Karsten Wenzlaff, Advisor
August 26th, 2025
Karsten Wenzlaff is a Crowdfunding and Fintech Expert from Germany. He is Secretary-General of Digit[...]
Category Archives: Legal Issues, Regulation, Consultation
Can Canada Turn Access Into Productive Participation?
August 19, 2026 | NCFA Story Intelligence | Competition And Market Structure, Capital Markets And Market Infrastructure, Open Banking Open Finance And Data Sharing
Can Canada Turn Access Into Productive Participation?
Capital, Payments, Data And Retail Markets Are Converging Into A 2030 Growth Test
On March 9, 2026, the U.S. Securities and Exchange Commission held its 45th Annual Small Business Forum. The agenda moved from early-stage entrepreneurs to growth companies and smaller public companies. Market participants could propose recommendations and vote on which should be prioritized for the SEC and Congress.
The U.S. has not solved small-business capital formation. That is partly why the process is useful. Questions around finders, investor eligibility, offering rules, fund structures, secondary liquidity and smaller public-company economics keep returning as markets change.
Canada is now opening several parts of its financial economy at the same time. Capital programs, SME financing, payments access, consumer-driven banking and retail private-market initiatives are moving from policy design toward operating tests. The question is no longer whether access exists on paper. It is whether more businesses, investors and challengers can use it economically.
The U.S. Keeps Reopening The Participation Question
The Forum looks across the financing lifecycle
The SEC brings founders, investors, advisers and intermediaries into one recurring process. Its 2026 Forum program again moved from early-stage financing to growth capital and smaller public markets.
The same frictions keep returning in new forms
Finders, investor eligibility, offering limits, fund structures, secondary liquidity and small-public-company economics remain active issues because one reform can solve one bottleneck while exposing another.
The Market Is Never Finished 45 years of feedback
The transferable lesson is not a U.S. securities rule. It is the habit of bringing market participants back into the process and testing whether a framework is producing the market it was intended to create.
Canada already has detailed market evidence
CVCA tracks venture and private equity. NACO tracks angel investing. Regulators and departments publish market studies, consultations and program data. Canada does not lack information about every part of the financing system.
Canada is also actively intervening
The federal government is preparing another C$1 billion venture and growth capital program. The Competition Bureau is studying SME financing. Payments, data access and retail private markets are also being redesigned.
The Canadian Opportunity Is To Connect Policy With Market Function
Canada already has consultations, programs and market data. The harder test is whether each reform produces enough real participation to change who can compete, invest and scale.
Canada Is Opening More Than Capital Markets
Institutional venture capital is getting a larger engine
The Venture and Growth Capital Catalyst Initiative is designed to attract more private and institutional capital into Canadian venture funds, strengthen fund managers and support high-growth companies from pre-seed through growth.
SME financing is being tested against a broader business population
The Competition Bureau's SME financing competition, including lender entry, expansion and switching barriers.
More Capital Does Not Answer Who Can Participate
Growth VCCI can deepen capital for companies that fit venture mandates. It does not automatically finance every viable manufacturer, service company or local employer whose growth profile, asset base or financing need sits outside institutional venture economics.
Financial data is moving toward regulated access
The proposed Canada's open banking rules bring accreditation, liability, data scope, security and technical standards into one operating framework.
Core payment infrastructure is opening to a wider membership base
PSPs and more credit unions can join Payments Canada, while the Real-Time Rail rules and access are moving toward the planned Q4 2026 launch. Wider eligibility gives PSPs and credit unions a clearer route into core payment infrastructure.
The Door Opens, Then Economics Decide Who Walks Through
Formal access changes who is allowed to participate. Competition changes only when entrants can absorb compliance, technology, integration and operating costs and still build products customers want.
Fintechs can gain more control over the customer experience
Directer access to data, payments and settlement can reduce dependence on incumbent-controlled infrastructure and give challengers more control over pricing, product design and service delivery.
Smaller financial institutions can compete through shared capabilities
Credit unions and regional firms may not need to build every payments, AI, compliance, data or digital-asset capability internally if specialized providers can deliver those functions at workable scale.
Participation Can Change The Cost Of Competing
The payoff is not a longer list of fintech entrants. It is more providers controlling enough of their infrastructure and economics to put sustained pressure on incumbents.
Retail Investors Are Entering Private Markets Through Two Doors
Managed access gives households professional selection
Ontario's long-term asset fund work could give retail investors diversified exposure to venture capital, private equity, private debt, infrastructure and other long-duration assets through professionally managed funds.
Direct access gives households the company decision
Equity crowdfunding lets an investor choose an individual company. It can connect businesses with customers, employees and supporters, but it also concentrates risk and usually offers little liquidity.
Private-Market Access Is Splitting Into Two Models
Managed access can broaden exposure to private-market returns. Direct access can broaden the number of people deciding which companies receive their money. Both can widen participation, but they create different markets.
Canada is building the managed channel for wider retail use
Managed structures can bring diversification, diligence, portfolio construction and product-level controls around valuation and liquidity. They can also preserve professional gatekeeping over where retail capital is deployed.
Canada's direct channel remains comparatively constrained
NI 45-110 allows a Canadian issuer to raise up to C$1.5 million in 12 months. Ordinary investors are generally limited to C$2,500 per offering, or C$10,000 when a registered dealer determines suitability.
Risk Appetite Is Also A Wealth Participation Question
If more company value is created while businesses remain private, wider retail access affects more than issuer financing. It influences which households can accept productive risk and participate earlier in private-market returns.
Canadian direct demand can reach the existing ceiling
Blossom, Edison Motors and Gander have used community capital alongside accredited, offering memorandum or other financing. Their raises show direct retail capital can complement professional capital rather than replace it.
International peers provide more room for direct participation
Australia permits eligible issuers to raise A$5 million in 12 months and caps retail investment at A$10,000 per company annually. U.S. Regulation Crowdfunding allows eligible issuers to raise up to US$5 million.
Legal Access Can Still Produce A Thin Market
Canada's smaller market does not prove regulation caused weak activity. Issuer quality, investor demand, distribution, awareness, liquidity and platform execution also matter. It does show why market-opening rules should eventually be judged by whether enough issuers, investors and intermediaries can participate economically.
By 2030, Participation Should Show Up In The Market
One future produces more viable participants
New payment participants build useful services. Open-banking firms turn permissioned data into products customers adopt. Smaller institutions buy modern capabilities instead of rebuilding them. More businesses find financing that fits their stage and economics.
The other future opens rules without changing market power very much
Accreditation, integration, compliance, distribution and technology remain expensive enough that the largest institutions and professional managers capture most new activity. Formal access widens while competitive intensity changes only at the margin.
By 2030, The Difference Will Be Visible In Who Built Scale
The evidence will be practical. Entrants that survive. Products customers use. Capital reaching different kinds of companies. Investors using managed and direct routes. Smaller institutions offering capabilities once reserved for much larger competitors.
Better participation can improve the inputs to productivity
More financing choices, faster settlement, stronger data access and better financial tools can give businesses more capacity to invest, automate, hire, commercialize and serve customers.
Stronger companies can create the next round of participation
Businesses that build revenue, productivity and international reach create more investable opportunities. Successful founders, employees and investors can recycle capital, experience and networks into the next generation.
Productive Participation Could Become Self-Reinforcing
More viable participants can increase competition. Better competition can improve products, distribution and capital allocation. Better tools and financing can support more investment. Stronger companies can create more opportunities for households and institutions to participate again.
The U.S. process expects the friction to change
Market participants return because new rules, market conditions and business models keep changing the problem. A recommendation can be implemented and still leave a new bottleneck elsewhere.
Canada will need the same feedback discipline across more than capital
As payments, data, private markets and financing become more open, policymakers will need to know who entered, who could not, which businesses became sustainable and where access failed to generate enough economic activity.
The Next Policy Question Comes After Access
Canada has spent years opening doors. The next phase is finding out which openings create viable markets. That means judging regulation and public programs by the participation, competition and productive activity they generate while preserving the protections that made wider access possible.
Participation is not a complete explanation for Canada's productivity problem. Management capability, commercialization, industrial structure, R&D, domestic demand, risk appetite and global scale all matter.
But Canada is now creating new access points across capital, payments, data and investing at the same time. That gives Canada a rare four-year window to see whether productive participation becomes a real growth mechanism rather than a policy slogan.
Talking Point
Canada may already possess much of the capital, technology, talent and institutional capacity needed for stronger growth. The opportunity between now and 2030 is to make more of those assets economically usable by more businesses, investors and financial challengers. If today's reforms create viable participation rather than permission alone, Canada could end the decade with more competition, more investable companies and more ways for households and institutions to share in productive growth.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
|---|---|---|
 |  |  |
SEC Regulation Crypto Assets and US$75M Fundraising Rules
August 18, 2026 | NCFA Feature | Regulation And Policy, Digital Assets, Capital Markets And Market Infrastructure
New Offering Rules, Crypto Resales And Investment Contract Exit
On August 18, 2026, the U.S. Securities and Exchange Commission proposed Regulation Crypto Assets (download 402 page PDF Proposed Regulation Crypto Assets document), a tailored securities framework for certain investment contracts involving crypto assets. The 402-page proposal would create a startup exemption of up to US$5 million over four years, a larger fundraising exemption with US$20 million and US$75 million tiers, crypto-specific disclosures, new SEC forms, secondary-market provisions, state-law preemption and a process for determining when an investment contract has ended.
The scope is narrower than the name might suggest. Regulation Crypto Assets would apply to what the SEC calls a covered investment contract. A crypto asset must be subject to the investment contract, the crypto asset itself must not be a security and no other asset can be subject to that contract.
That builds on the SEC's March 2026 crypto interpretation. The March action addressed when transactions involving a non-security crypto asset can create an investment contract and when that relationship can end. Regulation Crypto Assets would add an operating framework around that lifecycle.
The proposal is significant because it goes beyond creating two new fundraising limits. The SEC is designing rules for how certain crypto investment contracts could be offered, disclosed, distributed and resold, and how the underlying crypto asset could eventually separate from the investment contract.
What Regulation Crypto Assets Does And Does Not Cover
The proposed Regulation Crypto Assets isn't a comprehensive U.S. crypto rulebook. It doesn't create the general regulatory regime for payment stablecoins, programmable payments, crypto custody, crypto lending, mining or conventional securities that happen to be tokenized. Those activities may fall under other federal or state laws, other regulators or separate SEC work.
Payment stablecoins are a good example. Regulation Crypto Assets says permitted payment stablecoins could be accepted as consideration in a covered offering and would count toward its offering limit. It does not establish the rules for issuing payment stablecoins.
That work is proceeding separately under the federal GENIUS Act. On August 17, one day before the SEC proposal, the U.S. Treasury issued a proposed payment stablecoin rule covering implementation of the separate federal framework for their issuance, offering and sale.
Other crypto activities can intersect with Regulation Crypto Assets without becoming generally regulated by it. The proposed Startup Exemption contemplates certain distributions connected with development and use of a crypto network, including circumstances involving airdrops, staking, governance, gas fees and testing. The legal question remains whether the particular transaction involves a covered investment contract.
The proposal also doesn't create a new legal category for tokenized stocks or bonds. Tokenized conventional securities remain securities. Regulation Crypto Assets instead addresses a narrower case where the crypto asset itself isn't a security but is subject to an investment contract.
It's important for founders, investors, lawyers and trading platforms to know that a crypto asset, an investment contract involving that asset and a tokenized security, can look technologically similar while carrying very different securities-law consequences.
The US$5M Startup Route Removes Several Reg CF Frictions
The proposed Startup Exemption could be used for no more than four years after an issuer's initial Form NOR filing. The issuer and its affiliates could conduct covered transactions up to an aggregate US$5 million during that period and couldn't simply restart the four-year clock for the same or a substantially similar crypto asset.
The issuer definition is unusually flexible. The proposal would allow an entity, an individual or a group of individuals or entities to qualify, subject to the other conditions. That accommodates crypto projects that may begin with a development team before they resemble a conventional corporate securities issuer.
The fundraising mechanics are also important. The proposed startup route would permit general solicitation, impose no individual investment limit on retail purchasers and require neither financial statements nor use of a registered intermediary. Covered investment contracts sold through the exemption would not be restricted securities under federal law and would not carry a separate rule-based holding period.
Disclosure doesn't disappear. Before conducting covered transactions, the issuer would file Form NOR on EDGAR and make the disclosures required by Rule 103 publicly available free of charge.
Those disclosures are designed around the investment contract and crypto network. They include offering terms, management and conflicts, the crypto asset, development plans, network or application security, source code where applicable, token economics and allocations, governance, the related crypto ecosystem and material risks. The information must remain publicly available, with material changes addressed under the proposal's update requirements.
Bad-actor disqualifications would apply as well, and issuers would remain subject to federal antifraud and antimanipulation rules. This is a different compliance model, not an absence of securities regulation.
The most revealing comparison is Regulation Crowdfunding. Reg CF also permits up to US$5 million, but over a 12-month period. It requires a registered broker-dealer or funding portal, financial disclosure and investment limits for non-accredited investors, while securities generally face a one-year resale restriction.
The SEC makes that comparison itself. Its economic analysis estimates average Reg CF intermediary fees at approximately 6.6%, with a 6% median, and identifies the absence of mandatory financial statements and an intermediary as potential cost savings under the crypto Startup Exemption.
There is little evidence that current Reg CF rules have produced a large crypto financing market. SEC data identify 42 crypto-related Reg CF offerings by 41 issuers between 2016 and 2024. Reported proceeds totalled approximately US$13.6 million, with an average of US$545,300 among offerings for which proceeds were reported. The SEC cautions that the proceeds total is incomplete and likely represents a lower bound.
The proposal is therefore testing more than a higher ceiling. It asks whether removing particular intermediary, financial reporting, investor and resale frictions would make a public capital route more workable for qualifying crypto projects.
Tier 1 Fundraising Exemption US$20M With Ongoing Reporting
Larger projects could instead use the proposed Fundraising Exemption. Tier 1 would permit up to US$20 million in 12 months. The issuer would have to file Form 1-CRYPTO and couldn't sell covered investment contracts until the SEC qualified the offering statement.
The offering circular would combine the crypto-specific Rule 103 disclosures with financial information about the issuer. Tier 1 financial statements generally wouldn't require an audit, but the issuer would still enter an ongoing reporting regime using annual Form 1-KC, semiannual Form 1-SC and Form 1-UC for specified current events.
Retail investors would also face a restriction that doesn't apply under the Startup Exemption. A non-accredited investor generally couldn't purchase more than 10% of the greater of annual income or net worth. For a non-natural person, the test would use revenue or net assets.
Tier 2 Fundraising Exemption US$75M With Audited Financials
Tier 2 would permit up to US$75 million in 12 months. Like Tier 1, it would require Form 1-CRYPTO, SEC qualification before sales, ongoing reporting and the 10% non-accredited investor limit. The key additional financial requirement is that Tier 2 statements would have to be audited by an independent accountant under the proposed standards.
The larger Fundraising Exemption also comes with a strong U.S. nexus. The issuer would have to be an entity organized under U.S. law, a majority of its executive officers or directors would need to be U.S. citizens or residents, more than half of its assets would need to be in the United States and its business would have to be administered principally there.
Canada appears explicitly in the SEC's request for comment. Question 86 asks whether Canadian issuers, or other foreign issuers, should be permitted to rely on the Fundraising Exemption.
That is more than a passing jurisdictional detail. Regulation A already allows qualifying Canadian issuers, while the proposed Regulation Crypto Assets fundraising route currently does not. Whether the SEC changes that provision could affect how useful the US$20 million and US$75 million routes become for Canadian crypto companies.
Resale And State Rules Could Expand Crypto Distribution
The proposal's treatment of secondary transfers may prove almost as important as its fundraising limits. The SEC says existing exemptions can impede the network effects of crypto assets when they restrict who can participate or how quickly securities can be resold.
Both proposed exemptions would therefore allow issuers to sell covered investment contracts that are not restricted securities under federal law. Investors wouldn't face the federal holding periods associated with restricted securities, although contractual restrictions and other applicable laws could still affect a transfer.
That differs from common Regulation D offerings and from Reg CF's first-year resale limits. The SEC's rationale is specific to crypto networks. Wider ownership and use can contribute to how a network operates and how the crypto asset derives value, so distribution restrictions can affect more than investor liquidity.
See: Canada's Stablecoin Regulatory Framework
Rule 500 would address another obstacle by proposing federal preemption of certain state registration and qualification requirements. It would treat purchasers in qualifying Regulation Crypto Assets transactions as qualified purchasers for that purpose and extend the treatment to specified secondary-market transactions.
The preemption isn't unlimited. Secondary-market treatment would depend on the issuer remaining current with the disclosure, filing or reporting requirements attached to the applicable exemption. States would also retain antifraud authority, powers over unlawful broker or dealer conduct, notice filing requirements and applicable fees.
For trading platforms and intermediaries, the proposal introduces an additional status question. They may need to distinguish between the underlying non-security crypto asset, an outstanding covered investment contract involving it and an asset for which that investment-contract relationship has ended.
The Safe Harbor Creates An Investment Contract Exit
Rule 400 addresses one of the most distinctive features of the proposal. The SEC's existing securities rules generally deal with financial instruments whose fundamental legal character doesn't change over time. A crypto asset can present a different problem because an investment contract surrounding it may end while the crypto asset continues to exist and circulate.
The proposed safe harbor would apply when the issuer has completed or permanently ceased all essential managerial efforts that it represented or promised under the covered investment contract. The issuer also couldn't be making, or intending to make, new promises to perform those essential managerial efforts.
An issuer seeking to use the safe harbor would file Form TR. The filing would include a certification and an analysis supporting the conclusion that the required managerial efforts have ended.
Meeting those conditions would mean the crypto asset is deemed no longer subject to that investment contract for the relevant definitions of a security under the Securities Act and Exchange Act. That doesn't mean Form TR can convert a security into a non-security simply because an issuer files it. The substantive conditions still have to be satisfied, and the SEC can challenge an issuer's analysis.
Nor does the proposal replace Howey or the March interpretation. The safe harbor creates one defined route for dealing with the end of an investment contract. The SEC acknowledges that a covered investment contract could also cease to exist outside the safe harbor under the applicable securities-law analysis.
That lifecycle helps explain why the proposal is more consequential than a new exemption schedule.
The SEC is contemplating a regulatory sequence in which a project can finance development through an investment contract, distribute the associated crypto asset widely and potentially reach a point where the investment contract itself no longer exists.
Canada Could Face A Wider Crypto And Funding Gap
Canada has dealt with token offerings for years. Canadian securities regulators issued guidance on cryptocurrency offerings in 2017 and followed with more detailed token offering guidance in 2018. The CSA has made clear that coins or tokens can involve investment contracts and distributions of securities depending on their economic substance and how they are offered.
There have also been Canadian security-token initiatives and exempt-market token offerings. The difference isn't that Canada has avoided token issuance. Canada has generally applied its existing securities laws, prospectus exemptions and registration framework rather than creating a dedicated crypto lifecycle regime comparable to Regulation Crypto Assets. That difference also fits Canada's wider capital formation gap.
Capital formation makes that difference more important. Canada's NI 45-110 startup crowdfunding exemption currently permits an eligible issuer to raise up to C$1.5 million over 12 months. An investor generally can invest up to C$2,500 in an offering, or C$10,000 when a registered dealer determines that the investment is suitable, and the offering must take place through a funding portal.
The Canadian market is also much smaller. FrontFundr reports that it processed C$4.79 million from 4,320 investors under NI 45-110 in 2025 and accounted for 93% of activity under the exemption. Because that 93% figure comes from FrontFundr rather than an official national regulatory dataset, it should be treated as a platform estimate rather than an official Canadian market total.
There is stronger evidence that the C$1.5 million ceiling is becoming binding for some issuers. Edison Motors raised C$1.491 million under NI 45-110 in 2025, roughly 99% of the limit. Blossom Social raised C$1.450 million, approximately 97%.
See: Reg CF At 10 Shows Equity Crowdfunding Works
The more direct U.S. comparison is Regulation Crowdfunding. Reg CF already allows eligible companies to raise up to US$5 million in 12 months, but requires an SEC-registered intermediary, limits investments by non-accredited investors and generally restricts resale for one year. The proposed US$5 million crypto Startup Exemption would use the same headline ceiling with a different compliance model.
The larger crypto Fundraising Exemption is more directly comparable with Regulation A. Existing Reg A already uses US$20 million Tier 1 and US$75 million Tier 2 limits, with additional audit, investor-protection and ongoing-reporting requirements at Tier 2.
Canada is a different comparison. NI 45-110 isn't a crypto-specific equivalent to Regulation Crypto Assets, but it is Canada's nationally harmonized startup crowdfunding route. It remains capped at C$1.5 million over 12 months, with a funding-portal requirement and investor limits of C$2,500 per offering or C$10,000 with suitability advice from a registered dealer.
NCFA has been advocating for a C$5 million or higher issuer cap for years, arguing that the C$1.5 million ceiling can limit the usefulness of the exemption for growing companies. That concern is now easier to test against actual market activity, with some Canadian crowdfunding campaigns reaching close to the current ceiling.
The relevant policy question is therefore wider than whether Canada has an identical crypto exemption. The U.S. already offers Reg CF and Regulation A for different stages of capital raising and is now proposing a separate crypto-specific framework built around fundraising, token distribution, resale and the eventual end of an investment contract.
That matters because Canada's capital formation system already has funding gaps, while some Canadian crowdfunding campaigns are reaching the NI 45-110 ceiling. Regulation Crypto Assets could add another financing and regulatory option to the U.S. market without a directly comparable Canadian crypto-specific route.
The proposed US$75 million Tier 2 also raises a separate competitiveness issue. The SEC is asking whether Canadian issuers should eventually be eligible for the Fundraising Exemption. If they are included, qualifying Canadian crypto companies could gain access to a much larger U.S. pathway. If they remain excluded, access to U.S. capital could become another factor projects consider when deciding where to organize and raise funds.
None of this means Canadian regulators should copy the SEC. It does strengthen the case for examining Canada's startup financing limits, token-offering rules and capital-market pathways together rather than as separate policy files.
For Canada, the challenge is whether existing rules can protect investors while giving legitimate companies enough financing capacity and regulatory flexibility to build here. If the U.S. adds specialized crypto fundraising routes on top of Reg CF and Regulation A, that competitive comparison becomes more difficult to ignore.
Talking Point
If the U.S. adds a dedicated crypto capital-formation and investment-contract lifecycle regime on top of Reg CF and Regulation A, while Canada still relies on existing exemptions and a C$1.5 million startup crowdfunding cap, how long can Canada treat crypto regulation and capital-formation reform as separate policy questions?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Why fintech operational resilience begins with IT asset transparency
Aug 17, 2026
When the first DORA Register of Information submissions arrived in April 2025, European supervisors kept hitting the same wall. Financial entities could not produce an accurate, current list of their own ICT assets. The data sat in spreadsheets, in a departed engineer's notes, and across two or three tools that disagreed with each other. The EBA flagged widespread gaps and sent institutions back to resubmit, in several cases more than once.
None of that was a security failure in the usual sense. The controls were often in place. What was missing sat one level lower: a reliable inventory of what the firm actually runs. For a fintech, that absence is not a documentation nuisance. Operational resilience – keeping payments, ledgers, and customer access working through a disruption – rests on knowing what you run, where it runs, and what stops when a component fails. You cannot map a dependency you never recorded, and you cannot restore a service whose parts you cannot name.
The asset inventory is now the regulatory floor
DORA (Regulation (EU) 2022/2554), in force since 17 January 2025, states the requirement plainly. Article 8 obliges financial entities to identify and classify all ICT assets and information assets, document the links and interdependencies between them, and keep those inventories current – refreshed after every major change, with a dedicated risk assessment of legacy systems at least once a year. DORA requires EU member states to lay down effective, proportionate and dissuasive penalties for financial entities. The sanctions that apply depend on national law and on the circumstances of the breach.
The UK sets a parallel bar. Under FCA policy statement PS21/3 and PRA supervisory statement SS1/21, the transitional implementation period ended on 31 March 2025. Firms must identify their important business services, set impact tolerances, and map the resources each service depends on, including technology, data, facilities, and people. That mapping collapses without an accurate asset layer beneath it. In the US, the 2020 interagency paper on operational resilience points the same way, tying resilience to a clear view of critical systems and their dependencies.
See: AI Agents Enter Governed Financial Workflows
Enforcement is tightening rather than loosening. Germany's BaFin declared the DORA “transformation year” over at the end of 2025, a signal that supervisors now expect working inventories, not remediation plans. Three regulators, one shared premise: transparency of IT assets is the precondition for everything built on top of it.
Figure 1
Figure 1. IT asset transparency is the base layer every resilience process depends on.
What transparency means in an ICT estate
Transparency is not a spreadsheet exported once a quarter. It is three capabilities working together, and the weakest one sets the ceiling.
Discovery keeps the inventory honest
Automated hardware and software auditing finds devices, virtual machines, cloud instances, and installed packages without waiting for anyone to complete a form. Fintechs churn infrastructure quickly, so a hand-maintained list is stale within weeks. Agent-based and agent-less scanning each catch what the other misses – agents report from laptops that leave the network, while agent-less scans reach devices where you cannot install software.
Relationships turn a list into a map
A configuration management database (CMDB) records that a specific payment API runs on these servers, reads from that database cluster, and backs a named customer-facing service. During an incident, that relationship graph gives you blast radius in seconds instead of a war-room reconstruction. A flat asset list cannot answer the question that matters: if this fails, what else goes with it?
Classification and ownership make it auditable
Every asset needs a criticality rating, a named owner, a lifecycle state, and a link to the business function it supports. That is close to a word-for-word restatement of what DORA Article 8 asks a financial entity to hold, which is why an inventory missing those fields tends to fail at submission time rather than during an outage.
Table 1. What each resilience obligation actually needs from the asset layer.
| Resilience obligation | Asset data it requires | Consequence of a gap |
| DORA Article 8 inventory and classification | Full list of hardware, software, and cloud services with a criticality rating and named owner | Incomplete Register of Information; repeated resubmission cycles |
| Dependency mapping (DORA Art. 8; UK important-business-service mapping) | CMDB relationships tying assets to services, users, and third parties | Cannot scope incident impact or evidence a recovery path |
| Incident response and recovery | Live location, configuration, and ownership for every asset | Longer time-to-restore; recovery steps improvised during the outage |
| Yearly legacy-system risk review | Lifecycle state, end-of-life flags, and patch status | End-of-life systems stay live and unassessed |
| Third-party and concentration risk | Register of vendor-linked assets and their interconnections | Blind to a supplier dependency during a supplier outage |
Where asset visibility breaks in fintech environments
The failure modes are predictable. Cloud and SaaS growth push assets outside the corporate network, where an on-network scanner never sees them. Shadow IT – a product team standing up a service on a corporate card – never reaches the register at all. Remote and field laptops drop off the VPN and stop reporting, so their patch state quietly goes unknown. And the most common failure is the humblest one: the inventory lives in spreadsheets and email threads that no discovery tool feeds, so it drifts out of date the moment it is saved.
The dataset behind Alloy Software's recent deals shows how entrenched that last pattern is. Across more than 40 closed-won accounts between 2024 and 2026, spreadsheets, email, and homegrown databases were the single most common system teams were replacing – ahead of any named commercial tool.
Figure 2
Figure 2. Prior systems replaced across 40+ Alloy Software closed-won deals (2024–2026).
Building an asset register that survives an audit
A workable sequence follows the order of dependency, not the order of visible output:
- Turn on automated discovery first, both agent-based and agent-less, so the inventory populates itself instead of relying on manual entry.
- Reconcile duplicates, then assign an owner and a criticality rating to every asset – an unowned asset is an unmanaged risk.
- Build the relationships, tying assets to the services, users, and third parties that depend on them, so the CMDB can answer impact questions.
- Schedule reporting a regulator or internal auditor can read directly, refreshed on a fixed cadence rather than rebuilt in a rush before each audit.
The order matters. Teams that start with dashboards before discovery end up with attractive reports built on data nobody trusts. Discovery first, relationships second, reporting last.
Choosing a platform: what actually matters
For a regulated fintech, three questions filter the market quickly. Does discovery reach cloud and off-network devices? Does the CMDB model relationships rather than store a flat list? Can the data stay on-premises where a security policy or air-gapped requirement demands it? Cost matters, but it rarely decides the outcome on its own.
Table 2. Decision view across five ICT asset and service-management platforms.
| Platform | Discovery reach | CMDB and relationships | Hosting | Indicative cost / fit |
| Alloy Navigator | Agent and agent-less network inventory; off-network audit for field laptops | Integrated CMDB; tickets linked to assets, users, and contracts | On-prem or cloud | ~$1k–$25k/yr; 2–35 IT staff |
| ServiceNow | Agent-less discovery via MID server; broad cloud coverage | Deep, highly configurable CMDB | Cloud-first; limited on-prem | Six-figure programmes; 100+ IT staff |
| Lansweeper | Agent and agent-less scanning; strong network coverage | Asset-centric; lighter service relationships | Cloud or on-prem | Per-asset pricing that has risen sharply; small–mid teams |
| ManageEngine ServiceDesk Plus | Agent and agent-less; discovery add-on | CMDB in higher tiers | On-prem or cloud | Low–mid, per-technician/node; small–mid teams |
| Freshservice | Discovery agent plus probe | Cloud-native CMDB | Cloud only | Per-agent SaaS; no on-prem option |
Costs reflect market positioning, not quotes; verify against current vendor pricing before shortlisting.
Where a firm has outgrown spreadsheets but cannot absorb a six-figure ServiceNow programme, mid-market platforms cover the ground. Alloy Navigator sits in that band: agent and agent-less network inventory, an integrated CMDB that links tickets to assets, users, and contracts, and a choice of on-premises or cloud hosting for healthcare, public-sector, and finance environments with strict data-residency rules. Deal data puts its annual cost between roughly $1,000 for small teams and $25,000 for larger estates, which is why it usually appears against Lansweeper and ManageEngine rather than enterprise suites.
The inventory is the start, not the finish
An accurate asset register earns its keep only when it feeds the processes around it. Change management is the clearest example: when every change references the assets and services it touches, the CMDB stays current as a by-product of daily work instead of decaying between audits. Incident response reads the same relationship graph to scope impact, and third-party risk mapping – a specific DORA obligation – draws on the register of vendor-linked assets. Teams that want to go deeper on tying assets to change and incident workflows tend to find that the relationship model, not the raw asset count, is where the resilience value sits.
Where to start this quarter
If a fintech can answer three questions on demand – what do we run, what depends on it, and who owns it – most of DORA Article 8 and the UK mapping requirement is already within reach. If it cannot, no volume of policy documentation closes the gap, because the gap is data, not paperwork. Point automated discovery at the whole estate, including cloud and remote endpoints, and measure how far the result differs from the current spreadsheet. That delta is the honest size of the resilience problem.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
How fintech companies can use public web data without regulatory risk
Aug 17, 2026
A mid-size alternative lender in Vilnius pulls company registry filings, marketplace pricing and sanctions lists into its underwriting model every night. None of it is illegal to read. Most of it becomes a liability the moment it is copied, stored and combined with something else. That gap between "publicly visible" and "lawfully processed" is where fintech compliance teams keep losing arguments with their own data science departments.
Public web data – company filings, marketplace listings, court dockets, sanctions databases, social media bios – has become a standard input for credit scoring, fraud detection, KYB and competitive pricing in financial services. In Meta Platforms v. Bright Data, a federal district court held that Bright Data had not breached Meta's terms of service by collecting data from logged-out pages, which was the specific conduct at issue. The ruling turned on Bright Data's particular conduct and its contractual relationship with Meta rather than establishing a general rule for scraping public websites. For a regulated entity, that distinction is not academic. A bank's third-party risk team, an EU DORA auditor or a state attorney general does not care whether the data was "technically public" if the collection method itself created exposure.
What "public" actually means under US and EU law
hiQ Labs v. LinkedIn is still the reference case for US practitioners, and it is more nuanced than the headlines from 2019 suggest. The Ninth Circuit held twice, first in 2019 and again on remand in 2022, that scraping data from pages open to any visitor does not amount to accessing a computer "without authorization" under the Computer Fraud and Abuse Act. That took the CFAA off the table as a criminal exposure for reading public pages. It did not end the case. hiQ and LinkedIn settled the remaining contract claims in 2022, and hiQ agreed to destroy the data it had already collected and pay damages, because its scraping still violated LinkedIn's user agreement. The lesson for a fintech legal team is specific: CFAA risk and contract risk are two separate questions, and winning on one does not close the other.
On the EU side, the CFAA question barely matters, because GDPR does not distinguish between public and private personal data. Article 4 defines personal data by whether it relates to an identifiable natural person, not by where it was found. A LinkedIn bio, a court filing with a defendant's name, or a marketplace seller profile with a real name attached all fall inside GDPR's scope the moment they are collected, and Article 6 still requires a lawful basis – legitimate interest is workable for adverse-media or fraud screening, but it requires a documented balancing test, not just a note in a Confluence page.
Where fintechs actually use this data
Four use cases account for most of the public-data traffic coming out of fintech data engineering teams. Alternative underwriting pulls e-commerce store metrics, invoice marketplaces and gig-platform ratings to score borrowers who lack conventional credit files – Kabbage and, later, Amex built entire product lines on this. AML and sanctions screening cross-references OFAC, EU and UN lists against onboarding data, refreshed daily because list updates are unscheduled. Competitive pricing intelligence in embedded finance and BNPL tracks merchant-facing rates across marketplaces to benchmark interchange and fee structures. Fraud and adverse-media screening checks court records, press mentions and social profiles as a secondary signal alongside device fingerprinting.
Not all four carry the same regulatory weight. The table below is the one compliance teams actually need before greenlighting a collection project, not a generic "data source" taxonomy.
| Data source | Typical fintech use | Regulatory sensitivity | Main legal basis to check |
| Company registries (Companies House, EDGAR, EU BRIS) | KYB, beneficial ownership checks | Low to medium | Public register rules and applicable data protection law; filings may contain personal data of directors, officers, beneficial owners and other natural persons |
| Sanctions and PEP lists (OFAC, EU, UN) | AML/KYC screening | Low | Government-published, but update frequency and source authenticity matter |
| E-commerce and marketplace pricing | Competitive intelligence, embedded-finance pricing models | Low to medium | Terms of service and contract law; CFAA exposure may be lower for pages accessible without login (per hiQ v. LinkedIn) |
| Public social media profiles | Alternative credit signals, fraud indicators | Medium to high | GDPR/CCPA personal-data rules apply even if the profile is public |
| Court records and litigation databases | Adverse media, fraud investigation | High | Jurisdiction-specific rules on re-use of judicial data (varies widely, e.g. France's Article 33) |
The technical side: building a collection pipeline that survives an audit
The engineering choices matter as much as the legal analysis, because a regulator or a bank's third-party risk assessor will ask for logs, not intentions. A defensible pipeline has five properties, and they map to concrete infrastructure decisions rather than policy statements.
Figure 1
Figure 1. Each control maps to an artifact a third-party risk assessor can actually inspect. The first four are described below; request logging is the fifth, and the one the practical takeaway returns to.
Rate limiting that respects the source, not just your own throughput budget
Reading a site's robots.txt crawl-delay directive and setting concurrency accordingly is a five-minute engineering task that changes the legal character of the whole program. A crawler hitting a company registry at 200 requests per second looks like a denial-of-service test to the target's security team, regardless of what the data is used for afterward. Most production fintech scrapers we've reviewed cap at 1 request per 2-4 seconds per domain, which keeps CPU load on the target negligible and avoids the WAF triggers that generate abuse complaints in the first place.
IP rotation for reliability, not for evasion
This is the point where proxy infrastructure choice stops being a procurement decision and starts being a compliance decision. Rotating through residential or datacenter IPs to maintain a stable success rate against rate limits is standard engineering practice. Rotating IPs specifically to re-access a source after being blocked for a terms-of-service violation is the fact pattern that turned hiQ's win on CFAA into a loss on contract claims. The distinction sounds semantic until an opposing counsel reconstructs your request logs during discovery.
Data minimization at ingestion, not at export
Filtering personal identifiers (names, emails, phone numbers, biometric-adjacent fields) before the data lands in a warehouse is materially cheaper than filtering it after ten analysts have already queried the raw table. A regex-and-NER pass at the collection layer, logged with a timestamp and a rule version, is the artifact a DPO can actually show an auditor.
Retention limits tied to the original purpose
GDPR's storage limitation principle (Article 5(1)(e)) and most US state privacy laws expect a defined retention period. "We keep everything indefinitely for model retraining" is the single most common finding in the DPIAs we've read for alt-data underwriting programs, and it is usually fixable with a 90-180 day rolling window plus a documented exception process for flagged accounts.
Infrastructure and vendor selection
Proxy and scraping infrastructure choice affects three things a compliance file will ask about: whether the vendor itself runs KYC on IP sourcing, whether the billing model matches your actual usage pattern (per-IP monthly vs. per-GB bandwidth), and whether the vendor's own terms indicate the network is ethically sourced rather than built from compromised devices.
| Provider | Billing model | Entry price | Where it fits a fintech workload |
| Proxys.io | Per dedicated IP / month | From $1.40/mo (individual IPv4), $0.13/mo (IPv6) | Steady, low-volume monitoring jobs (registry checks, sanctions list refresh) where a fixed, auditable IP per data feed is easier to log than rotating bandwidth pools |
| Decodo (formerly Smartproxy) | Per GB, tiered | $2.00-$3.75/GB depending on volume | Mid-volume scraping across many source domains where bandwidth, not IP count, is the cost driver |
| Oxylabs | Per GB, sales-assisted | Roughly $8/GB at entry tier, KYC required before provisioning | Enterprises that want a vendor-side KYC record as part of their own third-party risk file |
| Bright Data | Per GB (PAYG or committed) | $8.40/GB PAYG residential, down to ~$3/GB committed; datacenter from ~$0.90/GB | Large, multi-region collection programs where volume discounts offset the higher entry rate |
The billing model split matters more than the headline price. A sanctions-list refresh job that hits the same twelve government sources every night at a predictable, low volume is a poor fit for per-GB bandwidth pricing – you're paying for a metric (data transferred) that has almost nothing to do with your actual constraint, which is IP reputation and consistency of access over time. Vendors like Proxys.io bill per dedicated IP per month, which lines up better with that access pattern and makes cost forecasting for a fixed set of monitored sources straightforward. A marketplace-pricing crawl that touches thousands of product pages across dozens of domains is the opposite case: bandwidth is the real cost driver, and a per-GB model from Decodo, Oxylabs or Bright Data scales more predictably with that workload. Enterprises already running Oxylabs' or Bright Data's own KYC process may lean on that as one input to their own vendor risk assessment, though it doesn't substitute for one.
Figure 2
Figure 2. The two variables that move cost are how many domains a run touches and how much data it moves, not the headline price per unit. Per-IP and per-GB rates are quoted in different units and cannot be compared directly.
See: AI Governance for Canadian Financial Advisors
None of these vendors, including the ones with published ethics or KYC pages, remove the fintech's own obligation to define a lawful basis, log what was collected, and honor retention limits. The proxy layer solves an availability and reliability problem – consistent access to public pages without disproportionate load on the source – not a data protection problem.
When the current setup stops being fit for purpose
Three signals usually mean a proxy or scraping setup needs to change, independent of price. First, a rising block rate on sources with unchanged rate limits – that's an IP-reputation problem the vendor's pool has accumulated, not something a compliance policy fixes. Second, the compliance team asking for source-level access logs the engineering stack can't currently produce – that's a signal the collection layer needs structured logging before it needs a new vendor. Third, a shift in workload shape, for example moving from a handful of steady, low-volume registry checks to broad multi-domain marketplace crawling, which usually means the per-IP pricing that worked for the first case stops making sense for the second.
Practical takeaway
A fintech data program built on public web sources holds up under regulatory review when three things are documented before the first request is ever sent: the lawful basis for each data category (not a blanket justification), the technical controls that keep collection proportionate to the source (rate limits, minimization, retention), and a request log detailed enough to reconstruct what was collected and why if a regulator or a counterparty's third-party risk team asks. The infrastructure vendor is a smaller decision than most procurement processes treat it as – it changes reliability and cost, not the underlying legal analysis.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Coinbase Tests How Regulated Securities Can Work Onchain
August 13, 2026 | NCFA Market Activity | Digital Assets Blockchain And Tokenization, Capital Markets Infrastructure And Funding, Regulation And Policy
Coinbase Tests How Regulated Securities Can Work Onchain
On August 11, 2026, Coinbase received Financial Services Permission from the Financial Services Regulatory Authority of Abu Dhabi Global Market to establish a regulated tokenization hub in Abu Dhabi, allowing it to arrange investment deals and provide custody for tokenized securities.
The licence gives Coinbase a regulated structure for putting share-backed securities into digital wallets while keeping investor rights, sanctions controls and securities rules attached. The real test is whether tokenized securities can work in digital wallets without losing the investor rights and controls behind them.
The Token Comes With Conditions
Coinbase says securities issued through the ADGM structure are fully backed by underlying shares and can give verified holders economic and voting rights.
The terms are more specific. Only securities that meet the prospectus's vesting conditions carry certain rights, including voting. Dividends are automatically reinvested, while redemption is limited to eligible vested holders. Investors exercising redemption also need an appropriate brokerage or bank account capable of receiving the proceeds.
The FSRA approved prospectus register shows the legal structure in practice. Coinbase Onchain SPV Ltd is listed as issuer of NVIDIA CB Certificates, ticker NVDAc, classified as Certificates over Shares. The primary prospectus was approved on August 4, 2026.
Investors therefore aren't simply holding NVIDIA shares on a blockchain. They're holding a Coinbase-issued security linked to underlying shares, with ownership rights governed by the certificate and prospectus.
That point matters as tokenized securities develop measurable business models around custody, distribution, liquidity and investor rights. The technology can change how a security is held and transferred without removing the legal machinery underneath it.
Wallet Access Doesn't Make The Security Permissionless
Coinbase says investors transacting only in these digital securities don't need to establish a traditional brokerage account or correspondent banking relationship. They need a wallet.
Every transfer is still subject to sanctions screening, and Coinbase says assets can be frozen or seized at the wallet level when required.
That puts the wallet in a different role from the early crypto idea of bypassing financial intermediaries. It becomes another way to distribute and hold a regulated security while identity, custody, corporate actions and redemption remain part of the system.
Several operating details aren't public yet. Coinbase hasn't disclosed the full range of securities, all eligible jurisdictions, the blockchain network, secondary trading venues or how freely the securities can move between third-party wallets and applications.
Those details will determine the scope of the hub as market infrastructure or it remains primarily a new distribution channel.
Tokenized Equities Are Competing On Distribution
Coinbase is entering a market where competitors are already testing different ways to connect tokenized securities with traditional market infrastructure.
In July, xStocks expanded into more global equity markets through a model that combines token distribution with conventional execution, custody, ledgering and recordkeeping behind the scenes.
The value isn't in listing another tokenized stock. It is in making issuance, custody, trading, corporate actions and redemption work well enough that investors can actually use the asset.
Coinbase brings its existing wallet, custody and trading network into that contest. It is also expanding beyond crypto into a wider financial platform, a strategy already visible in the competition between Coinbase and Robinhood across trading, derivatives and new financial products.
Canada remains a separate regulatory market. Coinbase Canada's investment platform expansion includes ambitions around stocks and other products, but the Abu Dhabi authorization doesn't establish approval or availability for Canadian investors.
Talking Point
If tokenized equities can travel through wallets but still depend on issuers, custodians, eligibility rules and redemption infrastructure, how much of the capital market has actually changed?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
```
AI in Canadian Financial Advice Firms and the Governance Standards That Must Be Followed
Aug 13, 2026
Artificial intelligence (AI) is rapidly becoming part of the day-to-day operations of Canadian financial advice firms. From automating administrative tasks and analyzing client portfolios to supporting investment research and improving client communications, AI has the potential to make advisors more efficient and help firms deliver a better client experience.
But as adoption accelerates, governance isn't always keeping pace.
Many firms are experimenting with AI tools before establishing clear policies around how those tools should be used, monitored, and supervised. That creates significant risk in an industry where investment advice is built on trust, accountability, and regulatory compliance.
Using AI without proper governance is a bit like prescribing medication without understanding the side effects or drug interactions. The technology may offer benefits, but without safeguards, oversight, and a clear understanding of the risks, unintended consequences can quickly outweigh the advantages.
For Canadian financial advisors, governance shouldn't be viewed as unnecessary bureaucracy. It's an essential part of responsible innovation.
The Regulatory Landscape Is Evolving
Canada's financial regulatory environment already places significant responsibilities on advisors, and those obligations don't disappear simply because AI enters the picture. The Canadian Investment Regulatory Organization (CIRO), together with provincial securities regulators such as the Ontario Securities Commission (OSC) and the Canadian Securities Administrators (CSA), have made it clear that existing regulatory obligations continue to apply whenever technology influences regulated activities. Firms remain responsible for ensuring investor protection, fair dealing, appropriate supervision, cybersecurity, privacy, and sound governance, regardless of whether decisions are supported by artificial intelligence.
AI governance is no longer simply a future consideration. CIRO's 2026 Compliance Report identifies artificial intelligence and emerging technologies as areas of supervisory focus, signalling that firms should expect regulators to examine how AI systems are being used, what controls are in place, and whether appropriate oversight exists. The message is clear: firms remain accountable for the outcomes produced by the technology they choose to implement.
At its core, Canadian financial advisors continue to operate under well-established regulatory obligations. For most registered firms, this includes complying with Know Your Client (KYC), Know Your Product (KYP), and suitability requirements under the Client Focused Reforms. In certain advisory relationships, such as discretionary portfolio management, a fiduciary duty may also apply. Regardless of the business model, advisors are expected to understand the rationale behind every recommendation they provide and be able to explain why it is appropriate for each client. That expectation becomes much more challenging if an AI system produces recommendations that advisors cannot clearly explain, let alone defend or stress test.
Strong AI Governance Will Be Essential
Explainability is only one piece of the governance puzzle. Firms must also consider data privacy, cybersecurity, recordkeeping, model bias, third-party vendor oversight, and ongoing monitoring of AI systems. Regulators expect firms to demonstrate not only that technology delivers operational benefits, but also that associated risks are identified, documented, and actively managed.
History provides plenty of reasons for this scrutiny. AI systems used in other industries, such as HR, have produced biased hiring decisions, inaccurate healthcare recommendations, and flawed credit assessments due to inadequate oversight or unintended algorithmic behaviour. Financial advice firms cannot assume similar issues won't emerge within investment or wealth management applications.
Another emerging consideration is AI-generated investment commentary. Recent guidance from the CSA and CIRO reinforces that securities laws apply regardless of how investment recommendations are delivered. Whether commentary comes from a financial advisor, an online platform, or an AI-powered tool, firms remain responsible for ensuring communications comply with applicable registration, disclosure, and investor protection requirements. AI cannot be used to distance a firm from its regulatory responsibilities; introducing it does not reduce those responsibilities. If anything, it increases the need for governance.
Build Governance Before Expanding AI
Strong AI governance starts long before a new tool is deployed. Rather than allowing employees to independently adopt AI solutions across different departments, firms should first define exactly where AI will be used and where human expertise must remain central to the decision-making process. Administrative automation, document summarization, workflow management, and research support may represent lower-risk applications than suitability assessments, portfolio recommendations, or investment decisions that directly affect clients. Establishing clear use cases helps prevent AI from gradually expanding into areas where the risks may outweigh the benefits.
Governance also requires clear accountability. Every AI-enabled process should have an identified owner who is responsible for monitoring performance, addressing concerns, and escalating issues when necessary. Responsibility cannot rest with the software itself. Human accountability remains essential.
Transparency should be another guiding principle. Clients deserve to understand when AI contributes to services they receive, particularly if it influences recommendations, communications, or financial planning outputs. Transparency builds trust while helping clients better understand how technology supports, rather than replaces, professional judgment.
Bias testing is equally important because AI models learn from historical data, which can contain unintended biases. If left unchecked, algorithms may produce outcomes that disadvantage certain investor groups or reinforce patterns that conflict with principles of fairness and equal access. Regular testing allows firms to identify and correct these issues before they affect clients. The objective isn't simply to deploy AI; it's to deploy AI responsibly.
Turning Governance Into Daily Practice
Creating governance policies is only the first step. Maintaining them requires ongoing operational discipline. There are some daily practices that could help firms in this aspect:
Proper documentation: Every meaningful AI-assisted recommendation or decision should be properly documented. Firms should be able to demonstrate how information was generated, how it was reviewed, and how the final recommendation was reached. Comprehensive documentation not only supports internal quality control but also prepares firms for future regulatory reviews.
Continuous monitoring: AI systems are not static. Performance can change over time as market conditions evolve, new data becomes available, or models begin exhibiting algorithmic drift. Regular reviews help ensure systems continue operating as intended while identifying unexpected behaviours before they become larger problems. Many firms may benefit from conducting quarterly governance reviews that assess model performance, review exceptions, evaluate client outcomes, and confirm compliance with internal policies.
Employee education: This should also remain a priority. Advisors need to understand both the strengths and limitations of AI. Training should focus not only on how to use new tools but also on recognizing situations where human judgment should override automated recommendations.
AI should not be treated as a set-and-go replacement for professional expertise. It should be used responsibly as a tool that enhances decision-making and quality investment advice while preserving the experience, judgment, and accountability that clients expect from trusted financial advisors.
Responsible AI Is a Competitive Advantage
AI will undoubtedly reshape financial advice in Canada, but technology alone won't determine which firms succeed. Governance will. Organizations should establish clear policies, maintain transparency, monitor performance, and preserve meaningful human oversight while using AI. Without adequate governance, firms may expose themselves to compliance failures, reputational damage, and increased regulatory scrutiny.
See: AI Agents Enter Governed Financial Workflows
As AI capabilities continue to expand, firms should regularly ask themselves one important question: Could we clearly explain every AI-assisted recommendation to a client and, if necessary, to a regulator? If the answer is yes, governance is likely supporting innovation. If the answer is no, governance deserves attention before AI adoption moves any further.
Ultimately, responsible AI is not a roadblock to the adoption of innovation. It's about ensuring innovation strengthens the quality, integrity, and trust that define professional financial advice.
— — —
About The Author
Nadeem Kassam, Marnoa Private Wealth Counsel
Nadeem Kassam, CFA®, MBA
Chief Investment Strategist, Chief Operating Officer & Portfolio Manager at Marnoa Private Wealth Counsel
Nadeem is a Chief Investment Strategist and Portfolio Manager with 20+ years' experience across major global banks, including senior-level roles at RBC, Raymond James, CIBC, Deutsche Bank, and Citigroup. At Marnoa, he leads investment strategy and portfolio management with a focus on North American equities and is a frequent commentator in the media, including regular appearances on BNN Bloomberg.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
FCA Handbook API For Compliance And Regtech
August 13, 2026 | NCFA Resource | Risk Compliance And Regtech, Artificial Intelligence And Data, Regulation And Policy
Machine Readable Rules For Compliance Systems And AI
On August 6, 2026, the UK Financial Conduct Authority launched the FCA Handbook API, giving firms, developers and RegTech providers direct access to structured Handbook data. The free service lets software retrieve current rules, guidance, technical standards and glossary content for use inside compliance and regulatory change systems.
The practical value is real. Firms no longer have to rely only on website searches, monthly downloads or manually maintained rule libraries when they want FCA source material inside their own systems. The API creates a direct route from the Handbook into software that tracks obligations, maps rules to business activities or supports AI assisted compliance work.
What It Does In Practice
The API provides structured access to the FCA Handbook, Technical Standards and Glossary. Users need a free Handbook account, and the FCA says the data can be used in firms’ own applications or through third party technology providers.
The FCA identifies several practical uses:
- mapping rules to products, activities and customer journeys
- tracking and comparing current and future Handbook changes
- feeding regulatory and policy updates into compliance systems
- supporting RegTech products with current FCA source data
- providing trusted regulatory content to AI tools
AI can help retrieve, classify and compare regulatory information, but the quality of the output still depends on the source material it receives. A direct FCA data feed reduces one common problem which is compliance tools working from copied, stale or inconsistently maintained rule text.
NCFA has already identified this problem in AI powered regulatory reporting. The opportunity isn't simply to add AI to compliance work. Systems need reliable regulatory inputs, clear controls and a way to trace outputs back to the underlying rule or guidance.
The API can also reduce manual work around regulatory updates. Firms can connect Handbook content to internal rule inventories, product governance, control libraries or change management processes rather than repeatedly checking individual pages for updates.
There are some practical access conditions. Users cannot work with the API directly through the Handbook website. They need a compatible external application such as Postman or RapidAPI, or another system built to use the interface. Protected endpoints are also subject to rate limits.
Who Gets Value
The clearest users are compliance teams, legal teams, RegTech providers, financial institutions and fintechs that need FCA rules inside operational systems.
Large firms with internal technology teams can connect the data to their own compliance architecture and tailor how Handbook content is matched to business lines, products or controls.
Smaller firms may get more value indirectly through RegTech providers that use the API to improve rule monitoring, change alerts, obligation management or policy tools.
Developers and AI teams also gain a cleaner source for regulated workflows. For example, a compliance assistant could retrieve relevant Handbook content, compare current and future text, or help staff identify which internal policies may need review after a rule update.
That doesn't make the API a compliance decision engine. A system can retrieve the rule accurately and still reach a poor conclusion about how it applies to a particular firm, product or client situation. Human review, legal interpretation and internal accountability remain necessary.
Strengths And Limits
The main strength is source quality. The API automatically draws from the latest Handbook rather than requiring firms or vendors to maintain their own copy of the rulebook. That can improve consistency and reduce the delay between a Handbook update and its appearance inside a compliance system.
It is also useful that the FCA has made the service available without a separate licence fee. Firms can choose whether to connect directly or use a technology provider, which lowers the barrier for developers and RegTech companies testing new compliance tools.
The API is not a complete regulatory archive. It does not provide historic Handbook versions. Requests for past dates return an error, although current and future versions are available through the API. Firms that need a full historical record will still need the Handbook website, archive tools or their own retained records.
The API also does not cover every piece of FCA information. The FCA Handbook contains rules, guidance and standards, while other FCA publications, supervisory communications, consultations, speeches and notices remain outside that core source. Compliance systems therefore still need broader regulatory monitoring.
Direct access to current regulatory text improves the input, but it does not guarantee accurate interpretation. Firms using AI for compliance should still test outputs, keep records, control permissions and make it clear when a person needs to review the result. The IOSCO AI Supervisory Toolkit provides useful additional guidance on governance, oversight, data quality and control expectations for AI in regulated financial environments.
The FCA Handbook API is most useful when treated as authoritative source infrastructure. It can make regulatory information easier for software to retrieve and keep current, while firms remain responsible for deciding what the rules mean for their own operations.
Key Resources
FCA Handbook API Launch (use cases for compliance, RegTech and AI)
FCA Handbook API FAQ (access, current data, limits and usage requirements)
FCA Handbook API (API access and developer entry point)
FCA Handbook (current rules, guidance and technical standards)
AI Powered Regulatory Reporting (regulatory data, automation and AI opportunity)
IOSCO AI Supervisory Toolkit For Capital Markets (AI governance, controls and oversight)
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: [www.ncfacanada.org](http://www.ncfacanada.org)
| | |
|---|---|---|
| | |
