Category Archives: Regtech, Compliance, Governance

Mycroft Raises $3.5M for Agentic AI Compliance Officer

Funding | Sep 24, 2025

Credit Image courtesy of PRNewswire, Mycroft

Image courtesy of PRNewswire, Mycroft

Mycroft Positions Its Agentic AI Officer as the New Standard for Startup Security and Compliance

On Sep 22, 2025, Toronto-based AI startup Mycroft announced that their agentic AI Security and Compliance Officer has emerged from stealth with $3.5 million USD in seed funding to accelerate product development and expand its reach. The funding round was led by Luge Capital with participation from Brightspark Ventures and Graphite Ventures, alongside existing investors Ripple Ventures, Developer Capital, Antler, BoxOne Ventures, and strategic angels.

See:  Agentic AI in Banking From Pilots to Real Impact

This latest round follows a $1.2 million USD pre-seed round last September 2024, reported by BetaKit.  Together, the two rounds bring Mycroft’s total funding to approximately $4.7 million USD.

The new capital will go towards product enhancements, expanded go to market initiatives, and scaling up operations. According to SecurityWeek, the platform currently offers modules for cloud security, device security, application protection, and audit preparation. The strategy is a direct response to increasing demand for automation in enterprise compliance and security, as companies face escalating compliance requirements from regulators around the globe.

Compliance Focused AI Agent

Security and compliance functions have traditionally been fragmented across multiple tools, manual processes, and spreadsheets. Mycroft’s core innovation is a single AI-driven platform that acts as a Security and Compliance Officer. Behind the scenes, it is powered by no-code AI agents that handle specialized workflows such as monitoring cloud infrastructure, enforcing security policies, managing incidents, and preparing for audits. This design gives companies one platform to manage security and compliance, while multiple no-code AI agents work in the background on specialized tasks.

See:  Why No Code AI Agents Matter for Fintech in Canada

Mike Kim, Co-founder and CEO of Mycroft:

“Security shouldn’t be a burden. It should be a superpower. Our goal is to give every company access to enterprise grade security without needing a massive team. Mycroft’s AI agents don’t just automate tasks, they elevate the way teams operate, helping them move faster and stay protected from day one.”

Early Traction and Customer Adoption

Although Mycroft was in stealth mode, they have already signed more than 50 customers in its first six months. Early adopters include Superwhisper, Evolo, CoVet, Unified, Willful, Wisedocs, and Weave (YC25). The rapid uptake for enterprise grade security and compliance solutions highlight clear market need, especially among fast growing tech companies.

Karim Gillani, General Partner at Luge Capital highlights the importance of placing compliance at the center of trust:

“Security and compliance have evolved from manual back office functions to front line priorities that can shape customer experiences and brand reputation. Mycroft’s AI Security and Compliance Officer is the teammate that every company needs in order to stay safe.”

Competitive Positioning

The AI security sector is increasingly crowded, with startups and established firms racing to deliver solutions in cloud protection, identity management, governance, and audit readiness. Mycroft differentiates itself by focusing on autonomous agentic AI that operates with minimal configuration and delivers end to end compliance outcomes. It offers a cost efficient alternative for startups and mid sized companies that lack large security operations teams.

See:  CIRO Cyber Breach Puts Spotlight on Regulatory Security

By integrating modules that span from device security to regulatory audit support, Mycroft aims to give scaling companies confidence to grow while maintaining compliance.

Outlook

Mycroft is well positioned to pursue sectors with heavy compliance such as fintech, healthcare, and SaaS.  As regulations tighten globally, demand for solutions that can act as a virtual compliance officer is expected to grow. For more details, visit Mycroft’s official site.


NCFA Jan 2018 resizeThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create aa vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter

 

ShadowLeak Shows Zero Click AI Agent Risk

Cybersecurity | Sep 23, 2025

Freepik DC Studio, AI Agent security

Image: Freepik/DC Studio

Radware Reveals How A Hidden Email Prompt Made A ChatGPT Agent Leak Gmail Data

On September 18, 2025, researchers at Radware disclosed a zero click indirect prompt injection called ShadowLeak that caused ChatGPT Deep Research to leak Gmail data after it encountered a booby trapped email.  It's a new class of risk where hidden instructions can manipulate agents while being invisible to users, so NCFA wants to ensure that fintechs and key stakeholders are aware of how attackers can turn AI helpers into data thieves in a way that users including developer's can't see.

ShadowLeak AI Agent Risk

Radware’s analysis shows that the leak originated from OpenAI’s own cloud infrastructure rather than a user’s device. A malicious email carried hidden HTML instructions such as white text on a white background. When the user later asked the agent to summarize emails, the agent followed the invisible prompt and sent private details to an attacker controlled URL.

Because the action happened in the cloud, the victim’s network defenses never saw it.

See:  Elliptic Report Shows Cross-Chain Crime Reaches $21.8B

The researchers warned that the same trick could work on other connectors including Google Drive, Dropbox, Outlook, calendars, and GitHub. That means sensitive business data such as financial contracts, HR records, and meeting notes could also be exposed.

Radware reported the issue on June 18, 2025. OpenAI deployed fixes by early August and closed the case on September 3. An OpenAI spokesperson told Recorded Future News that the company continually improves safeguards against exploits like prompt injections.

Other Recent AI Agent Exploits

ShadowLeak is not the only case of an AI agent being manipulated into acting against its user.

At Black Hat in August 2025, researchers demonstrated an attack called AgentFlayer that used a poisoned Google Drive document to leak secrets through ChatGPT connectors. The document contained hidden instructions that looked harmless to a person but were machine readable. When the agent processed the file, it followed the malicious prompt and attempted to extract sensitive data.

See:  BlackRock Tests Multi Agent AI in Equity Portfolios

On August 20, 2025, security researchers at Brave (website browser company) disclosed a similar flaw in Perplexity’s Comet browser. They showed how a hidden Reddit prompt could read Gmail one time passcodes and expose them to an attacker.

On September 13, 2025, Tom's Hardware wrote about a malicious Google Calendar invite method could steer ChatGPT agents with connectors enabled to leak sensitive data, again by embedding hidden instructions in content that appears ordinary to the user.

Guidance and Protection

From Radware’s advisory and government sources such as the U.S. National Institute of Standards and Technology, here are some suggested practices.

  • Limit connector permissions and revoke unused access
  • Sanitize incoming content to strip hidden instructions before agents process it
  • Log all agent actions and monitor for suspicious behaviour
  • Restrict or block external connections to unknown URLs
  • Use layered defenses including prompt injection filters, HTML sanitization, and user confirmations for risky tasks
  • Review connectors regularly to ensure only required apps are linked
  • Train staff on the risks of connecting agents to sensitive systems
  • Use multiple layered defenses (don't rely on a single point of failure)

Why It Matters for Fintech

AI agents are being connected to sensitive systems at a time when fintech firms face increasing scrutiny over privacy and security.

If a connector exploit can quietly leak contracts, loan records, or customer identifiers, the implications are massive, such as regulatory fines, reputational loss, and reduced trust from partners and investors.

In Canada, where regulators are preparing rules on open banking and digital identity, firms cannot afford to treat agent security as an afterthought. Research shows that 57% to 80% of injection attempts succeed when attackers repeat them (i.e. 25 times), which is why layered defenses are essential.

See:  AI Psychosis Threatens Trust in Innovation

Banks and financial technology firms must implement agent safeguards into compliance frameworks, risk models, and vendor contracts that will protect customer trust and reduce liability. Canadian fintechs should approach agent security not only as a technical concern but part of core competitiveness functionality.

Board oversight is also critical, as regulators and investors will expect firms to demonstrate how they manage AI risks.


NCFA Jan 2018 resizeThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create aa vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter

 

Kevin Durant’s Bitcoin Recovery and User Protection

Crypto | Sep 22, 2025

Freepik krakenimages.com, lost crypto

Image: Freepik/krakenimages.com

NBA Star’s Decade Long Highlights Risks of Account Lockouts and Customer Service

On September 20, 2025, Coinbase CEO Brian Armstrong announced that NBA star Kevin Durant had regained access to his Coinbase account nearly ten years after first buying Bitcoin, and then initially purchasing it for around $650 per Bitcoin in 2015, implying a whopping gain of more than 17,000% ten years later.

Armstrong confirmed the recovery on X, which followed Durant’s story earlier in the week at the CNBC x Boardroom Game Plan summit in Santa Monica. Durant described how he first bought Bitcoin in 2014–2015

See:  Coinbase Pushes for Tokenized Equities Approval

Kevin Durant’s Decade Long Bitcoin Recovery

Durant’s first exposure to Bitcoin came around 2014–2015, when he says he “started watching YouTube videos” about the emerging digital asset. Intrigued, he encouraged his agent, Rich Kleiman, to take a closer look. Their enthusiasm was quickly cooled when, according to Kleiman, their business manager “said, ‘No, don’t do that.’ So we didn’t.”

That might have been the end of the story if not for a party hosted by venture capitalist Ben Horowitz. Kleiman recounted how they heard Bitcoin mentioned repeatedly that night, and “we woke up the next day and said, ‘We have to do this.’” From there, they invested in Bitcoin and later became early backers of Coinbase through their firm Thirty Five Ventures.

See:  Coinbase Breach Days Before S&P 500 Listing Milestone

According to Coindesk, Durant’s entry point was near $650 per Bitcoin in 2015, a level that makes his eventual recovery especially striking. With Bitcoin trading above $115,000 in September 2025, that original purchase reflects a gain of more than 17,000%, a staggering return on investment that Durant could only access once his Coinbase account was unlocked nearly a decade later.

Forced Hodling and Consumer Protection

Durant’s lost account access resulted in type of “forced hodling” through multiple market cycles.  Chainalysis-based research on permanently lost Bitcoin estimates millions of crypto assets are out of reach because people have lost their passwords or recovery keys. That reduces the amount available to trade and makes the asset more scarce.  Durant’s case shows that being locked out by accident can sometimes lead to big gains, but it also reveals the real danger for everyday users who may never regain access to their accounts.

Coinbase outlines strict processes for regaining access if emails or two factor devices are lost. Users may need to reset forgotten passwords, recover two factor authentication, or provide identity documents through account access troubleshooting. Many users report challenges completing these steps. After Durant’s recovery, social media threads filled with complaints from customers who have been locked out for years.

In response, Armstrong reposted a detailed thread from his support team on X, promising product improvements and faster support. Coinbase also maintains VIP service tiers for high volume traders.  Reuters published an article in August 2025 about widespread user frustration with locked accounts and the Verge covered investigations into delays in customer support.  Clearly more work needs to be done by Coinbase to support all customers, and not just celebrities that might be prioritized for obvious reasons.

Practical Takeaways for Crypto Users

Durant's experience of lost keys and account access can happen to even the most sophisticated investors, causing an incredible amount of frustration.  Prevention is the best protection. Coinbase advises enabling multiple two factor authentication methods, including hardware keys, and  updating recovery emails and phone numbers regularly.

See:  U.S. Prepares to Count Crypto in Mortgage Rules

Also, users should evaluate the benefits and risks of storing crypto on exchanges versus self custody options using a secure wallet. Digital asset investors should only work with crypto exchanges that offer reliable recovery workflows and strong customer support.

Conclusion

Thanks to Durant's celebrity status, consumer protection from lost keys and account access is back in the news.  For Durant, it's another story and a drop in the bucket but for regulators and industry leaders it's a recurring lessons that equitable account recovery and strong consumer support is essential to wider adoption.  While new trading features are also being developed and released, crypto exchanges and leaders need to prioritize safeguarding access for all users.


NCFA Jan 2018 resizeThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create aa vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter

 

SEC Clears Path for Fast Track Crypto ETFs

Regulation | Sep 18, 2025

Freepik ETFs

U.S. SEC Approval of New Listing Standards Opens the Door for Faster Digital Asset ETFs

On September 17, 2025, the U.S. Securities and Exchange Commission (SEC) approved generic exchange listing standards for Commodity-Based Trust Shares. This decision means that exchanges can now list new products without filing for case by case approvals, including those backed by digital assets.

This policy update is arguably the most significant since the SEC’s approval of spot bitcoin ETFs earlier this year, and is anticipated to accelerate the rollout of digital asset funds across U.S. markets.

SEC Adopts Generic Exchange Listing Standards

Commodity Based Trust Shares are exchange traded products that hold physical assets like metals or digital assets, instead of being regulated under the Investment Company Act of 1940. Under the new rules, this means that digital assets can be listed more quickly if they meet certain standards.

See:  Canada Launches First Spot Solana ETFs With Staking

The new framework effectively creates a fast track for digital asset ETFs. Before every product required a Section 19(b) filing with reviews that could stretch for months.

To qualify, the product must either track an asset traded on a market that is part of the Intermarket Surveillance Group with data sharing agreements, be linked to a regulated futures contract that has been trading for at least six months, or have at least 40% of its portfolio in a single commodity already covered by another listed product.

The SEC stressed that even though these products are not investment companies, they must still publish key disclosures, including their holdings and daily net asset value, similar to ETFs.

In addition to the new generic listing standards, the SEC also approved two specific applications that will give investors more ways to gain regulated exposure to crypto assets:

  1. Grayscale Digital Large Cap Fund - an ETF that holds a basket of spot digital assets based on the CoinDesk 5 Index.
  2. Covered p.m.-settled options on the Cboe Bitcoin U.S. ETF Index and the Mini-Cboe Bitcoin U.S. ETF Index, including third Friday expirations, nonstandard expirations, and quarterly expirations.

Reactions and Implications

Not all commissioners agreed. Commissioner Caroline Crenshaw warned that generic standards could change responsibility for investor protection. Read the formal statement 'Passing the Buck' by Commissioner Caroline Crenshaw for her concerns about speed and scrutiny in volatile markets.

Market observers expect a wave of new filings.

For investors, more products mean greater choice and a need to understand custody, valuation, and disclosures.

See:  SEC Clears Crypto Staking. What It Means for Canada

For fintechs and asset managers, shorter timelines create room for innovation in fund design, multi asset strategies, and derivatives.

Commissioner Hester Peirce welcomed the decision as overdue. In her statement on the approval , she noted that generic listing standards “eliminate the need for prior SEC approval under Section 19(b)” and would reduce time and resources required to bring new products to market. Peirce acknowledged past delays and court rulings that pushed the SEC to open a path for spot crypto ETPs, and she emphasized that the new rules provide alternative eligibility criteria beyond surveillance sharing agreements. She argued that the streamlined process will benefit investors, issuers, market participants, and the Commission itself by increasing predictability and efficiency.

Canadian Regulators Face Increasing Pressure as U.S. Moves Forward

Canada approved the first spot bitcoin ETF in 2021, but most digital asset funds are still reviewed case by case. By approving new generic exchange listing standards, the United States has adopted a scalable model that could influence regulators globally.

See:  CSA Consultation on New Canadian ETF Rules

If Canada doesn't modernize its framework, fintech innovators and investor capital could drain south where products can launch faster. Aligning with an efficient standard could help maintain Canada’s leadership in fintech while ensuring investor protections.


NCFA Jan 2018 resizeThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create aa vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter

 

AI Psychosis Threatens Trust in Innovation

Mental Health | Sep 17, 2025

Freepik Rawpixel.com, Mental health

Image: Freepik/Rawpixel.com

Rise of 'AI Psychosis' Cases in Canada, Sound Mental Health Alarm

On September 17, 2025, CBC news published a sobering story of the growing number of Canadians who have reported mental health crises linked to prolonged conversations with AI chatbots.  Some are describing these cases as a type of artificial intelligence induced psychosis.  NCFA is covering this article in hopes to provide Canadian mental health resources to support those struggling with AI related mental health issues.

Everyone is at risk who interacts with AI for prolonged periods of use.  If you think you are immune, think again.  The B.C. Psychosis Program warns that chatbots can reinforce delusional thinking rather than challenge it.  Community-led Canadian efforts are building support resources and ethics workstreams.

See:  The Silent Mental Health Crisis: Leadership Burnout

Toronto developer Anthony Tan believed he was living inside a simulation and was hospitalized after weeks without sleep. He later launched the AI Mental Health Project to support those struggling with similar issues.

Allan Brooks of Ontario spent over 300 hours with ChatGPT, convinced he had discovered a breakthrough mathematical theory. When his delusion collapsed, he co-founded the Human Line Project, which now connects more than 125 people with similar experiences.

Global Evidence and Widening Mental Health Risk

International reporting shows similar risks. Parents testified to Congress about teen suicides after chatbot interactions, as covered by CBS reporting. OpenAI has announced age verification plans following a lawsuit involving a 16 year old.

Research indicates a tendency for language models to mirror user beliefs. Researchers at Anthropic published a study, 'Towards Understanding Sycophancy in Language Models" (see Anthropic's research summary).

Recommendations for Safety and Innovation

Data driven evidence shows that chatbots often agree with users, even when it ignites harmful thinking. To prevent this, financial AI tools should be designed to test ideas against reality, point users to verified and transparent external information, and clearly signal when content is speculative.

Fintech firms also need to be transparent about safety. They should publish regular audits that show how their systems respond to emotionally sensitive conversations and what safeguards are in place.

See:  Meta AI Rules Trigger Calls for Stricter Oversight

Industry can also demonstrate leadership by creating a code of ethics that directly addresses mental health risks. This voluntary framework should include independent reviews and compliance checks, building on the kind of work already happening through community groups like the Human Line Project.

Regulators however should avoid blanket restrictions that could slow innovation. Instead, oversight should be based on the level of psychological and financial risk, ensuring protections are strong where they need to be while leaving room for responsible growth.

Closing Thought

As fintech platforms increasingly adopt AI for customer service and advice, trust remains critical, and if broken adoption will slow and regulatory scrutiny will intensify affecting the competitiveness and growth outlook.


NCFA Jan 2018 resizeThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create aa vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter

 

CMA Lessons on Competition and Growth for Canada

Competition | Sep 15, 2025

Freepik rawpixel.com, productivity

Image: Freepik/rawpixel.com

UK CMA Speech Confirms That Competition Drives Investment and Scale-ups

On September 15, 2025, Sarah Cardell, Chief Executive of the UK Competition and Markets Authority (CMA), delivered a speech at the BVCA Summit outlining how competition policy can drive investment and scale-ups. This article summarizes the CMA’s takeaways, benchmarks them against Canada’s position, and explores what lessons fintech leaders and policymakers should draw on.

Four Takeaways from Cardell's Speech

1. Pace and Reducing Delays to Boost Investment

The CMA stressed that long regulatory delays deter investors and can cause promising startups to fail before securing capital. To address this, the CMA introduced new performance indicators to shorten merger review timelines and committed to streamlining processes across its work.

See:  Insights from the UK’s Pro-Innovation Regulation Review

“Delay chills investment and can mean promising startups run out of road.”

2. Proportionality and Reducing Burdens

Excessive or outdated regulation can create costs and risks that stifle investment and innovation. The CMA promises to act proportionately, weighing costs and benefits carefully, phasing out outdated remedies, and focusing on the issues most relevant to consumers and businesses.

“We will act proportionately and minimise costs wherever we can.”

3. Predictability and Reducing Uncertainty

Uncertainty in regulatory outcomes undermines investor confidence. The CMA is introducing clearer jurisdictional guidance for merger reviews and publishing detailed roadmaps under its new digital markets regime to provide businesses with greater certainty.

“Uncertainty can stall decision-making and weaken business and investor confidence.”

4. Process and Engaging Stakeholders

The CMA emphasized the importance of open and direct engagement with stakeholders. It is creating new forums such as the Growth and Investment Council and deploying stakeholder surveys to improve how its policies reflect commercial realities.

See:  UK to Cut Regulatory Red Tape to Boost Tech and Growth

“The CMA is more committed than ever to the fundamentals of our role – to promote competition and protect consumers, within an independent regime.”

Canada’s Scorecard Against the CMA Takeaways

Measured against the CMA’s framework, below we try to rank how Canada performs for fintech competitiveness and investment.

Pace (2.5/5)

We can look at the past for data-driven proof that Canadian fintechs face chronic delays that slow capital raising and partnerships. Open banking has missed multiple government deadlines, leaving fintechs and banks without full clarity of the program.

Another example is around payment modernization, particularly the Real Time Rail (RTR) which has also faced repeated setbacks, stalling innovation in faster payments. Let's not forget the creation and rollout of equity crowdfunding rules that took years to harmonize nationally under NI 45-110, meaning startups endured fragmented frameworks for far too long. In an era where global regulators must keep pace with innovation, Canada's slower regulatory pace is a drag on growth.

Proportionality (2/5)

Overlapping and duplicative rules increase compliance costs disproportionately for startups. Equity crowdfunding portals are a good example. Under National Instrument 45-110, portals must register as restricted dealers, maintain minimum working capital, and comply with know-your-client and suitability requirements similar to investment dealers, even though transaction sizes are capped at $1.5 million per year.

See:  Canada’s Public Sector Costs and Productivity Gap

These requirements add legal, audit, and technology costs that are heavy for small portals but don't always provide proportionate consumer protection benefits, since investment limits already restrict retail investor exposure. The result is fewer viable portals, reduced competition, and higher costs for startups seeking to raise capital. Payments firms navigating multiple oversight bodies face similar burdens. Competition Act amendments have broadened investigative powers, but without a clear proportionality test for smaller firms. This creates uncertainty and often deters new entrants.

Predictability (2/5)

Canada has stalled on open banking and been inconsistent on payments modernization, leaving both fintechs and banks unsure about what rules to plan around. Licensing and regulatory approaches often lack clear roadmaps, meaning firms cannot anticipate timelines or likely outcomes. This erodes investor confidence at exactly the point when fintechs need greater visibility and confidence support. By contrast, the CMA now publishes roadmaps and consults on jurisdictional thresholds in advance.

Process (2.5/5)

Regulators in Canada conduct consultations but feedback loops can be slow and often opaque, discouraging stakeholders from participating. It reminds of a Stephen King quote, "Fool me once, shame on you. Fool me twice, shame on me. Fool me three times, shame on both of us."  Stakeholders rarely see how their input affects outcomes.

See:  New Zealand’s Regulatory Approach Offers Lessons for Canada

In fintech licensing and payments reform, firms report long periods of silence, creating uncertainty and wasted preparation costs. Engagement exists but is not structured to produce rapid clarity. The CMA, by contrast, has set up a Growth and Investment Council and targeted outreach to startups, making process improvements measurable and visible.

Outcomes and Accountability

What further distinguishes the CMA approach is its focus on measurable outcomes. Timelines, KPIs, and stakeholder feedback are built directly into its reform process. In Canada, regulators rarely hold themselves to outcome metrics. Open banking, payments modernization, and fintech licensing all lack clear outcome based benchmarks for success with transparent reporting, leaving startups and investors facing prolonged uncertainty.

Government Procurement as a Fintech Growth Escalator

Cardell highlighted procurement as a powerful lever for scaling firms. In the UK, public procurement represents £385 billion annually. Used strategically, it can help innovative firms scale into global leaders.

Canada’s Phoenix pay system failure illustrates what happens when procurement excludes startups and fintechs. Instead of relying solely on a single legacy vendor, the government could have piloted payroll fintechs and scaled those that proved reliable. This approach would have reduced project risk, avoided billions in overruns, and nurtured homegrown fintechs with export potential. The Phoenix example demonstrates why procurement should be used to actively build capacity for Canadian innovators, which can be accomplished in several ways.

See:  Innovative Approaches to Smarter Regulation

Demand Generation

Government is the largest single purchaser in the economy, and directing even a fraction of that demand toward fintech solutions can create the credibility these firms need to raise capital and expand. For example, the government could launch vendor challenges for small business lending platforms or digital payment systems for rebates, benefits, and tax refunds. Winning firms would gain real contracts that prove their technology works and make it easier to raise more investment. This type of procurement not only meets government requirements but helps Canadian fintechs grow at home and compete abroad.

Scaling Escalator

Too often, fintechs win small pilots but never graduate to meaningful contracts. A staged model, where early pilots can transition into scaled adoption if they meet performance benchmarks, would help promising firms grow into national providers. This escalator effect is critical in financial technology, where credibility with one large client can unlock commercial opportunities globally.

Regulatory Bridge and Clarity

Fintechs often face a Catch-22 where they can't win major contracts without clear regulatory status, yet regulators hesitate to provide clarity until the firm has proven market traction. Procurement could break this cycle by acting as a regulatory bridge. If a fintech wins a vendor challenge for services such as digital identity or payments, the process could be designed to include early regulatory sign-off or tailored supervisory guidance. This would give the fintech and its backers confidence about compliance costs and expectations, while also reassuring the public that safeguards are in place from the start.

See:  Overcoming Barriers to Growth in Financial Regulation

Taken together, the above examples could use government procurement as a genuine scale-up escalator.  So instead of simply selecting incumbents all the time and concentrate risks into a handful of providers that turn into an oligopoly, government purchasing could become a purposeful tool for nurturing Canadian fintechs into globally competitive firms.

Lessons and Recommendations

The CMA’s speech discusses competition as a tool for unlocking growth. For Canada’s fintech sector, three lessons stand out.

  1. Approvals must be streamlined so fintechs can access capital and scale without delays.
  2. Oversight should be applied proportionately so startups retain resources for innovation rather than compliance.
  3. Procurement should be used strategically to build scale up pathways through real contracts that strengthen fintechs at home and abroad.

If Canada embraced the UK's stance on competition and scale-ups, fintechs would move faster from idea to scale, investors would back firms with greater confidence, and procurement would foster globally competitive players.

Competition shouldn't be seen as a hand-brake but rather as the engine for Canadian productivity and growth.


NCFA Jan 2018 resizeThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create aa vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter

 

S&P Blocks Strategy’s Inclusion Sending Message to Boards

Crypto | Sep 16, 2025

Freepik drobotdean, Bitcoin

Image: Freepik/drobotdean

S&P’s Rejection Shows Bitcoin Treasuries Face Barriers to Index Entry (and Automatic Passive Flows)

As reported by MarketWatch, the S&P Dow Jones Indices announced its quarterly rebalance and chose not to add Strategy Inc. (formerly, MicroStrategy) to the S&P 500.

Strategy Inc is the largest corporate holder of bitcoin with more than 630,000 BTC, equal to over 3% of the total supply, and met all the published criteria on market capitalization, liquidity, and profitability, but was essentially excluded by the powers of committee discretion. JPMorgan analysts said this exclusion is a warning shot to company boards that bitcoin heavy treasuries may face barriers to benchmark inclusion, limiting access to the large automatic flows of index tracking funds.

See:  GameStop Joins Growing List of Bitcoin Treasury Holders

In response, Strategy’s executive chair Michael Saylor posted an image showing that its shares have outperformed the S&P 500 and Bitcoin with the caption “Thinking about the S&P right now ….” He also told Barron’s, “Every quarter, we make new believers. I think that will continue for the foreseeable future.”

Exclusion from the S&P Raises the Cost of Capital

The S&P 500 is the most tracked equity index in the world. Entry usually lowers a company’s funding costs while expanding its investor base. Trillions of dollars are passively allocated to its members. While the methodology spells out eligibility rules, the committee reserves the right to apply judgment.

Inclusion in the S&P 500 forces trillions of dollars of index tracking funds to buy a company’s stock, creating large automatic inflows that lower funding costs and deepen liquidity. Exclusion means those compulsory passive flows never materialize.

See:  Strategy Buys More BTC as Canadian Crypto ETFs Grow

Strategy built its bitcoin position through repeated equity offerings, which turned its stock into a leveraged proxy for bitcoin. That model is now constrained. At the same time, Nasdaq (where Strategy MSTR is currently listed) requires shareholder approval for certain crypto related financing steps, which increases governance complexity and slows decision making.

Together these barriers raise the cost and difficulty of growing corporate bitcoin reserves through treasury strategies. Boards now face a choice of maintaining a bitcoin identity with limited access to mainstream capital markets, or rebalance treasury policies to preserve index eligibility and liquidity.

Some Companies May Prefer Bitcoin ETF Exposure

Some investors may prefer exposure through ETFs rather than dealing with dilution or volatility inside an operating company. Equity research coverage and institutional ownership might reduce if analysts see a company as primarily a bitcoin vehicle rather than an operating business.

Exchange traded funds present a clear alternative. Canada approved spot bitcoin ETFs in 2021 and the United States followed in 2024. ETFs hold bitcoin directly in custody and issue units that trade on exchanges, offering regulated and liquid exposure. ETF fees are typically between 0.2% and 1.0%, relatively modest compared to the governance and financing costs of treasury strategies.

See:  Trump Media and Crypto.com Launch Cronos Treasury Firm

However, corporate treasuries allow boards to control timing and scale, use equity issuance to accelerate exposure, and attract investors who prefer equity proxies for bitcoin. Yet these benefits are balanced by costs that now include index exclusion, shareholder approval requirements, and stock valuations that swing with bitcoin more than business fundamentals.

The early regulatory approval of spot bitcoin ETFs in Canada gave investors a first mover's advantage, and a clear and credible option for digital asset exposure at a time when corporate treasuries were still the main vehicle in other markets.

Since then, Canadian companies including miners and digital asset firms such as Hut 8 and BIGG Digital Assets have also pursued bitcoin treasury strategies. This means Canada now has both treasuries and ETFs operating side by side, and it is expected that additional pathways to digital asset investments will emerge over time as regulations evolve.

Outlook

The S&P committee will meet again this December to review index composition. That update could determine whether Strategy’s exclusion is temporary or a longer standing policy. Regardless of the outcome, the September rejection may already be impacting board room decisions affecting the balance between treasury exposure versus ETFs.  ETFs offer a regulator approved and stable pathway for investor demand, while treasuries provide control and branding but now carry higher financing and governance costs. 


NCFA Jan 2018 resizeThe National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create aa vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

NCFA Financial Innovation MapNCFA Innovation Opportunity BriefsNCFA Fintech Insights
NCFA Fintech WhispererNCFA Fintech Fridays PodcastNCFA Weekly Newsletter