Karsten Wenzlaff, Advisor
August 26th, 2025
August 25, 2026 | NCFA Insight | Treasury Liquidity And Cash Management, Payments Infrastructure And Money Movement, Cross Border Payments And FX

On August 25, 2026, Royal Bank of Canada created a RBC Global Transaction Banking business spanning Commercial Banking in Canada and the United States and RBC Capital Markets. Payments, cash and liquidity management, working capital, trade finance and foreign exchange will operate under shared leadership and one strategy.
Most of the products already existed. RBC is changing how it organizes, develops and sells them. RBC Edge serves Canadian cash management clients and RBC Clear serves the U.S. market. The bank hasn't said the two platforms will become one system.
When a business collects money, makes payments, holds cash, converts currencies and borrows through the same bank, that relationship can produce payment fees, operating deposits and more financing opportunities. RBC is trying to make more of those services work as one relationship across borders.
RBC explicitly links transaction banking to deposit growth. By the end of fiscal 2025, RBC Clear U.S. transaction banking had attracted US$23 billion in deposits from more than 180 clients, up from about US$9 billion and 100 clients earlier that year. RBC's medium term target is US$50 billion.
Operating deposits are useful because businesses need money available for payroll, suppliers, collections and other daily obligations. RBC can use those balances as funding elsewhere in the bank while earning fees from payments and treasury services.
BMO shows how significant that combination can become. At its March 2026 Investor Day, BMO Treasury and Payment Solutions said it served more than 138,000 businesses and had processed $68 trillion in payments during the previous fiscal year. The business represented roughly 40% of BMO's deposits and about 10% of fee revenue.
For banks, the prize isn't just the payment. It's the cash before and after the payment, the foreign exchange required across markets and the financing a business may need later.
Businesses don't have to replace their primary bank to give part of the relationship to somebody else. Payments, foreign exchange, cards, payables and finance software can all be purchased separately while the main operating account stays where it is.
Canadian payment data shows where demand is strongest. Payments Canada SME payment research found 69% of small and medium-sized businesses would use real-time payments to send money and 66% would use them to receive money if available. Payment delays were their most common payment problem, followed by cash flow management.
A separate 2025 Canadian business payments survey found 60% planned to increase fintech use, 77% were prioritizing real-time payments and 53% expected to move from traditional payment methods toward digital ones.
This means payments are a practical entry point for fintechs. A company can solve a visible problem such as supplier payments, international transfers or reconciliation without asking the customer to move its entire banking relationship.
| Provider | What It Brings Together | Where It Can Win |
|---|---|---|
| RBC | Payments, deposits, cash management, FX, trade and working capital | Large relationships, lending capacity and cross border banking |
| BMO | Treasury, payments, deposits and embedded banking | North American treasury and business banking |
| Airwallex business payments and FX | Multi-currency accounts, payments, FX, cards and bill pay | Businesses managing money across countries and currencies |
| Float business finance platform | Accounts, cards, payments, FX, credit and finance automation | Canadian finance teams that want banking and software together |
| Dream Payments real-time payouts | Payment controls, supplier onboarding and payouts | Payments built directly into business software |
Customer survey and behaviour data suggests the relationship can already break apart product by product. Canadian bank switching reached a 20-year high in 2025, with 24% of Canadians choosing a new financial institution when opening an account. Another Canadian financial loyalty survey found 62% would be open to switching if the process were easier, while 35% identified switching hassle as a barrier.
Canada's new financial infrastructure can lower the friction of using several providers. Proposed Canada Open Banking and Consumer Driven Banking Rules establish the framework for consent-based financial data sharing, authentication and security.
The Canada open banking commercialization roadmap shows what that can mean commercially. Read-only data sharing can support cash flow dashboards, account comparison, switching and easier onboarding, while later payment initiation can open more room for embedded credit, payments and real-time treasury services. The competitive effect isn't only easier switching. It's easier unbundling, because a business can use better tools from another provider without first moving its main operating account.
A business could keep its core banking relationship with RBC while using another provider for foreign exchange, payables, treasury analytics, cards or financing. Better data access makes those services easier to connect. The primary bank doesn't have to lose the customer to lose part of the relationship.
The payment side is changing too. Canada's Real-Time Rail access rules create new participation routes for eligible payment service providers as Canada prepares for instant, data-rich payments. Payments Canada research already highlights strong SME demand for faster payments. RBC did not say that the new global transaction banking structure is connected to the rail, but banks and fintechs will eventually be building products on more capable payment infrastructure.
The NCFA Financial Innovation Map separates payments, treasury, embedded finance, business banking and open finance into different markets. Customers won't necessarily make the same distinction. A business wants to get paid, see its cash, pay suppliers, exchange currencies, borrow when necessary and keep the records straight.
RBC's scale still gives it advantages fintech specialists can't easily reproduce. It can combine deposits, lending capacity, treasury services, foreign exchange and large corporate relationships inside one regulated institution. For companies operating in both Canada and the U.S., making those services work smoothly together could be especially valuable.
But product-by-product competition changes what RBC has to defend. A client may keep its operating account while moving international payments to one provider, cards to another and treasury software somewhere else. Each piece that leaves takes fees, data and customer activity with it.
Fintechs don't necessarily need to replace RBC to win. Payments offer an early opening because businesses already want faster and more automated ways to move money. Open banking can make outside tools easier to connect. Better real-time infrastructure can widen the number of companies able to build around the payment itself.
RBC's Aug. 25 reorganization is about more than putting existing teams under common leadership. The bank is trying to make payments, cash, FX and financing work well enough together that businesses have fewer reasons to peel those services away one at a time.
As open banking makes financial data easier to share and real-time payments give businesses more ways to move money, can RBC keep more of the corporate relationship by connecting payments, cash, FX and financing, or will fintechs keep winning those services one product at a time?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
August 10, 2026 | NCFA Companies On The Move | Digital Banking And BaaS, Competition And Market Structure

On August 10, 2026, Revolut secured a French banking licence from the ACPR and European Central Bank. France will become Revolut's second EU banking base alongside Lithuania, with Germany, Ireland, Italy, Portugal and Spain expected to follow.
Revolut enters this phase with more than 75 million customers and $6 billion of 2025 revenue. It is also building licensed banks in several major markets, which changes the competitive significance of its renewed interest in Canada.
Revolut's 2025 results show a business well beyond its original foreign-exchange and card proposition. Revenue rose 46% to $6.0 billion, profit before tax reached $2.3 billion and net profit was $1.7 billion. Customer balances reached $67.5 billion.
Eleven product lines generated more than £100 million each. Card payments produced $1.3 billion of revenue, wealth $876 million and foreign exchange $800 million. Revolut Business accounted for 16% of group income.
Credit is becoming substantial enough to change the risk profile. The loan book grew 120% to $2.9 billion across personal loans, credit cards and an early mortgage portfolio, while commercial real estate lending has extended the company into more specialized credit.
Private-market pricing has climbed with the operating results. Revolut completed a secondary transaction at a US$75 billion valuation in November 2025. A new secondary sale confirmed in July 2026 is reportedly pricing the company at US$115 billion. The current sale has not been announced as completed.
The French licence divides Revolut's European banking structure more deliberately. Lithuania remains the banking base for much of the European Economic Area, while the French entity will take responsibility for six Western European markets with roughly 30 million Revolut customers.
Revolut completed the next stage of its UK banking licence in March, launching the bank for a domestic customer base of 13 million after receiving the licence in 2024 and completing its mobilisation period.
Mexico began full banking operations in January, and Australia became its first licensed bank in Asia-Pacific in July.
Revolut moved toward a standalone U.S. banking licence in January and formally applied for a national bank charter in March.
Owning more of the banking infrastructure gives Revolut greater control over deposits, credit, payments and pricing. It also requires more local capital, compliance and operating capacity. In Western Europe, Revolut has committed more than €1 billion to the new regional structure and plans to build its headquarters in Paris.
Revolut's renewed Canada strategy follows an earlier attempt built around prepaid cards and foreign exchange. The company entered a limited Canadian beta in 2019 and withdrew in 2021 without establishing a domestic banking presence.
Jan Pilbauer was appointed to lead Revolut Canada in 2025 after senior roles at Payments Canada and the Bank of Canada. Revolut has described Canada as attractive but remains early in its evaluation. It hasn't announced a launch date, and there is no public evidence of a Canadian bank licence application.
The regulatory setting has changed too. OSFI's Streamlined Approvals Framework creates a clearer federal route for eligible innovative banking models, while consumer-driven banking could reduce data-access barriers once regulated sharing is operating.
Revolut would also be operating a different business. A payments and FX app would add another fintech option. A Canadian operation spanning deposits, credit, wealth and business banking would compete for much more of the customer relationship.
Italy offers a recent reminder that localization cuts both ways. In April, the country's competition authority fined Revolut entities more than €11 million over investment disclosures, account restrictions and information concerning Italian IBAN availability.
The Italian action touched the same customer-treatment and localization issues Revolut has to manage as more markets gain their own banking entities. Revolut disagreed with the findings and said it would appeal.
Revolut now has the customers, earnings and product breadth to compete much more directly with established banks. Its French licence shows how much regulatory infrastructure that ambition requires. A Canadian return would reveal whether Revolut is prepared to build the same depth here.
Nik Storonsky and Vlad Yatsenko launched Revolut in London around spending, transfers and foreign exchange.
Revolut
Mobile financial technology company
Launch
Initial consumer product
Early Venture
Outside funding follows early adoption
UK First
International spending and transfers
Consumers
Customers seeking cheaper international money use
Banks And FX
Digital alternative to bank foreign-exchange pricing
A narrow international-spending problem gave Revolut an entry point before it asked customers to use the app for more of their finances.
Information notice: Private-company estimates are identified and attributed. Information may change after the stated update date. This content is provided for informational purposes only and does not constitute investment, financial or legal advice.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
August 6, 2026 | NCFA Market Activity | Open Banking Open Finance And Data Sharing, Identity Privacy And Data Governance, SME Finance And Business Banking

On August 6, 2026, Yapily expanded bank account verification for Google Cloud customers across 11 European markets.
Businesses in Germany, France, the Netherlands, Spain, Portugal, Lithuania, Italy, Belgium, Austria, Ireland and Sweden can now confirm a bank account during onboarding through a direct bank connection instead of submitting documents for manual review.
The optional service builds on an account-verification arrangement first announced in 2025. Google can now use one Yapily connection across the selected markets rather than maintaining separate document checks in each country.
Businesses can verify a bank account without uploading documents and waiting for someone to review them.
Business account verification often requires a bank statement or another document showing the account holder’s name and banking details. Staff then review the document and compare it with the information submitted during onboarding.
Yapily replaces that exchange with permissioned information received from the customer’s bank. The company says Google Cloud customers can confirm a business bank account and receive a result in minutes.
The service can return account-holder and identity information, account numbers and other bank-sourced data from consumer, business and corporate accounts. The information available and the authentication process may still vary by bank and market.
The immediate benefit is lower administrative cost. Faster verification can reduce manual review and limit document errors. It may also keep a qualified customer from abandoning onboarding while a bank statement waits for approval.
Banks provide the underlying APIs, but most businesses will not connect separately to every institution. They will usually reach open banking through an infrastructure provider or software that has already built the connection into a business task.
Yapily connects to banks and handles differences in authentication, consent, data formats and market coverage. Google places the verification step inside its own onboarding process. The customer sees a faster way to confirm an account, not a separate open banking product.
The same structure can support verification, lending, accounting, payments and treasury workflows. A business may use open banking without choosing an open banking provider or even seeing its name.
Direct bank data inside SME finance software is already taking a similar route in Canada. Adoption grows when bank connectivity is built into software businesses already use.
Google controls the onboarding experience and the customer relationship. Yapily supplies the bank connectivity and verification infrastructure behind it.
That split can work for both sides. Google removes a manual step without building bank connections market by market. Yapily gains enterprise volume and proof that its network can support a large international customer.
A similar division of roles appears where Jack Henry embeds Google Cloud technology inside bank operations. Google provides the underlying infrastructure, while the company closest to the financial institution controls the workflow and customer relationship.
The Yapily arrangement shows where commercial power may settle as open banking becomes embedded. The infrastructure provider can be essential while the software platform controls distribution, product placement and the customer experience.
There is no public evidence that the Google-Yapily arrangement is exclusive or restricts competing providers. The issue is whether specialist infrastructure firms can retain pricing power when their services sit behind much larger platforms.
One Yapily integration simplifies Google’s side of the process. It does not, however, make European bank connectivity uniform.
Verification still depends on the quality of each bank’s API, the information it returns and the authentication process available in that market. Some institutions or account types may not support every field needed to complete the check.
Yapily says it connects to more than 2,000 banks across 19 European markets. Its documentation describes the broader Validate service as being in private beta. The Google Cloud rollout shows a live enterprise use, but it does not mean every applicant will receive the same experience across every bank.
Enterprise customers will care less about the size of a country list than the percentage of applicants who complete verification without falling back to manual review. Successful verification rates, exception handling and bank coverage will determine how much time the workflow saves in practice.
Google Cloud’s rollout shows where open banking is heading. The bank connection disappears into onboarding, while the customer experiences one less document request.
As open banking disappears into business software, how much of the value will remain with the infrastructure provider behind the connection?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: [www.ncfacanada.org](http://www.ncfacanada.org)
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
August 5, 2026 | NCFA Market Activity | Wealth Investing And Trading, Embedded Finance, Competition And Market Structure

On July 20, 2026, Chime launched Chime Invest inside the app its members already use for deposits, spending, savings and credit. Members can buy US stocks and exchange traded funds from US$1 or choose a managed portfolio. Neither option has an account minimum.
Chime didn't build the regulated investment stack itself. Atomic Invest provides portfolio advice, while Atomic Brokerage executes and holds the investments. Self directed trades carry no commission, although other charges may apply. Annual managed portfolio fees are zero for Chime Prime members, 0.10% for Chime Plus and 0.25% for standard members.
On August 3, Allied Universal added Chime Workplace for a North American workforce of approximately 320,000 employees. Chime says Workplace includes investing alongside earned wage access, savings and credit building. The workforce figure describes potential reach. It isn't an enrollment count, and the announcement doesn't say employees will be automatically enrolled in Chime Invest.
Chime is a financial technology company, not a bank, broker or investment adviser. The Bancorp Bank and Stride Bank provide its banking services. Chime Invest sits outside that deposit relationship. Atomic Invest is an SEC registered investment adviser, and Atomic Brokerage is a registered broker dealer and SIPC member.
The partnership lets Chime enter wealthtech without carrying every licence, control and operating function inside its own company. It also creates a commercial incentive. Chime receives compensation based on assets referred to Atomic, so it benefits when members open and fund investment accounts. The product disclosure identifies that incentive as a conflict users should understand.
Chime brings something Atomic doesn't have on its own though, which is a frequent consumer relationship. The company says an average member opens the app five times a day and completes more than 50 transactions a month. Investing now appears beside the account where many members already receive pay, spend and save. That lowers the effort required to try investing, although it does not establish that members will fund accounts or keep investing.
Investment accounts are not deposits. They can lose value and do not receive FDIC insurance. SIPC protection applies through Atomic Brokerage within its limits, but it does not protect investors from market losses.
Chime bought Salt Labs in June 2024 for its employee rewards technology and employer relationships. It launched Chime Workplace in March 2025, then connected the service to Workday and UKG. Allied Universal gives that channel one of its largest disclosed partner workforces so far.
The entry product is MyPay at Work. Eligible workers direct their pay to a Chime account and can request an advance against verified earnings. From there, Chime can offer savings, credit and investing inside the same app.
Chime doesn't charge Allied Universal or its employees to make Workplace available. Some optional products can carry fees or charges. With no employer fee, the economics depend on workers enrolling, directing pay into Chime and continuing to use its products.
Useful benchmark for this strategy First Student is North America's largest school transportation provider, with 66,400 employees and operations across the United States and Canada. It joined Chime Workplace in the first quarter of 2026 and provides Chime an early usage benchmark among a large frontline workforce. Chime reported in the Allied Universal announcement that 46% of actively enrolled First Student employees began saving within two months. Among those savers, 76% kept contributing. The figures apply only to active enrollees, not First Student's full workforce, and Chime has not published comparable Workplace investment adoption.
Chime starts with pay, spending and savings before offering investments. Robinhood is building household finance outward from trading through managed investing, family accounts, cards and other products. SoFi combines lending, deposit accounts and investing, while earned wage providers concentrate more narrowly on access to pay.
Distribution determines which app gets the first chance to turn income into spending, savings, borrowing or investment assets.
Chime entered this rollout with 10.2 million active members at March 31, 2026. First quarter revenue reached US$647 million, up 25% from a year earlier, and the company reported US$53 million in net income. It also signed four new employer partners during the quarter, including First Student. Chime's second quarter results are scheduled for release after the market closes on August 5 and were not available when this article was verified. The 2025 fintech IPO class also included Circle, eToro and Klarna, giving investors several financial platform models to compare.
Stakeholders should monitor Allied Universal enrollment numbers. Direct deposit conversion, sustained savings, funded investment accounts and assets held through Atomic will show whether Chime can extend an everyday financial account into wealth management.
Can Chime turn frequent spending and payroll relationships into funded investment accounts, and can its employer channel bring that model to people who haven't used a wealth app before?
Chris Britt and Ryan King founded Chime in 2012. The company built a mobile financial account around direct deposit, card spending, early pay and fewer consumer fees.
ChimeA consumer financial technology company
FormationA mobile alternative to traditional bank accounts
Venture BackedPrivate financing supports product and member growth
United StatesConsumer banking and payments
Everyday EarnersPeople seeking simpler access to pay and spending
Banks And FintechsPrice, convenience and trust drive adoption
Direct deposit gave Chime a recurring place in a member's financial life. That primary account position later supported credit, liquidity and savings products.
Chime Invest adds US stocks, exchange traded funds and managed portfolios to the main Chime app. Members can begin with US$1, and neither investment option has an account minimum.
Atomic Invest provides the managed portfolio advice. Atomic Brokerage executes and holds the investments. Chime promotes the service and receives compensation based on assets referred to Atomic.
Chime says self directed stock and exchange traded fund transactions carry no commission, although other charges may apply. Managed portfolio fees are zero for Chime Prime members, 0.10% annually for Chime Plus and 0.25% for standard members.
Chime lists investing among the tools included with Chime Workplace. The Allied Universal announcement does not confirm automatic enrollment, immediate investment access for every employee or how many workers are eligible.
No. Chime is a financial technology company. The Bancorp Bank and Stride Bank provide its banking services. Chime Invest is a separate investment service provided through Atomic.
Chime describes Chime Invest as a product for eligible US members. The Allied Universal announcement refers to a North American workforce but does not confirm Canadian investment access.
This article is provided for informational purposes and does not constitute investment, financial or legal advice. Product availability, eligibility, fees and terms may change. Company adoption figures are attributed to Chime and should not be treated as independently audited results.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
July 28, 2026 | NCFA Market Activity | Open Banking Open Finance And Data Sharing, Payments And Money Movement, Competition And Market Structure

On July 28, 2026, Credit Connect reported that UK open banking passed one billion cumulative payments and 100 billion cumulative API calls across the CMA9 banks. Both totals cover more than eight years of activity.
The report directly quotes Open Banking Limited CEO Henk Van Hulle. A matching announcement wasn't available in Open Banking Limited's newsroom when this article was prepared, so the cumulative totals are attributed to Credit Connect.
Open Banking Limited's June performance data also shows what the system's baseline is for a single month. It recorded 2.8055 billion successful API calls, a 99.50% success rate and an average response time of 349 milliseconds. Credit Connect reported that API use rose 4.4% from May and response time improved by 50 milliseconds.
June also produced 40.16 million successful open banking payment initiations. Single domestic payments declined 1.2%, while Variable Recurring Payments increased 6.7%.
The cumulative milestone gets attention, but the monthly numbers say more about the current market. Banks are processing billions of API requests while third party providers initiate more than 40 million payments a month. Open banking now supports regular payment activity alongside account information services.
The figures describe different parts of the system. An API call is a request between an authorized provider and a bank. A payment is a successful payment initiation. Open Banking Limited also reports more than 19 million active user connections, but those connections aren't deduplicated individuals. The same customer may be counted through more than one provider or brand.
Payment use has been building quickly. The FCA's 2025 open banking progress report recorded 53% year over year growth in open banking payments. Variable Recurring Payments accounted for 16% of open banking transactions at that point.
The UK now has a functioning base for account to account payments. Banks supply the required APIs, fintechs build payment services and merchants decide whether the cost and customer experience compare favourably with cards and Direct Debit.
Variable Recurring Payments are relatively new to the UK market. UK open banking update tracked approximately 3.7 million VRP transactions in March 2025, along with more than 240 regulated third party providers. It also cited a UK Finance estimate that recurring payments could save merchants approximately £1.5 billion a year.
The July numbers show continued use while the industry develops commercial VRP beyond transfers between a customer's own accounts. Customers can authorize businesses to initiate repeat payments within agreed limits without approving every transaction separately.
On June 2, 2026, the FCA supported the launch of the UK Payments Initiative, an industry operated scheme for commercial Variable Recurring Payments. The FCA expects other commercial schemes to compete with it.
The initiative has substantial industry backing. In 2025, 31 participating firms, including banks, fintechs and payment providers, agreed to fund the initial operator. Proposed uses cover utilities, rail, government agencies, charities and regulated financial services.
The remaining question is how the economics are divided. Banks incur costs to provide premium APIs, while payment providers need pricing low enough to compete for merchants. In January 2026, the FCA and Payment Systems Regulator said they wouldn't prioritize a competition investigation into the proposed centralized access fee model at that stage.
The one billion payment total gives the industry a larger customer base on which to build. It doesn't determine who captures the revenue. Banks may charge for premium access, payment firms may win merchant distribution and software platforms may package recurring payments into billing, treasury and account management products.
The original open banking system was built around a market competition order applied to nine large banks. Commercial schemes now bring more providers, products, pricing agreements and customer relationships into the system.
The FCA expects a new Future Entity to set common API standards, monitor performance, oversee certification and support commercial schemes. Its role will influence whether payment providers receive consistent access across participating banks.
The UK payments playbook connects commercial VRP delivery with retail payment rules, Faster Payments improvements and the future regulatory structure for open banking.
Reliability is already measurable. June's weighted API availability reached 99.80%, while successful calls reached 99.50%. Those averages are interesting, although a customer experiences the individual bank connection used for a particular service or payment.
Fraud still remains part of the operating model. Open Banking Limited's fraud monitor found that roughly one in 6,000 open banking payments was fraudulent in 2025, compared with one in 2,500 across the wider payments industry. Authorized push payment fraud accounted for more than two thirds of reported open banking fraud cases.
The direct Canadian relevance is the connection between data access and payments. Canada is developing consumer driven banking, payment system participation and future write access through separate rules and institutions. The UK experience shows where those files eventually meet through commercial pricing, recurring payment permissions, technical standards, liability and scheme governance.
As commercial VRP expands, who should control access pricing and liability when banks, fintechs and merchants all depend on the same connection?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |

We're opening up more and more APIs to partners, fintech services, and client applications. The only question is whether we're confident these same APIs aren't opening up new paths for attackers.
Just a few years ago, a bank mostly dealt with its own systems. A customer would log into the app, check their balance, make a transfer. The whole journey stayed inside the perimeter of a single organization.
Today, one customer might simultaneously use a mobile banking app, a budgeting service, an accounting platform, a payment provider, and an AI assistant that analyzes their spending. All of these services exchange data through APIs - interfaces that let different systems talk to each other according to a set of established rules.
Open Banking isn't just a regulatory requirement or a new integration channel - it's a shift in the trust model itself. A bank used to be responsible for security within its own infrastructure. Now it hands off part of its data to dozens of external services, and those services, in turn, rely on the bank. The more participants in the ecosystem, the more points there are where trust is either reaffirmed or cracked, every single day.
Attackers are less and less interested in finding a weak spot inside any one bank. Today, hackers target the interaction between systems itself. The longer the chain - bank, fintech, payment hub, partner app - the more places there are for something to go wrong.
Common examples include:
An API can perform flawlessly on the functional side - fast, stable, no errors in the logs - and still carry a critical vulnerability. Functional correctness and cybersecurity don't always go together.
Banks and fintech companies generally don't neglect API security. They go through certifications, run automated scans, do code reviews and QA. But none of these tools answer the one question that matters most: can this specific API's logic be bypassed in a way its developer never anticipated? Scanning catches known vulnerability patterns; code review and QA confirm the code does what it was built to do. Neither one thinks like an attacker who isn't hunting for a bug in the code, but for a logical gap in how the API interacts with other systems.
That's why most attacks on financial APIs today aren't about technical mistakes - they're about logic: the sequence of actions, the boundaries of authority, the trust placed in data coming from the client. It's also why modern Cybersecurity Solutions for Fintech increasingly go beyond formal compliance with standards, testing real-world abuse scenarios at the points where multiple systems meet.

Here's a short checklist for reviewing every external API in your ecosystem:
If you don't have a confident answer to any of these, that's reason enough to look closer.
It's worth telling apart three things that often get lumped together. Vulnerability scanning looks for known vulnerabilities by signature, catching familiar vulnerability classes, common misconfigurations, and known dangerous patterns. Automated testing checks whether the code performs its intended functions correctly. Separate from both is API Penetration Testing (https://datami.ee/services/pentest/api-penetration-testing/) - manual testing in which a specialist plays the role of a real attacker: combining requests, tweaking parameters, hunting for unusual sequences of actions that a scanner, in most cases, won't flag as anomalous, because each individual request looks legitimate on its own.
It's also best if this kind of testing is handled by an external team. In-house specialists tend to know their own API inside and out - and that's precisely what makes it hard for them to spot an unconventional abuse scenario, since day-to-day work with a system's logic doesn't train you to look at it through the eyes of someone deliberately trying to break it. External specialists bring experience from other architectures and payment integrations, so they're more likely to catch the gaps a team had written off as unimportant.
A bank can offer the most convenient digital service and the best partner API on the market. But if even one partner or customer stops trusting the security of the data exchange, the benefits of Open Banking vanish almost instantly. Trust here isn't a bonus feature - it's the baseline condition, and without it the whole structure loses its meaning.
That's why investing in API protection in the financial sector isn't just about regulatory compliance - it's about sustaining trust across the whole ecosystem: between bank and fintech, fintech and customer, and customer and every new service they let into their data.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |