Karsten Wenzlaff, Advisor
August 26th, 2025
Karsten Wenzlaff is a Crowdfunding and Fintech Expert from Germany. He is Secretary-General of Digit[...]
Category Archives: Fintech International
AI Payments Challenge Consent Rules And Liability
Mar 30, 2026 | NCFA Insight | Payments And Money Movement
FCA Considering How Payment Rules Apply When AI Agents Act Independently
On March 25, 2026, the FCA opened the door to regulatory changes for agentic AI payments, placing a policy question mark related to artificial intelligence. If software can autonomously initiate and execute payments, the industry needs to better understand the answer to a basic legal question. Who actually gives consent?
Under UK payment consent requirements, a payment transaction counts as authorized only if the payer has given consent, and that starts from a human payer. The FCA’s approach to payment services goes further and requires that consent is clear, specific, and informed. That framework works for card payments, standing orders, recurring mandates, and merchant initiated transactions. It becomes much harder to apply when an AI agent interprets a goal, selects a payee, and decides when to act.
See: Peoples Group, Fiserv to Modernize Payments Infrastructure
The real question is whether current rules can still pinpoint when consent actually happens. Today’s framework assumes a person is involved at the moment a payment is made. The FCA says authentication confirms the user is legitimate and has approved the transaction. It also requires strong customer authentication when someone initiates a payment or takes an action that could increase fraud risk. That logic breaks down when software makes decisions on its own. Current payment authentication guidance does not fit well with autonomous AI agents.
This becomes clearer when you look at how mandates work today.
Once a user sets up a mandate, some payments can go through without repeated authentication. But there is a limit. If a payment falls outside what the user originally approved, it becomes unauthorized unless the user steps in and updates the mandate. That gives fintech builders a clear boundary. The safest near term model for agentic payments is not full autonomy. It is controlled delegation. Users set the rules, and the AI operates inside them.
If a payment goes beyond what the user approved, it is treated as unauthorized. Under UK payment consent requirements, a payment provider needs the customer’s consent. Under unauthorized payment refund rules, providers must refund those transactions quickly, usually by the next business day, unless they have reason to suspect fraud. That puts pressure on payment firms, wallets, and embedded finance providers. If the approval model is weak, liability grows quickly and these rules leave very little room for error.
This affects Canadian fintech operators too. The UK is not just talking about AI in payments. It is updating the rules around it. In February 2026, the UK published a three year UK payments modernization plan, and UK payments roadmap for fintechs shows how regulators are lining up changes across retail payments, open banking, and digital assets. Agentic AI payments are now part of that wider regulatory perimeter push.
What's the takeaway for founders and product leaders? Don't present agentic AI as something that can give consent on its own. Build systems where the user sets clear limits, can cancel approval easily, and can trigger extra checks when a payment falls outside the rules. That fits much better with how regulators already treat mandates, authentication, and unauthorized payments. It also lowers risk as these systems grow.
How AI Payments Challenge Current Rules
For regulators, as AI agents start handling payments, the issue is not the activity itself, but how decisions are made. The FCA is now considering whether existing rules need to change, as some uses fit within current frameworks, while others raise questions around consent, authentication, and liability.
First, consent. Today’s framework requires a clear moment where the user approves a payment. If an AI decides when and how to pay, that moment becomes unclear. Regulators need to define what counts as valid consent when software acts on its own.
See: Which Fintech Processes Are Most Ready for Agentic AI
Second, authentication. Strong customer authentication is built around a user actively approving a transaction. If payments happen without that step each time, regulators need to decide when authentication still applies and when it can rely on pre-approved rules in the age of agentic payments.
Third, liability. If a payment goes wrong, current rules say the provider must refund unauthorized transactions quickly. But if an AI acts within a system the user set up, it is not always clear who is responsible. Regulators need to decide who pays when an agent acts outside what the user intended.
Talking Point
If AI agents start making payments at scale, who actually controls the money flow? The user, the platform, or the system that defines the rules behind it?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
|---|---|---|
 |  |  |
Wirex And Crossmint Launch Integrated Stablecoin Card Stack
Mar 30, 2026 | NCFA Fintech Market Activity | Payments And Money Movement
Wallet To Card Infrastructure For Stablecoin Spend
On March 30, 2026, Wirex and Crossmint launched an integrated stablecoin card stack. The product connects stablecoin wallets to card spending in one setup. According to the companies, crypto card volume has grown 106% a year since 2023 and reached an $18B annualized market by late 2025.
The bigger market is still early. Real stablecoin payments ran at about $390B annualized in 2025, or roughly 0.02% of global payments volume. That leaves a lot of room for growth, but it also shows how far the market still has to go before stablecoin spending becomes mainstream.
The main problem isn't demand alone. Stablecoin card programs usually need separate wallet, card, and compliance infrastructure. In earlier work with Wirex, Crossmint said it cut six months of internal development time, opened a path toward support for 20+ networks, and helped support a platform serving more than 7 million customers, processing more than $20B annually across 130 countries.
Daniel Rowlands, General Manager, Onchain Finance at Wirex:
"This is what it looks like when two pieces of infrastructure are built to fit together. Fintechs can now give their users a Wirex debit card funded directly from a Crossmint wallet, and as they grow, the full BaaS stack is there when they need it."
That is the stronger business case behind this launch. Stablecoin balances are getting easier to hold. The harder part is turning them into everyday spend in a product that launches fast, works across markets, and stays compliant. This stack goes after that build problem directly.
See: Stablecoin Payments Have Wings – Are You Ready?
For founders and investors, the commercial question is straightforward. If stablecoin cards keep growing, the advantage may sit less with another wallet feature and more with the firms that can package wallet infrastructure, card issuance, compliance, and distribution into one launch path.
Key Questions Behind The Launch
How big is the real stablecoin payments market?
Most headline stablecoin volume does not reflect real payments. A recent stablecoin payments reality gap analysis shows why the market needs more careful measurement. The best current estimate for actual stablecoin payments is about $390B annualized in 2025.
Why do stablecoin cards matter?
They turn wallet balances into spend at existing merchant acceptance points. That makes cards a clear current solution to go from holding stablecoins to using them in daily payments.
What slows product launches today?
Fintechs often have to assemble the wallet layer, card program, and compliance stack separately. That adds engineering time, raises launch cost, and slows distribution.
See: Quantum Safe Stablecoins Meet Real Time Finance Needs
Why does this launch stand out?
It does not start from zero. Wirex already has user scale and card infrastructure. Crossmint already cut build time in its earlier Wirex integration. That gives the launch a stronger operating base than a typical partnership announcement.
Talking Point
As stablecoin cards grow, which layer gains the stronger position: the wallet, the issuer, or the firm that can package both into one launch stack?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Retail Identity Verification: Stopping Return Fraud and Theft at the Point of Sale
March 29, 2026
Image: Unsplash/Priscilla Du Preez
Retail shrinkage — the industry term for inventory loss through theft, fraud, and administrative error — costs global retailers hundreds of billions of dollars annually. Within that figure, return fraud has grown into one of the most consistently underestimated line items. Unlike shoplifting, which is immediately visible and operationally disruptive, return fraud is quiet. It enters through the customer service desk, processed by a staff member under time pressure, usually accepted to maintain a positive customer interaction, and absorbed as a cost of doing business. Organized retail crime operations have identified this as a reliable revenue stream, and the scale of exploitation has grown accordingly.
The technology capable of changing this dynamic is retail identity verification: a systematic process of confirming the identity of customers at specific transaction touchpoints — most critically the returns desk — using automated document scanning rather than relying on staff judgment or paper-based log systems. When a fraudulent returner knows their identity is captured and matched against a return history database, the economics of the fraud change. The deterrent effect operates before any individual transaction is evaluated, and the audit trail it creates enables pattern detection that no manual system can replicate at the speed or scale required.
What is also important here is that return fraud does not operate in isolation. The same individuals and organized groups responsible for fraudulent returns are frequently responsible for the theft that enables those returns. Stolen merchandise returned for cash or store credit creates a clean revenue cycle for organized retail crime. That’s why identity verification at the returns desk intercepts not just the return itself but the downstream incentive that makes the preceding theft financially worthwhile.
What Is Retail Identity Verification?
Retail identity verification is the practice of confirming a customer’s identity at a point-of-sale or service transaction using a machine-readable identity document. In the returns context specifically, it means capturing the returning customer’s name and identity document details — typically via OCR, or Optical Character Recognition, the technology that extracts text from photographed documents — and recording that data against the return transaction in the retailer’s system.
In other words, it replaces the manual alternative — a staff member writing a customer’s name and address on a paper return form, or typing it into a terminal — with an automated scan that is faster, more accurate, and creates a structured, searchable record. The identity data captured is not used to authorize or deny the individual transaction in isolation. Its value lies in the cumulative pattern it reveals: a single customer attempting multiple no-receipt returns across locations, or a rotating group of individuals returning the same high-value items across store clusters.
Apart from this, retail identity verification in the age-restricted sales context serves a different but related function. Capturing identity at the point of sale for alcohol, tobacco, vaping products, or lottery tickets creates a documented compliance record that protects the retailer in the event of a licensing inspection or underage sale allegation. Thanks to this, a single scanning infrastructure can serve both loss prevention and compliance functions simultaneously, reducing the cost per use case when deployed across a multi-function retail operation.
The most widely used document capture methods are MRZ reading — the Machine Readable Zone, a standardized two-line strip at the bottom of passports and many national identity cards — PDF417 barcode scanning from the reverse of driving licences, and front-of-card OCR for documents without machine-readable zones. A capable retail scanning solution should handle all three, covering the range of documents customers are likely to present across the retailer’s operating region.
The Return Fraud Problem: Why Manual Controls Have Failed
Understanding why manual return controls consistently fail is essential context for designing an effective automated alternative. The failure modes are structural, not simply the result of inadequate staff training.
The No-Receipt Return Exploit
The majority of return fraud operates through the no-receipt return pathway. Retailers offering goodwill returns without a receipt — a policy designed to serve legitimate customers who have lost their proof of purchase — inadvertently create a channel through which stolen merchandise can be converted to cash or credit without any connection to the original transaction. From a financial perspective, restricting no-receipt returns too aggressively damages customer satisfaction and increases returns friction for honest customers. Capturing identity at the no-receipt return point resolves the dilemma: the policy can remain customer-friendly while the identity record creates the accountability that deters systematic abuse.
Cross-Location Fraud Rings
Organized retail crime groups exploit the siloed nature of most retail loss prevention systems. An individual executing multiple returns at different store locations generates no alert in any single store’s records, even if their cumulative return volume is clearly abusive. Identity capture linked to a centralized return history database changes this dynamic entirely: the pattern that is invisible store-by-store becomes immediately visible at the network level. These mechanics boost the detection rate for organized cross-location fraud without requiring any change to individual store return policies.
Staff Judgment Under Transaction Pressure
Return desk staff are typically trained to prioritise customer experience and process transactions efficiently. Challenging a customer on a suspicious return requires judgment, confidence, and a willingness to create conflict — qualities that vary significantly across individuals and that diminish under queue pressure. Automated identity capture removes the judgment element: the scan is a standard part of the process applied to every return, not a discretionary challenge that a staff member must decide to initiate. This positively affects consistency and removes the interpersonal friction that causes staff to avoid challenging transactions they should be questioning.
When Retail Identity Verification Makes the Strongest Case
Identity verification at the point of sale delivers its strongest returns in specific retail contexts. Here’s when the investment is most clearly justified:
- High-value electronics and consumer goods retail. Electronics, gaming equipment, power tools, and premium beauty products are the categories most targeted by organized return fraud, because their high unit value makes individual return transactions financially significant and their resale market is robust. Deploying identity verification at the returns desk for transactions above a defined value threshold — or for all no-receipt returns — concentrates the deterrent where the financial exposure is highest.
- Multi-site retail chains with centralized loss prevention. The full value of identity verification in a return fraud context is only realized when identity data is aggregated centrally and cross-referenced across locations. A chain with a single store gains a deterrent effect; a chain with fifty locations gains a network-level detection capability that can identify cross-location fraud rings within days of their first transactions.
- Age-restricted product categories. Alcohol, tobacco, vaping products, and lottery ticket retailers face dual compliance obligations: age verification at the point of sale and, in many jurisdictions, identity capture requirements tied to licensing conditions. A scanning infrastructure serving both functions delivers compliance value across both regulatory frameworks from a single integration point.
- High-return-rate product categories. Clothing, footwear, and furniture categories with inherently high legitimate return rates are also disproportionately targeted by wardrobing fraud — the practice of purchasing an item, using it once, and returning it as unworn. Identity capture combined with return frequency analysis can identify individuals whose return patterns are statistically inconsistent with legitimate shopping behaviour across this category.
What a Reliable Retail Identity Verification System Should Have
When evaluating identity verification solutions for retail deployment, pay attention to the following criteria:
- Multi-format document reading capability. You should look for systems that read MRZ strips, PDF417 barcodes, and front-of-card OCR text, covering the full range of identity documents customers are likely to present across the retailer’s geographic footprint.
- On-device processing with no cloud image transmission. Document images contain personal data. The system should process captured document data locally, returning structured fields — name, date of birth, document number — without transmitting raw document images to external servers. This is both a data protection requirement and a practical security measure.
- Centralized return history database with cross-location matching. The detection value of identity verification in a return fraud context depends on centralizing return records and querying that database in real time at every scan. You should attentively analyze whether the vendor’s architecture supports multi-site data aggregation and whether the query latency is low enough to avoid adding visible delay to the return transaction.
- Configurable alert thresholds by return value and frequency. Not every return warrants the same response. The system should allow the retailer to configure alert triggers — a specific number of returns within a defined period, a cumulative return value threshold, or a combination — that generate a staff notification or supervisor escalation rather than applying uniform scrutiny to every scan.
- EPOS integration with minimal workflow disruption. Typical integrations include direct API connection to EPOS — Electronic Point of Sale — systems, tablet-based standalone operation for dedicated return desks, and SDK embedding within existing retail management applications. It will be helpful to confirm that the integration path does not require modifications to the EPOS that would affect the primary sales workflow.
- Data retention and privacy compliance documentation. Identity data captured at the returns desk is personal data subject to GDPR and equivalent frameworks. We recommend confirming the vendor’s data retention policy, the legal basis for processing, and their approach to data subject access requests before deployment, as these obligations fall on the retailer as the data controller.
How to Implement Identity Verification at the Returns Desk
Implementing identity verification in a retail returns workflow requires attention to three dimensions simultaneously: the technical integration, the operational process design, and the customer communication approach. Neglecting any one of these dimensions will limit the effectiveness of the others.
Image Unsplash, Simon Hattinga Verschure
Define the Scan Policy Before Deployment
Before any technology is deployed, it is crucial to define precisely when identity capture is required: all returns without a receipt, all returns above a defined transaction value, all returns in specific high-risk product categories, or some combination. This policy decision shapes the entire implementation — the workflow design, the staff training, and the customer communication. We recommend starting with a narrowly defined scope — no-receipt returns above a value threshold — rather than attempting to capture identity on every return transaction from the outset, as this allows the team to refine the process before extending it.
Train Staff on the Customer Communication Script
The most operationally sensitive element of identity verification at the returns desk is not the technology — it is how staff present the requirement to customers. A customer who understands that identity capture is a standard policy applied consistently to all no-receipt returns is significantly more likely to comply without conflict than one who perceives it as a personal accusation. Staff training should include a specific, practiced script for introducing the scan request, handling common objections, and escalating to a supervisor when a customer refuses. It will be helpful to role-play these interactions during training rather than relying on written guidance alone.
Communicate the Policy Visibly at Return Points
Displaying clear signage at the returns desk indicating that identity may be required for no-receipt returns serves two functions simultaneously. First of all, it sets customer expectations before the interaction begins, reducing the likelihood of conflict when the scan is requested. Secondly, it functions as a deterrent in its own right: a fraudulent returner who sees that identity will be captured may elect not to proceed with the transaction before any staff interaction occurs. Given this, the signage itself delivers measurable loss prevention value at zero incremental operational cost.
Conclusion
Return fraud and organized retail theft are not problems that goodwill policies and staff vigilance can solve at scale. The economics favour the fraudster in any system where returns are processed on trust, where no identity record is created, and where pattern detection requires manual cross-referencing of paper logs. Retail identity verification changes those economics by creating a structured identity record at the transaction point, aggregating that data centrally, and making cross-location and cross-time patterns immediately visible to loss prevention teams.
See: LinkedIn Identity Checks Show The New Privacy Cost Of Trust
The implementation investment is modest relative to the shrinkage it addresses. A well-deployed system pays for itself within the first promotional season it covers by reducing the no-receipt return abuse that concentrates around high-value product launches and seasonal promotions. Apart from this, the compliance value it delivers for age-restricted product categories converts what might otherwise be a single-purpose loss prevention tool into a shared infrastructure investment with returns across multiple operational functions. Given this, retailers evaluating their loss prevention strategy should treat identity verification at the returns desk not as a future consideration but as a near-term priority.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
NCFA Weekly Fintech Intelligence Mar 21-27, 2026
March 27, 2026 | NCFA Fintech Whisperer Weekly Intelligence | Digital Assets Blockchain And Tokenization, Regulation And Policy, Payments And Market Infrastructure, Risk Compliance And Regtech
Image: Freepik
This live weekly NCFA intelligence page tracks financial technology developments that significantly affect how fintechs build, sell, raise capital, and operate under scrutiny. Coverage prioritizes Canada and includes global events that directly influence competitive conditions, market access, and execution realities across fintech sectors. This page will be updated throughout the week with market movers in a live format and then each week we'll close the prior week's contents in prep for the upcoming week, and continue on a rolling basis. (Missed prior week's Fintech Whisperer? (December 6-12, 2025, December 13-19, 2025, January 1-9, 2026, January 10-16, 2026, January 17-23, 2026, January 24-30, 2026, January 31-February 6, 2026, February 7-13, 2026, February 14-20, 2026, February 21-27, 2026, February 28-March 6, 2026, March 7-13, 2026, March 14-20, 2026).
Weekly Fintech Market Intelligence Mar 21 - 27, 2026
Digital Assets, Blockchain And Tokenization
RBA Moves Tokenised Market Work Beyond Pilot Stage
Mar 25, 2026, Australia
- Project Acacia covered tokenised bonds, repo, deposits, and funds with settlement using stablecoins, deposit tokens, wholesale CBDC, and ESA balances.
- The RBA tested issuing wholesale CBDC onto external ledgers to examine cross-ledger settlement.
- Next step is a longer sandbox focused on testing how tokenised money connects with existing systems such as RITS.
The RBA is moving past short pilots. The focus now is how tokenised money works with existing settlement systems and what holds up under real use.
Capital Markets And Funding
SEC Approves CAT Amendment Removing Online Query Tool
Mar 27, 2026, United States
- The SEC approved a CAT amendment that removes references to the online targeted query tool from the CAT NMS Plan.
- Regulators will continue to access CAT data through user defined direct queries and bulk extracts instead.
- The earlier CAT cost savings amendment estimated $2.5 million to $3.5 million in savings from eliminating the online targeted query tool.
The SEC is narrowing one regulator facing CAT access path in the name of cost savings while keeping other query methods in place. That doesn't change trading rules, but it can change how efficiently regulators search market activity and build surveillance cases, and to that extent there are some concerns around reduced oversight.
CIRO Finalizes Fully Paid Securities Lending Rule Amendments
Mar 26, 2026, Canada
- CIRO sets new rules and eligibility criteria for fully paid securities lending and financing arrangements.
- All existing exemptions end on Apr 27, 2026, and dealer programs must comply with the updated framework.
Fully paid lending goes from exemption based programs to a standard rule set. Dealers need to update inventory funding structures and controls before the effective date.
US House Holds Tokenization Hearing On Capital Markets Modernization
Mar 25, 2026, United States
- The U.S. House Financial Services Committee held a hearing on tokenization and the future of securities markets.
- The hearing treated tokenization as a capital markets modernization issue rather than a niche digital asset topic.
- Witnesses included DTCC, Nasdaq, SIFMA, Blockchain Association, and Plume Network.
- The discussion put exchange infrastructure, market plumbing, and securities treatment into the same policy frame.
Tokenization is now being discussed inside the core U.S. capital markets policy process, with major market infrastructure and exchange voices at the table. That raises the odds that tokenized securities will be treated as a market structure question tied to trading, clearing, settlement, and custody, not only as a digital asset issue.
New York Stock Exchange And Securitize Sign MOU To Support Tokenized Securities
Mar 24, 2026, United States
- New York Stock Exchange and Securitize agree to a memorandum of understanding focused on digital transfer agent infrastructure and broker dealer participation for issuer sponsored tokenized securities on an NYSE affiliated digital trading platform.
- Securitize is named as the first digital transfer agent eligible to mint blockchain native securities for corporate or ETF issuers on the platform.
- NYSE plans a digital transfer agent program intended to support on chain settlement of tokenized security transactions.
- Securitize Markets is expected to become one of the broker dealer participants on the platform.
Lynn Martin, President, NYSE Group: “As we explore how tokenization can enhance capital markets, it is critical that new infrastructure is developed in a way that preserves the trust, transparency, and protections investors expect. Securitize brings deep experience in digital asset infrastructure and transfer agency, making them a strong partner in helping design this next generation of market structure.”
Payments And Market Infrastructure
RBI Sets Payments Vision 2028 With Fraud, Cross Border, And Switching Priorities
Mar 27, 2026, India
- RBI’s Payments Vision 2028 sets the course through December 2028 under the theme “Shaping India’s Payment Frontier.”
- The plan includes a shared responsibility framework for unauthorised digital payment fraud, a Cyber Key Risk Indicators framework for non bank payment system operators, and a review of cheque security and electronic cheques.
- RBI also plans a review of the cross border payments framework, will examine a single window authorisation process under the PSS Act and FEMA, and will explore a Payments Switching Service to let customers switch providers more easily.
India is moving from payment expansion to payment control. Fraud liability, cyber resilience, cross border authorisation, and switching now sit closer to the centre of the next build cycle for banks, payment firms, and fintech infrastructure providers.
Visa Joins Canton Network To Support Private Onchain Payments
Mar 25, 2026, Global
- Visa says it will join the Canton Network as a Super Validator, becoming the first major global payments company in the network’s validator group.
- The move will support stablecoin payments, settlement, and treasury use cases for banks and financial institutions.
- Canton is built to let institutions use shared blockchain infrastructure without exposing sensitive transaction data.
- Stablecoin settlement activity is running at an annualized $4.6B and that it supports more than 130 stablecoin-linked card programs across more than 50 countries.
Visa is getting into the infrastructure layer. Privacy has been one of the main blockers for banks and large financial institutions using shared blockchain systems. If that barrier starts to fall, onchain payments, settlement, and treasury activity can move closer to core financial market infrastructure.
Bank of Canada Releases 2025 FMI Oversight Activities Annual Report
Mar 24, 2026, Canada
- Bank of Canada publishes its Oversight Activities for Financial Market Infrastructures 2025 Annual Report covering designated clearing and settlement systems.
- The notice highlights improvements designated FMIs made to risk management practices in 2025.
- The notice also highlights ongoing and new expectations set by the Bank for designated FMIs in 2026 and beyond.
FMI oversight expectations set the operating floor for payments and clearing infrastructure, which can flow through to participant requirements, vendor controls, and resilience planning.
BMO Introduces Tokenized Cash Platform With CME And Google Cloud
Mar 24, 2026, Canada / United States
- BMO says it is the first bank to offer CME Group’s tokenized cash solution on Google Cloud Universal Ledger.
- The platform is designed to support 24/7 institutional movement of value for margin, collateral, trading, and settlement workflows.
- Clients can convert dollars into a tokenized instrument for use with margined products at CME Group.
- The platform also lays the groundwork for tokenized deposits to support broader payment and treasury use cases.
This brings tokenized cash into live institutional money movement. It's a major Canadian bank using tokenized cash to support real margin, collateral, and settlement flows on a continuous basis. Tokenized money is moving deeper into market infrastructure and gives regulated institutions a way to move value when markets need it 24/7, not only during banking hours.
Deloitte And Stablecorp Bring QCAD Into Canadian Bank Workflows
Mar 23, 2026, Canada
- Deloitte Canada and Stablecorp announced an alliance to deploy QCAD-based stablecoin infrastructure with Canadian financial institutions.
- The integration targets bank use cases including liquidity management, inter-bank clearing, cross-border payments, and treasury operations.
- Deloitte positions QCAD as a Canadian-compliant stablecoin that can plug into existing banking systems and workflows.
- The timing aligns with expected progress on Canada’s federal stablecoin framework and Bill C-15.
Deloitte and Stablecorp are building integration paths for financial institutions to use QCAD inside existing systems. The work targets clearing, treasury, and cross-border flows, but no deployments or pilots have been confirmed yet. Treat this as a signal that stablecoin infrastructure is being wired into bank workflows ahead of regulatory clarity.
Regulation and Policy
UMIR Guidance Update Project Reaches Completion
Mar 27, 2026, Canada
- The UMIR Guidance Update Project reaches completion on Mar 27, 2026, pointing dealer members to updated guidance notes published across Phase 1 and Phase 2.
- The package focuses on clarity and usability, with non material edits that improve accuracy and make guidance easier to find and apply.
- A small subset of guidance notes does not get republished because they require material changes or no longer apply.
This closes a multi phase refresh and sets a new baseline for dealer compliance interpretation across UMIR topics, which can flow into policy mapping, training, and vendor rule logic.
Canada Expands Bank Of Canada Mandate To Stablecoins And Open Banking
Mar 26, 2026, Canada
- Bill C-15 received Royal Assent and expands the Bank of Canada’s role in digital finance and payments.
- The Bank will supervise stablecoin issuers and oversee the consumer-driven banking framework.
Bill C-15 puts stablecoins, payments, and consumer-driven banking under a more unified central bank structure. Firms now need to plan for supervision across digital money and data-sharing models, not treat them as separate tracks.
CIRO Sets Conditions For Dealer Access To Event Contracts
Mar 26, 2026, Canada
- CIRO sets how its rules apply when dealers trade or facilitate event contracts and prediction markets.
- Dealers must notify CIRO before offering these products and meet terms tied to authorization.
- Contracts tied to elections or political events are not permitted, and products must meet defined restrictions including minimum term length.
Event contracts are now included in a defined Canadian dealer framework. Firms need to clear product design, compliance, and notification before going live.
FCA Sets Out Next Phase Of Smarter Regulation
Mar 26, 2026, United Kingdom
- The roadmap targets faster authorisations using AI, including use of generative AI to review documents firms submit, with rollout across authorisations and supervision.
- It also outlines a new sandbox environment to test automated data feeds between firms and the regulator, aimed at cutting manual work and improving timeliness and reliability of information.
- The update includes a reporting burden reduction package that removes three regular data returns and reduces the frequency of another, plus a larger move of regulatory tasks into My FCA.
- A linked 2026/27 perimeter report calls for modernisation of payments regulation to mitigate risks while supporting innovation.
AI assisted authorisations and automated reporting feeds can shorten approval timelines and change how supervision picks up issues from live data.
FCA Consults On Simplified Financial Advice To Expand Access
Mar 25, 2026, United Kingdom
- FCA consults on changes intended to make it easier for firms to deliver simplified forms of individualized financial advice for consumers with more straightforward needs.
- FCA proposes consolidating suitability expectations, clarifying flexibilities around using sufficient information, and changing how ongoing advice reviews work, including moving away from a fixed annual review toward periodic reviews based on client needs.
- The consultation also opens a discussion on the future of trail commission and it states qualification standards and adviser charging rules remain unchanged.
- FCA sets the consultation close date as May 22, 2026 and links the full consultation PDF CP26/10 Simplifying the Pensions and Investment Advice Rules
Sarah Pritchard, Deputy Chief Executive, Financial Conduct Authority: “We want to see more people getting supported, who aren’t currently, and a market that innovates and offers tailored services to meet differing consumer needs.”
CIRO Publishes Enforcement Document Production Guide
Mar 25, 2026, Canada
- The Document Production Guide sets Enforcement Staff expectations for producing documents, records, and electronically stored information in response to a Request for Information issued under IDPC Rule 8100 or Mutual Fund Dealer Rule 6.
- The guide takes effect May 1, 2026.
- The guide frames preservation of data and metadata as part of maintaining integrity and reliability of records, and it aims to reduce clarification and resubmission cycles during investigations.
Dealers and fintech vendors that support eDiscovery, recordkeeping, surveillance, and investigation response workflows now have a clear CIRO baseline for data handling, metadata preservation, and production process design.
California Jury Opens A New Liability Lane For Addictive Platform Design
Mar 25, 2026, United States
- A Los Angeles jury found Meta and Google liable for harming a 20 year old plaintiff through negligent platform design and failure to warn, awarding $6M in damages. Reuters reports Meta is responsible for 70% of the award and Google for 30%.
- Reuters says the case serves as a bellwether for thousands of similar California state claims, while the related federal multidistrict litigation includes more than 2,400 lawsuits against social media companies over youth harm.
- The ruling is important because the jury accepted a design based theory tied to engagement mechanics instead of treating the dispute only as a content moderation issue. That raises the pressure on recommendation loops, infinite scroll, autoplay, and similar retention features.
- Pressure is building on a second front. On Mar 24, a New Mexico jury ordered Meta to pay $375M after finding it liable for misleading users about platform safety and endangering children. Reuters reports a second phase starts May 4 and could seek court ordered changes to Meta’s platforms.
- Meta has already warned investors that a number of U.S. youth related trials are scheduled for 2026 and may result in a material loss, which puts this issue inside formal enterprise risk disclosure rather than public relations damage control alone.
Courts are beginning to test whether engagement led product design itself can create liability at scale. If that theory survives, the impact reaches beyond social media. Any digital product that depends on compulsive use patterns, especially where minors or vulnerable users are involved, faces legal scrutiny and compliance costs.
August 6 update: A New Mexico court ordered Meta to establish a US$567M abatement fund, bringing the financial remedies in the case to US$942M, and imposed youth-safety requirements covering age assurance, teen usage and notifications, adult-minor contact controls and AI-chatbot interactions involving minors. Meta plans to appeal.
CIRO Tightens Guidance On Third Party Electronic Market Access
Mar 24, 2026, Canada
- CIRO issued guidance on third-party electronic access to marketplaces through direct electronic access, routing arrangements, and order execution services.
- The note ties the guidance to UMIR Rules 6.2, 7.1, 7.13, and 10.16, covering order identifiers, trading supervision, direct electronic access, and gatekeeper obligations.
- CIRO says the framework addresses risks tied to electronic access, including liability, credit, market integrity, sub-delegation, technology or systems, and regulatory arbitrage.
- The guidance also gives examples on order identification and designation, including use of the jitney marker, and highlights changes affecting order execution services, direct electronic access, and routing arrangements.
As more execution flows move through automated and intermediated channels, CIRO is making it clearer who is responsible, how orders must be marked, and what supervision has to look like. That raises the operating standard for dealers, trading desks, legal and compliance teams, and firms providing marketplace access. Electronic access remains open, but responsibility for supervision, order marking, and control cannot blur as more parties exist between the client and the marketplace.
Bipartisan Senate Bill Targets Sports Prediction Contracts
Mar 23, 2026, United States
- Senators Adam Schiff and John Curtis introduced the Prediction Markets Are Gambling Act to prohibit CFTC registered entities from listing contracts that resemble sports bets or casino style games.
- The press release says a March Madness winner contract has already exceeded $100 million in trading volume and Super Bowl prediction market volume topped $1 billion in 2026.
- The bill argues these contracts are being offered in all 50 states, including states that restrict or prohibit sports betting.
- The proposal would remove ambiguity in the Commodity Exchange Act and push sports style event contracts back under state gambling control rather than federal derivatives oversight.
This raises the risk that sports prediction markets face a direct statutory limit before the category settles into a stable regulatory path. Congress is now testing whether these contracts belong inside federal market infrastructure or back inside state gambling rules. Important for exchanges, prediction market operators, legal teams, and investors betting on event contracts as a durable product category.
AI Finance And Data Governance
US Treasury Launches AI Innovation Series For Financial Stability
Mar 23, 2026, United States
- Treasury says the Office of the Financial Stability Oversight Council and Treasury’s Artificial Intelligence Transformation Office launched an AI Innovation Series, described as a public private initiative focused on financial system strength and resilience.
- The series will run across four roundtables that convene financial institutions, technology firms, regulators, and specialized experts to focus on high value AI use cases and practical approaches for scaling AI while preserving safety and soundness.
- Treasury frames AI adoption as increasingly embedded across fraud detection, cybersecurity, credit underwriting, and operational risk management, and it links the series to how governance and supervisory approaches keep pace with enterprise AI deployment.
This series puts AI governance in focus for banks and fintechs, especially around model risk, cybersecurity controls, and how supervisors assess AI driven decisioning inside core workflows.
Banking And Credit
China Pushes Blockchain In Bank Tax Lending Model
Mar 27, 2026, China
- China’s State Taxation Administration and National Financial Regulatory Administration jointly told local tax authorities and banks to deepen the bank tax interaction model and encouraged the use of blockchain and privacy computing for compliant innovation.
- The notice tells banks to improve credit models, raise loan approval efficiency, and expand financing support for compliant taxpayers, especially small businesses.
- An official explainer says the bank tax interaction mechanism had delivered 45.1772 million loans totalling 15.7 trillion yuan by the end of 2025.
China is using tax data, regulated data sharing, and specific technologies to push more SME credit through banks. That is a lending infrastructure signal, not just a blockchain headline.
Conclusion
Regulators are setting clearer boundaries, and infrastructure is moving into production at the same time. That combination raises the cost of getting it wrong and shortens the window to get it right. Teams need working controls, real vendor oversight, and systems that hold up under load before scaling anything customer facing. NCFA offers various curated resources to help founders and investors stay current on developments that impact fintech markets, subscribe to NCFA weekly newsletter updates, view a rundown of current fintech news and insights, or dive into the latest fintech industry research.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
CoinPayments Taps OSL To Expand Across APAC
Mar 27, 2026 | NCFA Fintech Market Activity | Payments And Money Movement
Image: Freepik
Local APAC Rails and Fiat Off Ramps
On March 27, 2026, CoinPayments partnered with OSL Group to expand in APAC. The deal gives CoinPayments access to local payment rails and fiat off ramps across the region.
APAC is already a large and fast growing crypto market. Chainalysis' 2025 global crypto adoption reported that APAC transaction volume increased to $2.36T, up from $1.4T in a 12 month period ending June 2025. Crypto payments need merchants for local conversion, payout, and settlement that works in the market they serve.
CoinPayments brings real scale into that push. The company said earlier this month that it has processed more than $50B in crypto transactions and supports more than 250,000 merchants globally.
OSL brings a different advantage. After completing its Banxa acquisition in January 2026, OSL said its regulatory footprint expanded to more than 40 trading and payment licenses and registrations across the United States, Canada, the European Union, the United Kingdom, and Australia.
That gives the partnership a clear commercial logic. CoinPayments brings merchant reach. OSL brings regulated payout and conversion infrastructure. The March 27 announcement also builds on CoinPayments’ existing work with Banxa, so the operating link was already there before this APAC push.
Talking Point
In crypto payments, which creates more leverage over time: merchant reach or control of local payout and off ramp infrastructure?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
McKinsey AI Vulnerability Reveals Enterprise Risk
Mar 26, 2026 | NCFA Insight | Artificial Intelligence And Data
Internal AI Security Gaps Expose Real Operational Risk
On March 1, 2026, CodeWall, a security research firm focused on AI systems, privately reported security gaps to McKinsey. The firm said its agent found 22 unauthenticated endpoints, then chained a SQL injection issue and other weaknesses to gain read and write access across the production environment. CodeWall said the reachable data included 46.5 million chat messages, 728,000 files, 57,000 user accounts, 384,000 AI assistants, and 94,000 workspaces. It also said prompts, model configurations, and RAG related data were reachable.
On March 2, 2026, McKinsey acknowledged the findings and patched the unauthenticated endpoints the same day.
On March 9, 2026, CodeWall publicly shared research on vulnerabilities in McKinsey’s internal AI platform Lilli.
On March 11, McKinsey released this statement about the vulnerability and that a third party forensic review found no evidence that unauthorized parties accessed client data or client confidential information.
What Actually Happened
Public API documentation appears to have exposed a map of the system. Some endpoints reportedly required no authentication. One of them allegedly allowed database manipulation through JSON keys, which opened the door to SQL injection. From there, CodeWall said it could determine live production data and reach much deeper parts of the platform.
This incident doesn't point first to a model failure. It points to ordinary application security weaknesses around an AI system that had become deeply embedded in internal work.
McKinsey’s Response and What It Means
McKinsey didn't confirm the full scale of the researcher claims. Instead, it focused on the response. The company said it fixed the issue quickly and found no evidence that unauthorized parties accessed client data or client confidential information.
See: OSFI and GRI Workshops Reveal What Regulated AI Needs
Having said that, the reported scale of reachable internal material was large enough to raise questions about internal knowledge exposure, employee work patterns, and intellectual property concentration in one system.
CodeWall said prompt and configuration layers were reachable. If true, it means a bad actor could have potentially altered how the system retrieves information or generates answers. In an internal AI tool, that can create wrong outputs that look normal to staff.
That's where this type of incident becomes more useful for fintechs and financial firms. A publicly visible outage gets noticed whereas quietly altered outputs may not. In regulated environments, that can affect approvals, reviews, client treatment, policy interpretation, and internal decision support before anyone spots the pattern.
The Wider Lesson For Financial Services
Banks, lenders, insurers, wealth firms, and fintechs are building similar internal AI layers right now. They connect those tools to policy documents, research, support logs, internal files, and customer related workflows because it saves time and helps staff move faster.
See: Gilles Brassard Turing Award Puts Quantum Security In Focus
But that convenience comes with risk given that AI often pulls sensitive access into one place. If permissions are weak, endpoints are exposed, or prompt controls aren't protected, one internal tool can become a wider point of failure.
A key lesson founders and operators should take from this case, is to ask whether the application around it is locked down, whether prompts and retrieval rules are treated as sensitive assets, whether permissions are tight, and whether anyone has tested the system the way an attacker would.
Conclusion
Enterprise AI doesn't erase old security mistakes. It can magnify them by concentrating data, access, and trust inside a single interface.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Crypto Self Custody Growth And User Behaviour Data
Mar 26, 2026 | NCFA Feature | Digital Assets Blockchain And Tokenization
Data Shows Trend Towards Self Controlled Crypto Custody
On March 24 2026, a Cointelegraph Research and Trezor report on self custody behaviour put hard numbers behind the trend that's been building for years. Trust in centralized platforms keeps falling. At the same time, self custody is moving out of the expert corner of crypto and into the mainstream for serious users.
The report draws on 375 survey responses and pairs that data with real world exchange failures, wallet design analysis, and a sober look at where users still get hurt. People have watched enough platforms fail, and now they're changing how they hold assets.
1. Trust In Exchanges Declines at Scale
A combined 65% of respondents say they trust centralized exchanges less than they did four years ago. Of that group, 45% say they trust them much less and 20% say they trust them a bit less
33% point to exchange hacks as the main driver. 27% point to collapses such as FTX. Another 26% point to regulatory restrictions.
The trend matches the market’s recent history. FTX exposed an estimated $8B hole in customer funds. QuadrigaCX collapsed amid fraud and broken internal controls. Mt. Gox lost about 850,000 BTC after years of theft and system failures.
The deeper issue is structural. Centralized platforms gather large pools of assets behind a small number of operational and administrative control points. That concentration makes them efficient in good times, but it also makes them attractive targets when something goes wrong. One breach, one fraud, one breakdown in controls, and the damage can spread fast.
2. Users Change Behaviour Fast
Users aren't just frustrated. They're acting on it.
A striking 85% of respondents agree with the phrase “not your keys, not your coins.” That includes 63% who strongly agree. It's becoming standard thinking for people who want lasting control over digital assets.
See: BitGo Adds USDCx And cBTC Custody On Canton
When asked why they use self custody, 57% say private key ownership is the main reason. Another 24% say maximum security drives the decision.
Most respondents say they would not leave assets on a custodial exchange for more than one month, even without an immediate panic event. In practice, exchanges are starting to look less like vaults and more like temporary access points.
3. Hardware Wallets Now Mainstream
One of the clearest data points in the report is that 36% of respondents actively use hardware wallets.
A hardware wallet keeps your private keys off your phone or computer. You set up a transaction on your device, then confirm and sign it on the hardware wallet. The keys never leave the wallet. This lowers the risk of malware, hacks, and common theft methods.
Hardware wallets protect your keys, but they don’t protect your decisions. They can confirm a transaction comes from your device, but they can’t always tell if you fully understand what you’re approving.
4. Self Custody Still Carries Hard Risk
Phishing is still one of the biggest risks. Attackers copy real wallet brands, fake support messages, and trick users into giving up their recovery phrase. Once that’s exposed, the funds are usually gone.
Blind signing is another major issue, especially with smart contracts. Users approve transactions without fully understanding what they do. The report highlights a real case where a malicious approval led to a $1.4B loss. That alone shows self custody is not just about buying a device and feeling safe.
See: The Role of a Crypto Wallet in Canada’s Digital Finance Future
Supply chain risk is also real. Some people buy wallets from unofficial sellers and receive devices that have been tampered with or come with preset seed phrases. It compromises the user before self custody even begins.
Physical security is becoming more serious as well. The report cites 74 publicly reported physical attacks on crypto holders in 2025, with at least 9 already recorded in January 2026. These are real world attacks tied to visible holdings and weak operational privacy.
Then there is the quieter problem that rarely gets enough attention, which is backup failure. The report estimates that roughly 10% of circulating Bitcoin supply may already be lost because users mismanage recovery material or lose access entirely. It reminds the market that the biggest long term risk in self custody may not be theft alone. It may be preventable self inflicted loss.
5. Regulation Adds Pressure
Another useful part of the report is its treatment of regulatory risk. Users are not only responding to hacks and insolvencies. They are also responding to the fact that access to funds can be interrupted, such as payment rail seizures, exchange shutdowns, withdrawal suspensions, and enforcement actions that cut off access to custodial accounts. Different cases arise from different legal and operational reasons.
Users who worry about counterparty exposure, platform freezes, or policy driven restrictions increasingly want a self custody setup they can control directly.
What Fintech Builders Can Learn
Digital wallets are becoming core control layers in digital asset finance. That assumes customers will keep meaningful balances on platform for long periods of time.
The next real product gap is not only stronger key storage, but clearer intent verification. Users need to know what they are signing, why they are signing it, and what will happen next. That means readable transaction flows, better simulation tools, stronger warnings, clearer address handling, and far less dependence on users interpreting raw contract data on the fly.
Security is central to the user experience. The firms that reduce confusion, expose hidden risk, and make recovery practices easier to manage will offer a match better product experience than companies that assume security begins and ends with cryptography.
See: Takeaways from the SEC’s Crypto Custody Roundtable
Finally, distribution and engagement models will keep changing as assets move off centralized platforms and into user controlled environments. Markets are evolving toward wallet centered ecosystems, service layers, and infrastructure that works with user sovereignty rather than around it.
Ownership does not create security on its own. Security comes from repeated good practice. Users need to verify transactions carefully, protect recovery material, source devices properly, and think through physical as well as digital threat models. Put differently, self custody is not a static product state. It is an operating discipline.
Closing Thought
Self custody is no longer a niche behaviour reserved for maximalists, techies, and power users. It is becoming a natural response to broken trust in centralized custody. It moves responsibility away from institutions and toward individuals, which means the next generation of financial products must do more than secure assets. They must help people operate safely in a digital finance world.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
