Karsten Wenzlaff, Advisor
August 26th, 2025
Cybersecurity | May 14, 2025

Image: Freepik/DC Studio
Patrick Opet, JPMorgan Chase’s Chief Information Security Officer, has dropped a rare public warning that the modern SaaS (Software-as-a-service) model is enabling cyberattacks and embedding systemic risk into the global economy. His message is that the security architecture is breaking down, and software providers are not doing enough to fix it. Below are some urgent quotes from his discourse and why they matter for Canadian fintechs, investors, and regulators.
1. “SaaS has become the default... embedding concentration risk into global critical infrastructure.”
Many fintechs are using the same core SaaS vendors for payments, data, and automation, exposing them to a single point of failure. If one of these vendors is compromised, the effects can spread fast like wild fire on a dry summer's night. For fintech startups, the risks may be inherited without full visibility.
2. “Over the past three years, our third-party providers experienced a number of incidents... requiring us to act swiftly and decisively.”
Canadian fintechs with lean security teams need contingency plans for third party supplier compromise and must monitoring vendor behaviour or risk the full wrath of a serious attack that will disrupt operations, result in data theft or leakage, fraud and financial loss, regulatory and legal exposure, reputational damage and even cascading or 'fourth party' risks. Even a global bank must isolate vendors during incidents. Read OSFI's Guidance here: Third-Party Risk Management Guideline.
3. “Fierce competition among software providers has driven prioritization of rapid feature development over robust security.”
Security is often sacrificed for speed. Fintechs should require vendors to provide (1) strong and secure default settings, (2) regular third-party audits, and proof or evidence of strong internal security programs such as SOC 2 Type II or ISO/IEC 27001 certification.
4. “Modern integration patterns dismantle essential boundaries... relying on overly simplified interactions between third-party services and firms’ sensitive internal resources.”
OAuth tokens and API integrations are often misused, allowing third and unwanted parties to access internal systems. Without strong segmentation and logging, attackers can move quickly once access is gained. Microsoft Threat Intelligence recently confirmed state actors are now targeting common SaaS apps to infiltrate customers.
5. “The most effective way to begin change is to reject these integration models without better solutions.”
Canadian fintechs should ensure procurement policies require secure integration design, advanced authorization models, and greater transparency from vendors. Startups should reference the Canadian Center for Cybersecurity Top 10 IT Security Actions for implementation guidance.
SaaS brought convenience and speed but also concentrated risk across fintech infrastructure. For smaller Canadian firms who often lack internal security engineering, the consequences of a poorly or unsecured SaaS integration can be severe. This warning should not be ignored.
Fintech leaders should:
OSFI and the CSA have made it clear that third party oversight is now a priority, so fintechs can expect questions on cybersecurity controls and operational resilience during regular reviews. SaaS is here to stay but without stronger default security and safer integrations and oversight, it'll remain a growing liability.
Fintech startups and scale-ups cannot rely on vendors to lead. Security must be a shared responsibility across the ecosystem, and it begins with better architecture, more transparency, and smarter procurement.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Enforcement | May 12, 2025

Image: AI Freepik
On May 9, 2025, U.S. President Trump signed an executive order called 'Fighting overcriminalization in federal regulations' that changes how federal agencies can or cannot pursue criminal enforcement for regulatory violations, redefining risk for fintech and crypo leaders. The policy order says prosecutors must now show clear evidence that a person or company intended to break the law before charging them criminally.
This move targets the issue of overcriminalization and aims to reduce legal risk for businesses that unknowingly violate complex or technical rules. It could reshape how enforcement decisions are made in fintech, crypto, and other innovation-driven sectors.
Here's a link the fact sheet published by the White House. Essentially the order mandates all federal agencies to:
1. A good example may be former Binance CEO, Changpeng Zhao (CZ) who was sentenced to four months in prison in 2023 for violating the Bank Secrecy Act. The case focused on compliance gaps, not fraud. Similar enforcement actions in the future might be handled differently if there was no evidence of intent.
2. These two former Coinbase employees, Ishan and Nikhil Wahi, were convicted of insider trading using confidential listing information. Since their actions were deliberate, the order may not directly apply to them but it might influence how prosecutors approach future cases involving gray areas in trading conduct.
3. Fintech and crypto companies operating in complex and evolving regulatory environments may benefit the most. The new policy could limit criminal risk for teams that unintentionally violate reporting, registration, or compliance rules.
4. Sam Bankman-Fried was convicted in 2023 and sentenced to 25 years in prison. The FTX founder was found guilty of fraud, conspiracy, and misuse of customer funds. Courts found that his actions were intentional and deceptive, so the order likely does not apply in his case.
5. Alex Mashinsky former Celsius CEO pleaded guilty to fraud and market manipulation and recently received a 12 year prison sentence for crypto fraud and knowingly misleading customers. As a result, his case also likely falls outside the scope of the new enforcement policy.
The new policy directive places the burden on agencies to prove intent before pursuing criminal charges. The change may protect founders, operators, and teams from facing prison time over technical mistakes or unclear compliance rules in an ever evolving regulatory environment.
While the order does not affect past convictions, it may influence how courts and prosecutors handle ongoing investigations. It also gives legal teams a new foundation to challenge charges that lack clear evidence of intentional wrongdoing.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
AI | May 9, 2025
Image: Freepik/iconicbestiary
On May 8, 2025 during a U.S. Senate testimony on 'Winning the AI Race', Microsoft Vice Chair Brad Smith said the company blocked employees from using the DeepSeek AI app because of the app’s data collection practices, risks of propaganda, and Chinese state censorship. Smith confirmed that DeepSeek “is not available on the Microsoft store” and cannot be used by staff. The full hearing coverage can be found at TechCrunch.
But at the same time Microsoft continues to offer DeepSeek’s open source AI models through its Azure cloud platform, raising questions for both the public and business users alike. According to Dataconomy, Microsoft claims that it has audited, changed, and sandboxed the models before release to remove parts they deem are risky or unsafe.
This mixed approach has raised some concerns since the AI model can be used by others without Microsoft's internal protections. Some smaller companies may also not have the tools or awareness to even evaluate these risks, whether they be related to security or reputation.
It's the same underlying tech. Even if Microsoft tweaks the model, the core code base still comes from DeepSeek, so any unknown, unspottable, or embedded risk could still be present.
The open source models that Microsoft offers via its Azure cloud platform, could have been adversely modified by bad actors for risks like surveillance, disinformation or phishing campaigns.
It's a double standard for Microsoft to say it's unsafe for employees but okay for customers to use it. It sends a mixed message and in certain cases a reputational or regulatory risk could grow for companies that adopt it.
If governments and regulator tighten controls around AI supply chains, especially foreign ones from China, then companies could face compliance, or import/export restrictions in the the future. The State of New York has already banned DeepSeek on official devices earlier this year due to data privacy and censorship concerns.
Fintechs and financial institutions need to verify AI model origins and audit what is under the hood, and understand how its being deployed while staying aware of compliance risks. Microsoft’s internal controls may reduce risk for its own teams, but the public and smaller firms are left more exposed.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |