Karsten Wenzlaff, Advisor
August 26th, 2025
Karsten Wenzlaff is a Crowdfunding and Fintech Expert from Germany. He is Secretary-General of Digit[...]
Category Archives: Digital Identity, Privacy, KYC, AML/ATF
Is AI Going to Change Fintech Security?
Jun 17, 2024
Image: Freepik
Artificial intelligence has experienced unprecedented growth in the last few years, turning what was once a sci-fi concept into reality. This technology has been injected into almost every industry to streamline processes and automate tasks, and the fintech sector is no exception.
Modern financial systems have always relied on technological advances to bolster security and introduce new features. With AI opening new avenues, many are wondering: will AI change fintech security?
AI in Fintech
In its simplest form, the answer to this question is that AI has already changed the face of fintech security. Many companies within the sector have already employed AI to beef up security and help identify risks before hackers or thieves act.
There are numerous ways in which AI is being used, with those listed below being the most common.
Know Your Customer (KYC) Verifications
One of the most basic security measures in fintech transactions is customer verification. Often called Know Your Customer, this process involves verifying the information provided by a client by cross-referencing it with official identity documents.
AI is often equipped with optical character recognition (OCR), which enables the AI to read scanned documents. This streamlines the process of verifying if the papers provided by a customer match the information they supplied.
Implementing AI in this process improves the verification speed, but, more importantly, it boosts efficiency by removing the human error factor and preventing verification whenever the information does not correspond.
Attack Detection
According to a 2023 report by Sophos, approximately 64% of financial institutions surveyed were attacked with ransomware in 2022. Ransomware, among other attacks, is a constant threat to companies operating in the fintech sector, with hackers eager to access confidential financial information.
To mitigate the risks of being attacked, many fintech suppliers install AI that analyzes the vast amounts of data sent and received from company networks and servers. This analysis occurs in real time and can quickly identify suspicious patterns and activities.
Anything flagged by AI algorithms can be reported to security personnel to investigate and act on before an attack is launched or a vulnerability is exploited. This helps reduce the fallout from attacks and shows security teams where to bolster their defences.
Fraud Prevention
Aside from cyberattacks, fraud and money laundering are among the most prevalent threats within the fintech sector. These refer to criminal organizations using services to mask (or clean) their cash earned through illicit activities and make it appear as though it is from a legitimate source.
While companies in the fintech industry have always employed measures to identify and block these transactions, these have never been foolproof. With AI, the detection of money laundering is more precise and effective, limiting criminals’ chances of achieving their goals.
AI equipped with machine learning is trained to identify and raise the alarm on suspicious transactions, including attempted account takeovers, money funnelled through multiple channels, and large amounts of money being moved between accounts.
Automation
When money laundering, fraud, or attacks on an account are suspected, AI already alerts company security teams of the activity. However, many companies are going one step further by allowing AI to interact more extensively whenever such activities are detected.
Allowing artificial intelligence to freeze accounts and block transactions can stop many illicit activities before they are completed. This ensures the integrity of systems and prevents money from being transferred when it shouldn’t be.
However, it also allows security teams and the relevant authorities more time to investigate the circumstances surrounding the transaction. If everything is in order, the transaction can proceed, and the AI can be taught what circumstances are within allowable parameters, ensuring a false alert is not raised again.
Behaviour Analysis
Another area where AI is being employed is in tracking and building user-profile behaviour analytics. This delves into each user’s everyday practices, routines, and idiosyncrasies to help develop a standard practice profile.
When customers log into their accounts and perform transactions or activities far outside their regular behaviour patterns, AI can quickly identify them and alert the fintech operator or take proactive steps (as mentioned above) to protect the account.
Once verification has been performed to ensure that the user in the account performing the activities is the authorized person, services can resume. As with automation, this can assist in identifying possible account takeovers or stop activities in cases where an account’s security has been breached.
Safer Transactions
With the above roles undertaken by AI, financial technology companies are better equipped to handle cyberattacks and can more easily detect fraudulent transactions. They can do this much more efficiently and often in real time, meaning that no losses can occur that aren’t immediately noticed or prevented.
As AI secures financial transactions, other industries are also beginning to embrace it. The iGaming sector, for one, has also started using AI in a wide range of areas to ensure players are legitimate and that transactions are secure. Many sites, such as eCheck Casinos, are also using AI in their security measures to prevent attacks.
Conclusion
With corporations like Google, Meta, and OpenAI racing to create the most advanced AI technology, further roles in fintech security will undoubtedly emerge. These roles must be carefully balanced with the threats posed by AI.
These include the privacy of the massive amounts of data that AI uses, transparency as to how AI calculates things and the decision process it follows, and whether or not an AI holds any bias. The ethical issue of using AI must also be considered, with many OpenAI employees openly speaking against it.
If these risks are navigated correctly, the future of fintech security could be significantly transformed, hopefully benefiting every company in the industry and every user of fintech services.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
|---|---|---|
 |  |  |
Anonymously Access Popular AI Chatbots with DuckDuckGo AI
AI | Jun 14, 2024
Image: Freepik/rawpixel.com
Revolutionizing Privacy in AI Interactions
The well-known privacy-focused search engine DuckDuckGo just released 'AI Chat' (with a twist), their latest feature. This service offers customers a unique, privacy-focused method of interacting with AI chatbots by enabling them to access well-known chatbots while being completely anonymous.
See: Financial Privacy: SEC Launches Enormous Database Compiling All Stock Trades
This project is well aligned with the growing concern in the digital era about data security and privacy. DuckDuckGo offers useful AI services while addressing the challenge of protecting personal data by guaranteeing anonymous interactions.
- When interacting with AI chatbots, no personal information is gathered or shared thanks to DuckDuckGo AI Chat. Remember, in the AI sector, this level of privacy protection is unheard of so time to pay attention.
- Without revealing their identity, users can interact with several AI chatbots on a single platform. This facilitates easier and safer access to a variety of AI technologies.
- Users have complete control over their data, which reduces the risks privacy, data breaches, and illegal data use.
- This feature will probably persuade other tech firms to make privacy a top priority, which could result in more changes to the way AI and data privacy interact.
See: 2023 Data Privacy in North America – Year in Review
Gabriel Weinberg, CEO of DuckDuckGo, states:
"Our goal is to make the internet less creepy. With AI Chat, users can benefit from AI's capabilities without sacrificing their privacy."
Outlook
DuckDuckGo's launch of anonymous AI conversation services will help foster trust and security in digital interactions while benefiting individual users and setting a new industry norm.
Insurance Industry Sitting on Treasure Trove of Big Data, As Regulators Wrestle Data Privacy
Similar approaches to data management can also help fintech organizations to protect customer data and employ AI to drive innovation and enhance user experiences.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Credit Reference Agencies Are Coming For Your Data
Data Insights | Jun 3, 2024
Image: Freepik/Rawpixel.com
Credit Reference Agencies Are Monetizing Data Services Beyond Credit Reporting
Consumer credit information is gathered and maintained by credit reference agencies (CRAs) such as major players TransUnion, Experian, and Equifax. To generate credit reports, they gather information from multiple sources, such as financial institutions, public records, and direct customer input. Lenders, insurers, employers, and other organizations can use these reports to evaluate a person's creditworthiness, risk profile, and financial history.
See: 2023 Data Privacy in North America – Year in Review
The gathering and reporting of credit information is still the primary duty of CRAs. Nonetheless, their operations now cover a far wider ground. The focus on marketing services and data analytics represents a change from just giving credit scores to delivering all-inclusive data solutions. The application of cutting-edge technologies and the growing importance of data insights differentiate modern credit reporting methods from traditional approaches. In order to more precisely target customers, data marketing services make use of the enormous amount of data that is gathered by CRAs and other sources. To segment markets, forecast consumer behaviour, and customize marketing campaigns, they examine and make use of this data.
Trends and Insights
1. Credit reporting agencies (CRAs) now offer data marketing and advanced analytic services, which goes well beyond standard credit reporting. This development is in line with a larger trend in data monetization, which uses customer data to create new sources of income.
2. CRAs' prediction power has been greatly increased by the combination of artificial intelligence (AI) and machine learning (ML). Personalized marketing plans and more precise risk evaluations are made possible by these technologies.
3. People are becoming more conscious of the ways in which their personal information is gathered, utilized, and sold. Calls for increased transparency and control over personal data are heightened by privacy concerns.
4. To address these growing privacy gaps, regulatory frameworks are changing. Stricter guidelines on data collection and use are imposed by laws such as the California Consumer Privacy Act (CCPA) in the US and the General Data Protection Regulation (GDPR) in Europe.
See:
Insurance Industry Sitting on Treasure Trove of Big Data, As Regulators Wrestle Data Privacy
Primer on Quebec’s New Data Portability Law
Which Way Are These Businesses Heading?
- CRAs will likely continue extending their services into new markets and developing nations, providing solutions that are specifically suited to the demands and legal frameworks of those regions.
- Businesses are spending money on platforms that provide customers greater control over their data and improved access to their credit information. This includes individualized financial guidance and instructional materials.
- CRAs are now able to incorporate their data solutions into cutting-edge financial products and services because of growing partnerships with financial technology firms.
What Could Go Wrong?
- Customers may experience incorrect credit denials or increased interest rates as a result of inaccurate or out-of-date information.
- Consumer trust can be severely damaged by major privacy violations resulting from unauthorized access to or exploitation of consumer data.
- Serious fines and legal ramifications may arise from non-compliance and disregarding the constantly changing data protection standards.
Regulation
Regulators globally are examining CRAs and their data marketing services more closely, and are continually adapting privacy rules to protection participants, such as (to name just a few):
See: Protecting Financial Privacy in the Digital Age: Crafting a Stronger Framework
- The Personal Information Protection and Electronic Documents Act (PIPEDA) regulates how personal information is gathered, used, and disclosed in Canada. It makes sure that organizations have individuals' consent before collecting their data and that it is used for the intended reasons.
- GDPR protects privacy and data in the European Union.
- Californians now have more control over their personal information thanks to the California Consumer Privacy Act (CCPA).
- The Fair Credit Reporting Act (FCRA) regulates the gathering, sharing, and application of consumer data in the US.
The objectives of these legislation are to safeguard customer privacy, regulate data veracity, and establish interoperable standards. For companies to remain compliant and preserve customer confidence, they need to stay on top of regulatory developments.
Closing Outlook
Innovation is a bit like water, such that it will always find a way to trickle down. As more data is amassed and integrated with advanced analytics, AI, and ML, more sophisticated products that improve credit scoring, risk assessment, and individualized financial services will ultimately create a more agile and responsive financial ecosystem. There will be significant opportunities for fintechs to compete directly with CRAs or establish varied partnerships.
See: How Data And Technology Consulting Can Transform The Financial Sector
Consumers will have improved access to their financial information, allowing them to make better decisions and receive tailored financial guidance. Increased transparency and data accuracy can lead to more equitable credit evaluations, however there are privacy concerns and risk of data breaches which requires balanced privacy protections and regulatory monitoring. The future of CRAs must strike the balance between innovation and ethical data practices. The successful integration of CRAs into the fintech ecosystem can drive financial inclusion and spur innovation.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
The Necessity of Copyrighting Your Voice in 2024
AI Voice | Jun 3, 2024
Image: Freepik
Exploring The Necessity of Copyrighting Your Voice in 2024
As artificial intelligence (AI) technology continues to rapidly evolve, safeguarding personal and business assets has become increasingly important. One interesting question arising in 2024 is exploring how necessary it is to copyright one's voice.
What Does the Law Say?
Traditional Copyright Law
This falls back to traditional print copyright law: Copyright laws do not protect voices. When it comes to copyright protection, voices are not “fixed” in a tangible medium of expression.
See: Generative AI: A Primer On Canadian AI and IP
Rather, copyright law protects the words or sounds that might be produced by a voice, such as recorded songs or spoken performances but does not protect voices.
Right of Publicity
The right of publicity protects an individual's name, portrait, voice, and likeness for commercial purposes in many states and is the most likely legal structure that a celebrity or anyone who does not want their voice to be used commercially or without their permission.
Legal Precedent Cases
- Bette Midler vs. Ford Motor Co. -> Midler won a suit against Ford for using a similar sounding voice of Midler in a commercial, which also established that unique voices fall under right of publicity.
- Tom Waits vs. Frit-o-lay -> Waits wins case against Frito-lay for their use of a voice-over that sounds like Waits in a commercial, solidifying further that unique voices are protectable and establishing precedent for punitive components.
Why Protect Your Voice?
- For Individuals -> A unique manner of speaking is a vital part of your identity. Impersonation with fraudulent use with AI generating voices and deepfakes, it is easier now to copy a voice. When you take action to protect your voice this can prevent others from digitally manipulating it without permission.
- For work -> Businesses use different voices in branding, for example in ads and customer service. Safeguard them and keep the continuity of their unique voices, which is characteristic for sustaining and believing the brand. When hiring voice actors, companies must ensure that the voice performers are properly licensed, and that there is no breach of any law concerning the unauthorized use of the recorded material.
See: Generative AI and Major Human Rights Fintech Risks
- Biometric voice protection in fintech -> In the fintech sector, voice protection means something very specific: many fintech companies use voice biometrics to authenticate their customers. It is essential for security and anti-fraud measures to be taken in order to protect these biometric data points. Securing all voice interactions (like through AI assistants) is essential to maintain customer trust and stay compliant with data privacy regulations.
Interesting Case - AI-Made Song with Drake and The Weeknd
As an example, a popular AI-generated song called “Heart on My Sleeve" included the artificial voices of Drake and The Weeknd. Universal Music Group filed copyright takedown request for the viral song made by AI on Spotify, YouTube, Apple Music, Soundcloud and Bandcamp. Because of this, it highlights gaps in the law in terms of protecting artists against not being asked to lend their voices to AI-generated content.
Conclusion
Though you cannot copyright your voice, there is range of legal protections through the right of publicity and contract. Any public-facing digital application may be used in this way, particularly those in the fintech sector, to guarantee protection of the voice for their identity, and to also protect the biometric data and maintain trust with their customers.
See: NIST Insights: GenAI Risk Management Framework
With the continued evolution of technology and AI, we can expect the legal world at some point in the future to create additional protections for our voices and other personal identifiers as well. Stay tuned...
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Generative AI and Major Human Rights Fintech Risks
GenAI | May 28, 2024
Image: Freepik/rawpixel.com
Key GenAI Human Rights Risks That Fintech Companies Need To Mitigate
As generative AI (GenAI) technologies are increasingly being integrated into fintech companies to create unrivalled opportunities for efficiency and innovation, fintech founders need to develop responsibly and respect the most crucial human rights. B-Tech, a project of the UN Human Rights Office of the High Commissioner has published an informative paper linking these risks to the Universal Declaration of Human Rights (UDHR) in a recent report titled, "Taxonomy of Human Rights Risks Connected to Generative AI". Such risks include threats to privacy, further discrimination and bias, job displacement that leads to economic instability, and an infringement on freedom of expression and access to true information. Below are some key fintech related risks. Let's dig in...
1. Privacy and Data Protection
"No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks." UDHR Article 12
Financial technology companies are processing reams of sensitive personal data. GenAI technology enhances the data analytics, but at the same time, it risks serious threats to privacy. The greatest fears are around the deepfake abuse, unauthorized data scraping, and intrusions into the privacy of personal data.
- The capability of creating convincingly realistic fake content will implicate identity impersonation for the purposes of fraud.
- The malpractice of unapproved data scraping of personal data from social media and other sources is likely to lead to violation of privacy.
2. Prejudice and Bias
"All are equal before the law and are entitled without any discrimination to equal protection of the law." UDHR Article 7
GenAI systems can further highlight, replicate, and amplify training data bias, leading to adverse practices in credit scoring, loan approval, customer service, among others.
- AI-trained models built from biased data sets could unfairly deny loans or credit to certain demographic groups.
- Automated processes and decision making may further exacerbate the already existing socioeconomic inequalities.
3. Right to Work and Economic Stability
"Everyone has the right to work, to free choice of employment, to just and favourable conditions of work and to protection against unemployment." UDHR Article 23(1)
Potential GenAl applications in fintech may automate even repeatable jobs, thus leading to relocation of employment opportunities. This affects the economic stability and right of gainful living.
- Automation of customer service and compliance positions could see significant job displacement.
- The shift to AI-driven processes will likely expand the economic gap and truly affect a wide range of labour, not just the unskilled
4. Freedom of Expression and Access to Information (Bill of Rights Chapter Four)
"Everyone has the right to freedom of opinion and expression; this right includes freedom to hold opinions without interference and to seek, receive and impart information and ideas through any media and regardless of frontiers." UDHR Article 19
In fintech, the key is trustworthy information to support making informed decisions based on facts and reliability. AI in its current form might propagate misinformation adversely affecting trust in financial systems and fuelling the flow of incorrect information.
See: CAI’s Draft AI Framework for Human Rights
- A fake piece of financial news produced by AI could fuel market manipulation and investor confidence loss.
- Overreliance on AI for information can lead to a failure to tap multiple, diverse, and reliable sources of information.
What Could Happen If There's a Breach?
A violation of any of these human rights can lead to various forms of recourse:
- Individuals can seek redress under data protection regulations, for example, the General Data Protection Regulation (GDPR) in Europe. This regulation calls for strict privacy protections and tends to impose severely high penalties for non-compliance.
- A breach involving discrimination or bias may trigger anti-discrimination laws, which prohibit unfair treatment on the basis of race, gender, ethnicity, and other protected characteristics.
- A violation of the right to work and economic stability, employees can claim based on employment and labor laws that protect against unfair dismissals or unsafe working environments.
- Financial regulators, such as the SEC in the US have the authority to investigate and litigate fintech businesses on breaches of the financial regulations that have a consumer protection and ethical behavior conduct element.
- Most countries have human rights commissions or kinds of bodies through which the complaints filed are taken to the extent of taking any necessary measures against firms abusing human rights.
See: The Battle for Privacy in the Digital Age
- Filing of class action lawsuits can lead companies to alter unethical practices.
- Another remedy is through individual law suits for recovery of damages due to an injury suffered because of a breach.
- Negative media or influencer publicity would publicly exposed the fintech firm and it would tarnish its reputation, which would press the firm to change its practices. Advocacy groups could also have campaigns for more awareness to make companies accountable.
- Shareholders and investors pressure fintech companies to maintain ethical practices and respect for human rights, leading corporations to shift their policies and practices.
As one can see from the long list above, violated individuals and organizations have a range of channels to seek redress and hold the fintech companies accountable for human rights violations.
How to Proactively Mitigate Human Rights Risks in Fintech
Several best practices that fintech companies and financial institutions might adopt to proactively mitigate these risks of human rights.
1. Implement Ethical AI Guidelines and Conduct Regular Audits
- Adopt and enforce policies that make ethics and human rights the key considerations in the development and application of AI.
- Establish internal review boards for the AI projects to ensure that the projects are within the ethical standards and human rights principles.
- Conduct regular audits of AI systems and algorithms to prevent data from having bias or that algorithms don't further bias the data thus making unfair and discriminatory practices.
See: India Biometric Data Breach Highlights Cybersecurity Risks
- Use privacy impact assessments regularly to prevent data protection and privacy threats.
- Conduct AI operations, decision-making, and policies on the use of data in a transparent manner and publicly report on the use of AI including any measures to mitigate human rights-related risks.
2. Engage Stakeholders and Invest in Training
- Collaborate with human rights industry experts, organizations, and regulatory bodies to keep on top of best practices and evolving standards.
- Engage a diversity of stakeholders, inclusive of customers and affected communities, in the development and review of AI systems.
- Train all employees comprehensively in ethical AI practices, data privacy, and human rights.
3. Data Protection and Inclusive Innovation
- Develop strong management and data security measures to protect sensitive, personally identifiable information from potential breaches and unauthorized access.
- Put anonymization and encryption methods into place for personal data.
- Use diverse training data when developing AI solutions to reduce bias.
4. Establish Clear Recourse Mechanisms
- Stay informed of the laws and regulations in force. Adhere to industry standards and guidelines for the ethical use of AI and fintech operations.
- Prepare, develop, and implement plans to remediate any harm that has been caused by the AI system.
See: NIST Insights: GenAI Risk Management Framework
- Setup clear way to handle complaints and grievances related to the outcomes of the AI systems.
- All leaders in the company must commit to practising and ensuring an ethical corporate culture that encourages ethical behaviour, transparency, and respect of human rights.
Conclusion
Generative AI is a game-changer in fintech but it can amplify potential human rights risks. Companies big and small are advised to proactively mitigate core risks through privacy-first design, elimination of biases through culture, staff training, and ethical leadership and integrity around the processes and information within their organizations. Businesses need to embrace ethical guidelines, be subject to periodic audits, and include stakeholders in the process of building trust and responsibility in the use of AI for financial services.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Primer on Quebec’s New Data Portability Law
Data Privacy | May 27, 2024
Image: Freepik/rawpixel.com
This September, Quebec's Law 25 mandates data portability rights, impacting organizations handling Quebec residents' personal information
On September 2024, Quebec's Law 25—namely, An Act to Modernize Legislative Provisions as Regards the Protection of Personal Information—will begin, creating a sea change in data privacy regulation that governs all transactions of companies in Quebec. This law intends to increase individuals' control over their personal data and provide additional responsibilities for firms in terms of data processing, transparency, and security. With these looming changes, Law 25 is something a fintech firm must understand now to stay compliant in the future and to deter hefty fines. NCFAs industry partner, Gowling WLG has put together this handy guide called, 'The Right to Data Portability: Everything You Need to Know"
Overview
- Starting September 22, 2024, Quebec individuals will be able to request their computerized personal information in a structured, commonly used format (e.g., JSON, CSV, XML) see Right to data portability, which shall allow them to have their personal data transferred from one company to another. This requires a fintech firm to develop robust systems that enable the transfer of data seamlessly, without compromise to the security and integrity of the data. This affects organizations collecting, using, or disclosing personal information of Quebec residents.
See: The Formation of the Canadian Digital Regulators Forum and its Impact on the Digital Economy and Consumer Privacy
- Non-compliance with Law 25 can lead to severe fines, from $15,000 to $25,000,000 CAD, or up to 4% of the corporation's worldwide annual turnover, whichever is higher. That means failure to fully comply with the new regulations regarding operations for data protection can result in significant financial costs.
- Personal data may not be transmitted to a third country unless a mandatory Privacy Impact Assessment (PIA) has been carried out, the risks have been assessed, and remediation measures have been implemented. This is intended to prevent any risk of breach or misuse of that data.
- The law strengthens requirements for obtaining consent and shall be explicit, informed and collected separately from other stipulations of the general terms of use. Under these conditions, fintech companies must ensure that users are perfectly aware of how their data is going to be used and have the ability to withdraw consent at any time.
- Technological products and services should, by design, provide the highest privacy levels with an onus on the default privacy settings (in other words, 'privacy by default'. This way, it shall ensure that the data of the users is protected from the start and thus reduce any risks attributed to its collection and processing.
Takeaways for Fintech Companies
- Prepare now and ensure systems can export data in required formats
- Implement an efficient process and secure method for handling requests
- Educate and train staff on new requirements and procedures
See: 2023 Data Privacy in North America – Year in Review
- Continuously monitor compliance to avoid severe penalties
- Seek legal advice to fully understand and comply with the law
How Does Law 25 Compare with PIPEDA?
The following is an in-depth comparison of the similarities and differences between PIPEDA and Quebec's Law 25.
| Feature | Quebec's Law 25 | PIPEDA |
|---|---|---|
| Scope and Jurisdiction | Applies to organizations in Quebec and those doing business with Quebec residents, focusing on protecting residents' privacy regardless of business location. | Applies to private-sector organizations across Canada involved in commercial activities, focusing on national-level privacy protection. |
| Consent Requirements | Requires explicit, informed consent, separate from other terms of service, similar to GDPR standards. | Allows for either express or implied consent, depending on the sensitivity of the personal information being collected. |
| Data Portability | Introduces the right to data portability, allowing individuals to transfer their personal data between organizations starting September 22, 2024. | Does not explicitly provide for data portability rights. |
| Privacy by Default | Mandates the highest privacy settings enabled by default, ensuring maximum data protection from the outset. | Does not specifically mandate privacy by default settings. |
| Privacy Impact Assessments (PIAs) | Requires organizations to conduct PIAs before transferring personal data outside Quebec, similar to GDPR requirements. | Encourages PIAs but does not mandate them. |
| Penalties for Non-Compliance | Imposes fines ranging from $15,000 to $25,000,000 CAD, or up to 4% of the company's worldwide annual turnover. | Imposes fines up to $100,000 CAD for non-compliance. |
| Data Protection Officer (DPO) | Requires certain organizations to appoint a privacy officer responsible for compliance. | Does not require the appointment of a DPO, but recommends it for large organizations. |
| Right to Erasure | Introduces the right to erasure, allowing individuals to request deletion of their personal information. | Does not include a specific right to erasure, but individuals can request corrections to their personal information. |
| Private Right of Action | Empowers individuals to take legal action against businesses for privacy violations, allowing for collective actions. | Does not provide a broad private right of action. |
| Cross-Border Data Transfers | Requires PIAs to assess the equivalence of foreign data protection laws before transferring data outside Quebec. | Requires organizations to use contractual or other means to protect personal information when transferring it to a third party. |
What About A National Standard?
While Quebec's Law 25 is currently specific to the province of Quebec, there is growing momentum for similar privacy protections to be adopted across Canada.
See: Analysis: Does Bill C-27 Reflect Lessons Learned from Past Public Outcry? Data Sharing for Public Good
The federal Bill C-27, which includes provisions for a new Consumer Privacy Protection Act, signals an ongoing effort to enhance data privacy nationwide. If adopted, these regulations could harmonize with Quebec's stringent standards, setting a unified framework for data protection across the country.
Looking Ahead
For organizations operating in the fintech space, it is important to remain aware of the law and how it is evolving in order to ensure full compliance for the protection of the data of their users. This will raise consumer trust in the economy and yield a safer and more transparent digital environment.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
TD Bank’s Money-Laundering and Bribery Scandal
AML/AMF | May 6, 2024
Image: Freepik
Amidst escalating scrutiny, TD Bank finds itself embroiled in a high stakes money-laundering scandal, sending shockwaves through the financial world.
The US Department of Justice's is investigating TD's role in facilitating illicit fentanyl profits intensifying apprehensions regarding the bank's compliance practices. The allegations, involve the bank's ties to a US$653 million drug money-laundering case sparking concerns among investors, regulators, and industry observers globally.
According to Gabriel Dechaine, National Bank of Canada analyst, the investigation by the U.S. Justice Department is centered on allegations that Chinese drug traffickers utilized TD Bank, reportedly resorting to bribing TD employees in the process. According to Dechaine, the collective fines may reach a staggering $2 billion. Additionally, regulators may impose constraints, such as limitations on balance sheet expansion, potentially impacting the bank's operations over an extended period.
See: Canadian Banks Face Scrutiny Over Sustainability Claims
TD's market capitalization plummeted by approximately $10 billion since the revelations surfaced. The sharp decline in stock prices underscores investor anxieties and underscores the imperative for robust risk management and regulatory compliance within the financial sector.
Elizabeth Goldenshtein, TD Bank Spokesperson:
"Criminals constantly seek to use banks to launder money. Regrettably, our U.S. (anti-money laundering) program did not effectively thwart these activities. This is unacceptable, and we must and we will do better,"
Despite the turmoil, TD's leadership has acknowledged the gravity of the situation and pledged to bolster its anti-money laundering (AML) controls through substantial investments in personnel and technology. CEO Bharat Masrani's commitment to fortifying the bank's compliance infrastructure reflects a proactive stance in addressing regulatory lapses and restoring stakeholder trust.
Outlook
Looking ahead, TD's efforts to rectify its compliance deficiencies and rebuild its reputation will be closely scrutinized. The bank's ability to implement robust AML controls, foster a culture of accountability, and navigate regulatory challenges will shape its trajectory and impact the broader financial ecosystem.
See: Revolutionizing Anti-Money Laundering: Insights from Project Aurora
For fintech stakeholders, it's critically important to have adequate compliance measures and proactively manage risk. As regulatory scrutiny intensifies and market dynamics evolve, fintech entrepreneurs and investors must remain vigilant and adapt accordingly.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
