Karsten Wenzlaff, Advisor
August 26th, 2025
Karsten Wenzlaff is a Crowdfunding and Fintech Expert from Germany. He is Secretary-General of Digit[...]
Category Archives: Entrepreneurs, Start-ups, Small Businesses
5 Global Payroll Challenges (and How to Avoid Them) in 2026
July 23, 2026
Paying employees across borders sounds simple enough, until you're staring at a stack of tax codes, currency conversion tables, and compliance deadlines that change country by country. For US-based companies going international, global payroll is one of the fastest ways to rack up serious legal and financial exposure if you aren't ready for it.
Here's the thing: most payroll pitfalls follow predictable patterns. Below are five global payroll challenges companies run into in 2026, along with what you can actually do to sidestep each one.
1. Tax Compliance Across Multiple Jurisdictions
Tax rules differ dramatically from one country to the next. They shift constantly. A company paying workers in Germany, Brazil, and the Philippines simultaneously is wrangling three completely different income tax structures, social contribution rates, and filing calendars, all at once, all with real consequences. Get it wrong, and fines pile up fast. One practical move is to plug into payroll infrastructure built specifically for cross-border compliance, rather than patching together manual processes that inevitably crack under pressure. For instance, global payroll from Borderless AI automates tax withholding calculations and filing deadlines across 170-plus countries, cutting down the manual work that causes errors in the first place.
But software alone won't save you. Build a compliance calendar tailored to each country where you pay people, and assign clear ownership for each market's filings; don't let it float around as a general finance team responsibility. Tax authorities in most countries won't cut you slack just because you're unfamiliar with local law; proactive documentation and regular audits of your withholding rates aren't optional if you want clean books across every jurisdiction.
2. Currency Fluctuations and Exchange Rate Risk
Paying employees in local currencies sounds straightforward, until exchange rates shift hard and your payroll costs jump 15% overnight. In 2026, with the US dollar showing volatility against the euro, the Japanese yen, and several emerging market currencies, this is a genuine budget headache for any company running international payroll.
The fix has two parts. First, keep your payroll budget separate from your general operating budget so exchange rate swings don't quietly eat into margins. Second, use forward contracts or hedging tools that lock in rates for 30 to 90-day payroll cycles. Many companies skip this because it feels overly complex, but the cost of not hedging can far exceed the cost of the instrument itself; that's a trade-off worth sweating. You should also review your payroll calendar to make sure payments go out on consistent, predictable dates; inconsistent timing creates exchange-rate surprises because conversions land at different points in the rate cycle. Predictable scheduling makes budgeting far more accurate across your international workforce.
3. Worker Misclassification in International Markets
This one catches more companies off guard than any other. Misclassifying employees as independent contractors is among the most expensive global payroll mistakes you can make in 2026, and the exposure is far larger than most finance teams realize until it's too late. Worker classification rules are stricter in most countries than they are in the US. Courts in places like Spain, France, and the UK have handed down significant penalties to companies that paid workers on contractor terms while directing their work like employees.
The risk isn't only financial. In several countries, misclassification triggers mandatory back payment of benefits, termination protections, and employer-side social contributions applied retroactively, sometimes covering years of prior engagement. Don't assume US standards translate. Before you bring on an international worker, map out the classification criteria for that specific country, asking whether the worker controls their own hours, uses their own tools, and serves multiple clients. If those answers point toward an employment relationship, treat it as one. A legal review before the first payment goes out is far cheaper than a reclassification audit down the road. Document your reasoning clearly and revisit classifications whenever the working arrangement changes.
4. Data Privacy and Cross-Border Payroll Data Transfers
Payroll data is sensitive. Moving it across borders puts you squarely under data privacy laws that carry real teeth; the EU's GDPR remains one of the strictest frameworks globally, but countries like Brazil, Canada, and India have built their own versions with equally serious enforcement. For US companies, the catch is that your data practices get judged by the destination country's rules, not your home state's.
A standard payroll export to a European employee record system may require a data transfer agreement, explicit consent mechanisms, and defined retention schedules. Start there. Map where your payroll data actually flows, from collection through storage to processing, and you'll likely find transfer points you didn't know existed, especially if third-party payroll vendors subcontract their data processing. Audit those vendor agreements for data residency clauses. Build a cross-border data transfer policy and train your HR and finance teams on what triggers a reporting obligation, because small procedural gaps here tend to surface only when regulators come looking. By then, the cost to fix things is steep.
5. Payroll Processing Delays and Banking Infrastructure Gaps
Even when your compliance is spotless, slow payroll processing chips away at employee trust and creates real operational problems, particularly in markets where local banking infrastructure is less developed than in the US. Across Southeast Asia, West Africa, and parts of Latin America, standard wire transfers can take five to seven business days and sometimes arrive with unexpected intermediary fees already deducted. Employees in those markets might tolerate it once. They won't keep tolerating it.
See: 58 Must-Read Remote Work Resources | 50 Great Remote Working Resources
Start by evaluating whether your payroll provider actually supports local payment rails rather than just SWIFT transfers. Real-time payment networks now exist in over 50 countries. Providers connected to them can clear payments in hours rather than days, which matters enormously when workers in new markets are depending on punctual wages to meet local obligations. Set an internal payroll processing deadline that's earlier than the official pay date, building in a buffer for banking delays, public holidays, and currency conversion queues. When you onboard employees in a new market, ask specifically about local banking norms, how people receive wages there, whether digital wallets are common, and what documentation they need for large incoming transfers. That upfront conversation prevents avoidable friction down the line.
Conclusion
Global payroll gets complicated quickly. But the 5 global payroll challenges covered here share one common thread: they're all predictable and preventable with the right groundwork. Tax compliance, currency risk, worker classification, data privacy, and payment infrastructure are all manageable when you treat them as structural concerns rather than last-minute checks, embedding accountability into your processes before problems surface rather than after. The companies that handle international payroll well don't improvise. They build systems, assign ownership, and audit regularly. Start with the markets you're in today, fix the gaps you find, and carry that discipline forward as you grow.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
|---|---|---|
 |  |  |
CSA Cybersecurity Guidance for Registered Firms
July 20, 2026 | NCFA Resource | Cybersecurity And Fraud, Risk Compliance And Regtech, Capital Markets And Market Infrastructure
Policies, Training, Vendor Risk, And Incident Response
On July 15, 2026, the Canadian Securities Administrators published new cybersecurity guidance for registered dealers, advisers, and investment fund managers (Download the 12 page PDF report). CSA Staff Notice 33-322 combines findings from a focused review of 73 firms with practical expectations for policies, employee training, risk assessments, third party oversight, and incident response.
The notice is most useful as a compliance review tool. Firms can compare their written controls, operating practices, and supporting records against the deficiencies and effective practices identified by securities regulators. The guidance is particularly relevant for smaller and medium sized firms that may not have dedicated cybersecurity teams.
What It Does In Practice
The notice organizes cybersecurity readiness around five areas that regulators examined under section 11.1 of National Instrument 31-103:
- written cybersecurity policies and procedures
- employee cybersecurity training
- cybersecurity risk assessments and controls
- oversight of third party service providers
- written and tested incident response plans
The review found useful benchmarks. 8% of firms had no written cybersecurity policies, while 55% had policies that needed improvement. Twenty one per cent provided no employee cybersecurity training. Forty five per cent completed risk assessments that could have been stronger, and 12% had no documented assessment during the review period.
Third party oversight was one of the clearest weaknesses. All examined firms used service providers with access to systems or data, but 62% had no documentation or limited documentation supporting their cybersecurity oversight. The CSA expects firms to complete and document due diligence before onboarding a provider and repeat that review throughout the relationship.
The guidance identifies information firms should assess, including data storage, encryption, access controls, patch management, incident notification, subcontractors, operating jurisdictions, and shared responsibility in cloud environments. It also recommends maintaining a complete vendor register and reviewing current SOC 2 or similar reports where available.
Incident preparedness also receives detailed attention. Fifteen per cent of firms had no written incident response plan. Among firms with a plan, 53% needed stronger procedures and 63% should have tested their plans more regularly. The notice describes tabletop exercises and simulated attacks as practical ways to test whether people, processes, and technical controls work together during an incident.
Who Gets Value
The primary audience is firms registered as dealers, advisers, portfolio managers, investment fund managers, exempt market dealers, and restricted portfolio managers. Chief compliance officers, directors, technology leaders, privacy professionals, and internal audit teams can use the notice to organize a control review and identify missing documentation.
Boards and senior executives can also use it to test whether cybersecurity oversight is tied to clear responsibilities, regular reporting, and evidence that controls operate as intended. Written policies alone aren’t enough when actual practices, testing schedules, or access controls differ from the documented process.
Cybersecurity consultants, legal advisers, insurance providers, managed service providers, and software vendors can use the findings to better understand the records and evidence registered firms may need during a regulatory review.
Strengths And Limits
The notice is strong because it combines regulatory expectations with observed deficiencies, percentages, effective practices, and practical takeaways. It covers both governance and technical controls, including multifactor authentication, encryption, backups, access rights, patching, email filtering, endpoint protection, and activity logging.
It also makes documentation a central requirement. Firms should be able to show when policies were reviewed, who completed training, how risks were assessed, what vendor due diligence occurred, and when incident plans or backup recovery procedures were tested.
The guidance does not create a complete technical cybersecurity standard, and it doesn’t replace obligations under privacy, securities, corporate, or other applicable laws. Expectations also vary with the firm’s size, operating complexity, client information, service provider reliance, and exposure to cyber risk.
Firms should therefore use the notice as a regulatory gap assessment and evidence checklist, then supplement it with appropriate legal advice, technical standards, testing, and controls suited to their operations.
Key Resources
CSA Staff Notice 33-322 (cybersecurity examination findings and guidance for registered firms)
CSA Staff Notice 33-321 (foundational 2017 cybersecurity and social media guidance)
NIST Cybersecurity Framework (risk management structure for identifying, protecting, detecting, responding, and recovering)
CIS Critical Security Controls (prioritized technical and operational safeguards)
Wealthsimple Confirms Breach Impacting Clients (third party exposure and incident response)
Proposed Class Action Targets Equifax Access Controls (access governance and third party permissions)
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
How TouchBistro’s Exit Changed What Success Looked Like
July 7, 2026 | NCFA Story Intelligence | Payments And Money Movement, SME Finance And Business Banking, Capital Markets And Market Infrastructure
Growth Capital, Lost IPO Options And A Changed Exit Waterfall
On July 7, 2026, Harris acquired TouchBistro, a Toronto restaurant technology and payments company whose point of sale, payment processing and management products serve more than 16,000 restaurants across over 100 countries. Harris, part of Constellation Software, didn’t disclose the purchase price.
The Globe and Mail later reported that Harris paid $100 million. Reporter Sean Silcoff said the transaction followed a December 2025 recapitalization that converted Francisco Partners’ debt into equity, gave the lender control of the board and reduced earlier shareholders to a minority position. He also reported a nine figure loss for OMERS and no recovery for employee common shares.
Those reported outcomes make the acquisition look like a failed exit. The operating record is more complicated. TouchBistro spent about 15 years building a global restaurant technology business, processing billions of dollars in transactions, expanding its product suite and surviving a pandemic that shut down much of its customer market.
The business had value. Its financing required more.
TouchBistro found a specific operating problem. Founder Alex Barrotti built the original product around restaurants that wanted mobile ordering, table management and point of sale software on an iPad. The narrow industry focus helped TouchBistro expand into reservations, loyalty, staff scheduling, online ordering, accounting, payments and restaurant management.
Investors saw a larger opportunity. Restaurants represented a fragmented global market with recurring software revenue, payment volume and room to sell several products into the same customer account. Venture backing could accelerate product development, international sales and acquisitions before larger competitors controlled the category.
BDC joined the shareholder base. TouchBistro’s 2017 Series C included BDC IT Venture Fund, giving the company backing from a federal Crown corporation alongside private investors. That public investment supported a Canadian company competing internationally, but it also carried a mandate to produce a financial return.
The C$72 million Series D raised the ambition. In June 2018, OMERS Ventures and JPMorgan Chase led the round, with BDC and existing investors participating. TouchBistro said it would expand research, enter more markets and double its workforce.
OMERS placed a major institutional bet. In September 2019, OMERS Growth Equity led a C$158 million Series E and invested C$85 million itself. Barclays Bank, RBC Ventures and BMO Capital Partners joined the round, while BDC, JPMorgan Chase and other existing investors participated.
The company had scale to support the pitch. OMERS said TouchBistro served more than 16,000 restaurants in over 100 countries and processed more than US$11 billion annually through its payment system. The financing supported product development, acquisitions, international expansion and hiring.
A public listing offered several advantages. It could provide new investment, establish a market price, give investors a route to sell shares and support acquisitions with public equity. It could also preserve TouchBistro as an independent Canadian company if public investors accepted the growth case.
There was no guarantee the market would cooperate. An IPO would require reliable growth, audited financial performance, predictable recurring revenue and public investor demand. The company never named an intended exchange in the sources reviewed, so the record doesn’t establish that TouchBistro rejected a Canadian listing.
The founder stepped out of the CEO role. In April 2021, Barrotti handed leadership to board chair Samir Zabaneh. He described the transition as a new stage requiring experience operating large global companies, not as a forced departure.
The operating job had changed. TouchBistro now needed to recover from the pandemic, control spending, expand payments revenue and compete with larger rivals. Leadership that was suited to founder led expansion wasn’t automatically suited to the next operating and financing phase.
A financing round doesn’t just fund the next stage of growth. It can quietly redefine which exits remain possible.
Private financing replaced the expected public route. In November 2022, Francisco Partners supplied C$150 million for product expansion, core services and acquisitions. Francisco Partners includes TouchBistro within its credit and structured solutions portfolio.
The financing bought time under new conditions. Equity absorbs losses until an exit. Debt introduces repayment, covenants, maturity dates and senior claims. Convertible instruments can later become ownership. The public announcement didn’t disclose the complete instrument, pricing, covenants or conversion terms.
The category kept getting harder. TouchBistro competed against Toast and other restaurant technology firms with their own payments, software, data and distribution advantages. Investment could finance products and acquisitions. It couldn’t guarantee that TouchBistro would outgrow a larger rival.
Cost discipline carried its own tradeoff. Silcoff reported that Zabaneh reduced costs while growth weakened. That doesn’t prove the reductions caused the later outcome. It shows the conflict management faced: preserve cash, invest against a larger competitor or raise more money into a weaker market.
A reported recapitalization reordered the company. In his public summary of the Globe investigation, Silcoff reported that Francisco Partners converted debt into equity in December 2025, took control of the board and reduced existing shareholders to a minority position.
The transaction wasn’t publicly announced at the time. TouchBistro’s full cap table, preference stack, debt balance and sale waterfall remain private. The reported control change explains the direction of the outcome, but it doesn’t provide enough information to calculate each shareholder’s recovery independently.
Venture investors judged the result against the money invested. A fund can’t treat survival, employment or customer continuity as its primary return. It needs distributions large enough to offset losses elsewhere in the portfolio and return money to its own investors.
Harris judged the operating business differently. Constellation Software and its operating groups acquire vertical software businesses that can serve specialized customers for years. They can focus on recurring revenue, customer retention, product depth, pricing and cash generation without needing a venture scale exit.
The Founder Lens
TouchBistro doesn’t prove that founders should reject venture capital. The company used institutional backing to build products, enter international markets, acquire technology and compete in a category that required significant investment. A smaller financing plan may have produced a smaller business or allowed a larger competitor to overtake it sooner.
It does show why the amount raised can’t be separated from the type of company being built and the outcomes its market can realistically support. Every round assumes a future. Higher valuations require more growth. Preferred investment adds priority. Debt adds fixed obligations and control rights. A delayed IPO, weaker market or missed target can leave a founder running the same company under very different economics.
Canada’s debate often starts with whether founders can access enough money. The early stage funding funnel is narrowing, and Canadian companies still face a limited pool of domestic investors capable of leading large rounds. Those are genuine constraints.
TouchBistro raises the question on the other side. Once money becomes available, is it structured around the company’s likely growth, customer market and exit routes? Canada’s longstanding need for flexible growth financing includes equity, debt and hybrid products. Flexibility only helps when founders and boards understand what each instrument can claim later.
Founders can’t control pandemics, public market windows or every competitive threat. They can model the consequences of a financing before signing it.
What sale price clears the preferences?
What happens if growth takes twice as long?
Which covenants transfer control after a missed target?
Could the company accept a strategic offer without leaving common shareholders with nothing?
Does the business have a credible route to the outcome its investors require?
Those questions aren’t pessimistic. They’re part of building the company.
The Company Survived. The Original Exit Didn’t.
TouchBistro built software that restaurants still use. Harris acquired its products, customer relationships and industry expertise. The work continues under a Canadian software owner.
The financial outcome followed a different logic. The expected IPO never arrived. Private credit reportedly gained control. Earlier shareholders lost priority. The eventual sale appears to have preserved the operating business without satisfying the venture investment behind it.
That is the distinction founders need to see before the next round, not after the sale.
A valuable company isn’t automatically a successful venture investment. A large exit isn’t automatically a founder win. Investment that opens the next stage can quietly close outcomes that once looked available.
Questions Founders Should Ask Before The Next Round
- What exit value clears every senior claim in the proposed financing?
- How much common ownership remains after the round and future dilution?
- Does the company’s market support the valuation investors now require?
- What happens if the IPO window closes or the next round isn’t available?
- Could debt preserve today’s valuation while weakening tomorrow’s options?
- Which performance targets can transfer board control or force a recapitalization?
- Would a smaller round preserve more strategic acquisition options?
- Are founders, employees and investors using the same definition of success?
Share this story → Explore related intelligence → Subscribe
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Why Fintech Companies Should Understand Worker Classification Before Hiring International Talent
July 10, 2026
Financial technology organizations are often able to grow - employing staff from different countries - these companies use international recruitment to address high workloads, find highly trained employees and enter new geographical areas. Many professionals, like software engineers, data researchers and client service experts, prefer roles that allow them to work from any location. While these hiring practices are beneficial, businesses are responsible for managing the specific challenges involved.
Worker classification is a primary factor for companies to manage when they hire across borders. Organizations that identify their staff correctly are able to prevent legal disputes and avoid the loss of money. Businesses that operate in multiple countries have fewer administrative tasks when they clearly define the legal status of their international workers.
Understanding Worker Classification
Worker classification is the process where an organization determines if a person is an employee or an independent contractor. Companies are required to follow specific guidelines to establish the legal status of their workers. Government agencies and courts evaluate the degree of control an employer has and how much independence a worker maintains to make this decision. Please be aware that the label a company gives to a worker is not the only factor that determines their status.
This consideration is particularly important for companies that staff internationally. The status of a worker who provides services from abroad can change depending on the country where they originate. As such, businesses should understand the implications of classifying employees as independent contractors outside their jurisdiction.
Legal and Financial Risks
Businesses can suffer adverse financial and legal consequences from misclassifying workers. For instance, companies may incur substantial expenses by following court orders mandating retroactive payments of payroll taxes, overtime, and social benefits. In addition, businesses must consider litigation costs in any resulting disputes over misclassification.
Companies that hire internationally must navigate complex legal frameworks when classifying their workers. Most jurisdictions allow businesses to employ independent contractors on either a full-time or part-time basis. However, certain countries require organizations to treat such workers like employees. It can be challenging to ensure that employment terms abide by all applicable statutory requirements in different jurisdictions. As such, companies may find themselves facing adverse consequences when trying to establish long-term contracts for workers based abroad. To mitigate these risks, businesses turn to local attorneys and a Toronto Employment Lawyer to understand the implications before hiring.
Impact on Business Operations
How a company classifies its workers influences how the business functions. Management must recognize the administrative tasks and legal requirements that apply to different categories of workers - these arrangements are important because they change how the company processes payroll, manages benefits plus protects private data. Leaders are able to use this information to plan their workforce and lower the risk of legal disputes.
The status of a worker is what defines their specific legal rights but also responsibilities. Individuals who are employees are usually eligible for more protections and company provided benefits than those who are independent contractors. If a company understands these distinctions, it is able to follow the law as well as maintain a consistent hiring process - this knowledge is necessary for organizations that intend to grow in multiple countries and use the specific abilities of their staff effectively.
Supporting Regulatory Compliance
The financial technology industry is subject to many regulations. Companies are required to dedicate time and money to follow laws regarding data privacy, security for digital information plus financial reporting. This commitment to compliance is also necessary when businesses hire staff. Classification of workers is an important process because these organizations manage private data and perform money transfers for customers. Organizations that hire people in other countries are encouraged to monitor legal changes but also speak with an employment lawyer. Audits are a helpful tool to identify problems and lower risks before a company hires remote employees.
Build Sustainable International Teams
Fintech companies often find benefits in hiring employees from other countries - this approach allows businesses to grow and find qualified workers in a larger market. All staff members must follow the same professional requirements regardless of their location. Management teams are responsible for creating clear rules for international hiring to keep processes uniform and minimize potential problems.
See: Borderless AI Launches Crypto Payroll For Global Teams
Rules change depending on the country - businesses are more successful when they monitor legal updates. A detailed plan for following laws is necessary because international employment is complex - these strategies are also important for keeping the trust of investors and protecting the public image of the company.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Telpay Acquires Notch To Expand SME Cash Flow
July 9, 2026 | NCFA Market Activity | Payments And Money Movement, SME Finance And Business Banking, Fintech And Innovation
Telpay Adds Accounts Receivable And Payment Collection
On July 7, 2026, Winnipeg based Telpay announced that it acquired Notch Financial, a Toronto based accounts receivable automation company. Terms weren't disclosed.
The acquisition brings accounts receivable, invoicing and payment collection together with Telpay’s existing payment, payroll and approval workflows, expanding the platform from payment execution toward SME cash flow management.
Mark Loewen, President of Telpay, said:
"Businesses don’t lose sleep over how payments are processed, they worry about whether they’ll have the cash they need when they need it."
Notch Adds Receivables To Telpay who has spent more than 40 years helping businesses manage money going out through supplier payments, payroll and approval workflows. Notch adds the incoming cash side, including invoices, collections and receivables visibility.
The transaction confirms that Telpay is going from payments execution toward cash flow control for Canadian SMEs.
SME Cash Flow Needs Better Timing
The acquisition comes as Canadian small businesses are paying closer attention to receivables, working capital and payment timing.
Payment timing remains an important operating indicator for Canadian SMEs. See: Canadian Small Business Revenue Turns Negative In Q4.
Cash flow pressure doesn't always come from a lack of sales. It can come from slow collections, manual invoicing, fragmented approvals or poor visibility into what cash is actually available. That's why AR and AP automation are becoming core SME infrastructure rather than back office software.
The same trend appears in Open Finance SME Capital Access, where fresh invoice, payment, account and cash flow data can support faster credit decisions and better liquidity tools.
Payments Platforms Move Closer To Cash Flow
Payment companies are expanding beyond transaction processing into the operating layer around cash flow. See: Lloyds Expands SME Payments With Stripe Infrastructure.
The strategic question though is who owns the actual SME relationship? The account, the payment workflow, the operating data or the cash flow tools.
Telpay now covers both sides of SME cash flow: (1) Outgoing payments through supplier payments and payroll, and (2) Incoming cash through invoicing, collections and receivables visibility.
The platform value increases when a business can see both sides without stitching together separate tools.
Jordan Huck, CEO of Notch, said:
"Together, we see tremendous opportunities to deliver even more value as businesses manage every aspect of their cash flow."
Talking Point
Will Canadian SME payment platforms win by processing transactions, or by owning the cash flow workflow around invoices, collections, approvals and working capital?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer to peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: [www.ncfacanada.org](http://www.ncfacanada.org)
| | |
|---|---|---|
| | |
Global Agentic Regulator Hackathon Applications Now Open
July 9, 2026 | NCFA Market Activity | Artificial Intelligence And Data, Risk Compliance And Regtech, Cybersecurity And Fraud, Digital Identity And Trust, Payments And Money Movement, Digital Assets Blockchain And Tokenization
Join A Global Challenge To Build Practical Agentic AI Prototypes For Regulators And Public Authorities
On July 8, the Cambridge Digital Innovation & Regulation Initiative (C:>DIR), hosted by Financial Innovation for Impact (Fii), launched the Global Agentic Regulator Hackathon. Applications are NOW OPEN for a worldwide challenge that brings together policymakers, regulators, AI researchers, engineers, financial institutions, fintechs, RegTechs, SupTechs, academics and technology innovators to develop practical, explainable and deployable agentic AI prototypes for public authorities. The National Crowdfunding & Fintech Association of Canada (NCFA) is participating as an Ecosystem Partner to help promote the initiative across global fintech ecosystems, including Canada's fintech, AI and innovation networks.
The virtual hackathon runs from July 8 to September 18, 2026, with concept note submissions due by July 31. It carries a US$100,000 prize pool, and winning teams will also be invited to present at the Singapore FinTech Festival, hosted by GFTN. The launch is supported by the BIS Innovation Hub, Global Financial Innovation Network (GFIN), Digital Regulation Cooperation Forum (DRCF), and a global group of supporters, ecosystem partners and academic institutions.
Building Supervisory Tools Before the Market Fully Arrives
AI agents are already operating in financial services. The next question is whether regulators will have the tools to supervise them.
According to the organizers, the CCAF 2026 AI in Financial Services Global Report found that 58% of fintechs and 47% of traditional financial institutions are adopting agentic AI, compared with 28% of regulators. That gap is important because AI agents can recommend, transact, monitor, route, execute and coordinate across systems faster than traditional supervisory processes were designed to handle.
This is why the hackathon is strategically important. It treats agentic AI as a supervision and infrastructure issue, not just a productivity tool. Public authorities need better ways to monitor risks, test model behaviour, understand accountability and respond to market activity that can develop at machine speed.
Six Priority Challenge Areas
Participants will develop prototypes across six challenge areas:
- AI Enabled Financial and Non Financial Advice
- Agentic Payments, Commerce and Their Oversight
- Decentralised Market Infrastructure, Smart Contracts and AI Agents
- AI Driven Fraud and Scams
- Know Your Agent (KY-A), Digital Verification and Digital Public Infrastructure
- Market Manipulation and Agentic Herding
These themes reflect where financial supervision is likely to be tested first as AI systems begin initiating transactions, interacting with digital assets, providing financial guidance and coordinating increasingly complex financial activities.
Why This Matters for Builders
For founders, researchers, fintech teams, RegTechs and infrastructure providers, the opportunity is not simply to build smarter AI. It is to help shape the supervisory capabilities that may define trusted digital finance as autonomous systems become more common.
The breadth of organizations involved is a strong signal. With regulatory partners, global financial innovation networks, technology firms, academic institutions and ecosystem groups participating, the hackathon shows that agentic AI oversight is becoming a shared public and private sector priority.
For Canadian participants, the timing is also practical. Canada has strengths in artificial intelligence, financial services, digital identity, payments, cybersecurity, digital assets and regulatory innovation. This gives Canadian builders a chance to contribute to global supervisory tools before standards and operating models become more established internationally.
Who Should Participate
The organizers are seeking multidisciplinary teams that combine regulatory knowledge with technical expertise, including:
- Regulators and public authorities
- AI researchers and engineers
- Financial institutions
- Fintech, RegTech and SupTech firms
- Universities and academic researchers
- Technology innovators
Key Dates
| Milestone | Date |
| Preliminary round opens | July 8, 2026 |
| Concept submissions close | July 31, 2026 |
| Teams selected | August 4 to August 14, 2026 |
| Virtual build phase | September 1 to September 8, 2026 |
| Global demonstrations and regulator voting | September 15, 2026 |
| Winners announced at the C:>DIR Summit, Cambridge | September 18, 2026 |
Apply to the Global Agentic Regulator Hackathon
Applications for the preliminary round are open until July 31, 2026. Regulators, AI researchers, engineers, fintechs, RegTechs, SupTechs, financial institutions, universities and technology innovators are invited to submit concept notes and develop practical agentic AI prototypes for the future of financial supervision.
Read the full challenge details and submit your application through the official C:>DIR Global Agentic Regulator Hackathon page.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Why Fintech Can’t Wait For Quantum Computing
July 3, 2026 | NCFA Insight | Cybersecurity And Fraud, Digital Identity And Trust, Risk Compliance And Regtech, Payments And Money Movement, Digital Assets Blockchain And Tokenization, Artificial Intelligence And Data
Post-Quantum Planning Starts Before The Threat Arrives
Governments are no longer treating post-quantum cryptography as a research topic. They're now publishing migration plans.
On June 22, 2026, the White House issued an order on advanced cryptographic attacks, including the risk that adversaries collect encrypted data today so they can decrypt it later. The same day, a separate White House order advanced U.S. quantum innovation across computing, sensing, networking, applications, and industry partnerships.
That combination is the useful development marker for fintech. Governments are funding quantum capability while also pushing organizations to prepare for the security risk that follows.
The financial sector doesn't need to know the exact year a cryptographically relevant quantum computer arrives before it starts planning. Long time customer data, payment credentials, digital identity systems, API certificates, custody systems, vendor software, archived records, and cryptographic keys may remain sensitive for years.
Quantum readiness is therefore becoming an operating requirement. Not someday. Now.
Governments Are Publishing Migration Plans
The policy picture is getting clearer.
NIST finalized its first three post quantum cryptography standards in August 2024. The standards are FIPS 203 for ML-KEM, FIPS 204 for ML-DSA, and FIPS 205 for SLH-DSA. NIST says organizations should begin migrating systems to quantum resistant cryptography.
NCFA has already tracked how post quantum cryptography is entering implementation, with payments, digital identity, secure messaging, APIs, and financial data all exposed to the migration challenge.
Canada has started, too. The Canadian Centre for Cyber Security published a roadmap for migrating Government of Canada non classified IT systems to post quantum cryptography, covering stakeholders, phases, milestones, governance, and departmental planning.
Financial authorities are paying attention too. The Bank for International Settlements published a quantum readiness roadmap for the financial system, and the G7 Cyber Expert Group issued a roadmap for the financial sector's transition to post quantum cryptography.
The practical message is this. Start with awareness, find where cryptography is used, assess risk, plan migration, and work with vendors before deadlines become urgent.
Today's Encryption Protects Tomorrow's Data
The hardest quantum risk is not only future system compromise. It is long term data.
Financial institutions protect account records, payments data, identity documents, loan files, custody records, private market documents, insurance records, tax files, transaction histories, and compliance archives. Some of that data must stay confidential for years or decades.
That creates the harvest now, decrypt later problem. An attacker can collect encrypted data now and wait for stronger decryption capability later.
For fintechs, this impacts the planning window. A company doesn't need to be systemically important to hold sensitive data. A payments provider, open banking intermediary, wallet provider, identity service, lending platform, wealthtech app, regtech vendor, or crypto custodian may all depend on cryptography that was never designed for a quantum era.
You Can't Upgrade Cryptography You Haven't Found
Post quantum migration starts with discovery.
Most organizations know they use TLS, certificates, signing keys, databases, cloud services, APIs, authentication systems, payment connections, and vendor platforms. Fewer have a current inventory of which cryptographic algorithms protect each system, which assets must remain confidential long term, and which vendors control the upgrade path.
That's why cryptographic inventory keeps appearing across official guidance.
A fintech should be able to answer basic questions:
- Where are RSA, elliptic curve cryptography, key exchange, signatures, and certificates used?
- Which customer data must remain confidential for more than five, ten, or twenty years?
- Which APIs, identity tools, custody systems, payment rails, and cloud services depend on vulnerable algorithms?
- Which vendors control cryptographic updates?
- Which systems can support crypto agility without a major rebuild?
- Who owns the roadmap: security, compliance, engineering, risk, procurement, or the board?
Without that inventory, migration plans become guesswork.
Every Vendor Becomes Part Of The Migration
Fintech security is rarely managed by one company anymore.
A single product may rely on cloud hosting, identity verification, payment processors, data aggregators, card issuing platforms, custodians, wallet technology, fraud systems, CRM tools, analytics software, email providers, certificate authorities, and outsourced compliance systems.
That makes post quantum readiness a vendor risk issue.
A fintech can upgrade its own code and still remain exposed through a vendor that cannot explain its cryptographic dependencies. Banks and credit unions face the same issue in reverse. They may need to ask whether fintech partners can support post quantum requirements before onboarding, renewing, or expanding contracts.
The procurement question changes from "is this vendor secure today?" to "can this vendor survive a cryptographic transition without disrupting our product, customers, or regulatory obligations?"
Where Quantum Risk Already Exists
Quantum readiness touches more than cybersecurity teams.
In payments, cryptography protects authentication, transaction integrity, messaging, API connections, certificates, and sensitive account data.
In digital identity, it protects credentials, signatures, documents, device binding, verification records, and trust chains.
In crypto and digital assets, it touches wallets, custody, private keys, signing systems, transaction authorization, smart contract administration, and institutional key management. BTQ's quantum safe Bitcoin and stablecoin roadmap highlights one approach to preparing digital asset infrastructure for post quantum cryptography.
In open banking, it affects API security, consent records, data sharing, third party access, and customer authentication.
In capital markets, it touches trading access, fund administration, investor records, tokenized securities, transfer agency, data rooms, reporting, and long term documents.
In AI and data systems, it affects model access, training data, confidential records, synthetic data pipelines, and secure data exchange.
That breadth is why the topic belongs with executives, product leaders, compliance teams, boards, and investors, not only cryptography specialists.
Canada Has A Public Roadmap, But Fintech Needs Its Own
Canada's Cyber Centre roadmap gives public sector organizations a starting point. It also gives fintech and financial services leaders useful guidance that migration will take planning, governance, technical discovery, budgets, and coordination.
Canada doesn't yet have a full financial sector post quantum mandate comparable to a hard compliance deadline, but that statement should not create comfort.
Canadian fintechs operate in a global market. They sell into banks, credit unions, enterprises, governments, insurers, capital markets, payment networks, and regulated financial institutions. Their buyers may start asking post quantum questions before Canadian rules require formal answers.
A fintech that can show cryptographic inventory, vendor readiness, migration planning, and crypto agility may have an advantage in enterprise sales. A fintech that cannot answer basic questions may face longer diligence, higher security friction, or blocked procurement.
The Next Security Products Aren't Quantum Computers
The near term opportunity is not building quantum computers. It's helping financial organizations prepare for the cryptographic transition. Quantum Bridge's USD $8M raise shows Canadian capital already backing deployment ready quantum safe security for finance, telecom, government, and defence.
Product opportunities include:
- cryptographic inventory and discovery tools
- certificate and key lifecycle automation
- crypto agility platforms
- PQC testing environments
- vendor cryptography questionnaires and evidence systems
- identity modernization for quantum safe credentials
- custody and wallet security upgrades
- API and payment connection readiness testing
- regtech reporting for quantum readiness
- board and risk dashboards for cryptographic exposure
These opportunities are practical because they map to work financial firms already need to do. They need to know what they use, what they protect, which systems carry the highest risk, which vendors control dependencies, and how migration can happen without breaking production systems.
These are the kinds of tools that belong on NCFA's Financial Innovation Map, such as identity, payments, custody, regtech, data governance, and cyber resilience.
Preparation Starts Before The Deadline
Quantum readiness won't arrive as a single upgrade.
Organizations will need inventories, test environments, migration sequencing, vendor commitments, product changes, audit evidence, customer communications, and fallback plans. Some systems will be easy to update. Others will depend on old software, hardware limits, contracts, third party platforms, or regulatory approvals.
That's why waiting for a precise quantum break date is the wrong approach for operators. Ask yourself, your team, your leadership this simpler question, "If a regulator, bank partner, insurer, enterprise buyer, or board asked tomorrow where vulnerable cryptography sits in the business, could the company answer?"
For many fintechs, the honest answer is probably no. So that's the opening to start.
Takeaway: Post quantum cryptography isn't a distant science fiction story anymore. It's becoming part of how financial organizations prove they can protect data, manage vendors, maintain trust, and keep critical services running through the next security transition.
Talking Point
If post quantum readiness starts with knowing where cryptography lives, should fintech due diligence now include a cryptographic inventory before major bank, payments, custody, or identity partnerships?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer to peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: [www.ncfacanada.org](http://www.ncfacanada.org)
| | |
|---|---|---|
| | |
