Karsten Wenzlaff, Advisor
August 26th, 2025
Funding | Sep 24, 2025

Image courtesy of PRNewswire, Mycroft
On Sep 22, 2025, Toronto-based AI startup Mycroft announced that their agentic AI Security and Compliance Officer has emerged from stealth with $3.5 million USD in seed funding to accelerate product development and expand its reach. The funding round was led by Luge Capital with participation from Brightspark Ventures and Graphite Ventures, alongside existing investors Ripple Ventures, Developer Capital, Antler, BoxOne Ventures, and strategic angels.
This latest round follows a $1.2 million USD pre-seed round last September 2024, reported by BetaKit. Together, the two rounds bring Mycroft’s total funding to approximately $4.7 million USD.
The new capital will go towards product enhancements, expanded go to market initiatives, and scaling up operations. According to SecurityWeek, the platform currently offers modules for cloud security, device security, application protection, and audit preparation. The strategy is a direct response to increasing demand for automation in enterprise compliance and security, as companies face escalating compliance requirements from regulators around the globe.
Security and compliance functions have traditionally been fragmented across multiple tools, manual processes, and spreadsheets. Mycroft’s core innovation is a single AI-driven platform that acts as a Security and Compliance Officer. Behind the scenes, it is powered by no-code AI agents that handle specialized workflows such as monitoring cloud infrastructure, enforcing security policies, managing incidents, and preparing for audits. This design gives companies one platform to manage security and compliance, while multiple no-code AI agents work in the background on specialized tasks.
Mike Kim, Co-founder and CEO of Mycroft:
“Security shouldn’t be a burden. It should be a superpower. Our goal is to give every company access to enterprise grade security without needing a massive team. Mycroft’s AI agents don’t just automate tasks, they elevate the way teams operate, helping them move faster and stay protected from day one.”
Although Mycroft was in stealth mode, they have already signed more than 50 customers in its first six months. Early adopters include Superwhisper, Evolo, CoVet, Unified, Willful, Wisedocs, and Weave (YC25). The rapid uptake for enterprise grade security and compliance solutions highlight clear market need, especially among fast growing tech companies.
Karim Gillani, General Partner at Luge Capital highlights the importance of placing compliance at the center of trust:
“Security and compliance have evolved from manual back office functions to front line priorities that can shape customer experiences and brand reputation. Mycroft’s AI Security and Compliance Officer is the teammate that every company needs in order to stay safe.”
The AI security sector is increasingly crowded, with startups and established firms racing to deliver solutions in cloud protection, identity management, governance, and audit readiness. Mycroft differentiates itself by focusing on autonomous agentic AI that operates with minimal configuration and delivers end to end compliance outcomes. It offers a cost efficient alternative for startups and mid sized companies that lack large security operations teams.
By integrating modules that span from device security to regulatory audit support, Mycroft aims to give scaling companies confidence to grow while maintaining compliance.
Mycroft is well positioned to pursue sectors with heavy compliance such as fintech, healthcare, and SaaS. As regulations tighten globally, demand for solutions that can act as a virtual compliance officer is expected to grow. For more details, visit Mycroft’s official site.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create aa vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Cybersecurity | Sep 23, 2025

Image: Freepik/DC Studio
On September 18, 2025, researchers at Radware disclosed a zero click indirect prompt injection called ShadowLeak that caused ChatGPT Deep Research to leak Gmail data after it encountered a booby trapped email. It's a new class of risk where hidden instructions can manipulate agents while being invisible to users, so NCFA wants to ensure that fintechs and key stakeholders are aware of how attackers can turn AI helpers into data thieves in a way that users including developer's can't see.
Radware’s analysis shows that the leak originated from OpenAI’s own cloud infrastructure rather than a user’s device. A malicious email carried hidden HTML instructions such as white text on a white background. When the user later asked the agent to summarize emails, the agent followed the invisible prompt and sent private details to an attacker controlled URL.
Because the action happened in the cloud, the victim’s network defenses never saw it.
The researchers warned that the same trick could work on other connectors including Google Drive, Dropbox, Outlook, calendars, and GitHub. That means sensitive business data such as financial contracts, HR records, and meeting notes could also be exposed.
Radware reported the issue on June 18, 2025. OpenAI deployed fixes by early August and closed the case on September 3. An OpenAI spokesperson told Recorded Future News that the company continually improves safeguards against exploits like prompt injections.
ShadowLeak is not the only case of an AI agent being manipulated into acting against its user.
At Black Hat in August 2025, researchers demonstrated an attack called AgentFlayer that used a poisoned Google Drive document to leak secrets through ChatGPT connectors. The document contained hidden instructions that looked harmless to a person but were machine readable. When the agent processed the file, it followed the malicious prompt and attempted to extract sensitive data.
On August 20, 2025, security researchers at Brave (website browser company) disclosed a similar flaw in Perplexity’s Comet browser. They showed how a hidden Reddit prompt could read Gmail one time passcodes and expose them to an attacker.
On September 13, 2025, Tom's Hardware wrote about a malicious Google Calendar invite method could steer ChatGPT agents with connectors enabled to leak sensitive data, again by embedding hidden instructions in content that appears ordinary to the user.
From Radware’s advisory and government sources such as the U.S. National Institute of Standards and Technology, here are some suggested practices.
AI agents are being connected to sensitive systems at a time when fintech firms face increasing scrutiny over privacy and security.
If a connector exploit can quietly leak contracts, loan records, or customer identifiers, the implications are massive, such as regulatory fines, reputational loss, and reduced trust from partners and investors.
In Canada, where regulators are preparing rules on open banking and digital identity, firms cannot afford to treat agent security as an afterthought. Research shows that 57% to 80% of injection attempts succeed when attackers repeat them (i.e. 25 times), which is why layered defenses are essential.
Banks and financial technology firms must implement agent safeguards into compliance frameworks, risk models, and vendor contracts that will protect customer trust and reduce liability. Canadian fintechs should approach agent security not only as a technical concern but part of core competitiveness functionality.
Board oversight is also critical, as regulators and investors will expect firms to demonstrate how they manage AI risks.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create aa vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Mental Health | Sep 17, 2025
Image: Freepik/Rawpixel.com
On September 17, 2025, CBC news published a sobering story of the growing number of Canadians who have reported mental health crises linked to prolonged conversations with AI chatbots. Some are describing these cases as a type of artificial intelligence induced psychosis. NCFA is covering this article in hopes to provide Canadian mental health resources to support those struggling with AI related mental health issues.
Everyone is at risk who interacts with AI for prolonged periods of use. If you think you are immune, think again. The B.C. Psychosis Program warns that chatbots can reinforce delusional thinking rather than challenge it. Community-led Canadian efforts are building support resources and ethics workstreams.
Toronto developer Anthony Tan believed he was living inside a simulation and was hospitalized after weeks without sleep. He later launched the AI Mental Health Project to support those struggling with similar issues.
Allan Brooks of Ontario spent over 300 hours with ChatGPT, convinced he had discovered a breakthrough mathematical theory. When his delusion collapsed, he co-founded the Human Line Project, which now connects more than 125 people with similar experiences.
International reporting shows similar risks. Parents testified to Congress about teen suicides after chatbot interactions, as covered by CBS reporting. OpenAI has announced age verification plans following a lawsuit involving a 16 year old.
Research indicates a tendency for language models to mirror user beliefs. Researchers at Anthropic published a study, 'Towards Understanding Sycophancy in Language Models" (see Anthropic's research summary).
Data driven evidence shows that chatbots often agree with users, even when it ignites harmful thinking. To prevent this, financial AI tools should be designed to test ideas against reality, point users to verified and transparent external information, and clearly signal when content is speculative.
Fintech firms also need to be transparent about safety. They should publish regular audits that show how their systems respond to emotionally sensitive conversations and what safeguards are in place.
Industry can also demonstrate leadership by creating a code of ethics that directly addresses mental health risks. This voluntary framework should include independent reviews and compliance checks, building on the kind of work already happening through community groups like the Human Line Project.
Regulators however should avoid blanket restrictions that could slow innovation. Instead, oversight should be based on the level of psychological and financial risk, ensuring protections are strong where they need to be while leaving room for responsible growth.
As fintech platforms increasingly adopt AI for customer service and advice, trust remains critical, and if broken adoption will slow and regulatory scrutiny will intensify affecting the competitiveness and growth outlook.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create aa vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Competition | Sep 15, 2025
Image: Freepik/rawpixel.com
On September 15, 2025, Sarah Cardell, Chief Executive of the UK Competition and Markets Authority (CMA), delivered a speech at the BVCA Summit outlining how competition policy can drive investment and scale-ups. This article summarizes the CMA’s takeaways, benchmarks them against Canada’s position, and explores what lessons fintech leaders and policymakers should draw on.
The CMA stressed that long regulatory delays deter investors and can cause promising startups to fail before securing capital. To address this, the CMA introduced new performance indicators to shorten merger review timelines and committed to streamlining processes across its work.
“Delay chills investment and can mean promising startups run out of road.”
Excessive or outdated regulation can create costs and risks that stifle investment and innovation. The CMA promises to act proportionately, weighing costs and benefits carefully, phasing out outdated remedies, and focusing on the issues most relevant to consumers and businesses.
“We will act proportionately and minimise costs wherever we can.”
Uncertainty in regulatory outcomes undermines investor confidence. The CMA is introducing clearer jurisdictional guidance for merger reviews and publishing detailed roadmaps under its new digital markets regime to provide businesses with greater certainty.
“Uncertainty can stall decision-making and weaken business and investor confidence.”
The CMA emphasized the importance of open and direct engagement with stakeholders. It is creating new forums such as the Growth and Investment Council and deploying stakeholder surveys to improve how its policies reflect commercial realities.
“The CMA is more committed than ever to the fundamentals of our role – to promote competition and protect consumers, within an independent regime.”
Measured against the CMA’s framework, below we try to rank how Canada performs for fintech competitiveness and investment.
We can look at the past for data-driven proof that Canadian fintechs face chronic delays that slow capital raising and partnerships. Open banking has missed multiple government deadlines, leaving fintechs and banks without full clarity of the program.
Another example is around payment modernization, particularly the Real Time Rail (RTR) which has also faced repeated setbacks, stalling innovation in faster payments. Let's not forget the creation and rollout of equity crowdfunding rules that took years to harmonize nationally under NI 45-110, meaning startups endured fragmented frameworks for far too long. In an era where global regulators must keep pace with innovation, Canada's slower regulatory pace is a drag on growth.
Overlapping and duplicative rules increase compliance costs disproportionately for startups. Equity crowdfunding portals are a good example. Under National Instrument 45-110, portals must register as restricted dealers, maintain minimum working capital, and comply with know-your-client and suitability requirements similar to investment dealers, even though transaction sizes are capped at $1.5 million per year.
These requirements add legal, audit, and technology costs that are heavy for small portals but don't always provide proportionate consumer protection benefits, since investment limits already restrict retail investor exposure. The result is fewer viable portals, reduced competition, and higher costs for startups seeking to raise capital. Payments firms navigating multiple oversight bodies face similar burdens. Competition Act amendments have broadened investigative powers, but without a clear proportionality test for smaller firms. This creates uncertainty and often deters new entrants.
Canada has stalled on open banking and been inconsistent on payments modernization, leaving both fintechs and banks unsure about what rules to plan around. Licensing and regulatory approaches often lack clear roadmaps, meaning firms cannot anticipate timelines or likely outcomes. This erodes investor confidence at exactly the point when fintechs need greater visibility and confidence support. By contrast, the CMA now publishes roadmaps and consults on jurisdictional thresholds in advance.
Regulators in Canada conduct consultations but feedback loops can be slow and often opaque, discouraging stakeholders from participating. It reminds of a Stephen King quote, "Fool me once, shame on you. Fool me twice, shame on me. Fool me three times, shame on both of us." Stakeholders rarely see how their input affects outcomes.
In fintech licensing and payments reform, firms report long periods of silence, creating uncertainty and wasted preparation costs. Engagement exists but is not structured to produce rapid clarity. The CMA, by contrast, has set up a Growth and Investment Council and targeted outreach to startups, making process improvements measurable and visible.
What further distinguishes the CMA approach is its focus on measurable outcomes. Timelines, KPIs, and stakeholder feedback are built directly into its reform process. In Canada, regulators rarely hold themselves to outcome metrics. Open banking, payments modernization, and fintech licensing all lack clear outcome based benchmarks for success with transparent reporting, leaving startups and investors facing prolonged uncertainty.
Cardell highlighted procurement as a powerful lever for scaling firms. In the UK, public procurement represents £385 billion annually. Used strategically, it can help innovative firms scale into global leaders.
Canada’s Phoenix pay system failure illustrates what happens when procurement excludes startups and fintechs. Instead of relying solely on a single legacy vendor, the government could have piloted payroll fintechs and scaled those that proved reliable. This approach would have reduced project risk, avoided billions in overruns, and nurtured homegrown fintechs with export potential. The Phoenix example demonstrates why procurement should be used to actively build capacity for Canadian innovators, which can be accomplished in several ways.
Government is the largest single purchaser in the economy, and directing even a fraction of that demand toward fintech solutions can create the credibility these firms need to raise capital and expand. For example, the government could launch vendor challenges for small business lending platforms or digital payment systems for rebates, benefits, and tax refunds. Winning firms would gain real contracts that prove their technology works and make it easier to raise more investment. This type of procurement not only meets government requirements but helps Canadian fintechs grow at home and compete abroad.
Too often, fintechs win small pilots but never graduate to meaningful contracts. A staged model, where early pilots can transition into scaled adoption if they meet performance benchmarks, would help promising firms grow into national providers. This escalator effect is critical in financial technology, where credibility with one large client can unlock commercial opportunities globally.
Fintechs often face a Catch-22 where they can't win major contracts without clear regulatory status, yet regulators hesitate to provide clarity until the firm has proven market traction. Procurement could break this cycle by acting as a regulatory bridge. If a fintech wins a vendor challenge for services such as digital identity or payments, the process could be designed to include early regulatory sign-off or tailored supervisory guidance. This would give the fintech and its backers confidence about compliance costs and expectations, while also reassuring the public that safeguards are in place from the start.
Taken together, the above examples could use government procurement as a genuine scale-up escalator. So instead of simply selecting incumbents all the time and concentrate risks into a handful of providers that turn into an oligopoly, government purchasing could become a purposeful tool for nurturing Canadian fintechs into globally competitive firms.
The CMA’s speech discusses competition as a tool for unlocking growth. For Canada’s fintech sector, three lessons stand out.
If Canada embraced the UK's stance on competition and scale-ups, fintechs would move faster from idea to scale, investors would back firms with greater confidence, and procurement would foster globally competitive players.
Competition shouldn't be seen as a hand-brake but rather as the engine for Canadian productivity and growth.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create aa vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |