structured logging before it needs a new vendor. Third, a shift in workload shape, for example moving from a handful of steady, low-volume registry checks to broad multi-domain marketplace crawling, which usually means the per-IP pricing that worked for the first case stops making sense for the second.
Practical takeaway
A fintech data program built on public web sources holds up under regulatory review when three things are documented before the first request is ever sent: the lawful basis for each data category (not a blanket justification), the technical controls that keep collection proportionate to the source (rate limits, minimization, retention), and a request log detailed enough to reconstruct what was collected and why if a regulator or a counterparty's third-party risk team asks. The infrastructure vendor is a smaller decision than most procurement processes treat it as – it changes reliability and cost, not the underlying legal analysis.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
Aug 3, 2026 | Artificial Intelligence And Data, Banking And Credit, Risk Compliance And Regtech
The financial technology industry is changing as users expect quick responses, services tailored to their needs and smooth digital interactions. Artificial intelligence in CRM software is helping these companies improve how they interact with users - this technology is able to analyze data, automate interactions and provide detailed information about user requirements. When businesses combine management tools with artificial intelligence, they are able to create communication strategies that are more efficient plus build more stable relationships with users.
Improving Customer Data Management
Fintech companies manage large quantities of information from transactions, account activity and digital interactions. The best CRM software helps these organizations organize and evaluate this information - identifying patterns. Businesses are able to use automated systems instead of manual reviews to understand user preferences but also create experiences that are more relevant.
Advanced platforms allow financial service providers to create profiles that show communication history, financial behaviors and service preferences - this information is useful for teams to provide specific support and make better decisions. When businesses have a clear understanding of their users, they are able to offer services that match individual requirements.
Creating Personalized Customer Experiences
Personalization is a significant part of engagement because users expect services that match their specific situations. Solutions using artificial intelligence are able to analyze interactions as well as recommend products or services based on data - this allows companies to move away from general messages and provide communication that is more useful.
Systems are also able to help businesses predict what a user needs before a problem occurs. As an example, a platform is able to identify changes in behavior so that financial teams provide information at the correct time - this method is proactive and increases satisfaction.
Enhancing Customer Support Operations
Support is a primary area where artificial intelligence is changing how companies interact with users. Automated chat tools, intelligent response systems or the integration of data allow companies to provide assistance more quickly - these technologies are able to answer frequent questions so that support teams are able to focus on more difficult concerns.
Platforms also give representatives access to important information during a conversation - this reduces the need for users to repeat their details and allows employees to provide solutions that are more effective. A support process that is efficient is able to improve trust and strengthen long term relationships.
Supporting Better Business Decisions
Fintech companies require accurate information to make decisions about products next to marketing. AI CRM provides analytics that help businesses understand trends and evaluate strategies - these details allow organizations to identify areas for improvement and change their services based on how users behave.
Selecting the most appropriate software requires an evaluation of features like automation plus data analysis. Businesses are in need of solutions that handle financial data securely. Artificial intelligence is able to help companies make informed decisions and improve their general strategies for engagement.
Increasing Automation Across Fintech Services
Automation is a useful tool for businesses that want to be more efficient and maintain consistent communication. Platforms are able to automate tasks like follow up messages but also routine notifications - this reduces the amount of administrative work and allows employees to spend more time on activities that require human attention.
Automation is also helpful for maintaining engagement throughout the time a user is with a company. From the initial signup to ongoing support, the systems are able to ensure that users receive communication on time - this consistent interaction helps businesses create experiences that are smoother.
Strengthening Security And Compliance
Security is a critical concern because companies manage sensitive financial information. Software is able to assist companies - monitoring interactions, identifying unusual activity and supporting compliance - these features help businesses manage risks while they maintain efficient interactions.
Tools are also able to improve internal visibility - providing records of communications as well as activities - this information is helpful for organizations to remain accountable and respond to regulations. When companies combine management with security features, they are able to create digital experiences that are safer.
Transforming The Future Of Customer Engagement
Artificial intelligence is changing how fintech companies connect with users - improving personalization and decision making. As digital services expand, businesses that use intelligent solutions are able to understand expectations or provide experiences that are more responsive.
The future of engagement will continue to rely on technologies that combine data analysis with efficient communication - these systems give organizations the ability to build stronger relationships. When companies use these tools, they are able to create experiences for their users that are more reliable and valuable.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
The core business makes private networks easier to deploy and govern, while Aperture and Border0 take Tailscale into AI access and privileged infrastructure—two markets with bigger security budgets and much heavier competition. This profile looks at what customers are buying today, where the next leg of growth could come from and what the public evidence still can’t tell us.
These are selected Tailscale case studies, not audited results or a measure of what the average customer should expect. Still, they help explain how the product spreads: it removes the VPN tickets, slow onboarding and constant access administration that technical teams already dislike. A developer can start with one live problem, and if the network holds up, IT and security have a practical reason to standardize it, add controls and bring more of the company onto the same service.
The Products Driving Tailscale’s Business
Core Tailscale appears to be the product that pays today. It creates an encrypted private network among approved users, devices, servers and services, with identity based policy deciding what can connect. Developers can get started without rebuilding the company network; as use grows, IT and security can add centralized administration, device posture, logs and tighter access controls. Tailscale’s client, command line tool and relay server code are open source, but the hosted coordination server is proprietary. That coordination service distributes public keys and access rules, while customer traffic normally moves directly between endpoints or through encrypted relays. Tailscale Raises $230M To Power Identity-First Networking looked at why this model could pressure conventional VPN and firewall products.
The pricing supports the same bottom up motion. Tailscale currently lists a free Personal plan, Standard at US$8 per user per month, Premium at US$18 and custom Enterprise terms, with paid plans adding provisioning, device posture, administrative roles, network flow logs, regional routing and support. The cost of trying the product is low; the account becomes more valuable as more people, devices and company controls move onto it.
Revenue is the important missing number. Tailscale doesn’t publish it, and the outside estimates aren’t close enough to treat as fact. GetLatka puts 2025 revenue at US$45.2 million, although it says the figure is modelled and that management wasn’t interviewed. Northmetric estimates US$60.1 million in current annual recurring revenue with medium confidence, relying partly on an assumed 54,000 paying customers—well above BetaKit’s July 2026 report of nearly 40,000 paid business clients. Taken together, the estimates point to a company with real commercial scale, but they don’t establish Tailscale’s actual revenue.
Aperture is the move into AI access and cost control. Sitting between approved users or agents and AI model providers, it centralizes credentials while applying access rules, usage visibility and spending limits. That puts platform, security and AI infrastructure teams squarely in the buyer group. AI Agents Enter Governed Financial Workflows explains why permissions, approved tools and audit records matter once agents touch regulated work. Existing Tailscale networks could give Aperture a useful distribution advantage, but the product remains in beta and is currently available without extra cost during testing. Six users are included, with additional access handled through the company; usage, paid conversion and final pricing haven’t been published.
Border0 moves Tailscale into privileged infrastructure access. It governs sensitive connections to servers, databases, Kubernetes environments and internal applications, adding approval workflows, session recording and audit visibility. Those capabilities put Tailscale in front of security, compliance and operations buyers—not just the teams managing everyday network access. After acquiring Border0 in March 2026, Tailscale began connecting the product to its identity and networking layer, although the combined offering remains in beta. Adoption, revenue and final packaging haven’t been disclosed, so Border0 is best viewed as a credible expansion route rather than a proven second engine.
Competition, Regulation And Market Pressure
Tailscale now overlaps with secure networking, identity security, privileged access and AI gateways. Each move opens another budget, but it also brings the company up against much larger security platforms with broader bundles, established enterprise sales teams and far more acquisition firepower.
Large security platforms are buying identity.Palo Alto Networks completed its acquisition of CyberArk in February 2026, adding privileged access and identity security to a platform that already spans network, cloud and security operations. CrowdStrike agreed to acquire SGNL for continuous identity controls, while Zscaler agreed to acquire Symmetry Systems for data and AI access visibility. Buyers are clearly paying for identity and access control, but they may increasingly prefer to buy it inside a larger security contract.
SASE rivals have more capital and enterprise reach.Netskope’s September 2025 IPO raised approximately US$992 million and valued the company at about US$9.6 billion on a fully diluted basis. Netskope, Zscaler, Cloudflare and Palo Alto Networks can bundle network access with wider security products and sell through established enterprise teams. Tailscale’s counter is that technical users can adopt its product before a large security procurement begins, although that advantage could narrow as buyers consolidate more of their security spending with fewer vendors.
Open source keeps the paid product honest. Tailscale identifies Headscale as an independent alternative to its proprietary coordination server, which means a capable technical team can self host that layer. The subscription therefore has to keep earning its place through reliability, administration, policy, support and company controls—not connectivity alone.
Easy adoption doesn’t remove enterprise budget friction. A Tailscale commissioned survey of 1,000 technology leaders found that 42% cited workflow or integration disruption when security upgrades were delayed, while one third cited an unclear business case. Customer results give Tailscale’s sales team concrete savings to work with, but a company wide deployment still needs an owner, a budget and proof that another security vendor can be retired or avoided.
What Makes Tailscale Different In Summer 2026
Tailscale’s edge starts with how it gets in. A developer or infrastructure team can solve a live networking problem without waiting for a company wide migration; if the product works, IT and security can add policy, device controls, logs and support around a network that people are already using. Reported results from Instacart, Cribl, Corelight and Positron give that approach substance beyond the usual product pitch. It also places Tailscale across several areas in the NCFA Financial Innovation Map, including digital identity, cyber resilience, AI governance and enterprise infrastructure.
The next act is harder because Aperture and Border0 ask those customers to trust Tailscale with AI access and privileged infrastructure, where the budgets are larger and the incumbents are stronger. Nearly 40,000 paid business clients and 2.5 million active devices give Tailscale a meaningful starting point; what isn’t public yet is whether either product is creating meaningful new revenue.
The Company Intelligence Snapshot follows the funding, customer growth and product decisions that brought Tailscale to this point.
NCFA Company Intelligence Snapshot
Tailscale
Identity based secure connectivity for businesses, infrastructure, AI workloads and privileged access
Last updated Jul 21, 2026
Company At A Glance
Founded2019 by Avery Pennarun, David Carney, David Crawshaw and Brad Fitzpatrick
BaseToronto founded, fully distributed team
StatusPrivate, Series C
FundingUS$275M raised across seed, Series A, Series B and Series C financing
ProductsBusiness VPN, remote access, workload connectivity, Aperture AI gateway and Border0 privileged access
TechnologyWireGuard based encrypted mesh networking with identity controlled access
CustomersDevelopers, IT teams, security teams, enterprises, AI companies and infrastructure operators
Business ModelFree personal access with paid business and enterprise subscriptions
Milestones
Select a milestone to follow how Tailscale expanded from mesh networking into a wider access platform
1Launch2019–Apr 2020
2Remote Work DemandNov 2020
3Series BMay 2022
4Enterprise ScaleMar 2024–Jan 2025
5Series CApr 2025
6Access PlatformFeb–Jul 2026
Milestone 1
Tailscale Launches A Simpler Private Network (2019–Apr 2020)
Tailscale was founded in 2019 to reduce the complexity of connecting people, devices and services across the internet. Its first generally available product combined WireGuard encryption, identity and direct connections without requiring companies to rebuild their existing networks.
Company
TailscaleA Canadian founded secure networking company
Stage
LaunchGeneral availability arrived in April 2020
Capital
US$3M SeedLed by Heavybit with Uncork Capital and others
Markets
GlobalRemote teams, cloud infrastructure and personal networks
Customers
Developers FirstIndividuals and technical teams could start without enterprise deployment
Competition
Simpler VPNDirect encrypted connections reduced reliance on central VPN concentrators
Additional Company Data
WireGuard supplied the encrypted data layer
Identity replaced manual IP based access rules
The open source client helped technical buyers inspect and adopt the product
A free personal plan supported bottom up distribution
Why This Milestone Matters
Rather than begin with a top down security sale, Tailscale gave developers a faster way to connect private infrastructure and let working networks make the case for wider adoption.
Milestone 2
Remote Work Accelerates Demand (Nov 2020)
Tailscale raised a US$12 million Series A led by Accel as remote work increased demand for secure access across distributed teams. The company used the financing to expand its product and team while customers adopted private networks across more devices and environments.
Company
TailscaleSecure networking built for distributed teams
Stage
Early GrowthUsage expands after general availability
Capital
US$12MSeries A led by Accel
Markets
Remote WorkAccess across home, office and cloud environments
Customers
Distributed TeamsDevelopers, operators and early enterprise users
Competition
Fast DeploymentUsers could install Tailscale without replacing their physical network
Additional Company Data
Remote work turned secure access into an operating requirement
Accel joined Heavybit and Uncork Capital as a major investor
The company expanded support across common operating systems
Early enterprise deployments tested larger network requirements
Why This Milestone Matters
The Series A arrived as remote work turned private access into an everyday operating problem. The opportunity was no longer just developer convenience; distributed companies needed a network they could administer at scale.
Milestone 3
US$100 Million Funds Enterprise Expansion (May 2022)
Tailscale raised a US$100 million Series B led by CRV and Insight Partners. The round gave the company capital to expand engineering, customer support and commercial adoption while retaining the free personal product that drove referrals and bottom up use.
Company
TailscaleA product led network and security company
Stage
ExpansionEngineering and commercial capacity increase
Capital
US$100MSeries B led by CRV and Insight Partners
Markets
EnterprisePrivate access across cloud, office and remote infrastructure
Customers
Technical BuyersDevelopers introduced the product before wider company deployment
Competition
Product Led SecurityEase of use became part of the security proposition
Additional Company Data
Total disclosed financing reached US$115 million
Paid seat growth supported a larger business customer base
The company kept free personal access as a distribution channel
Capital supported a longer investment horizon for network infrastructure
Why This Milestone Matters
US$100 million gave Tailscale time to build enterprise depth without closing the free door that brought users in, preserving the model’s central tension: easy individual adoption followed by paid company controls.
Milestone 4
Business Adoption Doubles In Ten Months (Mar 2024–Jan 2025)
Tailscale EnterpriseBusiness networking and access controls
Stage
ScalePaid company adoption accelerates
Capital
Recurring RevenueBusiness subscriptions support the commercial model
Markets
Multiple IndustriesTechnology, finance, manufacturing, healthcare and AI
Customers
10,000+Business customers reported in January 2025
Competition
Bottom Up AdoptionUsers could validate the product before a company wide purchase
Additional Company Data
Paying teams passed 5,000 in March 2024
Business customers passed 10,000 by January 2025
More than half of the first 5,000 customers arrived in the preceding year
Enterprise features supported larger and regulated organizations
Why This Milestone Matters
Doubling from 5,000 paying teams to more than 10,000 business customers in ten months showed that bottom up use could convert into company spending. Developers weren’t a side audience; they were part of the route to market.
Milestone 5
Series C Backs A Larger Platform Ambition (Apr 2025)
Tailscale raised a US$160 million Series C led by Accel with participation from CRV, Insight Partners, Heavybit and Uncork Capital. The financing valued the company at approximately US$1.5 billion and brought total disclosed funding to US$275 million.
Company
TailscaleIdentity based connectivity at global company scale
Stage
Series CProduct and engineering expansion
Capital
US$160MApproximately US$1.5B valuation
Markets
Global InfrastructureEnterprise, cloud, edge, IoT and AI environments
Customers
Businesses And BuildersLarge organizations alongside developers and personal users
Competition
Identity LayerThe network becomes a base for additional access products
Additional Company Data
Total disclosed financing reached US$275 million
Accel returned to lead the growth round
The company planned to expand engineering and product teams
AI workloads became a stated customer and product priority
Why This Milestone Matters
The Series C funded a broader ambition, giving Tailscale room to build more security and access products around networks its customers had already deployed rather than stopping at VPN replacement.
Milestone 6
Aperture And Border0 Extend The Access Platform (Feb–Jul 2026)
Tailscale launched Aperture to control AI model access, credentials, usage and cost, then acquired Border0 to add privileged infrastructure access and session auditing. Both products use Tailscale identity and private connectivity as their operating base.
Company
Tailscale PlatformConnectivity, AI access and privileged access
Stage
Product ExpansionNew security products build on the existing network
Capital
Acquisition And BuildBorder0 joins while Aperture develops internally
Markets
AI And PAMModel gateways and privileged infrastructure sessions
Customers
Security And Platform TeamsAdministrators need control without slowing technical users
Competition
Platform BreadthTailscale competes for more of the access and control stack
Additional Company Data
Whether Aperture converts from beta use into paid enterprise adoption
How quickly Border0 becomes native inside the Tailscale administration experience
How far Tailscale expands beyond connectivity without adding the complexity it originally removed
Why This Milestone Matters
Aperture and Border0 are Tailscale’s first serious attempts to sell beyond the core network. Access to existing customers should help, although both products face different buyers and stronger incumbents; paid adoption will tell us whether Tailscale has a platform or a successful network with two promising adjacencies.
Frequently Asked Questions About Tailscale
What is Tailscale?
Tailscale is a secure networking platform connecting users, devices, servers and services through encrypted, identity-controlled networks. It uses WireGuard for encryption and a coordination layer for identity, discovery and policy. Traffic generally travels directly between endpoints rather than through a central VPN concentrator.
Who founded Tailscale?
Tailscale was founded in 2019 by Avery Pennarun, David Carney, David Crawshaw and Brad Fitzpatrick. Pennarun is chief executive and Carney is chief strategy officer. The company was founded in Toronto and operates as a fully distributed organization.
Is Tailscale a Canadian company?
Tailscale was founded in Toronto and is widely described as a Canadian-founded company. Its team is fully distributed, and the company serves customers globally.
How much funding has Tailscale raised?
Tailscale has raised US$275 million in disclosed financing: a US$3 million seed round, US$12 million Series A, US$100 million Series B and US$160 million Series C. Accel, CRV, Insight Partners, Heavybit and Uncork Capital are among its investors.
What is Tailscale’s valuation?
Tailscale was valued at approximately US$1.5 billion with its April 2025 Series C. Because it is privately held, this financing valuation is not a continuously updated market value. A later financing, secondary transaction or acquisition could establish a different valuation.
Tailscale uses a freemium subscription model. Its Personal plan is free, while Standard and Premium are priced per user and Enterprise pricing is negotiated. Aperture is currently in beta, and Tailscale has not disclosed how much revenue Aperture or Border0 contributes.
Does Tailscale disclose its revenue?
Tailscale does not publish official revenue or audited financial results. GetLatka and Northmetric publish estimates, but those figures are modelled rather than company reported and should not be treated as confirmed revenue.
What is Aperture by Tailscale?
Aperture is an AI access gateway designed to control which users and agents reach AI models, centralize provider credentials, observe model usage and manage cost. It remains in public beta, so eventual pricing, adoption and business contribution are not publicly established.
What did Border0 add to Tailscale?
Border0 joined Tailscale in March 2026, bringing controlled SSH, Kubernetes, database and remote-administration access into its product range, along with session recording and audit visibility. Tailscale said Border0 was already integrated with its network, identities and policies. Financial terms were not disclosed.
Who competes with Tailscale?
The list changes by use case. Core Tailscale competes with VPN, zero trust network access and software defined networking products, as well as self hosted WireGuard alternatives. Aperture faces AI gateway vendors. Border0 puts Tailscale into privileged access management, where large security platforms already compete.
Is Tailscale profitable?
Tailscale does not publicly disclose whether it is profitable. Revenue, margins, cash burn and audited financial results remain private.
Information notice: Private-company estimates are identified and attributed. Information may change after the stated update date. This content is provided for informational purposes only and does not constitute investment, financial or legal advice.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
Most of the fintech intelligence that crosses a Canadian analyst's desk arrives pre-labeled by sector: lending, open banking, payments, insurance. US social casinos rarely get filed under any of them, which is part of why the category is easy to underrate. Strip away the cartoon coins and the free-spin marketing, and what remains is a consumer payments business with a money-in flow, a money-out flow, and a compliance perimeter that looks familiar to anyone who has ever built a wallet or a checkout.
That reframing matters because the US market has grown large enough to work as a live demonstration of payment ideas the Canadian sector is still rolling out. Before treating social gaming as a novelty, it helps to see how the products are actually packaged for players. GamingToday keeps a running reference on sweepstakes-style gaming options that lays out how these titles present coins, prizes, and purchase tiers, which is a sensible way to read the consumer surface before you go looking for the plumbing underneath it.
This piece reads the boom the way a payments team would rather than the way a gambling columnist does. It walks through the money-in side, the identity layer, the money-out side, and the embedded-finance framing that ties them together, then asks the partner-risk question that US bank regulators are now putting to any firm that touches these flows. Throughout, the vantage point is Canadian, because the RTR launch and the country's open-banking timeline make the US experience unusually relevant reading for a payments desk in Toronto or Vancouver.
Reading a Free Game as a Payments Product
The first mental switch is to stop counting players and start counting transactions. A social casino does not earn money from people playing free rounds. It earns money at two points only: when a user chooses to buy a package of virtual coins, and, in the sweepstakes variant, when a user redeems an accumulated prize balance back into real value. Everything between those two points is engagement, and engagement is free to the player and nearly free to the operator.
Size the market and the reason for attention becomes obvious. Analyst estimates for the global social casino category in 2025 span a wide band, from roughly nine billion dollars to more than twenty billion, depending on where each firm draws the boundary between social slots, poker apps, and sweepstakes brands. The definitions are messy, but the direction is not in dispute: this is a multi-billion-dollar consumer segment whose entire revenue base is card charges, account transfers, and payouts. For a payments professional, that makes it a large real-world test of exactly the rails and controls the industry argues about in the abstract.
The revenue mix is what separates social casinos from most mobile games. By several industry counts, a large majority of new social casino releases now ship with in-app purchases, and the sale of virtual coins, not advertising, supplies most of what they earn. A game that monetizes through purchases rather than ads is, functionally, a merchant. It has a checkout, an average order value, a decline rate, and a chargeback problem, and those metrics behave the way they do in any high-frequency, low-ticket consumer business.
What a Social Casino Actually Is, Precisely
Precision here prevents the whole analysis from drifting. A social casino is a free-to-play product. The core loop uses a virtual currency, often called Gold Coins, that has no cash value and cannot be redeemed for anything. Players can buy more of it to keep playing, but they are buying entertainment time, not a stake. This is legally and mechanically distinct from a real-money online casino, which takes wagers in dollars and pays winnings in dollars, and which is licensed in only a small number of US states.
The sweepstakes variant adds a second currency, usually called Sweeps Coins, that can be redeemed for prizes, and it reaches players through no-purchase methods as well as through a bonus attached to coin packages. That free-entry mechanism is the legal hinge that lets sweepstakes brands operate in far more states than licensed casinos can. It is also the feature that draws the most regulatory attention. Real-money online casinos are not legal in California, and the state's Assembly Bill 831, effective January 1, 2026, restricts the dual-currency sweepstakes model directly, extending exposure to the vendors and partners who support it.
For a payments reader, the takeaway is narrow and important. The money-in flow, buying Gold Coins, exists in both the plain social model and the sweepstakes model. The money-out flow, redeeming a prize, exists only in the sweepstakes model, and it is the flow that carries the heavier compliance weight. Keeping those two flows separate in your head is the difference between understanding the sector and repeating marketing copy about free coins.
The Money-In Side and the Card-Acceptance Problem
Buying a coin package looks trivial to a player: pick a tier, tap a saved card or a mobile wallet, receive coins instantly. Underneath, it is one of the harder acceptance problems in consumer payments. Card networks and issuing banks treat anything gambling-adjacent as elevated risk, even when the product is legally a game rather than a wager. That classification drives higher decline rates, tighter merchant category coding, and processor pricing that reflects the risk of chargebacks and reputational exposure.
Image by Idris Halloway
The consequences shape the whole business. An operator that loses even a small share of attempted purchases to false declines is leaving revenue on the table at its single point of monetization, so payment optimization is not a back-office concern for these firms but a growth lever. Many run several processors in parallel and route each transaction to whichever is most likely to approve it, a practice payment teams recognize as orchestration. Mobile wallets help, because tokenized wallet transactions approve at higher rates and reduce stored-card exposure, which is why the checkout you see is usually a wallet button rather than a raw card form.
Account-to-account options sit at the edge of this flow and are growing. Paying directly from a bank account through an open-banking connection or a pay-by-bank rail sidesteps card interchange and card-network risk rules entirely. For an operator squeezed on card acceptance, an account-to-account purchase is cheaper and harder for an issuer to block, which is one reason the social gaming sector watches open-banking payment initiation as closely as any retail category does.
Identity and Onboarding as a Payments Function
The industry talks about identity as a compliance chore, but for a payments team it is really part of the acceptance stack. Before a sweepstakes brand can let value flow out, it has to know who the account holder is, and that verification has to be strong enough to satisfy anti-money-laundering expectations on the redemption side. Weak onboarding produces fraud losses and payout disputes; onboarding that is too heavy kills conversion at signup. The tension between those two failure modes is the same one every neobank and wallet provider manages.
What makes social casinos instructive is the sequence. Because the free coins require no payment, a user can sign up and play with almost no friction, and heavier identity checks are deferred until the moment money is about to move out. That deferred-verification design, light at the top of the funnel and strict at the cash-out gate, is a pattern payment and lending firms use widely, and the social casino version runs it at very large scale with real fraud pressure behind it. Watching how these operators tune the verification gate is a practical lesson in balancing conversion against loss.
The stakes rise on the redemption side because that is where the model resembles regulated value transfer. Source-of-funds questions, sanctions screening, and duplicate-account detection all land at the payout step. A payments provider evaluating one of these brands as a client should read the strength of that gate as carefully as it reads the purchase flow, because the redemption path is where the regulatory liability actually concentrates.
Where Embedded Finance Quietly Sits
Step back and the whole arrangement is an embedded-finance story. The game company is not a bank and does not want to become one, yet it offers a checkout, a stored-value balance, and a payout capability that together behave like financial services wrapped inside entertainment. That is the definition of embedded finance: financial functions delivered inside a non-financial product, through partners who supply the regulated pieces behind the scenes. NCFA's own plain-language primer on embedded finance frames the category as banking brought to the customer rather than the customer sent to the bank, and a social casino is that idea taken to its consumer-entertainment extreme.
The value chain looks the same as it does in any embedded-finance case. There are providers who hold the regulated licenses, enablers who supply the middleware and orchestration, and distributors, here the game brands, who own the customer relationship and the interface. Industry projections put the embedded-finance market on a steep growth path, with one widely cited forecast pointing to roughly US$776 billion by 2029 at a compound annual rate near twenty-four percent, and social gaming is one of the noisier consumer expressions of that curve.
Seeing the sector this way changes which risks matter. The interesting exposure is not whether a given game is fun or fair. It is that a chain of payment providers, processors, wallet vendors, and identity firms is quietly powering a product with a shifting legal footprint, and each of those partners inherits part of the risk. That is precisely the arrangement regulators have started to examine, and it is where the Canadian reader should pay closest attention.
The Money-Out Side and the Pull of Instant Payouts
Prize redemption is where social casinos meet the most active frontier in payments: getting money to a person quickly and cheaply. A player who wins expects the value to arrive fast, and a slow or failed payout is the quickest way to lose that player's trust and any future purchases. So the redemption experience is not a courtesy, it is a retention mechanism, which puts direct commercial pressure on the operator to use the fastest rail available.
Image by Idris Halloway
Traditional payout rails make this hard. A bank transfer can take days, a card refund is slow and reversible, and a gift card shifts cost around without solving speed. The rails purpose-built for this problem are the real-time payment systems now spreading worldwide: in the United States, instant networks that clear in seconds around the clock, and in Canada, the Real-Time Rail that Payments Canada is bringing online in phases through 2026 on the ISO 20022 messaging standard, with irrevocable settlement any time of day. A payout that lands in seconds, at a low flat cost, is exactly what a redemption flow wants.
The irrevocability of those rails is a double-edged design. Instant, final settlement is wonderful for a legitimate payout and dangerous for a fraudulent one, because there is no chargeback to claw a bad transfer back. That is why the identity gate discussed earlier tightens precisely at the cash-out step, and why operators pair fast rails with playthrough conditions and payout thresholds. For a Canadian payments desk preparing RTR use cases, the social casino payout problem is a preview of the fraud and speed trade-offs the domestic rail will face across many industries.
Mapping the Payments Underneath the Play
It helps to lay the pieces side by side, because the player sees a simple game surface while the payments team sees a stack of distinct decisions. The table maps each visible touchpoint to what the player experiences and to the question a payments professional should ask about it.
Touchpoint
What the player experiences
The payments question underneath
Signup and free coins
Instant, no payment, start playing
How light can onboarding be before fraud enters
Coin purchase
Tap a wallet, coins appear
Which processor approves it, at what decline rate and cost
Stored coin balance
A number in the app
Is this stored value, and who holds the liability
Identity verification
A prompt before cash-out
Is the check strong enough for AML on payout
Prize redemption
Money arrives, ideally fast
Which rail, how fast, and is it reversible
Partner chain
Invisible
Which licensed firm carries the regulatory duty
Read down the right column and the pattern is clear. Nothing on the player-facing side reveals where the money, the liability, or the compliance duty actually sits. Every meaningful risk lives in the second column, in the partner arrangements the interface is designed to hide. A payments reader who only watches the game surface will miss the entire business.
The Partner-Risk Question Regulators Are Now Asking
The reason this matters beyond curiosity is that the firms enabling these flows are the same kinds of firms bank regulators are scrutinizing hardest right now. Through 2024, US banking agencies issued a joint statement on the risks in bank arrangements with third parties and asked for comment on bank-fintech partnerships, signaling that the regulated institution behind an embedded product cannot treat the partner relationship as someone else's problem.
Image by Idris Halloway
The principle those agencies set out reads directly onto the social casino chain. In the Federal Reserve's federal guidance on third-party risk management, issued with the FDIC and the OCC in 2024, the agencies state that engaging a third party does not diminish or remove a bank's responsibility to operate in a safe and sound manner and to comply with applicable requirements. Translate that to a game brand's payment stack and it means the licensed provider at the base of the chain owns the compliance outcome, no matter how many enablers and distributors sit between it and the player.
For any payment firm weighing social gaming as a client, that reframes the diligence. The question is not only whether a specific brand is above board today, but whether the provider can supervise a partner whose legal footing may narrow state by state as measures like California's restriction spread. A rail that clears a redemption for a product later ruled offside is not a neutral pipe in the eyes of these frameworks. It is a supervised activity, and the cost of getting the partner assessment wrong is measured in enforcement, not just churn.
What Canada's Payments Sector Can Take From the Boom
The useful conclusion for a Canadian reader is not to chase the sector or to dismiss it, but to treat it as free field research. The US social casino market is running, at consumer scale, the exact experiments the Canadian sector is about to formalize: instant irrevocable payouts, account-to-account purchasing, deferred identity verification, and financial features embedded inside a non-financial brand. Each of those is a line item in Canada's open-banking and Real-Time Rail rollout, and the US market is stress-testing them in public right now.
The risks travel just as well as the techniques. The same speed that makes a real-time payout delightful makes a fraudulent one unrecoverable. The same embedded-finance structure that lets a game offer a slick checkout spreads regulatory duty across a chain of partners who may not all understand what they are carrying. A Canadian provider that reads the US boom carefully gets to learn those lessons before the domestic rail is fully live, which is a far cheaper way to learn them than through a domestic incident.
Filed correctly, then, US social casinos belong on the payments desk, not the entertainment page. They are a large, fast-moving, real-money demonstration of embedded finance under regulatory pressure, and the plumbing they run on is the same plumbing the Canadian sector is building. The free coins are the distraction. The transaction flows, the payout rails, and the partner-liability questions underneath them are the reading that repays the attention.
Frequently Asked Questions
Why would a payments professional study social casinos at all?
Because the product is a consumer payments business dressed as a game. Its entire revenue comes from coin purchases and prize redemptions, so it exercises card acceptance, identity verification, and fast-payout rails at large scale under real fraud pressure. That makes it a working case study in the same problems any wallet, checkout, or neobank has to solve.
How do social casino coin purchases move through the card networks?
They move like any high-risk, low-ticket merchant charge. Card issuers treat gambling-adjacent purchases as elevated risk, which raises decline rates and processing costs, so operators often route transactions across several processors and lean on mobile wallets to lift approval rates. Account-to-account and pay-by-bank options are growing because they sidestep card interchange and network risk rules.
What makes prize redemption a real-time payments problem?
Players judge a brand by how fast a prize arrives, so operators want the quickest rail available, which points toward instant systems like the US real-time networks and Canada's coming Real-Time Rail. Those rails settle in seconds and are irrevocable, which is ideal for a genuine payout and risky for a fraudulent one, so identity checks tighten at the cash-out step to compensate.
How does embedded finance apply to a social casino?
The game company offers a checkout, a stored-value balance, and a payout capability without being a bank itself, relying on licensed providers and middleware behind the scenes. That is embedded finance by definition: financial services delivered inside a non-financial product. The same provider, enabler, and distributor value chain seen across embedded finance applies directly to the sector.
What should a Canadian payment provider check before working with a social gaming brand?
Start with the strength of the identity and source-of-funds gate on the redemption side, since that is where anti-money-laundering liability concentrates. Then assess the brand's legal footing state by state, because measures restricting dual-currency sweepstakes are spreading. Under current third-party risk frameworks, the licensed provider keeps the compliance duty regardless of how many partners sit in between.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
Innovation Map → Digital Identity And Trust → Portable Business Identity → Opportunity
Last Updated Jun 24, 2026
FINANCIAL INNOVATION OPPORTUNITY BRIEFThis page tracks evidence, risks, validation signals and venture opportunities emerging as business identity, KYB, beneficial ownership data and compliance credentials become more portable across financial platforms.
Innovation OpportunityDigital Identity, KYB And Data Portability
Portable Business Identity
Businesses still repeat identity, ownership, onboarding and compliance checks across banks, PSPs, lenders, marketplaces and software platforms. The opportunity is to let verified business identity, KYB records, authority, ownership and trust credentials move securely across institutions with consent and controls.
16 Evidence4 Questions4 Related Opps4 Resources
Opportunity Intelligence
Market Potential
US$51B+Digital identity solutions, 2026 estimate
US$30B+KYC and KYB spend by 2030
HighGrowth signals
4Source count
Portable business identity sits between digital identity, KYB, beneficial ownership, data portability and compliance automation. Market estimates vary by scope, but the direction is consistent: regulated firms need more reliable business identity data, while businesses need less repetitive onboarding across platforms.
Juniper Research said Know Your Business systems will reach US$30.5B globally by 2030.
Zion Market Research projected the E-KYB market to grow from US$271.9M in 2024 to about US$1.2B by 2034.
Top Opportunity
The strongest opening is portable KYB and business identity profiles that reduce repeated onboarding while preserving control, consent, verification quality and auditability. The buyer may be a bank, PSP, marketplace, lender, regtech provider or business platform that wants lower onboarding friction without weaker compliance.
Top Risks
Regulated firms may hesitate to rely on portable business credentials unless liability and assurance standards are clear.
Government registries, LEI issuers, identity providers and existing KYB vendors may compete for control of the trust layer.
Portability can increase fraud or data leakage risk if consent, revocation, freshness and governance are weak.
What To Watch
Consumer driven banking rollout, CSA data portability testing, GLEIF vLEI adoption, beneficial ownership rules, KYB automation, open finance standards and evidence that SMEs or platforms will pay for reusable business identity tools.
Product Opportunities
Strongest current path: Portable KYB Profiles
Evidence points to three venture paths. Each one addresses a different constraint that prevents business identity and compliance data from moving safely across financial ecosystems.
1. Portable KYB Profiles
Reusable business onboarding and ownership records
7 evidence signals
3 related questions
high readiness
Businesses repeatedly submit incorporation documents, ownership records, director information, tax data, licenses and compliance evidence to every new financial provider. Portable KYB profiles could reduce this duplication while keeping institutions in control of risk decisions.
The venture opportunity is not to eliminate due diligence. It is to make verified business information easier to reuse, refresh, audit and share under clear permission rules. Potential buyers include banks, PSPs, lenders, marketplaces, wealth platforms and compliance service providers.
What could break the thesis
Regulated firms may decide that relying on third party KYB records creates more liability than efficiency unless assurance standards mature.
Market WindowOpen
Buyer ClarityHigh
Competitive PressureMedium High
Evidence StrengthHigh
What to validate first
Will banks, PSPs or platforms rely on portable KYB outputs, or only use them to accelerate internal review?
2. Business Identity Wallets
Verified entity, authority and credential control
5 evidence signals
2 related questions
growing readiness
Business identity wallets would let companies hold and present verified entity information, authority credentials, licenses, beneficial ownership attestations and role based permissions. The vLEI model shows how legal entity identity can become cryptographically verifiable in digital interactions.
This path may be most valuable where businesses need to prove who they are, who can act for them and what authority has been granted across payments, procurement, lending, filings and platform onboarding.
What could break the thesis
Wallet adoption may remain fragmented if issuers, registries, platforms and regulators do not converge around interoperable standards.
Market WindowOpening
Buyer ClarityMedium High
Competitive PressureMedium
Evidence StrengthMedium High
What to validate first
Which credential creates enough value to drive wallet adoption: entity identity, authority to act, beneficial ownership, tax status or licensing?
3. Trust Passport Networks
Platform trust, compliance status and risk portability
4 evidence signals
2 related questions
early readiness
Many businesses build trust repeatedly across marketplaces, lenders, PSPs, procurement networks and software ecosystems. A trust passport network would let selected trust attributes travel with the business, including verification status, permissions, payment history, platform standing and risk signals.
This path is broader than compliance. It may support B2B marketplaces, SME finance, embedded finance, cross border trade and agent commerce. It is earlier because governance and liability questions are harder than the technology.
What could break the thesis
Platforms may refuse to share trust data if they view it as proprietary, competitively sensitive or too risky to rely on elsewhere.
Market WindowEarly
Buyer ClarityMedium
Competitive PressureMedium
Evidence StrengthEarly
What to validate first
Which trust attributes are portable enough to matter and safe enough for another platform to rely on?
Evidence Trail
16 verified and early evidence items. Evidence type classifies the signal, not the publisher.
Filter by signal type to review source records, market signals and thought leadership supporting this opportunity. Evidence is sorted newest to oldest.
Share your perspective, research, case study or video response. You can also express interest in future discussions, collaboration opportunities and innovation activities related to this topic.
NCFA Opportunity Intelligence tracks emerging venture opportunities using evidence, market developments and validation signals. Opportunity briefs are updated as new information, evidence and stakeholder perspectives become available.
This content is provided for information purposes only and does not constitute legal, investment, financial, tax or professional advice.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
June 16, 2026 | NCFA Story Intelligence | Fraud, Cybersecurity And Trust
AI Clones, Biometric Risk, Faster Payments And The Fight To Prove What Is Real
The phone rings. Many people no longer answer.
Not because they’re too busy. Because they’re not sure who is calling, what’s real, or whether the message is safe to trust. That small behaviour change tells a bigger story about finance, fraud, identity, and technology.
For years, financial trust relied on familiar signals: a voice, a face, a password, a bank name, a phone number, a regulator, a delay before money moved. AI clones, biometric breaches, deepfakes, cyberattacks, weak AML controls, and faster payments are now breaking those signals at the same time.
Financial trust used to have more time. Branch visits, paper signatures, settlement delays, call centre checks, account holds, and human review gave institutions more room to spot problems before money moved too far. The system was slower, but that slowness created time to verify.
Consumers learned to trust familiar signals. A bank logo felt official. A caller who knew account details sounded credible. A voice sounded personal. A password felt private. Those signals were never perfect, but they worked well enough when fraud was slower, less automated, and easier to recognize.
Trust Used To Move SlowlyBefore Digital Scale
Older financial systems weren’t fraud proof. They were time rich. Verification happened across people, documents, branches, phone calls, and settlement windows. The digital shift didn’t remove the need for trust. It compressed the time available to prove it.
Online finance moved trust away from the branch. Banking, investing, lending, crypto, payments, and onboarding shifted into screens and apps. That created better access and faster service, but it also made customers depend on passwords, text codes, device checks, email links, and remote identity tools.
Fraudsters followed the customer online. Phishing, fake websites, account takeover, crypto wallet scams, approval phishing, QR abuse, and spoofed support channels made digital convenience feel less certain. Operation Avalanche showed how coordinated fraud response is becoming part of the market.
The Internet Changed Identity2000s to 2020s
Digital finance made onboarding, investing, banking, and payments easier. It also moved trust into remote channels that fraudsters could imitate. The question became less “do I recognize this institution?” and more “is this message, login, device, account, person, or transaction actually real?”
Voice used to feel personal. Then AI cloning made it copyable. Cloned voices bypassed Voice ID tests at Santander and Halifax, exposing weakness in systems that treated a voice as a reliable authentication signal.1
The scam no longer has to sound like a scam. A cloned voice can sound calm, familiar, urgent, or official. That changes the risk for banks, call centres, families, executives, seniors, and anyone asked to approve a transfer or share information after hearing a voice they think they know.
Your Voice Is No Longer Yours2024
Voice authentication worked because a voice felt unique. AI weakens that assumption. Once a voice can be copied, the problem is no longer only who is speaking. It is whether the system can prove the voice belongs to the person authorized to act.
Learn more
Voice cloning turns a trust shortcut into a risk surface. A customer may hear a familiar voice. A bank may hear a voiceprint. A fraudster may see both as tools to exploit. That forces financial institutions to treat voice as one signal inside a layered verification model, not as proof on its own.
Questions worth watching
Will banks continue using voice authentication as a primary signal?
How quickly will call centres add stronger liveness and behaviour checks?
Will consumers still trust phone based banking if voices can be cloned?
Biometrics raise the stakes because they cannot be replaced easily. A major India breach exposed fingerprints, facial scans, and sensitive records tied to police officers and applicants.2 A password can be reset. A fingerprint can’t.
Fintech products increasingly depend on biometric convenience. Face ID, Touch ID, palm payment, device based onboarding, and selfie checks reduce friction. They can also concentrate risk if biometric templates, face scans, or identity documents are stored poorly or exposed through vendors.
Biometrics Become Permanent Risk2024
Biometrics promise stronger identity checks because they are tied to the body. That is also the problem. When biometric data is compromised, the harm can follow a person for years. Convenience becomes dangerous if the system cannot protect the thing it asks people to trust most.
Deepfakes make fraud feel human. Deepfake scams have used AI generated voices, fake identities, digital banks, and crypto rails to trick victims and move funds quickly.3
AI makes deception cheaper to personalize. Fraudsters can imitate an executive, a family member, a bank employee, a support agent, or an investment promoter. The scam can be written better, timed better, targeted better, and delivered through channels that look more legitimate than old phishing emails.
AI Gives Fraud Scale2025 to 2026
AI changes the economics of deception. More scams can be personalized. More identities can be synthesized. More messages can be tested. More attacks can be automated. Fraud moves from a labour intensive crime to something closer to a scalable service.
Learn more
OSFI and the Global Risk Institute flagged synthetic identity, deepfakes, voice spoofing, AI assisted cyberattacks, fraud as a service, and disinformation as regulated AI risks. That matters because financial institutions aren’t only using AI to serve customers. They’re also defending against attackers who can use similar tools.
Questions worth watching
Will AI fraud detection improve faster than AI enabled deception?
Can financial firms verify identity without making onboarding painful?
How will regulators test whether AI controls actually work?
Faster money gives fraud less time to fail. Real Time Rail, instant payments, request to pay, and faster settlement can improve cash flow and customer experience. They also shrink the window for fraud teams to stop a bad payment before it settles.
Fraud controls become part of the payment product. Real Time Rail analysis connects instant payments with centralized fraud capability, payment finality, and trust.4 Faster money only works if participants believe the system can manage faster mistakes.
Money Starts Moving Too Fast To Chase2026
Speed is not the enemy. Unverified speed is. The more quickly money moves, the more trust has to be built before approval, not after. That shifts fraud prevention upstream into identity, behaviour, device signals, transaction context, and real time monitoring.
Institutions are not only defenders. They are targets. CIRO confirmed approximately 750,000 Canadian investors were affected by a cybersecurity incident after a 9,000 hour forensic review.5 When regulated bodies are breached, trust damage extends beyond one account.
Third party systems can carry hidden risk. SaaS vendors can create concentration risk across fintech and financial services. A startup may inherit risk through a vendor, API, data processor, onboarding tool, cloud provider, or fraud vendor it does not fully control.
Institutions Become Targets Too2025 to 2026
Trust is not only about customers proving themselves to institutions. Institutions have to prove they can protect customer data, vendor systems, transaction flows, and controls. Once a trusted organization is breached, every future message from that organization becomes easier for fraudsters to imitate.
AML failure shows how controls can become business risk. TD’s more than $3 billion US AML penalty and leadership fallout showed how weak controls can limit strategy, growth, reputation, and trust.6
Canada is trying to organize the response. Canada’s first National Anti Fraud Strategy and Financial Crimes Agency push point toward more public and private collaboration on cyber risk, data sharing, and proceeds of crime recovery.7
Controls Become A Business Model2024 to 2026
Fraud prevention is no longer back office plumbing. It is becoming product design, customer experience, regulatory readiness, operational resilience, and competitive positioning. Banks, fintechs, PSPs, crypto platforms, identity providers, regtech firms, and payment networks are all being judged on whether they can help users trust what they approve.
Learn more
This creates a hard design problem. Strong controls can stop fraud, but they can also freeze legitimate customers, slow onboarding, block payments, and make good users feel punished. Weak controls create the opposite problem. They let fraud through and damage trust after the fact.
The next generation of fraud systems will need to combine identity checks, device signals, behavioural analytics, payment context, transaction monitoring, anomaly detection, customer education, and fast recovery paths. These capabilities are already becoming part of Canada’s trust and verification innovation pipeline.
Questions worth watching
Can fraud controls become stronger without making good customers suffer?
Will fintechs compete on trust as much as speed and price?
Can public and private data sharing improve without creating new privacy risks?
Fraud didn’t break trust all at once. It weakened the signals people and institutions used to verify reality. The phone call. The voice. The face. The fingerprint. The login. The bank name. The official looking message. The settlement delay. The regulated institution. Each one still matters, but none can carry trust on its own anymore.
That’s the hard part for financial innovation. Canada is moving toward faster payments, consumer driven banking, digital identity discussions, AI adoption, crypto market controls, and more automated financial services. None of those systems succeed simply because they’re fast or digital. They succeed because people trust what they’re seeing, hearing, approving, and authorizing.
What Happens Next?
Will banks and fintechs find better ways to prove what is real without making financial services harder to use?
Will AI fraud detection improve faster than AI enabled scams?
Will voice, face, fingerprint, and device signals become supporting evidence instead of standalone proof?
Will faster payments force stronger verification before money moves?
Will consumers regain trust in calls, messages, links, and alerts from financial institutions?
Can Canada build fraud intelligence sharing that protects consumers without weakening privacy?
What Did You Think?
What trust signal do you question now that you wouldn’t have questioned five years ago?
Share this story → Explore related intelligence → Subscribe
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
It's a Canadian cybersecurity story, not a military procurement story. Lastwall works in defence, government, and critical infrastructure environments, but the announcement is about growth capital for identity first security, zero trust access, and quantum resilient protection. For NBIF, it's the largest single investment in its history through the round.
Karl Holmqvist, Founder and CEO, Lastwall:
“We proved our model in the world’s most demanding federal market. We earned FedRAMP Moderate Authorization, secured U.S. government systems, and built a platform for the realities of modern cyber warfare. Now, we’re bringing those trusted capabilities home to help strengthen Canada’s cyber resilience at a defining moment for national security.”
Identity Security Is Critical Infrastructure
Lastwall secures access across cloud, hybrid, disconnected, and low bandwidth environments. It's important for energy, telecom, transportation, defence, government, and public sector systems where a failed login layer can become an operational risk.
The product focus is identity, authentication, credential protection, privileged access, and zero trust controls. Lastwall also says quantum resilient protection is built into the platform, which is key for systems that need to stay secure beyond the current threat cycle.
For fintechs and financial institutions, digital identity and access control are now resilience infrastructure. Fraud, account takeover, insider risk, cloud access, vendor access, and critical system protection all depend on knowing who is connecting, from where, and under what conditions.
Peter Dawe, BDC’s Vice President of Defence Strategy and a recently retired Major General, joined Lastwall’s board as part of the financing. That gives the company closer defence and sovereign capability expertise as Canada looks for more domestic cyber capacity.
Canada’s cyber resilience gap isn't only about monitoring threats. It's also about securing access to the systems that run public services, financial infrastructure, energy, communications, and national security. Canada’s new cyber law and PSP oversight are already raising the bar for security, resilience, and vendor accountability. Lastwall’s funding shows Canadian capital is starting to treat identity security as a sovereign capability, not just another software category.
Talking Point
Can Canadian cybersecurity firms turn U.S. federal proof into domestic critical infrastructure adoption before cyber resilience becomes a procurement emergency?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. 
