Karsten Wenzlaff, Advisor
August 26th, 2025
Cybersecurity | January 14, 2026

Image: Freepik/macrovector
On January 14, 2026, the Canadian Investment Regulatory Organization confirmed that approximately 750,000 Canadian investors were impacted by the cybersecurity incident first detected on August 11, 2025, as detailed in its update on unauthorized access to some Canadian investors’ data. CIRO said the confirmation follows the completion of more than 9,000 hours of forensic examination to determine the full scope of the incident.
CIRO first disclosed the cyber incident publicly in August 2025, with early findings focused on registration information connected to member firms and registered individuals. NCFA covered those initial disclosures, CIRO cyber breach puts spotlight on regulatory security, when they were made public in September 2025. Now after
CIRO stated that the breach resulted from a phishing attack and that investor information copied from its systems may have included dates of birth, phone numbers, annual income, Social Insurance Numbers, government issued identification numbers, investment account numbers, and investment account statements.
CIRO confirmed that it doesn't collect account login credentials such as passwords, security questions, or PINs, so at least that information wasn't exposed.
According to CIRO, the investor information was collected in the normal course of its investigative, compliance assessment, and market regulation work carried out under its investor protection mandate.
On August 11, 2025, CIRO detected a cybersecurity incident and shut down certain systems as a precaution while beginning an investigation.
On August 18, 2025, CIRO publicly disclosed the incident through its announcement on detecting a cybersecurity threat and confirmed that critical regulatory functions continued to operate.
On September 2025, CIRO confirmed that registration information for member firms and registered individuals had been affected and began notifying registrants directly, as outlined in its updates on CIRO cybersecurity incident updates.
On January 14, 2026, CIRO confirmed that approximately 750,000 investors were impacted and began issuing notification letters to affected investors by email or regular mail. CIRO stated that the January disclosure reflects the final findings of the forensic review and confirms the full extent of the data involved.
Notification letters to impacted investors are being sent by CIRO starting January 14, 2026, and are being delivered by email or regular mail, as explained on its page covering information for investors affected by the cybersecurity incident.
Affected investors are being offered two years of credit monitoring and identity theft protection through both major Canadian credit bureaus. CIRO said there is currently no evidence that the compromised information has been misused and that it continues to monitor for malicious activity, including the dark web.
This latest update materially expands the known scope of the CIRO cyber incident. Earlier disclosures focused on registrant data and regulatory systems. Hundreds of thousands of investors were affected, a significantly larger scale of exposure.
CIRO said that it notified law enforcement and relevant privacy authorities and retained external cybersecurity and forensic specialists to support its investigation. The regulator also acknowledged that a proposed class action has been filed in Quebec Superior Court in relation to the breach, adding a legal angle to the story that will no doubt continue to unfold together with remediation efforts. One might ask why were the disclosures phased, but the cyber incident seems complex given the completion of a 9,000 hour forensic review.
For Canada’s financial system, the CIRO's data breach reinforces that cybersecurity risk extends beyond financial institutions themselves and into the infrastructure that supports regulation and investor protection. How regulators secure sensitive data, communicate evolving findings, and strengthen controls going forward will be important for maintaining confidence in market oversight.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Exporting | Webinar | January 14, 2026
Image: Freepik/Rawpixel.com
Many Canadian companies still operate only in their domestic market or to a narrow set of export markets. That limited exposure becomes a problem when trade rules change, demand softens, or geopolitical risk rises like the current trade environment Canada finds itself in.
On January 28, 2026, Canada's Trade Commissioner Service (TCS) is hosting a webinar for founders and operators called 'Trade diversification: how to select a new market" to better understand the key decisions they must face to determine where to export their business internationally. The session aligns closely with NCFA's community and the hope is that founders will approach choices with more discipline than pure instinct.
Host: Trade Commissioner Service in partnership with the Forum for International Trade Training
Date/Time: January 28, 2026 at 1:00 PM EDT (60 minutes)
Format: Online via Webex
Description: The session introduces a structured approach to evaluating and selecting new international markets based on opportunity, fit, and risk. The webinar also features insights from Chief Trade Commissioner Sara Wilshaw on how Canadian companies can use Trade Commissioner Service support when entering or scaling in foreign markets. The webinar is designed for Canadian companies of all sizes and across all sectors that want to expand internationally, explore new export markets, or strengthen their global growth strategy through diversification. It is relevant for first time exporters as well as firms already active abroad that are reassessing their market mix.
The discussion explains why diversification matters now and how it helps reduce long term business risk.
A certified FITT expert walks through a clear step by step method for choosing the right market.
Canadian exporters share lessons from real expansion efforts including what worked and what they would change.
The session also explains how the Trade Commissioner Service supports companies with market intelligence, local connections, and on the ground insight.
A live Q and A allows participants to ask questions tied directly to their export plans.
Registration closes January 27, 2026. REGISTER HERE before registration closes on Jan 27, 2026. For questions, participants should contact the Trade Commissioner Service directly at tcs-sdc@international.gc.ca.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
AI Regulation | Jan 14, 2026

Image: Freepik
In the first days of January 2026, Elon Musk's AI chatbot Grok (developed by xAI and integrated into X) generated sexual images of real people, including images apparently involving minors, after internal safeguards failed. The issue became public immediately after the New Year and has gone viral since. What began as a platform failure quickly expanded into regulatory, legal, and civil society responses across multiple jurisdictions.
Malaysia and Indonesia are the only countries that have confirmed national blocks of Grok access, citing the creation of non-consensual sexualised imagery and public safety risks.
European Union officials also warned that failure to address the issue could lead to enforcement under existing digital safety rules. No EU-wide restriction has been imposed.
Public pressure has also played a role. International NGO Oxfam confirmed it's examining reports involving AI generated sexualised images created by altering real photographs, framing the concern around harm, consent, and exploitation.
Individuals whose likenesses were used in non-consensual AI generated sexual imagery have spoken out publicly in the United States, describing personal harm and exploring legal remedies, as reflected in accounts from people targeted by AI sexual images. Some unions and professional groups have also reduced or paused activity on X following the controversy.
In the United Kingdom, Ofcom launched a formal investigation into X after what it described as “deeply concerning reports” that Grok was being used to create and share sexualized images, including children.
Ofcom said it will assess whether X failed to remove illegal content quickly once aware of it, whether it took appropriate steps to prevent UK users from seeing such material, and whether it deployed highly effective age assurance measures to stop children from accessing pornographic images.
If Ofcom finds X has breached UK law, it can impose a fine of up to 10% of worldwide revenue or £18 million (whichever is greater), and can seek a court order requiring internet service providers to block access to X in the UK.
UK ministers publicly backed the investigation, urging Ofcom to complete it swiftly and stating that victims would not accept delay.
Elon Musk responded publicly by criticising government actions, saying the UK government was looking for “any excuse for censorship” after questions were raised about why other AI platforms were not being examined. Separately, Musk said he was unaware Grok had generated explicit images involving minors and stated such uses violate platform rules.
The United States has not blocked Grok, but lawmakers have focused on liability. The US Senate unanimously passed legislation allowing victims of non-consensual sexually explicit AI generated images to pursue civil action, including damages and court orders.
Canada has also avoided a ban. Ottawa's AI Minister Evan Solomon responsible for artificial intelligence stated the government will not ban Grok or X at this stage, while acknowledging that Canadian law doesn’t clearly address AI generated non-consensual sexual imagery, and that laws needed updating to address deepfakes.
To be sure, AI governance tightens once harm involves identifiable individuals as in this case. Across jurisdictions, responses are focusing on consent, child protection, and platform accountability rather than abstract debates about speech. For fintechs and other regulated firms deploying generative AI, scrutiny is on improving governance, safeguards, and enforcement readiness.
From NCFA's perspective, AI systems should operate within clear legal and ethical boundaries that protect individuals, maintain public trust, and still allow responsible innovation to move forward. As of now, verified developments include two confirmed national blocks, active regulatory investigations, quantified enforcement powers, and new US civil liability legislation. Further responses remain under review.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
CIX Summit | Jan 13, 2026

Image courtesy of CIX Summit
Mark your calendars! On March 25, 2026, CIX Summit returns to Toronto, bringing together high growth Canadian technology companies, global investors, and industry advisors for one of the country’s most established startup investment and awards events. NCFA is pleased to participate as an official Community Partner again this year, supporting broader visibility and access for founders and operators across our network.
Powered by Elevate, CIX Summit has built a long standing role in Canada’s innovation landscape by focusing on companies that demonstrate real traction, credible leadership, and scale potential. The event combines curated startup awards with a focused investment audience, creating a setting designed for meaningful conversations rather than surface level networking.
CIX Summit 2026 takes place at Design Exchange in Toronto, a venue that reflects the event’s emphasis on execution, discipline, and growth. The program brings together founders who are actively building, investors looking for deployable opportunities, and advisors who understand the operational and regulatory realities of scaling companies in Canada and internationally.
NCFA’s role as a Community Partner reflects our continued focus on improving access to capital, strengthening founder investor connections, and supporting platforms that prioritize quality over volume. Events like CIX matter because they concentrate attention on companies that are ready for the next stage, while helping investors identify teams with credible paths to growth.
As part of this partnership, NCFA is sharing an exclusive 20% discount on all CIX Summit passes for its community.
Use CIXNCFA20 for 20% off. Spots are limited! ✅
For full event details, CIX startup awards, program updates, and to get your tickets, visit https://cixsummit.com/
Stay tuned as NCFA will continue to share updates as CIX announces its Startup Awards finalists and Innovator of the Year, and as the program takes shape leading into March.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Payments | Jan 12, 2026

Image: Freepik/lyashenko
On January 11, 2026, Fiserv launched Unknown Shopper at NRF Retail’s Big Show in New York, introducing an analytics feature designed to extract customer insight from card present transactions that aren't tied to loyalty programs to better understand in store customers. Across retail, grocery, restaurant, and fuel environments, card present payments still dominate volume but produce limited visibility. Merchants see transactions, not behaviour. Repeat visits, cross channel relationships, and the impact of marketing spend often remain unclear when customers never enroll in loyalty programs. Now, Fiserv's Unknown Shopper solution is built to address that gap.
Unknown Shopper begins with the card present payment. Each card transaction is securely tokenized so it cannot identify a person, but it can still show patterns over time. That allows purchases to be grouped into anonymous customer segments based on real spending behaviour. Fiserv doesn't claim to identify individual consumers or expose personal data. Instead, the system enables segmentation, attribution, and measurement based on real spending activity.
Fiserv states that the capability sits on its payments intelligence platform and draws on transaction data processed across its acquiring network (the payment processing systems Fiserv uses to handle card payments for merchants). The company also states that its services reach nearly 100% of U.S. households and that Unknown Shopper delivers greater reach and accuracy than traditional demographic or lookalike targeting models. Note, that these reach and performance metrics are vendor stated claims and have not been independently verified.
What can be independently verified is scale. Fiserv publicly reports serving more than six million merchant locations globally and supporting approximately 10,000 financial institutions through its payments and banking infrastructure. That level of transaction volume matters because analytics based on payments data only become meaningful when they reflect broad, real world commerce rather than narrow samples.
Unknown Shopper fits into a broader pattern across large payments platforms. As core processing becomes more competitive and margins tighten, processors are looking for adjacent services that monetize data already flowing through their systems. Attribution, segmentation, and optimization tools sit naturally on top of payment activity, particularly when platforms operate at national or global scale. Payments scale increasingly determines who can credibly build second layer data products. Firms without that scale will need to specialize, partner, or focus on narrower use cases where data concentration exists.
For merchants, the appeal is operational simplicity. Loyalty programs require customer participation, incentives, and ongoing management. Processor embedded analytics operate in the background and work across physical and digital channels without changing the checkout experience.
Fiserv has been expanding its merchant services presence through partnerships and point of sale deployments. In 2025, TD Bank Group announced a strategic relationship with Fiserv that includes migrating approximately 3,400 merchant relationships representing about 30,000 Canadian merchant locations onto Fiserv’s processing and Clover infrastructure.
Fiserv does not publish a total count of Canadian merchants served. However, this expansion signals a growing footprint in a market where domestic processors such as Moneris still dominate at scale although reportedly RBC and BMO Possibly Looking to Sell Moneris. For Canadian fintechs and merchants, the implication is practical. Global payments platforms are extending beyond processing into data driven services, and those capabilities will increasingly be available in the Canadian market.
Unknown Shopper doesn't change the structure of the payments market. It reinforces where value is accumulating though and large platforms increasingly view it as a strategic asset that supports marketing, measurement, and decision making. The next questions will likely hone in on trust and boundary limits. Merchants may voice concerns as they evaluate new insights versus dependence. Regulators may watch how far payments data travels beyond its original purpose. Competitors will decide whether to build, buy, or partner to keep pace. This launch is a reminder that scale still compounds quietly, and that many of the most consequential product moves happen one layer above the transaction itself. More product detail and positioning is available on the Unknown Shopper product page.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |