Karsten Wenzlaff, Advisor
August 26th, 2025
July 22, 2026 | NCFA Companies On The Move | Wealth Investing And Trading, Artificial Intelligence And Data, Risk Compliance And Regtech

d1g1t is a Toronto wealthtech company whose enterprise platform brings portfolio management, performance and risk analytics, trading, reporting, billing, compliance and client engagement into one system. The company says more than 90 wealth firms across North America use the platform, representing over C$200 billion in assets across 600,000 accounts, 250,000 clients, 2,000 advisors and 20,000 users. Those assets belong to client firms and their investors; d1g1t supplies the technology rather than managing the money.
Its July 2026 launch of a server built on Model Context Protocol (MCP) connects that governed portfolio data to Claude, ChatGPT, Microsoft Copilot and other compatible AI tools. Advisors can ask questions about households, holdings, performance, exposures and mandate breaches without working through every screen by hand. The launch matters because d1g1t isn’t adding AI to an empty interface. It’s making an established wealth operating system callable by the assistants firms are beginning to use.
Wealth firms rarely replace a core platform for one clever feature. They do it because too many systems, spreadsheets and handoffs have made the business difficult to run. d1g1t sells against that fragmentation. Its platform gives advisors, operations teams, portfolio managers and compliance staff a common set of household, account, portfolio and risk data, then uses the same engine across reporting, trading, billing and client work.
Recent customer decisions show the size of the jobs it is winning. PWL Capital selected d1g1t in March 2026 for integrated portfolio management, trading, reporting, compliance, billing and client engagement, including bilingual delivery. In June, Goodreid Investment Counsel deployed the platform after using its previous system for a decade. Goodreid manages approximately C$900 million. Neither example proves a typical implementation result, but both show d1g1t being trusted with core operating work rather than a peripheral dashboard.
There is another useful clue in the cap table. CI Financial, National Bank’s NAventures, Purpose Financial and FigTree Financial have invested in d1g1t, partnered with it or used its technology. In 2025, RBC selected d1g1t’s analytics engine and made a strategic investment. For a wealth software company, customers that also supply capital can do more than validate the product. They can sharpen product priorities, open distribution and make the platform harder to dislodge once it sits inside important workflows.
The performance and risk engine is the foundation. d1g1t’s founders built their careers in quantitative finance and enterprise risk systems, including at Algorithmics and R2 Financial Technologies. That history matters because high-net-worth portfolios are rarely a neat list of public securities. Wealth firms may need to connect family entities, several custodians, private funds, partial ownership, off-book assets and different reporting rules before an advisor can answer a seemingly simple question. The engine calculates performance, exposure and risk across that structure, while the application layer turns those calculations into daily work.
The integrated workflow is what firms buy. The platform covers portfolio and model management, trading and rebalancing, performance reporting, billing, compliance, document management, business monitoring and a client portal. d1g1t says it supports traditional and alternative assets and works across multi-family offices, independent advisors, broker-dealers, custodians and bank advisor networks. That breadth creates a larger contract opportunity than a single analytics tool, but it also raises the implementation bar: the company has to handle data conversion, integrations, controls and firm-specific operating rules well enough to become the system people actually use.
MCP changes how users reach the platform. Instead of asking an advisor to click through several modules, the server exposes approved d1g1t capabilities to an AI assistant. A user can request a morning brief, summarize an upcoming meeting, check portfolio drift, examine exposures, prepare a report or flag a mandate breach in natural language. AI agents entering governed financial workflows need permission boundaries, traceable actions and reliable source data. d1g1t already organizes much of that underlying context inside the client’s wealth platform, which is more interesting than attaching a general chatbot to a collection of disconnected files.
d1g1t describes the MCP connection as governed. Public materials explain the intended workflows, although named customer deployments, pricing and detailed implementation specifications haven’t yet been released. Those details will show how quickly the product becomes part of daily advisor work and whether it helps expand existing contracts.
d1g1t is selling into a market where data quality, switching risk and regulatory responsibility matter as much as the interface. Its integrated platform gives the company several ways to win, but the field around it is getting more capable.
MCP is becoming a wealthtech connector, not a moat by itself. Canadian wealth platform OneVest launched its own MCP connection in April 2026, giving AI tools access to live wealth data, portfolios, pipeline information and tasks. OneVest’s continuing wealth-platform expansion makes it a particularly relevant Canadian comparison. d1g1t’s case will rest on the depth of its analytics, complex-portfolio support, integrated workflows and enterprise relationships, not simply on supporting an open protocol.
Large platforms are building native advisor assistants. Addepar’s Addison queries permission-aware portfolio data across a platform used by more than 1,400 firms, while Orion’s Denali AI connects portfolio, risk, CRM and planning information with audit controls. InvestCloud is automating meeting preparation and follow-up. These companies arrive with large installed bases and mature integrations. d1g1t doesn’t need to beat every platform everywhere, but it does need to make AI meaningfully better for the complex firms it already serves.
Good AI depends on clean, usable wealth data. Portfolio answers are only as reliable as the account, ownership, transaction and security data underneath them. PureFacts’ work with wealth platforms on data readiness reflects the same commercial reality: firms want automation, but first they need consistent data and clear operating definitions. d1g1t’s single-platform design can reduce some of that fragmentation. Client-specific data mapping and integration work won’t disappear.
Documents remain part of the advisor record. Holdings and performance data tell only part of a client’s story. Agreements, statements, correspondence and planning records also shape advice and compliance. FutureVault’s agentic document intelligence for advisors shows another route into the same workflow. d1g1t includes document management, but specialized providers can compete or partner around the edges of the platform.
The regulated firm still owns the decision. d1g1t is presented as a software provider, not an investment dealer or portfolio manager. Its clients remain responsible for suitability, supervision, books and records, privacy, cybersecurity and third-party oversight. Canadian cybersecurity guidance for registered firms makes vendor controls and incident readiness part of the buying decision. d1g1t’s SOC 2 Type II work is relevant assurance, though firms will still assess the current AI connection, permissions and data handling for their own use.
Enterprise growth can be lumpy. A core wealth platform can produce durable revenue once installed, but sales and implementation cycles are long. Each customer may require integrations, migration, testing and training before the contract reaches full use. d1g1t’s 96% revenue growth from 2021 through 2024 and recent PWL and Goodreid wins show progress; revenue, recurring-revenue mix, retention and implementation economics remain private.
d1g1t has spent years doing the difficult part: organizing complex wealth data and placing the same analytics inside reporting, trading, billing, compliance and client work. Its current scale, recent customer wins and relationships with major Canadian financial institutions give the MCP launch a credible base. The product isn’t asking wealth firms to trust an AI tool with data that sits somewhere else. It connects the assistant to a platform already used to run the business. On the NCFA Financial Innovation Map, that puts d1g1t at a useful intersection of wealth infrastructure, portfolio data, AI interfaces and compliance technology.
What matters next is adoption. Named firms using the MCP server in live advisor workflows, measurable time savings and evidence of larger or stickier contracts would show that natural-language access is becoming a commercial feature rather than a useful demonstration. That is a fair question for every wealth platform now adding agents, not a problem unique to d1g1t.
The Company Intelligence Snapshot below follows the capital, customer relationships and product decisions that brought d1g1t to this point.
d1g1t was founded in Toronto by financial technology veterans Dr. Dan Rosen, Philippe Rouanet and Benoit Fleury. Incubated at the Fields Institute, the company set out to bring institutional portfolio and risk analytics into a single operating platform for wealth firms. By late 2018 it had four customers representing approximately C$13 billion and 5,000 households.
d1g1tToronto wealth-management technology company
FoundationProduct and first enterprise customers
C$9M+Raised across two early rounds led by Purpose Financial
CanadaIndependent wealth firms and portfolio managers
4 FirmsApproximately C$13B and 5,000 households
One PlatformAnalytics and advisor work replace a fragmented stack
d1g1t began with a difficult but valuable wedge: institutional analytics adapted for wealth firms. The founders’ earlier enterprise systems gave the company credibility with buyers who would be trusting it with core portfolio data.
Information notice: Private-company estimates are identified and attributed. Information may change after the stated update date. This content is provided for informational purposes only and does not constitute investment, financial or legal advice.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |

July 21, 2026 | NCFA Companies On The Move | Cybersecurity And Fraud, Identity Privacy And Data Governance, Artificial Intelligence And Data
Tailscale is a Toronto founded secure networking company built around WireGuard, identity controls and direct connections between devices. By July 2026, it was nearing 40,000 paid business clients and approximately 300 employees, according to BetaKit. Tailscale’s website separately reports 2.5 million active devices and 100,000 monthly active users.
The core business makes private networks easier to deploy and govern, while Aperture and Border0 take Tailscale into AI access and privileged infrastructure—two markets with bigger security budgets and much heavier competition. This profile looks at what customers are buying today, where the next leg of growth could come from and what the public evidence still can’t tell us.
The best public clues come from customers describing work they no longer have to do. Instacart reduced internal VPN support requests from about 10 each week to nearly zero, cut new user onboarding to less than one minute and reported no outages after deployment. Cribl grew from 18 to approximately 550 employees without hiring a dedicated networking team to administer access, while Corelight reports saving more than 1,000 hours annually and Positron estimates it saves an hour each time a prospect is onboarded.
These are selected Tailscale case studies, not audited results or a measure of what the average customer should expect. Still, they help explain how the product spreads: it removes the VPN tickets, slow onboarding and constant access administration that technical teams already dislike. A developer can start with one live problem, and if the network holds up, IT and security have a practical reason to standardize it, add controls and bring more of the company onto the same service.
Core Tailscale appears to be the product that pays today. It creates an encrypted private network among approved users, devices, servers and services, with identity based policy deciding what can connect. Developers can get started without rebuilding the company network; as use grows, IT and security can add centralized administration, device posture, logs and tighter access controls. Tailscale’s client, command line tool and relay server code are open source, but the hosted coordination server is proprietary. That coordination service distributes public keys and access rules, while customer traffic normally moves directly between endpoints or through encrypted relays. Tailscale Raises $230M To Power Identity-First Networking looked at why this model could pressure conventional VPN and firewall products.
The pricing supports the same bottom up motion. Tailscale currently lists a free Personal plan, Standard at US$8 per user per month, Premium at US$18 and custom Enterprise terms, with paid plans adding provisioning, device posture, administrative roles, network flow logs, regional routing and support. The cost of trying the product is low; the account becomes more valuable as more people, devices and company controls move onto it.
Revenue is the important missing number. Tailscale doesn’t publish it, and the outside estimates aren’t close enough to treat as fact. GetLatka puts 2025 revenue at US$45.2 million, although it says the figure is modelled and that management wasn’t interviewed. Northmetric estimates US$60.1 million in current annual recurring revenue with medium confidence, relying partly on an assumed 54,000 paying customers—well above BetaKit’s July 2026 report of nearly 40,000 paid business clients. Taken together, the estimates point to a company with real commercial scale, but they don’t establish Tailscale’s actual revenue.
Aperture is the move into AI access and cost control. Sitting between approved users or agents and AI model providers, it centralizes credentials while applying access rules, usage visibility and spending limits. That puts platform, security and AI infrastructure teams squarely in the buyer group. AI Agents Enter Governed Financial Workflows explains why permissions, approved tools and audit records matter once agents touch regulated work. Existing Tailscale networks could give Aperture a useful distribution advantage, but the product remains in beta and is currently available without extra cost during testing. Six users are included, with additional access handled through the company; usage, paid conversion and final pricing haven’t been published.
Border0 moves Tailscale into privileged infrastructure access. It governs sensitive connections to servers, databases, Kubernetes environments and internal applications, adding approval workflows, session recording and audit visibility. Those capabilities put Tailscale in front of security, compliance and operations buyers—not just the teams managing everyday network access. After acquiring Border0 in March 2026, Tailscale began connecting the product to its identity and networking layer, although the combined offering remains in beta. Adoption, revenue and final packaging haven’t been disclosed, so Border0 is best viewed as a credible expansion route rather than a proven second engine.
Tailscale now overlaps with secure networking, identity security, privileged access and AI gateways. Each move opens another budget, but it also brings the company up against much larger security platforms with broader bundles, established enterprise sales teams and far more acquisition firepower.
Large security platforms are buying identity. Palo Alto Networks completed its acquisition of CyberArk in February 2026, adding privileged access and identity security to a platform that already spans network, cloud and security operations. CrowdStrike agreed to acquire SGNL for continuous identity controls, while Zscaler agreed to acquire Symmetry Systems for data and AI access visibility. Buyers are clearly paying for identity and access control, but they may increasingly prefer to buy it inside a larger security contract.
SASE rivals have more capital and enterprise reach. Netskope’s September 2025 IPO raised approximately US$992 million and valued the company at about US$9.6 billion on a fully diluted basis. Netskope, Zscaler, Cloudflare and Palo Alto Networks can bundle network access with wider security products and sell through established enterprise teams. Tailscale’s counter is that technical users can adopt its product before a large security procurement begins, although that advantage could narrow as buyers consolidate more of their security spending with fewer vendors.
AI gateways are becoming a real product category. Cloudflare AI Gateway added real time spending limits and identity based controls in June 2026, while Kong sells governance for models, MCP servers and AI agents. Neo Raises US$100M To Control Enterprise AI Agents shows how quickly money and products are gathering around agent inventory, permissions and policy. Aperture approaches the same problem from inside a customer’s private network, which gives it an interesting opening; whether that opening lasts will depend on policy depth, auditability and model coverage.
Canadian financial institutions face clearer AI and vendor controls. OSFI’s July 2026 bulletin on generative and agentic AI connects AI use to existing expectations for technology risk, operational resilience and third party oversight. Its technology and cyber risk guideline and third party risk guideline make identity, logs, access policy and vendor diligence commercially relevant. OSFI And GRI Workshops Reveal What Regulated AI Needs found that weak identity, provider concentration and vendor oversight are already limiting adoption. Tailscale’s SOC 2 Type II status helps. CSA Cybersecurity Guidance For Registered Firms shows why firms will still need documented vendor diligence, access controls and current assurance reports.
Open source keeps the paid product honest. Tailscale identifies Headscale as an independent alternative to its proprietary coordination server, which means a capable technical team can self host that layer. The subscription therefore has to keep earning its place through reliability, administration, policy, support and company controls—not connectivity alone.
Easy adoption doesn’t remove enterprise budget friction. A Tailscale commissioned survey of 1,000 technology leaders found that 42% cited workflow or integration disruption when security upgrades were delayed, while one third cited an unclear business case. Customer results give Tailscale’s sales team concrete savings to work with, but a company wide deployment still needs an owner, a budget and proof that another security vendor can be retired or avoided.
Tailscale’s edge starts with how it gets in. A developer or infrastructure team can solve a live networking problem without waiting for a company wide migration; if the product works, IT and security can add policy, device controls, logs and support around a network that people are already using. Reported results from Instacart, Cribl, Corelight and Positron give that approach substance beyond the usual product pitch. It also places Tailscale across several areas in the NCFA Financial Innovation Map, including digital identity, cyber resilience, AI governance and enterprise infrastructure.
The next act is harder because Aperture and Border0 ask those customers to trust Tailscale with AI access and privileged infrastructure, where the budgets are larger and the incumbents are stronger. Nearly 40,000 paid business clients and 2.5 million active devices give Tailscale a meaningful starting point; what isn’t public yet is whether either product is creating meaningful new revenue.
The Company Intelligence Snapshot follows the funding, customer growth and product decisions that brought Tailscale to this point.
Tailscale was founded in 2019 to reduce the complexity of connecting people, devices and services across the internet. Its first generally available product combined WireGuard encryption, identity and direct connections without requiring companies to rebuild their existing networks.
TailscaleA Canadian founded secure networking company
LaunchGeneral availability arrived in April 2020
US$3M SeedLed by Heavybit with Uncork Capital and others
GlobalRemote teams, cloud infrastructure and personal networks
Developers FirstIndividuals and technical teams could start without enterprise deployment
Simpler VPNDirect encrypted connections reduced reliance on central VPN concentrators
Rather than begin with a top down security sale, Tailscale gave developers a faster way to connect private infrastructure and let working networks make the case for wider adoption.
Information notice: Private-company estimates are identified and attributed. Information may change after the stated update date. This content is provided for informational purposes only and does not constitute investment, financial or legal advice.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
July 20, 2026 | NCFA Story Intelligence | Regulation And Policy, Capital Markets And Market Infrastructure, Competition And Market Structure

On July 15, 2026, Ontario Finance Minister Peter Bethlenfalvy announced that Ontario had committed to joining Canada’s securities regulatory passport system. The federal Finance Department highlighted the commitment following the federal, provincial and territorial finance ministers’ meeting in Charlottetown, ending almost two decades as the only jurisdiction outside the system.
Finance ministers described the decision as regulatory harmonization, removal of an interprovincial trade barrier and progress toward one Canadian economy. It also resolved a contradiction Ontario had carried for years. The province repeatedly documented duplication, delay and disproportionate compliance costs while continuing to require a separate Ontario decision where most of Canada relied on one principal regulator.
Ontario stayed outside because passport was never the prize it wanted. The province backed a single national regulator, then a cooperative authority with a wider institutional redesign. The first model failed in court. The second survived legally but never opened.
Companies carried the cost of waiting. Equity crowdfunding showed what fragmentation did at company level. A financing model designed to connect issuers and investors online became a provincial compliance exercise that excluded supporters, consumed employee time and made some smaller raises uneconomical.
The story isn’t that Ontario suddenly discovered regulatory friction in 2026. Every alternative gradually weakened while the economic cost of maintaining a separate process became harder to defend.
Canada has one capital market but several securities authorities. Each province and territory retains its legislation, regulator and enforcement powers. The Canadian Securities Administrators develops common instruments, policies and filing systems so companies don’t face entirely different frameworks in every jurisdiction.
Coordination reduces differences without eliminating repeated work. A filing, interpretation, fee or local review may appear reasonable on its own. A company raising capital or operating nationally experiences the accumulated cost through the same legal budget, employees and management time needed to build the business.
Most jurisdictions accept mutual reliance. The principal regulator can develop familiarity with the company, conduct the main review and issue a decision recognized elsewhere. The market gains a national operating mechanism without requiring provinces to surrender jurisdiction.
Ontario remains outside the compromise. An interface arrangement connects it to passport jurisdictions, but companies can still require a separate Ontario decision to access Canada’s largest capital market. The additional step remains while Ontario pursues a more ambitious institution.
The federal proposal reaches far beyond passport. The Canadian Securities Act would place registration, prospectuses, disclosure, derivatives, civil remedies and market offences within one federal regime. Ontario supports a structure that could replace the provincial coordination model rather than simply improve it.
The constitutional loss leaves Ontario without its preferred destination. In 2011, the Supreme Court rejected the proposed Act because Parliament couldn’t assume ordinary provincial securities regulation through its general trade and commerce power. Ontario loses the national model but still doesn’t join passport.
The cooperative model fixes the constitutional problem. Participating provinces would enact uniform laws administered by a common authority, while complementary federal legislation would address systemic risk and national criminal matters. Each legislature remains free to join, amend or leave.
Legal approval cannot assemble the institution. The Supreme Court approved the design in 2018, but major provinces remain outside and implementation dates recede. The first model fails because it takes too much provincial authority. The second preserves authority so carefully that no common regulator opens.
Several provincial rule books confront one digital market. Jurisdictions adopt different offering limits, investor caps, portal obligations, disclosures and filings. NCFA’s archive includes NCFA Canada Response to the Proposed Multilateral Instrument 45-108 Crowdfunding and Start-Up Prospectus Exemption.
The losses appear outside ordinary regulatory statistics. No portal initially registers under MI 45-108. More than 100 startups reportedly lose economical access to Ontario supporters, while one small firm assigns two employees for months to historical compliance work. The underlying record is available in March 1, 2019: NCFA Submission to the Ontario Securities Commission on Regulatory Burden. NI 45-110 harmonizes the market in 2021, but it cannot recover the financing, participation and productive work already lost.
The OSC confirms a pattern rather than a few difficult files. It receives 199 suggestions and identifies 34 underlying concerns, including repeated filings, difficult regulatory navigation, unclear service expectations, outdated technology and requirements that fall more heavily on smaller firms.
The response reveals the jurisdictional limit. The OSC announces 107 initiatives to improve service and remove avoidable work. Related NCFA coverage: OSC Makes Doing Business Easier for Ontario Market Participants. Ontario can improve its own processes, but it cannot eliminate national duplication while continuing to require a separate Ontario decision.
The Taskforce reaches beyond procedural burden. Its recommendations cover governance, competition, capital formation, disclosure, innovation, enforcement and investor protection. NCFA’s formal response is NCFA Response to the Modernizing Ontario’s Capital Markets Consultation Taskforce.
Ontario divides authority inside the OSC while preserving duplication outside it. Capital formation and competition enter the mandate, the Chair and CEO roles are separated and adjudication is placed within a distinct tribunal. The proposed Capital Markets Act does not replace the existing statutes, and no public tracker supports a claim that the complete 74 recommendation program was implemented.
The cooperative transition project winds down without transferring authority. Existing commissions remain responsible, the CSA continues coordinating national policy and passport keeps serving the jurisdictions that joined it. The practical system survives while the ambitious replacement recedes.
Ontario’s holdout loses its destination. The province is no longer choosing between passport and an approaching national regulator. It is choosing between passport and continued duplication with no replacement institution in sight. The original reason for waiting has disappeared, but companies still face the additional process.
The Bank of Canada turns weak productivity into an emergency. In March 2024, Senior Deputy Governor Carolyn Rogers says it is time to break the glass. Weak investment, limited competition and lengthy or unpredictable approvals discourage companies from committing capital.
Ontario’s separate review becomes part of the economic diagnosis. Every repeated filing, legal opinion and approval cycle uses the same employees, financing and management attention needed for technology, customers and expansion. Related NCFA coverage: How Competition Powers Canada’s Economic Growth. Passport doesn’t remove scrutiny. It prevents several regulators from consuming company resources to deliver substantially the same protection.
The cost of duplication is no longer only regulatory. It is productive work that doesn’t happen.
Ontario gives up duplication rather than jurisdiction. One principal regulator can conduct the main review while Ontario retains its legislation, commission, enforcement capability and voice in national policy. The province no longer has to choose between complete institutional control and surrendering its capital market.
The political commitment now faces an operating test. Industry advocates said passport can create a “single regulator experience through a principal regulator,” but harmonization in policy must also deliver harmonization in practice across legislation, policy and regulatory operations. Investment Executive reports the implementation direction and industry response. The strongest evidence of success will be fewer repeated reviews, lower compliance costs and faster interprovincial access while maintaining investor protection.
Ontario’s decision closes a long loop in Canadian capital markets policy.
The province rejected passport because it wanted a more ambitious national regulator. The first version failed constitutionally. The cooperative version survived in court but never became operational. Ontario then documented extensive burden inside its own market, implemented selected modernization reforms and continued requiring a separate provincial process after the national alternative receded.
Equity crowdfunding showed what the delay meant for companies. The market was divided before it could mature nationally. Legal work, platform controls and continuing obligations consumed a large share of modest financings. Investors were excluded by geography. Employees were assigned to compliance work instead of customers and growth.
The productivity emergency raised the stakes. Canada cannot describe weak investment, limited competition and poor productivity as urgent while treating avoidable duplication as institutionally harmless. The same capital and employee time cannot be used twice.
Passport is not a single national regulator, and it does not eliminate provincial authority. Its value is practical. One qualified regulator does the principal work while the others rely on the result.
Ontario didn’t suddenly discover regulatory friction in 2026. It gradually accepted that preserving every layer of control carried an economic cost that internal reform and an unfinished national project had not removed.
Ontario should publish an implementation schedule, identify the decisions covered by passport and report whether review periods, professional costs and duplicate regulatory interactions decline. Results for smaller firms should be reported separately because they carry fixed compliance costs most heavily.
Investor protection remains central. Reliance should remove repetition, not scrutiny. Principal regulators need the information, expertise and authority required to make decisions every participating jurisdiction can trust.
The larger question extends beyond securities regulation. Canada often pursues national economic outcomes through provincial institutions. Governments may continue debating the ideal architecture, but companies shouldn’t be required to finance avoidable friction while they wait.
When governments measure regulatory burden, should they count only compliance expenses that appear on company records, or also the financings, investment and productive work that never occur because the combined process makes them uneconomical?
Share this story → Explore related intelligence → Subscribe
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
July 20, 2026 | NCFA Resource | Cybersecurity And Fraud, Risk Compliance And Regtech, Capital Markets And Market Infrastructure

On July 15, 2026, the Canadian Securities Administrators published new cybersecurity guidance for registered dealers, advisers, and investment fund managers (Download the 12 page PDF report). CSA Staff Notice 33-322 combines findings from a focused review of 73 firms with practical expectations for policies, employee training, risk assessments, third party oversight, and incident response.
The notice is most useful as a compliance review tool. Firms can compare their written controls, operating practices, and supporting records against the deficiencies and effective practices identified by securities regulators. The guidance is particularly relevant for smaller and medium sized firms that may not have dedicated cybersecurity teams.
The notice organizes cybersecurity readiness around five areas that regulators examined under section 11.1 of National Instrument 31-103:
The review found useful benchmarks. 8% of firms had no written cybersecurity policies, while 55% had policies that needed improvement. Twenty one per cent provided no employee cybersecurity training. Forty five per cent completed risk assessments that could have been stronger, and 12% had no documented assessment during the review period.
Third party oversight was one of the clearest weaknesses. All examined firms used service providers with access to systems or data, but 62% had no documentation or limited documentation supporting their cybersecurity oversight. The CSA expects firms to complete and document due diligence before onboarding a provider and repeat that review throughout the relationship.
The guidance identifies information firms should assess, including data storage, encryption, access controls, patch management, incident notification, subcontractors, operating jurisdictions, and shared responsibility in cloud environments. It also recommends maintaining a complete vendor register and reviewing current SOC 2 or similar reports where available.
Incident preparedness also receives detailed attention. Fifteen per cent of firms had no written incident response plan. Among firms with a plan, 53% needed stronger procedures and 63% should have tested their plans more regularly. The notice describes tabletop exercises and simulated attacks as practical ways to test whether people, processes, and technical controls work together during an incident.
The primary audience is firms registered as dealers, advisers, portfolio managers, investment fund managers, exempt market dealers, and restricted portfolio managers. Chief compliance officers, directors, technology leaders, privacy professionals, and internal audit teams can use the notice to organize a control review and identify missing documentation.
Boards and senior executives can also use it to test whether cybersecurity oversight is tied to clear responsibilities, regular reporting, and evidence that controls operate as intended. Written policies alone aren’t enough when actual practices, testing schedules, or access controls differ from the documented process.
Cybersecurity consultants, legal advisers, insurance providers, managed service providers, and software vendors can use the findings to better understand the records and evidence registered firms may need during a regulatory review.
The notice is strong because it combines regulatory expectations with observed deficiencies, percentages, effective practices, and practical takeaways. It covers both governance and technical controls, including multifactor authentication, encryption, backups, access rights, patching, email filtering, endpoint protection, and activity logging.
It also makes documentation a central requirement. Firms should be able to show when policies were reviewed, who completed training, how risks were assessed, what vendor due diligence occurred, and when incident plans or backup recovery procedures were tested.
The guidance does not create a complete technical cybersecurity standard, and it doesn’t replace obligations under privacy, securities, corporate, or other applicable laws. Expectations also vary with the firm’s size, operating complexity, client information, service provider reliance, and exposure to cyber risk.
Firms should therefore use the notice as a regulatory gap assessment and evidence checklist, then supplement it with appropriate legal advice, technical standards, testing, and controls suited to their operations.
CSA Staff Notice 33-322 (cybersecurity examination findings and guidance for registered firms)
CSA Staff Notice 33-321 (foundational 2017 cybersecurity and social media guidance)
NIST Cybersecurity Framework (risk management structure for identifying, protecting, detecting, responding, and recovering)
CIS Critical Security Controls (prioritized technical and operational safeguards)
Wealthsimple Confirms Breach Impacting Clients (third party exposure and incident response)
Proposed Class Action Targets Equifax Access Controls (access governance and third party permissions)
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
July 20, 2026 | NCFA Market Activity | Cybersecurity And Fraud, Artificial Intelligence And Data, Risk Compliance And Regtech

On July 20, 2026, Neo emerged from stealth with US$100 million in combined seed and Series A financing from Andreessen Horowitz, Bessemer Venture Partners, Craft Ventures and Merlin Ventures.
The Boston cybersecurity company was founded in 2025 by Nick Warner, Shlomi Salem and Eran Shirazi. Note that it's unrelated to Calgary based Neo Financial. Warner previously served as SentinelOne president and COO, Salem led detection engineering and threat research at SentinelOne, and Shirazi previously co-founded EasySend after leading vulnerability research in Israel’s Unit 8200.
Neo is building what it calls an agentic software control layer. The platform gives security teams an inventory of AI agents, AI enabled applications, plugins, extensions, MCP servers and traditional software that has gained agentic capabilities. It then maps permissions, attributes actions and applies policy before software reaches sensitive data or systems.
The company plans to use the financing to expand engineering and go to market operations. Neo hasn't disclosed revenue, customer counts, named customers, valuation or the allocation between its seed and Series A rounds.
Enterprise security was built around human users, known applications and recognizable data flows. AI agents can act differently. They may inherit a user’s permissions, call several tools, reach files and credentials, communicate with other agents and continue operating without a conventional interface.
That means risky activity may not even resemble a conventional intrusion. An agent can use valid credentials and approved applications while still exporting too much data, reading a secret, pushing code or initiating an action that exceeds the authority its operator intended to grant. NCFA’s analysis of AI agents gaining identity and wallet access shows how quickly this issue reaches financial APIs and real infrastructure.
Neo’s platform combines four functions. It finds AI software, checks what it can access, shows who or what is behind each action, and lets security teams allow, block or pause that action for approval.
Threat's aren't limited to deliberately malicious agents. ShadowLeak demonstrated how hidden instructions could manipulate an AI agent and expose private information without a user clicking a malicious link.
Its Neoverse knowledge base maps the capabilities, risks and behaviour of agentic software before it enters an enterprise environment. Neo says enforcement occurs natively at the endpoint, where the software can intercept tool calls, API access, credential reads and data transfers before the action is completed.
Neo combines software inventory, posture intelligence, attribution and endpoint enforcement across agentic and traditional applications.
Check Point is developing a wider AI security control plane covering employee AI use, AI applications and agentic systems.
SailPoint is extending identity governance to AI agents and other non-human identities.
Existing endpoint security providers already control devices, files and processes, but may not yet map the permissions and chained actions occurring inside agentic software.
Cloud and application security companies can govern models, APIs and data access, creating a competitive question around whether customers will buy a separate agentic control layer or expect existing security platforms to absorb the function.
Banks and other regulated organizations will need more than a list of approved AI tools. They need to know which person authorized an agent, what credentials it inherited, which systems it can call, what information it can export and when human approval is mandatory.
Neo’s opportunity is to show who or what can access each system and enforce clear limits on what they can do. Its challenge is that endpoint, identity, cloud and network security companies are all pursuing parts of the same problem. Large institutions may prefer one more specialized control layer, or they may demand that existing suppliers add agent governance to products already deployed across the organization.
Financial institutions are adopting AI while remaining accountable for privacy, cybersecurity, third party risk, operational resilience and auditability. An agent that can access customer information, initiate a payment, change code or communicate externally will need authority limits that security, risk and compliance teams can understand.
Neo has the capital and founding team to compete early, but the category is still forming. Enterprise adoption, integration depth and the quality of its policy enforcement will matter more than the size of the launch financing.
Will enterprises buy a dedicated control layer for agentic software, or will endpoint, identity and cloud security providers absorb the function before the category becomes independent?
Nick Warner, Shlomi Salem and Eran Shirazi founded Neo in 2025 to build security controls for enterprise software gaining autonomous and agentic capabilities.
Neo SecurityEnterprise cybersecurity company focused on agentic software
FormationExperienced operators assemble before the public launch
Early Institutional BackingSeed and Series A allocation not publicly disclosed
Enterprise SecurityAI driven software environments
SecOps TeamsLarge organizations adopting AI enabled software
Operator ExperienceFounders previously built and scaled enterprise security companies
Neo begins with founders who have built cybersecurity products and commercial organizations before. That lowers some execution risk, but it does not yet establish enterprise adoption.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
July 20, 2026 | NCFA Market Activity | Lending Consumer Credit And BNPL, Embedded Finance, Banking And Credit

On July 20, 2026, OnePay launched personal loans ranging from US$1,000 to US$50,000 through a new partnership with Upgrade. Eligible customers can check rates, review an offer, accept the terms and manage repayment without leaving the OnePay app.
OnePay is the consumer finance platform backed by Walmart and Ribbit Capital. Its app already offers banking, high yield savings, a digital wallet, credit cards, investing, crypto, credit building and point of sale lending. Customers who bank through OnePay may receive funds as soon as the same day. Annual percentage rates range from 7.74% to 35.99%, depending on eligibility.
Upgrade provides and services the loans, while Cross River Bank issues them. OnePay controls the app experience and customer distribution. That division of work gives OnePay a lending product without requiring it to build the full underwriting, funding and servicing operation internally.
Personal loans extend that relationship beyond everyday payments and retail financing. The new product is designed for debt consolidation, major purchases and unexpected expenses rather than financing a single transaction at Walmart checkout.
Point of sale lending helps complete a purchase. A personal loan gives OnePay a role in a customer’s wider balance sheet and monthly cash flow. A borrower may use the proceeds to refinance higher cost debt, fund a large expense or cover an emergency.
OnePay says the application can use information customers have already supplied, reducing repeated data entry. That may improve conversion, but it also makes data permissions and decision responsibilities more important. Customers need to understand which company holds their information, which institution makes the loan and who controls servicing or collection decisions.
The expansion follows OnePay’s work with Synchrony on a Walmart credit card program and Klarna on OnePay Later. Together, those products give the app several ways to serve consumers across everyday spending, retail financing, credit building and larger borrowing.
Upgrade brings the credit machinery behind the product. The company has delivered more than US$50 billion in credit to over 8 million customers since 2017 across personal loans, cards, buy now pay later, home improvement and auto financing.
For Upgrade, the OnePay agreement adds distribution through an app connected to millions of consumers and Walmart’s retail ecosystem. Instead of acquiring every borrower through its own brand, Upgrade can supply lending inside another company’s customer relationship.
This is the same operating structure seen across embedded finance. The distributor owns the interface and customer traffic, while a regulated bank and specialist technology provider supply the financial product behind it.
That structure can lower customer acquisition costs and shorten product development. It also creates dependencies. OnePay relies on Upgrade’s underwriting and servicing performance. Upgrade relies on OnePay to present the product responsibly and bring suitable borrowers into the funnel. Cross River Bank carries the regulated lending role.
OnePay combines Walmart linked distribution with banking, payments, rewards and credit inside one app.
Upgrade supplies underwriting, loan technology and servicing rather than requiring OnePay to build those capabilities.
SoFi offers personal loans inside a broader consumer finance relationship that includes banking and investing.
Robinhood is also extending beyond its original product into a wider lifestyle finance relationship spanning investing, credit, banking and rewards, although OnePay brings Walmart linked retail distribution rather than a brokerage led customer base. See NCFA’s analysis of Robinhood’s lifestyle finance strategy.
LendingClub competes in unsecured personal credit with a bank funded model and direct consumer acquisition.
Major banks already hold deposits and customer data, but may offer slower applications or less integrated digital experiences.
Personal loans could deepen OnePay’s role in customers’ financial lives, especially when borrowing, banking, payments and rewards sit inside the same app. Will the app's convenience produce durable trust rather than simply more credit volume is the question.
Pricing near the top of the 35.99% APR range carries the clearest risk. Approval may be fast, but repayment can become difficult when the loan is used for an emergency or to consolidate existing debt.
OnePay will also carry much of the reputational impact even when lending decisions and servicing sit with partners. Unclear terms, poor servicing or aggressive collections could affect how customers view the wider platform.
Canadian banks, retailers and fintechs face the same trade-off. Embedded lending through consented financial data could help companies add credit faster, but the business controlling the interface still needs to make pricing, data use, lender identity and repayment responsibility clear.
Can OnePay turn Walmart scale distribution into a primary consumer finance relationship, or will it remain a storefront for credit products supplied by banks and specialist lenders?
Angus McDonald and Chris Bayley founded Cover Genius after encountering fragmented insurance distribution while operating an online travel business. RentalCover became the first use case for combining digital distribution, policy administration and claims support.
RentalCoverRental vehicle protection distributed through digital booking platforms
LaunchA focused first product built around a clear travel use case
Founder LedEarly development preceded the company’s later institutional funding rounds
Travel And MobilityRental car bookings across multiple countries
Travel PlatformsOnline travel agencies and rental car booking businesses
Integrated ProtectionInsurance offered inside the booking flow rather than through a separate purchase
The first product mattered because it gave Cover Genius a practical route into a difficult market. The company learned the operating work before expanding the platform.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |