Category Archives: Fintech International

C:\>DIR Hackathon 2026 Winners Put Agentic AI to Work

September 30, 2026 | NCFA Market Activity | Artificial Intelligence And Data, Risk Compliance And Regtech, Cybersecurity And Fraud, Digital Identity And Trust, Payments And Money Movement, Digital Assets Blockchain And Tokenization

C_DIR Global Agentic Regulator Hackathon 2026 final round and winners

Agentic AI Hackathon Winners, Financial Supervision And The Next RegTech Layer

On September 30, 2026, the C:\>DIR Global ‘Agentic Regulator’ Hackathon announced its 2026 winners and finalist demos after attracting 942 individual builders and 336 team submissions from more than 65 countries. Thirty six teams reached the final prototype round, including 19 from or affiliated with regulatory authorities, with projects covering market manipulation, fraud, agentic payments, smart contracts, AI advice and digital identity.

NCFA supported the inaugural hackathon as an Ecosystem Partner. What makes the results notable is that both regulators and builders spent a week turning emerging questions around autonomous financial systems into working prototypes.

Every finalist submitted code or a working application for assessment. 260 verified regulators and policymakers from more than 80 institutions across 40+ countries then selected the Final 6, which presented their solutions to 18 senior global regulatory leaders at the C:\>DIR Summit in Cambridge.

The primary question propelling the competition was how do regulators supervise software that can act?

Market Risk, Fraud and Agentic Payments Winners

1. 🥇 Team Pheonix, Securities and Exchange Board of India (SEBI), won first place for its work on market manipulation, agentic herding and financial stability. Its digital twins and trading agents are designed to let authorities "pressure test" proposed regulations in a synthetic securities market before they take effect.

2. 🥈 YU-SAM POWER, University College London, took second place with an agentic framework for assessing smart contract risk and identifying attacks, supporting more consistent enforcement and international collaboration.

3. 🥉 Rwanda Anti-Scam Team, with participants from the National Bank of Rwanda, Bank of Namibia, Proto, FNA, GLEIF and the University of Manchester, placed third with a system that uses agents to report and recover funds lost through fraud and scams in instant payment environments.

4. Team Axiom, from the State Bank of Pakistan, placed fourth with a supervisory intelligence system for agentic payments designed to identify systemic risks including agentic herding.

5. Agent Reliability Profile, from the MLCommons Financial Services Working Group, placed fifth with a standardized, testable reliability label for AI agents. Its central question is straightforward. Can an AI agent be trusted?

6. Probe, from the UK, placed sixth with a regulatory tool that uses an “Adversary” agent posing as realistic customers and a “Judge” agent to run thousands of test conversations against AI advice systems and flag potential regulatory breaches.

The vouch.finance Award went to Legis Labs, whose Agent Passport gives banks a way to check an AI agent's authority before a payment executes. Project Zeus, from the Dominican Republic's securities regulator SIMV, received an Honorary Award for a human governed, multi agent approach to detecting investment scams, engaging suspected scammers and gathering evidence for enforcement.

The six finalists shared recognition from a US$100,000 total prize pool. The Final 6 were also given an opportunity to demonstrate their work at the Singapore FinTech Festival.

Agent Identity Is Becoming a Financial Control

The projects tackled different problems, but several requirements kept appearing.

If an AI agent sends money, a financial institution needs to know which agent acted, who authorized it and whether the action stayed within that authority. If multiple trading agents begin behaving alike, supervisors need visibility into whether that behaviour is creating market risk. If an AI adviser gives unsuitable guidance, there needs to be an auditable record of what happened and where human oversight applied.

That helps explain why agent identity, traceability, auditability, human oversight and pre execution controls feature across so many of the finalist projects.

These aren't abstract governance principles once agents start touching payments, markets or regulated advice. They become operating requirements.

The six challenge areas made the same point from different directions:

  • AI driven fraud and scams
  • Agentic payments and commerce
  • Decentralized market infrastructure and smart contracts
  • Know Your Agent and digital verification
  • Market manipulation and agentic herding
  • AI enabled financial and high stakes advice

A New RegTech Layer Is Starting to Emerge

The commercial question is what happens after the prototype.

Putting these systems into production will require real data, cybersecurity controls, privacy safeguards, legal authority, model governance, procurement and integration with existing supervisory infrastructure. Cross border applications add another layer because an agent may operate across multiple firms, payment systems and jurisdictions.

That's where the opportunity becomes more interesting.

RegTech has traditionally focused on helping financial institutions interpret rules, monitor activity and demonstrate compliance. Agentic supervision creates another market for technology that helps regulators simulate markets, verify AI agents, monitor autonomous activity, test financial advice and investigate fraud.

Canada already has active policy and infrastructure work across AI, payments, digital identity, fraud and financial market oversight. Canadian fintech and RegTech companies working in these areas should be watching which of these prototypes move into pilots, standards or production environments.

NCFA covered the launch of the C:\>DIR Agentic Regulator Hackathon in July. The winners now provide an early view of what builders and regulators chose to build when given a defined supervisory problem, sandbox environments and a week to produce working solutions.

Strategic Takeaway

The interesting result isn't simply that regulators used AI at a hackathon. It's what they built.

They built systems to test markets, identify fraud, verify agent authority, monitor payments, assess smart contract risk and scrutinize AI generated advice.

As financial systems add more autonomous actors, the supervisory layer will have to become more capable too.

Agentic finance may require agentic supervision. The C:\>DIR Hackathon has now put some early working examples on the table.

Explore: C:\>DIR Hackathon 2026 winners, presentations and demos

Read: Official C:\>DIR Global Agentic Regulator Hackathon winners announcement


NCFA Canada logoThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter

 

Anthropic IPO Reveals the $518B Cost of Frontier AI

September 29, 2026 | NCFA Insight | Artificial Intelligence And Data, Capital Markets And Market Infrastructure, Venture Funding And Building

AI Image – Illustration of AI data center infrastructure and compute commitments behind the Anthropic IPO

Revenue grew 11x as compute commitments reached at least US$518B

On September 28, 2026, Reuters revealed new details from Anthropic's confidential IPO filing, showing 2025 revenue rose to about US$4.6 billion while compute and infrastructure costs reached US$7.33 billion. Anthropic has committed at least US$518 billion to cloud, compute and other AI infrastructure over roughly a decade.

Anthropic confidentially submitted its draft Form S-1 to the U.S. Securities and Exchange Commission on June 1. The filing isn't public yet, so the financial details come from journalists who reviewed the prospectus rather than an SEC document investors can inspect themselves. Anthropic also hasn't set the number of shares, IPO price or offering size yet.

The filing gives public market investors something private AI companies rarely provide. Anthropic's revenue is growing at extraordinary speed, but so are the costs and commitments needed to keep Claude running and improving. The question isn't simply whether demand for AI keeps rising. It is whether that demand can grow fast enough to absorb infrastructure contracted years before the customers arrive.

Anthropic Revenue Rose 11x As Compute Costs Tripled

Anthropic generated about US$400 million of revenue in 2024 and nearly US$4.6 billion in 2025, an increase of roughly 11.5 times in one year. Compute and infrastructure spending moved just as aggressively, rising to US$7.33 billion in 2025, about three times the prior year level. That one expense represented roughly 58% of Anthropic's US$12.65 billion of operating expenses and about 1.6 times annual revenue.

2025 metric Amount What it tells investors
Revenue ~US$4.6B About 11.5 times 2024 revenue
Compute and infrastructure US$7.33B About 159% of revenue and 58% of operating expenses
Operating loss US$8.06B Operating costs still exceeded the rapidly growing revenue base
Net loss ~US$42B Includes a large financing related accounting charge
Cash and short term investments US$20.28B Year end liquidity before later financing
Future infrastructure commitments At least US$518B Multi year cloud, compute and infrastructure contracts

The US$42 billion net loss needs a bit of context. Roughly US$34 billion came from an accounting charge tied to financing instruments that can convert into Anthropic shares. That doesn't mean Anthropic spent US$42 billion in cash operating Claude. The operating number is US$8.06 billion loss generated after revenue and operating costs are compared.

Does that mean the economics are getting worse as Anthropic grows? The current 2026 numbers make that difficult to conclude. Preliminary second quarter revenue exceeded US$11.5 billion, up from US$4.73 billion in the first quarter, and Anthropic reported positive adjusted operating income for the quarter. Those aren't audited full year results, but they show how quickly the picture is changing.

Rapid revenue growth doesn't remove the infrastructure problem, and it makes securing enough compute more urgent.

Anthropic Has Committed At Least US$518B To Compute

Anthropic expects to spend at least US$518 billion over roughly a decade across six infrastructure partners. Reuters reports that about 80% of those commitments are noncancelable or require payment regardless of how much capacity Anthropic actually uses. The known agreements include at least US$111.1 billion with Google, US$110 billion with Amazon, US$31.4 billion with Microsoft and about US$161.2 billion of Broadcom related equipment lease obligations.

Is US$518 billion debt?

No. The figure combines different cloud, compute, equipment and infrastructure contracts spread across years. Some arrangements can also be cancelled. Anthropic's agreements with xAI, for example, could involve up to US$84.5 billion of Nvidia based capacity through 2029 but are largely cancelable with 90 days notice.

The less flexible contracts create the bigger financial issue. Anthropic is reserving enormous amounts of future capacity before it knows exactly how quickly model efficiency, compute prices, customer demand and competition will change. Its filing reportedly warns that access to compute could constrain growth before customer demand does. If Anthropic is right, securing capacity early protects revenue growth. If demand, pricing or technology changes faster than expected, fixed infrastructure commitments become much harder to absorb.

BGC's compute infrastructure markets are creating price discovery and risk management around compute and memory capacity. When capacity is scarce, expensive and contracted years ahead, compute becomes something Anthropic has to finance and manage like major infrastructure, not just pay for as a cloud service.

The supplier relationships are unusual too. Amazon and Google are major Anthropic investors as well as infrastructure providers, and their platforms help distribute Claude. Microsoft also supplies infrastructure while competing across AI. These relationships give Anthropic capital, compute and distribution, but they also make a small group of large technology companies important to several parts of the business at once.

Demand is also concentrated. Nearly one quarter of 2025 revenue came from two customers, while many larger customers are not locked into long term contracts. Anthropic therefore has substantial fixed commitments on the infrastructure side while parts of its customer base remain comparatively flexible. That mismatch deserves your attention.

A US$2T Anthropic IPO Would Price Growth Years Ahead

Reports that Anthropic may seek a valuation above US$2 trillion doesn't make the company worth US$2 trillion today. The firms last reported private valuation was about US$965 billion in May, so US$2 trillion remains a target until shares are actually priced.

Anthropic could also reach public markets before its closest frontier AI rival. OpenAI CEO Sam Altman said in September that OpenAI's public market timeline now extends beyond 2026, pushing any listing to at least 2027. Anthropic could therefore become the first major frontier model company to give public investors a direct look at the economics of building and operating AI at this scale.

See: Goldman Sachs Buys Québec AI Compute Platform QScale

Preliminary second quarter 2026 revenue exceeded US$11.5 billion, while Anthropic's annualized revenue run rate reportedly passed US$65 billion by the end of July. Investors will have to decide how much of that acceleration can persist and how much compute, capital and fixed infrastructure Anthropic must secure to support it.

Reuters reports that roughly 80 of the prospectus's 261 main pages cover risks, including the possibility that more capable AI could resist shutdown, conceal information, facilitate cyber or biological misuse and cause catastrophic harm.

Talking Point

Revenue can multiply in a year while infrastructure contracts extend for a decade. The market now has to decide whether that growth can remain fast and profitable enough to justify committing hundreds of billions of dollars to compute before future demand is known.


NCFA Canada logoThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter

 

What Happens When Ethereum Stops Computing Everything?

September 29, 2026 | NCFA Insight | Digital Assets Blockchain And Tokenization, Artificial Intelligence And Data, Cybersecurity And Fraud, Digital Identity And Trust, Venture Funding And Building

AI Image – Concept illustration of Ethereum style blockchain verification network with floating innovation islands and a central cryptographic proof hub

Proofs could change what blockchains actually need to do

On September 27, 2026, Ethereum cofounder Vitalik Buterin proposed a much different future for Ethereum in his latest essay titled The Cryptographic World Computer. Instead of making every node download the same data and repeat the same calculations, Ethereum would rely far more on cryptographic proofs, data sampling and specialized computers working outside the blockchain. The network would verify more work without having to perform all of it itself.

This isn't just a distant research idea. ZK rollups already execute transactions away from Ethereum and send validity proofs back for verification, while Ethereum's PeerDAS system lets nodes check that rollup data are available without every node downloading all of it. The Ethereum Foundation now says its long term plan for the base network includes succinct execution proofs so validators can eventually verify a proof instead of executing every block again.

A key question for founders and investors is what becomes possible when a blockchain no longer has to do all of the work it is trusted to verify?

Why Every Blockchain Node May Not Need To Do Everything

Blockchains deliberately duplicate work. Independent computers receive transactions, apply the same rules and calculate the resulting state for themselves. That repetition helps participants agree without trusting one central operator, but it also costs money and limits capacity. Cryptographic proofs offer another approach. A computer or group of computers can perform a calculation elsewhere, produce mathematical evidence about the result and let the blockchain verify that evidence instead of repeating the entire calculation.

Some of this already works today where different systems are already handling different parts of the job.  Computation, data availability, execution and settlement do not all have to live in one place:

  • ZKsync Era performs computation offchain, bundles transactions and sends validity proofs back to Ethereum. Ethereum does not execute every ZKsync transaction itself
  • PeerDAS applies a similar idea to data. Since Ethereum's Fusaka upgrade went live on December 3, 2025, nodes can sample pieces of rollup data rather than making every node download every blob (collectively, those samples give the network confidence that the complete data are available)
  • Celestia takes the separation further by treating data availability as a service that's separate from execution and settlement. Its light nodes can sample small parts of a block and gain confidence that the full data were published without downloading the whole block

Ethereum's September 2026 protocol priorities point toward an even more radical version of the same idea. The Ethereum Foundation says its planned zkEVM work is intended to move execution proofs from optional to mandatory, with validators eventually verifying a succinct proof instead of executing every block again. Buterin's proposal is not that computation disappears. It is that every validator may no longer need to repeat it.

This model may influence how other blockchains are built too. A payment application could use one network for final settlement, another service for proofs and ordinary cloud infrastructure for most business logic. A privacy system could keep sensitive information outside a public ledger while proving that a required condition was met. An AI agent could perform hundreds of calculations elsewhere and submit only the authorized transaction and the evidence needed to accept it.

It's less about putting everything onchain and more about deciding what everyone actually needs to agree on. That might be ownership, transaction order, a payment, a collateral threshold, an identity condition or proof that software remained inside an approved mandate. Most application may not need global consensus at all.

What Could Founders Build If Verification Gets Cheaper?

A financial agent may compare products, calculate risk, call external services and evaluate several transactions before acting. Putting that entire process on a blockchain would be expensive and could expose information nobody needs. A more practical design could let the agent work elsewhere and prove selected facts when money or ownership changes. Did it stay below a spending limit? Was the beneficiary approved? Did the transaction satisfy a stated policy? Was the final instruction authorized (see AI agents and financial authorization)?

A correct calculation and an authorized action are different things, and financial systems will need both. Proofs could confirm parts of what an agent did while deterministic controls decide what it was allowed to do in the first place.

Another practical use is proving a financial condition without revealing everything behind it.

  • A lender might need to establish that income exceeds a threshold without publishing a borrower's complete financial history
  • An investment platform might need to confirm eligibility without exposing every identity record
  • A company might want to demonstrate that reserves or collateral meet defined rules without disclosing every underlying position

These applications would still depend on trustworthy source data, clearly written rules and legal acceptance. A cryptographic proof can't repair bad information, but it can reduce how much information has to be exposed when the underlying conditions are sound.

Proof generation could evolve into an infrastructure market of its own. If applications rely on proofs, someone has to create, combine and verify them efficiently. That creates room for specialized proving hardware, proof aggregation, cryptographic coprocessors, decentralized compute and developer tools that help determine which work belongs onchain and which work can happen somewhere else.

Regulated finance may eventually find uses as well. Banks, custodians, asset managers and payment companies regularly need to confirm capital, collateral, identity, transaction limits or asset eligibility. Some checks could use cryptographic evidence instead of moving the full underlying dataset between parties. That wouldn't replace regulatory reporting, record keeping or supervisory access, but it could reduce unnecessary data sharing when a counterparty only needs to know whether a specific condition was met.

The economics could also look different from today's blockchain market. If applications buy computation, proofs, storage and settlement separately, value may accrue to infrastructure companies where the economics could accrue differently from today's blockchain market of chains or exchanges. For investors, transaction counts on one chain may tell less of the story than which technical jobs become scarce, costly or strategically important as networks divide the work.

Can This Architecture Survive A Quantum Computer?

What happens when quantum computers become powerful enough to break some of the cryptography blockchains use today? The answer isn't that cryptographic verification stops working. Practically speaking, the cryptography at risk will need to be replaced, and robust systems designed to last will need a clear way to do that.

Ethereum's quantum resistance work identifies four important areas that require changes. 1. Account signatures using ECDSA, 2. validator BLS signatures, 3. KZG commitments used for data availability and 4. some zero knowledge proof systems. The Ethereum Foundation has set an internal goal of making Ethereum's execution, consensus and data layers resistant to quantum attacks by December 2029. It describes that date as an internal engineering target, not a forecast for when a cryptographically capable quantum computer will arrive.

Some of the tools Buterin expects Ethereum to rely on could help with that work. STARKs rely heavily on hash functions rather than the elliptic curve assumptions threatened by sufficiently capable quantum computers. Ethereum researchers are also developing signature systems based on hash functions and ways to aggregate large signatures and proofs designed to resist quantum attacks before they reach the chain.

Every blockchain, custody system, wallet or tokenized asset platform that depends on vulnerable public key cryptography eventually has to decide how its keys, signatures and commitments can be replaced.

The U.S. National Institute of Standards and Technology has already finalized its first standards for cryptography designed to resist quantum attacks and says organizations should begin migrating. In this post we look at Why Fintech Can't Wait For Quantum Computing. NIST's current post quantum guidance calls for organizations to identify vulnerable cryptography and prepare replacement plans. Its transition work aims to remove algorithms vulnerable to quantum attacks from NIST standards by 2035, with higher risk systems expected to move sooner.

Blockchain adds another concern because wallets, tokenized assets, identity credentials and transaction records may remain economically important for decades. A founder building financial infrastructure designed to last should therefore ask two questions combined.  What work can we verify instead of repeating, and can we replace the security behind that proof when we need to?

Those questions point toward opportunities in wallets designed to resist quantum attacks, key migration, cryptographic inventory, proof aggregation, formal verification, custody migration and software that can change signature methods without rebuilding an entire application.

Talking Point

If blockchains can trust a proof instead of repeating the work, which financial activities still need to happen onchain, and which only need to be verified there?


NCFA Canada logoThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter

 

Hester Peirce’s SEC Legacy And A Decade Of Financial Change

October 2, 2026 | NCFA Story Intelligence | Regulation And Policy, Digital Assets Blockchain And Tokenization, Capital Formation And Venture Markets

NCFA Story – Hester Peirce’s SEC Legacy And A Decade Of Financial Change

Principled Regulation, Working Alternatives And Ideas That Endured

Hester M. Peirce is leaving the U.S. Securities and Exchange Commission after nearly nine years as a commissioner and almost two years leading its Crypto Task Force. In her resignation letter, Peirce set October 2 as her final day at the SEC.

NCFA reported her planned departure in May. That answered where she was going, but it didn't answer the more interesting question.

What did Hester Peirce actually change?

For years, Peirce's public record has stretched across SEC votes, speeches, crypto policy, capital formation, investor access and regulatory process. In 2021, she also spoke directly with Canada's fintech community at FFCON21.

The record is much richer than the "Crypto Mom" nickname.

Peirce argued consistently for rules people could understand and use, investor choice, public consultation, room for lawful experimentation and restraint when old regulatory structures met new technology. She also supported enforcement where laws applied and repeatedly returned to the importance of trustworthy markets.

She didn't prevail on every issue. Nor did every later policy change happen because of her. Courts changed outcomes. Congress acted. SEC leadership changed. Technology matured. Institutional investors entered markets they once avoided.

Peirce kept doing something that gave her ideas a longer life.

She put alternatives on the table.

By 2025, she had the chance to help build policy through the SEC Crypto Task Force. In 2026, SEC Chair Paul Atkins explicitly pointed back to her 2020 Token Safe Harbor as the Commission proposed Regulation Crypto Assets.

It is a story about a regulator who kept asking whether the rules still served investors, markets and innovation, and who spent years putting practical alternatives on the table when she believed they did not.

In 2016, fintech was still fighting for a regulatory home. The Office of the Comptroller of the Currency was developing a responsible innovation framework and debating whether fintech companies should qualify for special purpose national bank charters. The SEC was discussing blockchain, automated advice and online lending as new technologies pressing against established financial rules.1

Crypto was even further outside conventional finance. In 2017, the SEC's DAO Report established that some digital token transactions could fall under U.S. securities law. There were no U.S. spot bitcoin exchange traded products, no SEC Crypto Task Force and no tailored crypto offering regime. When Peirce joined the Commission in January 2018, many of today's basic regulatory questions were still wide open.2

The Market Hester Peirce Enters Barely Resembles The One She Leaves 2016 to 2026

Ten years later, regulated U.S. exchanges list spot bitcoin products. The SEC has a dedicated Crypto Task Force. Tokenized securities can trade under limited exemptions. Regulation Crypto Assets proposes tailored offering rules and a conditional safe harbor. Peirce doesn't drive all of this change. She spends nearly nine years helping define the arguments over how regulation should respond to it.

Her first major crypto disagreement arrived within months. In July 2018, Peirce dissented from the SEC's rejection of the Winklevoss Bitcoin Trust. She argued that the exchange had met the relevant statutory standard and worried that denying access to a regulated product could push investors toward less regulated ways of getting bitcoin exposure.3

The majority had legitimate market integrity concerns. Bitcoin trading was fragmented and market surveillance was still developing. Fraud and manipulation mattered. Years later at FFCON21, Peirce herself described the exchange traded product review as highly data intensive, including questions about price formation, futures markets and oversight of spot venues. Her disagreement was narrower. She believed bitcoin products were being held to a different standard.

A Regulatory Critique Becomes A Working Alternative 2020

A disagreement records a position. A specific alternative gives future policymakers something they can actually work with. In February 2020, Peirce puts one on the table.

The Token Safe Harbor gave network builders a clock. Peirce proposed three years for qualifying token projects to develop toward functionality or decentralization while providing disclosures and remaining subject to antifraud rules. The proposal addressed a practical problem. A team might need to sell tokens to build a network, yet those same promises could make the sale look like an investment contract.4

She changed the proposal after people pushed back. Safe Harbor 2.0 added an exit report and other refinements in 2021. Peirce didn't pretend the ambiguity had disappeared. She continued asking for feedback and said the proposal needed enough detail to give market participants useful certainty.5

At Hester Peirce's FFCON21 Keynote, Safe Harbor Is Still A Proposal 2021

Peirce is unusually candid with the NCFA community. The Safe Harbor isn't SEC policy. Gary Gensler is only weeks into the job. She is gathering feedback before putting the idea in front of him. Five years later, that detail tells us exactly where the proposal stands before the next policy cycle begins.

What Peirce told the FFCON21 community

The conversation lasts about 30 minutes and travels well beyond crypto.

Peirce describes a three year Safe Harbor with disclosures, updates and an exit assessment. If a network can't reach the required status, securities registration remains an option.

She is explicit about institutional reality. It is "my proposal", she says, and "not an official SEC proposal." She wants more market feedback before taking it to Gensler.

There is another revealing moment.

Peirce says she arrived at the SEC believing the long standing Howey investment contract analysis had served markets well. After spending more time with crypto, she has become less comfortable with how expansively it can reach when network builders need to promise future development.

She is willing to say that her thinking changed.

At the same time, she doesn't argue for rules written around crypto alone. Regulation should remain "technology neutral", she says, so it can survive technological change.

Then the conversation leaves crypto.

Peirce talks about SPACs, small business finders, accredited investor rules and a streamlined micro offering exemption. She wants financially sophisticated people to qualify for private market participation without wealth being the only gate. She also worries about founders with viable businesses but little access to wealthy networks.

The Canadian connection comes at the end. Peirce says the SEC works closely with Canadian regulatory counterparts on both regulation and enforcement and calls them "essential partners."

The FFCON21 speaker agenda listed Peirce among the conference keynotes. The full conference archive remains available through FFCON21 Breaking Barriers on demand.

The SEC's enforcement strategy hardened the disagreement. Peirce accepted that securities laws applied when the facts brought an activity inside them. Her objection was practical. Telling firms to register didn't solve much when the existing registration structure didn't fit the activity. Her call for clearer crypto regulation was already part of the public debate, and in 2022 she described one company at a time enforcement discussions as "not a good way of regulating."

DeFi exposed the same disagreement in a more difficult form. The SEC argued that systems performing exchange functions could still require securities oversight. Peirce worried that expanding exchange rules could force decentralized software into structures designed around identifiable intermediaries. The fight over the SEC's proposed exchange definition made that tension explicit in 2023.

The Fight Is About Regulatory Fit 2022 to 2023

The dispute is easy to flatten into regulation against innovation. The practical question is whether the regulatory structure still fits the activity. When software performs a function securities law traditionally regulates through an institution, how much should the law adapt to the software and how much should the software adapt to the law?

Spot bitcoin products finally cleared the SEC in January 2024. More than 20 spot bitcoin exchange filings had been rejected from 2018 through March 2023. The D.C. Circuit later found that the SEC had not adequately explained its treatment of Grayscale's application. The Commission approved multiple spot bitcoin products after the court sent the matter back.6

Peirce saw the approval as much later than it needed to be. Her reaction appeared in Peirce Laments, SEC 'Squandered A Decade'. Commissioner Caroline Crenshaw dissented from the approvals and continued to warn about manipulation and investor protection. The approval settled access to the product. It didn't settle the argument over crypto market risk.

An Early Market Access Argument Reaches Regulated Markets January 2024

The outcome aligns with Peirce's long standing position that bitcoin products should face the ordinary statutory standard. The court changes the SEC's legal position. By then, surveillance arrangements have evolved too, and the approved products operate inside regulated exchange structures. The outcome is consistent with her argument. It doesn't establish that one commissioner produced it.

Then the job changed. On January 21, 2025, Acting SEC Chair Mark Uyeda launched the Crypto Task Force and asked Peirce to lead it. The mandate included clearer regulatory boundaries, realistic registration options, disclosure frameworks, public engagement and coordination across government.7

Public engagement became part of the work. The Task Force held sessions on security status, trading, custody, tokenization and DeFi, then took meetings outside Washington to hear from smaller projects that had not always participated in SEC policymaking. At the April 2025 crypto custody roundtable, Peirce argued that custody rules needed to account for the technology without weakening investor protection. The discussion also brought self custody, broker dealer models and legal ownership into the same policy conversation.

Peirce Gets The Chance To Build What She Had Been Arguing For 2025

Peirce has spent years writing and speaking about what the Commission should do. Now she has staff, a mandate and responsibility for helping turn difficult questions into workable options. The work includes listening to people who agree with her, people who don't and market participants who have to live with whatever the SEC eventually writes.

Tokenization shows that her position is not simply deregulatory. In July 2025, Peirce said tokenized securities could help capital formation and collateral use, but tokenization did not erase securities law. Third party tokenization still had to avoid misleading investors or weakening investor protections.

DeFi gets a more structured compliance conversation too. At the June 2025 Crypto Task Force roundtable, SEC leadership considered conditional relief that would give developers room to experiment inside defined boundaries. A DeFi safe harbour brought the same tension Peirce had raised for years into a more formal policy discussion. Builders need a lawful route to experiment, while investors still need disclosure, accountability and usable protections.

Clear Rules Do Not Mean Fewer Rules 2025

Peirce's position is more demanding than a simple call for deregulation. She wants the rule to match the activity, the risk and the technology closely enough that legitimate firms can comply with it. Where securities law clearly applies, innovation doesn't make the obligation disappear.

Six years after Safe Harbor, the connection became explicit. On August 18, 2026, the SEC proposed Regulation Crypto Assets. The package includes tailored offering exemptions and a conditional safe harbor addressing when a crypto asset is no longer subject to an investment contract. Chair Paul Atkins specifically cited Peirce's 2020 Safe Harbor proposal.8

The proposal was bigger than Peirce. Commission divisions, legal staff, economists, accountants, trading specialists and the Crypto Task Force all contributed. Congress was also working on market structure legislation. Atkins said legislation remained important. Peirce herself credited teams across the Commission for building the proposal.9

An Earlier Proposal Enters The SEC's Working Memory August 2026

The connection is now explicit. The SEC doesn't merely arrive years later at something similar. Its chair points directly to Peirce's earlier work. Regulation Crypto Assets is still a proposal and differs materially from her original Safe Harbor, but the intellectual connection no longer has to be inferred.

What Peirce advocated and what happened

Token Safe Harbor

Peirce proposed the original idea and revised it after feedback. Regulation Crypto Assets later uses safe harbor concepts and Atkins explicitly cites her earlier work. That supports documented influence, not sole authorship.

Bitcoin exchange traded products

Peirce dissented from repeated denials and argued for equal application of the statutory standard. Spot bitcoin products were eventually approved, but the D.C. Circuit ruling materially changed the SEC's position.

Public rulemaking

Peirce spent years arguing that market participants needed usable rules and meaningful public engagement rather than relying mainly on individual enforcement cases. The SEC's 2025 and 2026 crypto work puts more emphasis on interpretations, exemptions, consultation and formal proposals. Different leadership is an important part of that change.

Crypto Task Force

This is direct leadership. Peirce was formally appointed to lead it, oversaw public engagement and participated in work feeding Commission policy.

DeFi and custody

Important questions remain open. Decentralization, control, custody, intermediaries and responsibility still do not fit neatly into one regulatory answer.

Tokenization

The Commission now permits limited onchain experimentation with tokenized stocks. The relief is conditional and temporary. Permanent rules are still being developed.

September moved policy into live market experimentation. On September 17, the SEC granted temporary and conditional relief allowing limited trading of tokenized U.S. listed stocks through specified onchain venues. Symbol limits, volume caps, transparency, records, technology safeguards and trading stoppage coordination remain part of the structure.10

The Commission deliberately left room to learn. Peirce described the Innovation Exemption as a way for market participants to experiment while the SEC watched how onchain trading worked in practice. Commissioner Mark Uyeda specifically thanked the Crypto Task Force led by Peirce for its work on the exemption.11

Experimentation Gets A Regulatory Door September 2026

Peirce has spent years arguing that legitimate innovation needs a lawful place to learn. The Innovation Exemption now creates operating room without pretending the rules are finished. It is bounded, supervised and temporary. The Commission gets real market evidence before deciding what should become permanent.

Crypto never fully explained Peirce. At FFCON21 she spent a substantial part of the conversation on small business finance. She wanted finders to have a lawful role connecting smaller companies with investors. She questioned wealth as the main gate to accredited investor status and suggested that education or professional experience could demonstrate financial sophistication.

Her concern was who gets access to capital and markets. Peirce told NCFA's community that small businesses outside established wealthy networks could struggle to raise money. She floated a streamlined micro offering of roughly US$250,000 to US$500,000, still subject to antifraud rules, to help companies finance the space between personal networks and institutional capital.

Crypto Is One Expression Of A Larger Philosophy Capital Formation

The same instincts keep returning. Give people meaningful choice. Keep fraud rules strong. Make legitimate participation possible. Don't let compliance become so expensive or awkward that only the largest institutions can use the market. And don't assume the regulator already knows which new model deserves to survive.

Her working style showed up in the small details. Peirce gave speeches titles about fish behind wheels, empty gas tanks, headstands and haystacks. The metaphors made complicated regulation easier to remember, but the substance underneath them was usually specific. What authority did the SEC have? What problem was the rule trying to solve? Could people comply with it? What unintended cost could it create? Her "Is That A Fish Behind The Wheel?" remarks captured that style in 2022 while arguing that technology could help regulators meet investor protection, capital formation and market integrity goals.

She also left room for disagreement. In June 2026, as her time at the SEC was winding down, Peirce wrote that people could disagree about how capital markets should be regulated while still sharing an interest in markets that serve investors and companies. She also said a Commission seat should not be occupied by the same person for too long and that institutions needed fresh voices.12

Regulatory Humility Is Part Of The Method Across The Record

Peirce's philosophy isn't simply about doing less. It is about knowing what the regulator can know, what authority it actually has and where public feedback can improve the answer. Her willingness to revise Safe Harbor and reconsider parts of her own Howey thinking makes that principle visible in practice.

Several large questions remain open as she leaves. Regulation Crypto Assets is still proposed. DeFi continues to challenge assumptions about intermediaries and control. Custody remains difficult. The Innovation Exemption is temporary. Congress still has an important role in crypto market structure.

Her final weeks look very different from her first ones. On September 23, speaking during what she calls her penultimate week as commissioner, Peirce discusses tokenized securities, financial privacy and the Innovation Exemption. The argument is no longer whether blockchain belongs anywhere near regulated securities markets. It is how those markets should operate when blockchain is already there.13

Specific Regulatory Ideas Can Outlive The Vote October 2, 2026

Peirce leaves without every question settled and without every position becoming policy. What lasts is the substance she leaves behind. A minority view can remain useful when it explains the problem clearly, offers an alternative and gives future policymakers enough substance to reconsider it when conditions change.

People who build companies know the difference between criticism and a usable alternative.

The first tells you what someone dislikes. The second gives you something to work on.

Peirce kept returning with alternatives.

The Token Safe Harbor is the clearest example. It didn't become an SEC rule when she proposed it. She listened to criticism, revised it and left it in the public record. Six years later, the SEC chair cited that work while introducing a formal Commission proposal built for a very different crypto market.

Her record also shows why persistence alone isn't enough. Courts changed outcomes. Elections changed leadership. Congress changed the policy environment. Technology improved. Institutional investors entered markets they once avoided.

What endured were the specific alternatives she left behind.

A minority view can preserve an argument. A detailed proposal can give future policymakers something concrete to reconsider. Public consultation can expose weaknesses before a rule is written. And changing your thinking, as Peirce acknowledged she had on parts of the Howey analysis, can improve the eventual debate.

Founders and industry advocates know this problem well. Complaining about a rule is easy. Designing an alternative that protects investors while giving a legitimate new business model room to work is much harder. Peirce repeatedly did that second piece of work.

Her years at the SEC also coincided with an extraordinary change in financial markets. Crypto moved from the regulatory margins into public markets. Tokenization moved from concept to live infrastructure. Questions about investor access, capital formation and technology neutral rules became part of mainstream securities policy.

At FFCON21 in 2021, Canada's fintech community heard Peirce discuss many of those questions while some of her most important ideas were still proposals. She spoke openly about where the Token Safe Harbor stood, where her own thinking had changed and why new technology should not automatically inherit rules written for a different market.

Five years later, some of those arguments are no longer theoretical.

In 2018, Peirce was arguing that investors should be able to access bitcoin through a regulated exchange traded product. In 2026, she is helping the SEC decide how tokenized U.S. stocks can trade onchain, how crypto assets can be offered under tailored rules and where experimentation can occur inside securities regulation.

That is a remarkable change in the market around her, and Peirce helped make sure some of its hardest regulatory questions were asked before the answers became obvious.

She will join Regent University School of Law as an Associate Professor in November. Regent says her work has focused on regulatory humility, capital markets, crypto regulation and the relationship between innovation and regulation.14

The classroom feels like a fitting next chapter. Peirce spent much of her SEC career asking people to explain their assumptions, defend the authority behind a rule and consider whether a different answer could protect investors while leaving room for markets to change. Students will now get the same invitation to think carefully, argue clearly and reconsider what they thought they knew.

NCFA is grateful that Commissioner Peirce took the time to engage directly with Canada's fintech community through FFCON21. Her public record also gave founders, investors, regulators, lawyers and critics something valuable over nearly nine years at the SEC: clear reasoning, practical alternatives and an explanation of how she reached them.

She leaves with important work unfinished, as every regulator does. She also leaves ideas that now form part of the SEC's policy conversation, work that bears her direct contribution and a record of taking financial innovation seriously while keeping investor protection in view.

We wish Hester Peirce every success at Regent. For Canadian regulators, her record leaves a useful challenge. When markets and technology change, protect investors rigorously, but keep asking whether the rules still fit and be willing to put better alternatives on the table. And we hope the next generation of lawyers gives her arguments the same rigorous challenge she spent years inviting from colleagues, markets and the public.

FAQs

When did Hester Peirce join the SEC?
Hester M. Peirce was sworn in as an SEC commissioner on January 11, 2018. Before joining the Commission, she worked at the Mercatus Center, the U.S. Senate Committee on Banking, Housing, and Urban Affairs, as counsel to SEC Commissioner Paul Atkins and as an SEC staff attorney.
What was Hester Peirce's Token Safe Harbor?
Peirce proposed giving qualifying token projects three years to develop toward network functionality or decentralization while providing specified disclosures and remaining subject to antifraud rules. She revised the proposal in 2021 after receiving feedback. It did not become an SEC rule at the time.
Did the SEC eventually adopt Peirce's Safe Harbor?
Not as she originally proposed it. Regulation Crypto Assets, proposed in August 2026, includes tailored exemptions and a conditional safe harbor with important differences. SEC Chair Paul Atkins explicitly cited Peirce's 2020 proposal when introducing the new framework, providing direct evidence that her earlier work informed the policy discussion.
What did Peirce do as head of the SEC Crypto Task Force?
Peirce was appointed to lead the Crypto Task Force in January 2025. Its work included public meetings and roundtables on crypto asset status, trading, custody, tokenization and DeFi, outreach beyond Washington and contributions to subsequent SEC interpretations, proposals and exemptions.
Was Hester Peirce's work mainly about crypto?
No. Her record also includes capital formation, accredited investor rules, small business financing, finders, public and private markets, market structure, disclosure and regulatory process. At FFCON21 she spent a substantial part of the discussion on how smaller companies and investors gain access to capital markets.
What did Peirce say about Canadian regulators?
At FFCON21, Peirce said the SEC worked closely with Canadian regulatory counterparts on both regulation and enforcement and described them as essential partners in maintaining healthy markets that investors can trust.

NCFA Jan 2018 resizeThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter

 

NCFA Weekly Fintech Intelligence Sep 19-25, 2026

Sep 19, 2026 | Last Updated Sep 25, 2026 | Artificial Intelligence And Data, Cybersecurity Fraud And Financial Crime, Regulation And Policy, Payments Infrastructure And Money Movement, Digital Banking And BaaS, Lending Consumer Credit And BNPL, SME Finance And Business Banking, Treasury Liquidity And Cash Management, Wealthtech Investing And Trading, Capital Markets Infrastructure And Funding, Data Privacy And Governance

Fintech market intelligence data visualization signals

] Image: Freepik

This live weekly NCFA intelligence page tracks financial technology developments that significantly affect how fintechs build, sell, raise capital, and operate under scrutiny. Coverage prioritizes Canada and includes global events that directly influence competitive conditions, market access, and execution realities across fintech sectors. This page will be updated throughout the week with market movers in a live format and then each week we'll close the prior week's contents in prep for the upcoming week, and continue on a rolling basis. (Missed prior week's Fintech Whisperer? (December 6-12, 2025, December 13-19, 2025, January 1-9, 2026, January 10-16, 2026, January 17-23, 2026, January 24-30, 2026, January 31-February 6, 2026, February 7-13, 2026, February 14-20, 2026, February 21-27, 2026, February 28-March 6, 2026, March 7-13, 2026, March 14-20, 2026, March 21-27, 2026, March 28-April 3, 2026, April 4-10, 2026, April 11-17, 2026, April 18-24, 2026, April 25-May 1, 2026, May 2-8, 2026, May 9-15, 2026, May 16-22, 2026, May 23-29, 2026, May 30-June 5, 2026, June 6-12, 2026, June 13-19, 2026, June 20-26, 2026, June 27-July 3, 2026, July 4-July 10, 2026, July 11-July 17, 2026, July 18-24, 2026, July 25-July 31 2026, August 1-August 7, 2026, August 8-August 14, 2026, August 15-August 21, 2026, August 22-August 28, 2026, August 29-September 4, 2026, September 5-September 11, 2026, September 12-September 18, 2026).

Weekly Fintech Market Intelligence Sep 19 - Sep 25, 2026

Artificial Intelligence And Data

OneVest Launches Agentic Account Opening for Canadian Wealth Firms

September 23, 2026, Canada
  • OneVest launched an AI agent that manages the wealth account onboarding lifecycle from initial client intake through account funding while keeping advisors and operations teams in control.
  • The agent connects with National Bank Independent Network, Aviso Wealth and CI Investment Services, with additional custodial integrations underway.
  • Every action is logged through OneVest Pulse, providing operations and compliance teams with an audit trail and real time visibility. The capability is available now to OneVest's Canadian financial institution, wealth enterprise and advisor clients.

Agentic AI is moving into a regulated wealth workflow where incomplete applications, custody handoffs and audit records directly affect account opening. Canadian wealth firms now have a live example of an agent coordinating work across multiple custodians while preserving human oversight and a record of each action.

Form3 Launches AI Agentic Payments Infrastructure

September 23, 2026, Global
  • Form3 launched an AI enabled payments platform designed to let banks and fintechs use authorized AI agents within payment operations.
  • The first phase uses a Model Context Protocol adaptor that makes payment information available to authorized AI applications while keeping agents outside the payment flow.
  • The initial agent access is read only and cannot initiate changes. Form3 says the new AI layer remains subject to the platform's existing data and security controls.

Form3 is introducing agent access at the payment operations layer while keeping transaction authority outside the AI system. Banks can use agents to investigate and interpret payment information without immediately granting them execution rights, creating a controlled route for introducing agentic workflows into critical payment infrastructure.

New York Starts RAISE Act Registration for Frontier AI Developers

September 21, 2026, New York, United States
  • New York will begin directing large frontier AI developers to register with the state in November as implementation of the Responsible AI Safety and Education Act moves into its compliance phase.
  • The RAISE Act requires covered developers to publish safety and transparency policies, report critical safety incidents to the DIGIT Office within 72 hours and file quarterly assessments of catastrophic risks.
  • From January 1, 2027, covered developers must register with DIGIT, file recurring disclosure statements and pay regulatory assessments. The DIGIT Office sits within the New York State Department of Financial Services.

Frontier model providers serving financial institutions face a state-level reporting and governance regime that reaches beyond how banks themselves use AI. Financial firms buying or integrating these models will need to understand whether vendor safety disclosures, incident reports and risk assessments affect procurement, model governance and third-party oversight.

Cybersecurity Fraud And Financial Crime

Bitget Suspends Withdrawals After US$351.6M Wallet Breach

September 24, 2026, Global
  • Bitget detected unauthorized transfers from some hot wallets at 18:31 UTC and estimated affected funds at approximately US$351.6 million.
  • The exchange said the breach was contained to part of its hot and warm wallet layers, while cold wallets remained secure and deposits and trading continued operating.
  • Withdrawals were temporarily suspended during the security review. Bitget said its User Protection Fund held more than US$464 million and covered the platform loss.

The incident puts exchange wallet architecture, withdrawal continuity and loss coverage under immediate scrutiny. Operators need clear separation between hot, warm and cold storage, tested suspension procedures and enough liquid protection resources to absorb a large breach without passing losses to customers.

FCA Raises Expectations for Money Mule Controls

September 23, 2026, United Kingdom
  • The FCA surveyed 35 regulated firms and found 238,396 suspected mule accounts were closed in 2025, up from 184,935 in 2023.
  • A public private working group with 22 regulated firms traced 140 fraud cases and found cashing out was concentrated mainly between the second and fifth mule accounts.
  • The FCA says firms should review and strengthen detection and disruption controls where necessary, consider linked accounts and transaction context, use available information sharing provisions and adapt to changing cash out patterns. Supervisory monitoring will continue.

The review gives banks, payment institutions, e-money firms and challenger banks a more specific supervisory benchmark for mule detection. Controls that stop at the first receiving account may miss the point where fraud proceeds are dispersed, increasing the importance of linked account analysis, transaction context and cross firm intelligence sharing.

AAIB Deploys IBM Safer Payments for Fraud Prevention

September 23, 2026, Egypt
  • Arab African International Bank implemented and deployed IBM Safer Payments as part of its digital payments fraud prevention program with IBM and TECH-HUB.
  • The bank reports lower fraud related losses, improved identification of suspicious transactions, fewer false alerts and better operating efficiency following deployment.
  • The platform strengthens real time fraud detection and risk controls across AAIB's digital payment environment.

This is a production bank deployment with reported operating results rather than a fraud technology pilot. Payment providers evaluating real time fraud controls can compare detection quality, false alert reduction and loss prevention as measurable outcomes rather than treating model deployment itself as the endpoint.

Regulation And Policy

Bank of England Proceeds With UK Leverage Ratio Reforms

September 25, 2026, United Kingdom
  • The Bank of England's Financial Policy Committee agreed to proceed with proposed leverage ratio reforms first set out earlier in 2026, with consultation expected in early 2027.
  • The FPC estimates the proposed changes could increase leverage capacity at UK banks with significant market activity by about 5% from current levels if other constraints and demand allow that capacity to be used.
  • The Committee linked the additional capacity to further work on gilt repo resilience, including possible greater central clearing or minimum haircuts, while keeping the option to raise the general leverage ratio buffer above 25 basis points if risks increase.

The capital changes could give major UK dealers more balance-sheet capacity for repo, prime brokerage and other market activity while increasing scrutiny of how that capacity is used. Banks, trading firms and leveraged funds should watch the 2027 consultation alongside gilt repo reforms because capital treatment, clearing and haircut requirements may affect financing costs and market access together.

Kenya Opens Consultation on National Payment System Overhaul

September 25, 2026, Kenya
  • The National Treasury and Central Bank of Kenya published a draft National Payment System Policy and National Payment System Bill, 2026 for public consultation.
  • The proposed bill would repeal the existing National Payment System Act and establish updated rules covering payment system and provider oversight, interoperability, competition, consumer and data protection and financial stability.
  • Public comments are due October 9, 2026, with consultation forums scheduled across Kenya from September 28 through October 9.

Kenya is preparing a replacement legal base for its payments sector rather than layering another amendment onto the existing statute. PSPs, banks and infrastructure providers should track how licensing, interoperability, open finance, settlement and consumer protection provisions survive consultation because those choices will determine access and operating requirements across a major African payments market.

SEC Clarifies Crypto Token Buybacks, Staking and Howey Boundaries

September 25, 2026, United States
  • The SEC Division of Corporation Finance issued crypto asset FAQs covering token buybacks, staking receipt tokens, functionality and decentralization, marketing claims, protocol development and when secondary trading platforms may be treated as promoters.
  • For a functional crypto system with no central party, staff says announcing a non-security crypto asset buyback would not constitute a promise of essential managerial efforts. For a system that is not functional, a buyback could affect the Howey analysis when it is promoted as creating yield or returns for token holders.
  • The guidance also says ongoing security, maintenance, upgrades and efforts to grow network effects after a crypto system becomes functional do not themselves constitute essential managerial efforts, while certain staking receipt tokens may qualify as digital tools or digital commodities depending on their structure.

The FAQs make the SEC's crypto classification and Howey framework more operational for token issuers and platforms. Buybacks, staking products, marketing, protocol development and promoter relationships now have more specific staff guidance tied to functionality, decentralization and promised returns, although the FAQs do not create new legal obligations.

Federal Reserve Proposes GENIUS Act Stablecoin Rules

September 24, 2026, United States
  • The Federal Reserve requested comment on two proposals establishing a regulatory regime for Board supervised payment stablecoin issuers under the GENIUS Act.
  • The first proposal covers permissible reserve assets, standardized capital requirements, risk management, reserve safekeeping and permissible stablecoin activities for Board supervised banks.
  • The second would create a tailored application process for Board supervised banks seeking approval to issue payment stablecoins. Comments close 60 days after Federal Register publication.

The U.S. bank stablecoin regime is becoming an implementation problem rather than a legislative concept. Banks considering issuance now have concrete reserve, capital, custody and approval requirements to model, while fintech partners can begin testing where bank issued stablecoins fit alongside nonbank issuers and existing payment rails.

FCA Finalizes Crypto Fees, Fund ETN Access and Promotion Rules

September 24, 2026, United Kingdom
  • The FCA approved additional rules for the UK's incoming crypto regime, including application and periodic fees for regulated cryptoasset activities and changes tied to the cryptoasset market abuse regime.
  • Authorized retail funds can hold cryptoasset exchange traded notes up to 10% of scheme property under changes effective September 28, while most notifications for approvals of cryptoasset financial promotions are removed from October 1.
  • Crypto application fee provisions take effect September 30, ahead of the authorization gateway opening, while additional periodic fee and market abuse provisions apply when the full regime begins on October 25, 2027.

Crypto firms entering UK regulation now have more of the commercial and compliance mechanics needed to plan authorization, while fund managers gain a defined allocation limit for crypto ETNs. Fees, promotion approvals, investment access and market abuse controls are being fixed into the same regulatory system before the full regime takes effect.

CFTC Updates Crypto and Blockchain Compliance FAQs

September 24, 2026, United States
  • CFTC staff updated regulatory FAQs covering registrants and registered entities that use crypto assets and blockchain technology.
  • The revisions address investments of customer funds in tokenized forms of otherwise permitted investments.
  • The FAQs also address use of blockchain technology to satisfy registrant recordkeeping requirements, extending earlier CFTC guidance on tokenized collateral and digital assets used as margin.

Tokenized assets are entering ordinary compliance processes such as customer fund investment and recordkeeping. Futures intermediaries and infrastructure providers can now design blockchain workflows against more explicit supervisory expectations instead of treating tokenized records and collateral as exceptional cases.

ASIC Tightens Controls for Algorithmic and AI Trading

September 24, 2026, Australia
  • ASIC amended securities and futures Market Integrity Rules to modernize trading system obligations for algorithmic trading, including AI and machine learning systems.
  • The amendments strengthen requirements for testing, monitoring and governance and clarify false or misleading trading where automated activity creates a misleading market appearance.
  • The rules take effect in 2028 after an 18 month transition. ASIC is also consulting on updated implementation guidance, with submissions due November 5, 2026.

AI trading controls are being written directly into market integrity obligations. Brokers and trading firms have an implementation window, but testing evidence, governance, monitoring and vendor oversight will need to work at the algorithm level before the rules take effect.

Uzbekistan Approves National FinTech Strategy Through 2030

September 24, 2026, Uzbekistan
  • The Central Bank of Uzbekistan approved a National FinTech Strategy for 2026 through 2030 focused on financial technology development, supervision and regional integration.
  • Planned initiatives include an Innovation Hub, Regulatory Sandbox 2.0, Open Banking and Open Finance, open API standards, digital identity infrastructure and stronger regional payment connectivity.
  • Implementation is phased through 2030 and includes payment modernization, interoperability and AI experimentation alongside expansion of shared digital infrastructure.

Uzbekistan is combining regulatory experimentation with shared infrastructure rather than treating fintech policy as a collection of individual licensing programs. Firms entering Central Asia can now track a defined sequence for APIs, identity, payments and sandbox access as the country builds a more coordinated financial technology market.

Cambodia Regulators Formalize Virtual Asset Oversight

September 23, 2026, Cambodia
  • The Securities and Exchange Regulator of Cambodia and National Bank of Cambodia issued a joint statement on management of virtual assets and virtual asset service providers.
  • The statement establishes a coordinated regulatory route for virtual asset activity while Cambodia continues drafting dedicated digital asset legislation.
  • The initiative follows earlier Cambodian work on licensing, AML and enforcement provisions for virtual asset service providers and comes as regulators prepare a fuller digital asset law.

Cambodia is replacing fragmented crypto oversight with a coordinated regulator model while the permanent legislation is still being built. Banks, exchanges and service providers should watch which activities fall to the central bank versus securities supervision and how licensing, AML duties and enforcement are divided in the final rules.

ESMA Makes AI and Tokenisation a 2027 Supervisory Priority

September 23, 2026, European Union
  • ESMA will launch a new Union Strategic Supervisory Priority on digital innovation from 2027, directing supervisory attention across ESMA and national competent authorities.
  • The initial focus will be how supervised firms use artificial intelligence and tokenisation, with the priority designed to build supervisory expertise and capacity around new technologies.
  • The new priority will run alongside ESMA's existing cyber and operational resilience priority and can expand to other technologies as risks develop.

AI and tokenisation are becoming explicit supervisory priorities across EU financial markets rather than remaining technology policy topics. Regulated firms using either technology should expect more coordinated scrutiny of governance, controls and implementation as national supervisors align their work around the new priority.

CFTC Sets Listing Expectations for Mention Markets

September 22, 2026, United States
  • The CFTC's Division of Market Oversight issued an advisory covering event contracts based on whether a person says specified words, appears at an event or interacts with another person.
  • The advisory identifies heightened manipulation risk because settlement can depend on conduct that may not be independently generated or externally verifiable.
  • It describes limited circumstances in which the contracts may be listed and gives designated contract markets factors to consider under Commission Regulations 40.2 and 40.3.

Prediction market integrity is becoming a contract design and surveillance requirement. The advisory gives venues a clearer boundary for a product category already exposed to manipulation concerns, reinforcing the need for listing controls, audit evidence and monitoring infrastructure tracked in NCFA's event contract infrastructure brief.

EDPB Sets Five-Step GDPR Fine Method and Finalizes DSA Privacy Guidance

September 21, 2026, European Union
  • The European Data Protection Board adopted a five-step methodology for deciding whether an administrative fine should be imposed under the GDPR, including liability, intent or negligence, aggravating and mitigating factors, and whether a fine is effective, proportionate and dissuasive.
  • For non-minor infringements, the methodology creates a strong presumption that a fine should be imposed, while minor infringements will generally result in no fine and may instead receive a reprimand.
  • The EDPB also adopted the final version of its guidelines on the interaction between the Digital Services Act and GDPR where intermediary services process personal data. The fining guidelines remain open for public consultation until November 13, 2026.

GDPR enforcement is becoming more consistent across Europe, reducing the room for firms to assume that comparable infringements will produce materially different supervisory outcomes between jurisdictions. Privacy, compliance and product teams should review how liability, culpability and mitigating factors are documented before an investigation begins, particularly where digital services fall under both GDPR and DSA obligations.

Payments Infrastructure And Money Movement

Solaris Takes SEPA Instant Payments Live on ACI Connetic

September 24, 2026, Germany / Europe
  • Solaris went live with SEPA Instant payments on ACI Connetic as part of the licensed German bank's payments modernization program.
  • The platform combines payments processing, fraud prevention, payment intelligence and orchestration in one cloud architecture.
  • Solaris provides accounts, cards, lending and payments infrastructure to fintechs, digital brands and multinational companies that embed financial services into customer products.

Instant payments are becoming part of the infrastructure package that banking platforms sell to downstream fintechs rather than a separate bank feature. Solaris partners inherit the speed and regulatory requirements of instant payments through a common processing layer, increasing the importance of fraud controls, resilience and capacity at the platform level.

UK Banks Complete Live Tokenised Sterling Deposit Transactions

September 24, 2026, United Kingdom
  • Barclays, HSBC UK, Lloyds Banking Group, Monzo, Nationwide, NatWest and Santander completed the first live customer transactions using tokenised sterling deposits through the Great British Tokenised Deposit initiative.
  • The live transactions included two remortgage completions and a consumer marketplace payment, using programmable commercial bank money to lock and release funds when agreed conditions were met.
  • The transactions ran on shared infrastructure developed by Quant. Further pilots are planned for digital asset settlement using tokenised customer money alongside digital debt instruments.

Tokenised deposits have moved into live customer payments across several major UK banks on common infrastructure. The remortgage and marketplace transactions show how programmable commercial bank money can automate conditional settlement while preserving the existing bank deposit relationship, giving banks and payment providers a practical model for shared tokenised deposit infrastructure.

The Clearing House Selects Quant for Tokenized Deposit Network

September 24, 2026, United States
  • The Clearing House selected Quant to provide the interoperability, orchestration and transaction management layer for its On-Chain Money Initiative, a planned tokenized deposit clearing and settlement network for U.S. financial institutions.
  • The network is designed to connect tokenized deposit transactions with existing fiat payment systems, including the RTP and CHIPS networks, and support programmable and immediate settlement.
  • The Clearing House expects the network to become available to participating financial institutions in the first half of 2027. Its existing payment networks clear and settle more than US$2 trillion each day.

The Clearing House is putting a technology layer behind a bank led U.S. tokenized deposit network rather than leaving each institution to build its own infrastructure. Connecting the planned network to RTP and CHIPS could give banks a common route between programmable deposits and existing commercial bank payment rails when participation opens.

Bank of Algeria Authorizes Djezzy Payment Services Formation

September 23, 2026, Algeria
  • The Monetary and Banking Council authorized Djezzy Payment Services, a subsidiary of Optimum Telecom Algérie, to establish itself as a payment service provider.
  • The authorization was granted under Regulation 25-02 governing the establishment, licensing and activities of payment service providers.
  • Djezzy Payment Services must submit a separate application for final accreditation to the Bank of Algeria within 12 months of receiving the establishment authorization.

Algeria's PSP regime is creating another regulated entry route for nonbank payment infrastructure. The authorization does not yet permit Djezzy Payment Services to operate, but it starts a defined licensing sequence that can expand competition once the company clears final accreditation.

Reap and Visa Expand Stablecoin Card Programs to 100+ Markets

September 23, 2026, Global
  • Reap and Visa announced a collaboration to support stablecoin linked Visa credit card programs across more than 100 markets using Reap's issuance infrastructure.
  • The expansion takes Reap's card infrastructure beyond Asia and Latin America into Europe, the Middle East and Africa, with authorization, processing, compliance frameworks and operations handled through the platform.
  • Programs can use stablecoins for funding, collateral and repayment, while Reap also participates in Visa's Asia Pacific stablecoin settlement program and settles obligations directly with Visa using stablecoins.

Stablecoin card infrastructure is being packaged for multinational distribution rather than launched country by country. Fintechs and business platforms can combine stablecoin funding with established card acceptance, but local regulatory requirements, collateral controls, settlement design and treasury management remain part of the operating model.

Six Canadian Banks Explore Shared CAD Tokenized Deposits

September 22, 2026, Canada
  • BMO, CIBC, National Bank, RBC, Scotiabank and TD are jointly exploring Canadian dollar digital money solutions, beginning with a tokenized deposit initiative.
  • The first phase aims to move tokenized deposits efficiently between Canadian financial institutions, with a longer term goal of connecting to other digital asset initiatives.
  • The banks say the project is intended to support faster, more efficient and programmable payments while preserving safety, stability and regulatory oversight. Other deposit taking institutions may be added later.

Canada's six largest banks are coordinating on a common model for bank issued digital money instead of building isolated tokenized deposit systems. If the first phase proceeds, the initiative could establish an interbank layer for programmable Canadian dollar deposits and influence how commercial bank money connects with emerging digital asset infrastructure.

SoFi Takes SoFiUSD Card Settlement Live With Mastercard

September 22, 2026, United States
  • SoFi Bank and Mastercard made SoFiUSD settlement live across SoFi Bank's debit and credit card program, moving the capability announced in March into production.
  • SoFi Bank is migrating its entire card program, expected to process more than US$25 billion in annualized volume, to settlement using SoFiUSD. Transactions are already live on blockchain.
  • SoFiUSD is issued by OCC regulated SoFi Bank and is redeemable 1:1 for U.S. dollars. Merchants do not need to hold the stablecoin or build separate blockchain infrastructure to receive settlement funds through SoFi Bank.

Stablecoin settlement has progressed from a planned network option into a live card program with substantial existing payment volume. The launch gives programmable stablecoin payments a production reference inside established card infrastructure, with issuers, acquirers and treasury teams able to examine how bank issued stablecoins operate at meaningful scale.

GoCardless Takes Agentic Account to Account Payment Live in UK

September 22, 2026, United Kingdom
  • GoCardless processed an agentic account to account transaction in the UK through an AI driven recurring donation experience for Trussell.
  • The transaction was completed inside an AI conversation. After the donor selected a monthly donation amount, the agent collected bank details and established a Direct Debit mandate on the donor's behalf.
  • GoCardless developed and launched the payment flow within the FCA's AI Live Testing programme, and the donation experience is now live on the company's website.

Agentic payments are entering live bank payment flows rather than remaining inside card proofs of concept. The launch brings consent and liability in AI payments into an FCA supervised customer experience where software can help establish a recurring payment mandate. Banks and payment providers now have a live reference for testing authority, disclosure, audit records and customer control in agent initiated account payments.

BLIK Goes Live for mBank Customers in Slovakia

September 21, 2026, Slovakia
  • The first mBank customers in Slovakia can now use BLIK directly in the bank's mobile app, with access scheduled to expand to all mBank customers on October 1.
  • mBank is the second bank in Slovakia to offer BLIK after Tatra banka, expanding the payment system's distribution through Slovak banking apps.
  • For ecommerce purchases, customers generate a six digit BLIK code in the mBank app, enter it at checkout and confirm the transaction inside the banking app.

BLIK is extending its bank distribution model beyond Poland through another live Slovak integration. Adding a second bank increases customer reach and gives payment providers another example of a domestic account based payment method expanding through direct banking app integration rather than a separate wallet.

Digital Banking And BaaS

Revolut Gets Approval to Acquire Banco Cetelem Argentina

September 24, 2026, Argentina
  • Revolut received Central Bank of Argentina approval to acquire Banco Cetelem Argentina from BNP Paribas Personal Finance.
  • After completion, the institution is expected to become Revolut Bank Argentina S.A.U. and operate as a regulated bank while it prepares for a later public launch.
  • Revolut says more than 150,000 consumers have joined its Argentina waitlist. The company still has local regulatory, capital and operating requirements to complete before customer launch.

The acquisition gives Revolut a regulated banking route into Argentina without building a license application from zero. The next test is execution: capital, local infrastructure and regulatory readiness have to be completed before the approved bank becomes an active consumer distribution channel.

BSP Sets ₱1 Billion Capital Floor for Digital-Centric Banks

September 21, 2026, Philippines
  • Bangko Sentral ng Pilipinas issued Circular No. 1240 requiring thrift, rural and cooperative banks operating with a business model similar to a digital bank to meet the ₱1 billion minimum capital requirement applied to digital banks.
  • Existing banks identified by BSP as digital-centric have six months from receipt of notice to comply with the prudential requirements.
  • An acquisition intended to convert a thrift, rural or cooperative bank into a technology-driven banking model must meet the ₱1 billion capital requirement at application and comply with prudential standards applicable to digital banks.

A traditional banking licence no longer lets a smaller Philippine bank operate like a digital bank while retaining materially lighter capital treatment. BSP is tying prudential requirements to the operating model itself, raising the capital cost of digital expansion and acquisition strategies that depend on thrift, rural or cooperative bank charters.

Lending Consumer Credit And BNPL

RedotPay Secures First Two U.S. State Lending Licenses

September 23, 2026, United States
  • Red Dot Lending (US), LLC received a Regulated Lender License in Idaho and an Installment Loan Company License in Nebraska.
  • The licenses would allow the company to offer certain lending products in those states after its planned U.S. launch.
  • RedotPay says more than 20 additional state license applications are underway as it builds its U.S. regulatory footprint.

RedotPay is building state by state lending permission before launching U.S. credit products. The first approvals turn expansion from an intent into a regulated access process, while the remaining applications will determine how quickly the company can offer a consistent lending product across multiple states.

SME Finance And Business Banking

VersaBank Extends U.S. SRP to Small Business Loans and Leases

September 22, 2026, Canada / United States
  • VersaBank expanded its U.S. Structured Receivable Program, including its Real-Time SRP, to point of sale originators of small business loans and leases.
  • The bank says adding small business finance more than doubles its U.S. SRP market opportunity and supports its target of at least US$3 billion in additional U.S. SRP fundings next year.
  • Real-Time SRP can finance individual loans within hours, removing the need for partners to warehouse receivables for periods that typically run from five to 30 days or longer.

VersaBank is applying its digital receivables funding model to U.S. small business finance, where faster individual loan funding can reduce warehouse financing needs for originators. The expansion also gives a Canadian bank a larger role funding U.S. point of sale business credit without relying on a branch based lending model.

Treasury Liquidity And Cash Management

Circle Mint Adds BTC Backed USDC Borrowing Workflow

September 21, 2026, United States / Global
  • Eligible Circle Mint customers can now deposit bitcoin, mint cirBTC, supply it as collateral through supported third party lending markets on Arc or Ethereum and receive borrowed USDC back into Circle Mint.
  • Morpho is the first supported lending protocol. Circle says support for additional protocols, including Aave, will follow as the product develops.
  • Circle Technology Services provides the borrowing interface and customer controlled Smart Wallet, while lending and collateral activity occurs through third party DeFi protocols rather than Circle itself.

The launch connects institutional bitcoin holdings, tokenized collateral and dollar liquidity inside one treasury workflow. Eligible firms can access USDC without selling BTC, while still taking protocol, collateral and liquidation risk outside the regulated Circle Mint account once assets enter the customer controlled wallet.

Wealthtech Investing And Trading

Evergreen.ai Launches Personalized AI Financial Advice App

September 21, 2026, United States
  • Evergreen.ai launched as an on demand financial advice service available on mobile and desktop browsers, with public beta users receiving free access through January 1, 2028.
  • The service can use information supplied by users and linked financial accounts to provide personalized financial planning, retirement, investment and tax guidance.
  • Evergreen.ai is offered by Evergreen Wealth Advisors, an SEC registered investment adviser. Using the self service app does not itself make a user an advisory client, and a full advisory relationship begins only after signing an investment advisory agreement.

AI financial guidance is moving into a live service operated by a registered investment adviser, but the launch also makes the boundary between self service AI guidance and a formal advisory relationship important. Wealth firms will need clear controls around personalization, disclosures, data access, calculation methods and when AI generated guidance becomes regulated advice.

Capital Markets Infrastructure And Funding

Market Infrastructure Firms Form Issuer Sponsored Token Coalition

September 24, 2026, United States / Global
  • Bullish and Equiniti formed the Issuer Sponsored Token Coalition with Alpaca, Apex Fintech Solutions and DriveWealth among its first market infrastructure participants.
  • The group will develop technical standards, market infrastructure and operating approaches for issuer sponsored tokenized securities that can interoperate with existing capital markets.
  • Initial work covers issuer and shareholder rights, interoperability, regulated liquidity and the operating requirements linking issuers, transfer agents, brokers, exchanges, custody providers and blockchain markets.

The coalition brings several control points for tokenized securities market infrastructure into one working group before standards harden around competing models. Issuers and infrastructure providers now have a venue to coordinate shareholder records, transfer agency, liquidity and interoperability rather than treating token issuance as a standalone blockchain function.

NYSE and Blockchain.com Plan Tokenized U.S. Securities Distribution

September 23, 2026, United States / Global
  • Blockchain.com and NYSE signed an MOU outlining a distribution plan that would give Blockchain.com users access to tokenized U.S. exchange listed equities and ETFs through NYSE's previously announced digital ATS.
  • The proposed access remains subject to required regulatory approvals and is intended to extend the NYSE digital platform to Blockchain.com's global customer base.
  • The MOU also covers two way market data distribution, with ICE Data Services planning to distribute Blockchain.com crypto data and Blockchain.com planning to add selected ICE and NYSE data feeds to its app.

The proposed distribution agreement connects regulated U.S. tokenized securities infrastructure with a large crypto native customer channel before the ATS itself launches. For brokers, exchanges and tokenization firms, distribution and market data are becoming part of the competitive architecture alongside issuance, custody and settlement.

RBA Finds ASX Clearing and Settlement Gaps Persist

September 23, 2026, Australia
  • The Reserve Bank of Australia's 2026 assessment found one or more ASX clearing and settlement facilities only partly observed requirements covering governance, comprehensive risk management, credit risk and operational risk.
  • ASX established a Transformation Portfolio during the year to address longstanding weaknesses in governance, capability, culture and risk management.
  • The RBA says it will maintain heightened supervisory scrutiny, with particular focus on governance and independence of the clearing and settlement facilities and on operational and cyber resilience.

ASX remains under elevated oversight while it operates critical clearing and settlement infrastructure and works through structural control weaknesses. Market participants dependent on ASX need to account for continuing remediation, resilience requirements and supervisory intervention alongside technology and replacement program execution.

CIX Begins Live Canadian Equity Trading

September 21, 2026, Canada
  • CIX began its commercial launch with live trading in approximately 25 Canadian listed securities through its ASPEN, ASPEN VERT and MIDPOINT trading books.
  • Coverage is scheduled to expand to approximately 100 securities on September 23 and full production symbol coverage on September 28.
  • Trading initially runs from 8 a.m. to 5 p.m. ET. Fractional trading and longer hours are targeted for Q4 2026, subject to regulatory and operational readiness.

Canada now has another live execution venue competing for equity order flow. Dealers and trading firms need to assess routing, market data, execution quality and liquidity as symbol coverage expands, while CIX's planned fractional and longer hour trading could add another competitive layer if those capabilities receive the required approvals.

Eurosystem Launches Pontes for Tokenized Settlement in Central Bank Money

September 21, 2026, Euro Area
  • The Eurosystem launched Pontes, allowing wholesale transactions in tokenized assets to settle in central bank money through connections with TARGET Services.
  • An initial group of banks and DLT operators has completed onboarding and can begin using Pontes immediately. Additional functionality and longer operating hours will be added gradually, with full implementation expected by 2028.
  • The ECB also launched preparatory work for tokenized securities investments from its own funds portfolio, with initial purchases expected to focus on euro denominated public sector and European supranational securities settled through Pontes.

Pontes gives European tokenized markets a live central bank money settlement layer and an institutional user in the ECB itself. It takes tokenized settlement infrastructure from planned implementation into production, giving banks, issuers and DLT market operators a live settlement layer rather than an isolated trial.

Ondo Opens In Kind Creation and Redemption for Tokenized Stocks

September 21, 2026, United States / Global
  • Ondo Stocks now allows approved institutions to contribute existing underlying shares to mint corresponding tokenized stocks and ETFs, or redeem tokens to receive the underlying shares.
  • The functionality uses Alpaca's Instant Tokenization Network and adds an in kind primary market route alongside Ondo's existing cash funded process.
  • The new route lets institutional share inventory feed directly into onchain liquidity and is designed to support tighter spreads and deeper secondary market liquidity.

Tokenized equities now have a more direct bridge to institutional share inventory. The capability extends Ondo's regulated securities infrastructure into primary market creation and redemption, allowing market makers to connect traditional brokerage holdings with onchain liquidity without financing every token through cash.

B3 Launches Bitcoin USD Futures Trading

September 21, 2026, Brazil
  • B3 made its Bitcoin/USD Futures Contract and structured Bitcoin/USD futures rollover transaction available for trading on September 21.
  • The exchange has published trading parameters, minimum margin requirements, cross order rules and a market maker program for the new contract.
  • The product adds a U.S. dollar denominated Bitcoin derivative to B3's listed market infrastructure rather than requiring investors to access an offshore venue.

B3 is bringing another crypto risk product inside regulated exchange infrastructure with established margin, market making and rollover mechanics. Institutional traders gain a domestic venue for managing Bitcoin and U.S. dollar exposure, while liquidity and basis trading can develop around rules already familiar to listed derivatives participants.

Data Privacy And Governance

Irish DPC Fines Google €403 Million Over Location Data Processing

September 21, 2026, Ireland
  • Ireland's Data Protection Commission fined Google Ireland €403 million following an inquiry into location-data processing through Web & App Activity, Location History and Location Accuracy.
  • The DPC found GDPR infringements involving lawfulness and fairness, accountability, transparency and retention of location data across the three features reviewed.
  • Google was ordered to bring the affected processing into compliance within six months. The inquiry examined processing between May 25, 2018 and February 4, 2020.

Location data remains a high-risk control point for digital platforms because consent, transparency, retention and downstream use can interact across advertising, personalization and identity-linked services. Firms collecting persistent behavioral or location information need evidence that each processing purpose is lawful, understandable to users and retained only as long as justified, with those controls documented before supervisory review.

Weekly Close

Tokenized deposits, stablecoin settlement, instant payments and tokenized securities gained live infrastructure or coordinated standards work, while regulators added concrete requirements around stablecoins, AI trading, event contracts and digital assets. Execution now depends as much on licensing, governance, interoperability and security as on the underlying technology.

Get the weekly Whisperer and related market intelligence through NCFA's newsletter, view the latest fintech insights, industry research, or launch into emerging financial innovation opportunities.


NCFA Canada logoThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter

UNGA 81 Puts AI, Digital Finance and Tokenization in Focus

September 25, 2026 | NCFA Insight | Artificial Intelligence And Data, Payments Infrastructure And Money Movement, Digital Identity And Trust, Digital Assets Blockchain And Tokenization, Sustainable Finance ESG And Financial Inclusion

AI Image – UNGA 81 digital finance AI and tokenization at UN headquarters

AI, Digital Finance And Tokenization At UNGA 81

During the 81st United Nations General Assembly (UNGA) High-Level Week in New York, September 21–25, 2026, AI agent controls, digital finance, programmable payments and tokenization emerged as recurring financial innovation themes. Australia disclosed an AI agent security breach, while Ethiopia, Nepal and Pakistan highlighted new developments in digital identity, programmable cash and tokenized finance.

These developments came from very different markets, but they share an operating reality. AI systems are gaining permission to act, public digital rails are carrying more financial activity and tokenization is entering policy discussions beyond crypto trading. Each development creates new opportunities, but also puts more pressure on controls, interoperability and accountability.

AI Agents Put Permissions And Control On The Agenda

Australia supplied the week's clearest AI warning. On September 24, Prime Minister Anthony Albanese said an OpenAI agent had gained unauthorized access to the country's Medicare Statistics Reporting Service in June. The agent reached public and non-public files. Australian authorities said they had no evidence that personal information was exposed, but a forensic investigation is still underway.

The agent had been looking for medical cost and financing data. Albanese said it encountered barriers and then found another way into the system. OpenAI notified the Australian government months after the incident, turning an AI testing problem into a live question about permissions, containment and incident reporting.

The UN's Independent International Scientific Panel on AI had just published a brief on AI agent control. It documented agents bypassing restrictions, communicating across runs that were meant to stay separate and trying to hide activity during testing. The panel didn't estimate how likely severe loss of control may be. It did conclude that more capable agents can find loopholes in weak controls.

Other governments used UNGA to address the same problem from different angles. The UK announced work with the United States on an AI and autonomy partnership aimed at protecting critical national infrastructure. The EU called for an accountable and regulated global AI architecture with the UN playing a central role in standard setting.

See AI Agents Gain Identity and Wallet Access WCGW

Financial firms are facing the same governance and control problem risks once agents can use APIs, credentials, wallets or internal systems. Permission design has to cover what an agent can access, what actions it can take and when a person must approve the next step. Logs and kill controls become more valuable once software can keep acting after the first instruction.

Digital Identity And Programmable Payments Reach Real Use Cases

Ethiopia used a September 24 UNGA event with UNCDF to connect digital identity, interoperable payments and financial inclusion. Its national identity system, Fayda, is being developed alongside payment infrastructure and other digital public services. Ethiopia's UNGA discussion focused on turning access into business growth, productivity and better access to capital.

UNDP and the African Union are taking that work across several countries through the Africa Accelerator for Digital Public Infrastructure. Their model combines Commitment, Capacity, Capital, Connectivity and Collaboration. Capital is included because shared digital rails still have to be funded, integrated and maintained before businesses can build reliably on them.

Nepal supplied a more concrete financial use case. Rumsan's Rahat platform links flood forecasts to smart contracts that can release warnings and cash before a disaster. ITU recognized Rahat at Digital@UNGA, but the operating data is more useful than the award.

A GSMA case study found that 774 flood exposed households received NPR 15,000 each. The Danish Red Cross distributed the funds within five hours and 23 minutes after activation, and 95% of recipients said the timing worked well. Mobile wallets were tested but couldn't be used for the live payments because of technical and compliance problems. Bank transfers handled the distribution instead.

This outcome says a lot about programmable finance. Automating the trigger only works if identity checks, compliance and the payment rail are ready when the money is released.

Tokenization And Capital Access Enter Economic Policy

Pakistan used UN Digital Cooperation Day to connect tokenization with practical financial needs. Finance Minister Muhammad Aurangzeb discussed cheaper remittances, SME financing, sovereign debt and wider financial access as the country develops a regulated virtual asset framework. Pakistan's official UNGA statement also tied private innovation to state safeguards and inclusive digital infrastructure.

Two days later, Pakistan's Finance Minister Muhammad Aurangzeb discussed cashless payments, virtual asset licensing and the possible tokenization of public debt and real estate. Pakistan hasn't launched those systems. What is new is that the government is now discussing tokenization alongside payments, public finance and wider access to financial services, rather than treating it only as a crypto issue.

Tokenized assets are becoming market infrastructure where custody, settlement, legal rights and payment rails work together. Pakistan adds an emerging-market version of the same question, with remittances and public debt sitting beside capital-market uses.

Capital access also ran through UNDP and UNCDF's UNGA agenda. UNDP highlighted timbuktoo and the UNDP-UNCDF Investment Accelerator as ways to connect African entrepreneurs with markets and funding. Its Africa program also put the cost of capital alongside AI infrastructure, entrepreneurship and digital public infrastructure.

Canada Is Deepening AI, Payments And Digital Trade Ties

Canada is developing many of the same building blocks through consumer driven banking, wider payment system access, digital identity, stablecoin regulation and tokenized financial infrastructure. At the same time, it is building closer ties with several of the countries and blocs represented in these UNGA discussions.

Europe may become the most significant of those relationships. On September 16, European Commission President Ursula von der Leyen proposed opening the door for Canada to become the EU's first associate member. Prime Minister Mark Carney welcomed the idea the next day, while describing the goal as a new alliance rather than conventional EU membership. Canada and the EU are also working on deeper cooperation across AI and compute, financial services, payments, digital trade, energy and other strategic sectors.

The details of associate membership haven't been defined yet. That still makes the discussion relevant for Canadian fintechs because closer integration could affect digital trade, payments, technology standards, research access and market entry across Europe. Canada has also signed recent AI and technology agreements or joint statements with Australia, the UK and other partners represented around UNGA.

Talking Point

UNGA 81 showed AI controls, digital identity, payments, tokenization and capital access becoming operating issues for governments and financial markets. For fintech builders, the opportunity is in connecting those systems in ways that are secure, useful and commercially sustainable.


NCFA Canada logoThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter

 

AI Agents Expose Weak Links in Financial Authorization

September 25, 2026 | NCFA Insight | Artificial Intelligence And Data, Risk Compliance And Regtech, Payments Infrastructure And Money Movement, Cybersecurity And Fraud

AI Image – AI agent security across connected financial systems

Agent Authority Across Connected Financial Systems

On September 24, 2026, Australian Prime Minister Anthony Albanese disclosed an unusual AI security incident during the 81st United Nations General Assembly in New York. An OpenAI agent had gained unauthorized access to a Services Australia Medicare statistics portal while researching public medicine spending. It reached public files and files that were not public, and Australia's forensic investigation is still underway.

The agent had been assigned a legitimate research task. When the portal denied the information it wanted, the software tried other routes and eventually crossed an authorization boundary. For banks, fintechs and other firms giving agents access to APIs, credentials or transactions, the key question is whether every route to an action enforces the same authority.

Australia's AI Agent Found Another Route

The June 18 incident touched four Australian public websites. The government said interactions with the Australian Institute of Health and Welfare, the Victorian Department of Health and the NSW Bureau of Crime Statistics and Research were normal. The failure occurred at the Medicare Statistics Reporting Service portal after the requested information was denied.

The government's account says the agent kept trying to complete the task, obtained unauthorized access and wrote files to an internal server. Australia hasn't disclosed the exact vulnerability, request sequence or authorization flaw. No personal Medicare information is believed to have been accessed at this stage, and investigators are still checking whether other government systems were affected.

OpenAI identified the activity in August and notified Services Australia in September. Its separate review of agent behaviour has documented access control bypasses, exposed credentials, query or command injection and access to runtime internals across other incidents involving third parties. In July, NCFA reported that OpenAI models used during cybersecurity evaluations circumvented isolation controls and reached Hugging Face production systems after exploiting a vulnerability in the evaluation environment.

A September 21 UN brief described agents finding ways around restrictions, using channels they weren't supposed to use and keeping at a task in unexpected ways. That doesn't mean every agent will hunt for a weak point. It does mean that blocking one route doesn't guarantee the action itself is blocked.

Permissions Need To Follow The Action

Security teams already have language for much of this problem. The Open Worldwide Application Security Project (OWASP) also warns about agents using tools in the wrong way, being given too much freedom and getting more access than they should. NIST zero trust separates identity from authorization and checks access at the resource rather than assuming a known user or service can act everywhere.

The data support that caution. A NeurIPS 2025 red team competition collected 1.8 million prompt injection attacks against agents powered by 22 frontier models across 44 scenarios. More than 60,000 attacks produced documented policy violations, and the resulting benchmark reached near 100% attack success across the agents and policies tested. These were adversarial tests, not production incident rates, but they show how unreliable model instructions can become under deliberate attack.

Agent Security Bench, published at ICLR 2025, tested 13 model backbones across 10 scenarios with more than 400 tools. Its highest average attack success rate was 84.3%. The failures appeared across prompts, tool use and memory, which makes the surrounding permission system part of the security design rather than a backstop after the model fails.

Knowing which agent is calling an API is only the first check. A financial workflow also needs to know what resource the agent can reach, what action it can take, whose authority it is using and whether the amount, beneficiary or transaction still fits that mandate. Those checks become more important when one workflow crosses a bank, custodian, payment processor, cloud service or external API.

See AI Agents Gain Identity and Wallet Access WCGW

A strong control at one interface won't protect a weaker route elsewhere. A bank may block a beneficiary change in one application while a connected treasury API or vendor exposes a different way to reach the same payment outcome. Consequential systems therefore need their own authorization checks at the point where data, money or instructions change.

Financial Agents Can Already Spend And Submit

Canadian deployments are already giving agents authority inside real financial workflows. On September 21, Mastercard, Flybits and Rogers Bank announced a card purchase in which an AI shopping assistant selected a product and completed payment within customer instructions and a spending limit. Two days later, OneVest launched an account opening product that can prepare applications, submit information, follow cases through custodian processing and help staff work through exceptions. The Rogers Bank transaction used a defined spending ceiling rather than open authority over the card, while regulated firms using OneVest remain responsible for KYC, suitability, supervision and other decisions. Both examples show why access alone is too broad a control once software can act.

Finance also leaves less room to correct a mistake after the fact. A payment can settle, a beneficiary can change, a securities order can reach the market or a wallet can transfer value before a reviewer sees what happened. Spending limits, approval thresholds, revocation and transaction checks therefore have to work during execution, not only in a later audit.

Requiring a person to approve every tool call would remove much of the operating benefit. The more practical model is graduated authority. Low risk tasks can run inside narrow permissions, while higher impact actions trigger a fresh check or human approval before money, ownership or customer instructions change.

Canada Is Defining Agent Identity And Permissions

Canadian guidance is becoming more specific. The Canadian Centre for Cyber Security's agentic AI guidance recommends a distinct identity for each agent, narrow permissions, temporary credentials, controls around tool use and human checkpoints for higher risk activity. It also warns that governance built around human users does not always transfer cleanly to autonomous software.

OSFI's July 2026 technology bulletin identifies tool chaining, weak traceability and automated execution as agent risks. It points to unique identities for software agents, least privilege, temporary access, credentials that expire quickly, tool allowlists, API gateways, approval checkpoints and activity logs. OSFI describes these as sound practices, not new regulatory expectations.

Existing financial rules still place responsibility on the institution. OSFI's technology and cyber risk guidance already covers layered controls, identity and access management, monitoring and service accounts. Its third party risk guidance covers technology, cyber and subcontractor risk at outside providers. Those obligations become harder to manage when an agent can cross several organizations during one task.

OWASP's 2026 agentic framework adds threat categories around goal hijacking, tool misuse, identity and privilege abuse and agentic supply chains. ISO/IEC 42001 provides an organization wide AI management system. These frameworks provide many of the pieces, but connected workflows still need each consequential system to enforce the authority attached to the task and transaction.

Talking Point

The Australian incident shows what changes when software can keep working after one route is blocked. In financial services, agent identity is only the start. Authority has to hold across the credential, tool, API, third party and final transaction, even when the agent finds another way to continue the task.


NCFA Canada logoThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer to peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter