Karsten Wenzlaff, Advisor
August 26th, 2025
Regulatory Consultation | Aug 13, 2025

Image: Freepik/DC Studio
On August 12, 2025, the Canadian Investment Regulatory Organization (CIRO) announced proposed changes for consultation to update rules for Order Execution Only (OEO) dealers, which are digital-first platforms, such as Questrade, Wealthsimple Trade, MogoTrade, or RBC Direct Investing. The proposal would allow a wider range of tools for use, as long as safeguards like clear disclaimers and conflict avoidance measures are in place.
Currently, OEO dealers are allowed to let clients place trades but they are not allowed to provide investment advice. Current restrictions limit these dealers from offering features such as sample portfolios, self assessment tools, or certain educational supports, to avoid triggering “recommendations.”
Today, non CIRO fintechs and investor education organizations can offer self assessment tools, model portfolios, and interactive investor education features because they are not registered dealers. CIRO regulated dealers operate under strict rules, which can hold back innovation. The proposed changes could help close this gap by allowing regulated CIRO platforms to provide more engaging and competitive resources to DIY investors.
One motivation for the proposed rule change is the sharp increase of retail investors turning to social media, forums, and finfluencers for guidance. CIRO has warned that unverified online information can expose investors to serious risks. Expanding what regulated platforms can offer would give DIY investors more access to credible, compliant sources of information and reduce reliance on potentially misleading content.
CIRO is accepting comments on the proposal until November 10, 2025 and has made updating OEO guidance a priority for 2026. If adopted, these changes could reshape investor education in Canada by giving regulated platforms greater flexibility while maintaining essential protections.
The outcome of this proposal will determine how much flexibility regulated CIRO ealers have to innovate in investor and financial education. For fintech innovators and market participants, it's a sign that regulators are open to modernizing rules to better meet the needs of today’s self directed investors.
NCFA will continue to follow this development and share updates on how the final framework could influence the future of investor engagement.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Open Banking | Aug 13, 2025

Image: Freepik
FCA Releases Governance Plan for UK’s new Industry-led Open Banking Standards Body
On August 8, 2025, the UK’s Financial Conduct Authority (FCA) published its FS25/4 feedback statement outlining the governance framework for a new Future Entity to oversee the open banking standards in the UK. The plan details how the Future Entity will be funded, governed, and held accountable. It will be industry led and operated, not a government agency, but will function under the FCA’s oversight. For Canada, the model demonstrates how industry expertise can be combined with regulatory accountability to support innovation and trust.
Since 2017, open banking in the UK has been run by Open Banking Limited, a government run entity created by the UK’s Competition and Markets Authority (CMA) to deliver its order requiring the nine largest banks to create interoperable APIs. Known earlier as the Open Banking Implementation Entity (OBIE), it was a time limited role to boost competition in banking, and not designed to be a permanent governance model.
The FCA’s plan replaces OBIE with the Future Entity, which will have a long term, industry wide mandate. This change moves open banking oversight from a CMA specific enforcement body to an independent standards setter governed under the Data (Use and Access) Act 2025. This legal framework means the Future Entity can later expand into open finance and other areas of data portability.
The Future Entity will be a not for profit company limited by guarantee, funded by contributions from its users and beneficiaries including banks, fintechs, and other participants. Its board will be appointed by an independent appointments committee, not directly by the government or the FCA. The FCA will regulate it as an interface body under the Data (Use and Access) Act, but will not manage its day to day operations. This allows industry to lead on technical standards while the FCA can intervene if those standards do not protect consumers or the market.
The governance approach is similar to a self regulatory organisation (SRO). It is run by industry, sets technical and operational API standards, and monitors compliance. Like an SRO, it will send reports to the regulator. The key difference is that the Future Entity will not have enforcement powers. All formal enforcement remains with the FCA. This keeps legal authority with the regulator while allowing the industry to deliver the technical work.
Commercial operators will use the Future Entity’s standards to create products and services to meet interoperability while leaving space for competition and innovation. The Future Entity itself will only operate directly if there is no commercial incentive or there is a proven market failure.
Industry participants are already working on variable recurring payments for uses such as bill payments, which is planned for 2025. The FCA will hold workshops this summer and fall 2025 to finalize operational details, with a full plan expected by the end of the year.
Canada currently has no permanent open banking standards body. The UK approach shows how Canada could move a temporary regulatory order to a more permanent industry led framework without losing accountability or slowing progress.
An industry led and funded non-profit organization, supported by contributions from all users and beneficiaries, can create shared responsibility and boost financial sustainability. With an SRO style approach, industry leads on technical delivery while the regulator retains enforcement powers, can speed innovation while protecting consumers and market stability.
Important to keep the standards setting body separate from commercial operators to streamline interoperability and ensure a level playing field (reducing risk of favouritism towards certain providers). Applying these principles from the start could help Canada avoid disruptive governance changes later and build a system that supports both innovation and public trust. Learn more about Canada's open banking journey.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Biometric Guidance | Aug 13, 2025
Image: Freepik/rawpixel.com
On August 11, 2025, the Privacy Commissioner of Canada (OPC) released final guidance on handling biometric information such as facial recognition, fingerprint scanning, and voice identification.
how federal institutions and businesses must handle biometric information such as facial recognition, fingerprint scanning, and voice identification. The new privacy guidance applies to federal institutions and businesses across all sectors and follows more than a year of public consultation that included input from 34 written submissions and 31 stakeholder meetings. The updated guidance is Canada's response to mounting privacy risks thanks to the rapid growth of using biometric technology in authentication, security, and service delivery.
Biometric data is uniquely tied to an individual’s body and remains consistent over time, making it valuable for verification and sensitive for privacy, but it can reveal health indicators, racial and gender characteristics, and other personal details. Unlike passwords, it cannot be replaced if compromised.
The permanent nature and sensitivity of biometric data increases the risk for organizations collecting, storing, and processing without special safeguards. As the OPC guidance states, "Biometric information is sensitive personal information, and in most cases, it should be treated and protected as such."
Philippe Dufresne, Privacy Commissioner stressed:
“Organizations need to approach the use of biometric information in a privacy-protective way, building privacy considerations at the beginning of any new program or initiative.”
The guidance for private sector organizations clarifies when and how biometrics can be collected, used, and disclosed under the Personal Information Protection and Electronic Documents Act (PIPEDA). Businesses must ensure there is a clearly defined and appropriate purpose for any biometric program, supported by a proportionality test to weigh benefits against privacy risks.
They must also obtain meaningful consent from individuals, be transparent about how data will be used, ensure systems are accurate through testing, and apply robust security measures to prevent unauthorized access.
Federal institutions adhere to similar principles under the Privacy Act but face additional obligations. They must identify lawful authority before collecting biometric data and conduct a formal Privacy Impact Assessment to evaluate risks and mitigation strategies.
The federal guidance simplifies the rules for doing impact and risk assessments so they are easier to follow when planning a program. It also asks federal institutions to think carefully about whether biometrics are truly needed, if the benefits outweigh the privacy risks, and whether other options could work before moving ahead.
The final guidance incorporates several adjustments based on stakeholder feedback, including clearer definitions of sensitive information, closer alignment with legal requirements, more detailed technical explanations and best practices, refined consent guidance for private sector use, and expanded discussion of lawful authority for public sector programs.
| Area | Private Sector (PIPEDA) | Federal Institutions (Privacy Act) |
| Legal authority | No specific law needed, but must have a clear, appropriate purpose | Must confirm lawful authority before collecting biometrics |
| Risk assessment | Should assess proportionality and risks, but not formally required | Must complete a formal Privacy Impact Assessment |
| Consent | Must get meaningful, informed consent | Consent may not apply if collection is legally authorized |
| Proportionality | Required to weigh benefits vs privacy risks | Required with added focus on necessity and exploring alternatives |
| Security safeguards | Must apply strong protections to prevent misuse | Same requirement, plus oversight within government frameworks |
For fintechs, payment providers, and digital identity innovators, the guidance sets a higher compliance bar for wherever biometric services may be used, such as customer on-boarding, fraud prevention, and authentication. Companies will need to integrate privacy risk analysis into early product design, justify and write-down decision-making, and ensure biometric tools are tested for accuracy and fairness.
Meeting these requirements will add compliance costs but will be important to maintain consumer trust and avoiding regulatory scrutiny as biometric use expands in financial services.
With it's latest guidance, the Privacy Commissioner is making biometric governance a core compliance area in Canada. For fintechs, this is both a regulatory obligation and a competitive opportunity. Those that build privacy into biometric solutions from the beginning can improve market credibility while remaining compliant.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Banking Policy | Aug 12, 2025

AI generated image of financial exclusion
On August 7, 2025, the White House issued an executive order aimed at ending “politicized or unlawful” debanking. The order directs U.S. regulators to ensure that banks cannot deny service based on political views, religious beliefs, or lawful industry participation, including cryptocurrency. It's the highest profile intervention in U.S. banking in decades and could influence how other jurisdictions handle access to financial services. In Canada, let us not forget the swift debanking of key persons related to the trucker convoy debacle only a few years ago.
Federal banking regulators are to remove “reputational risk” from examination manuals within 180 days. All decisions to deny or close accounts must be based on looking at each customer’s situation on its own, using facts rather than opinions, and assessing real financial and compliance risks instead of relying on broad labels or assumptions.
Regulators must review past cases of account closures or denials within 120 days and take corrective actions, including fines, consent orders, or reinstatement of clients. The Small Business Administration is tasked with urging lenders to reinstate borrowers affected by unlawful debanking. The Office of the Comptroller of the Currency has already updated its materials to comply.
Supporters of the order point to documented cases where lawful businesses, advocacy groups, or individuals lost access to banking without clear justification. Critics argue banks must retain the ability to consider reputational factors when managing compliance obligations under anti-money laundering and counter-terrorist financing laws. A Financial Times analysis notes that crypto companies have been prominent among those alleging discrimination, alongside political organizations and religious nonprofits.
While Canada has not adopted similar measures (yet), there are high profile cases revealing parallels, such as in 2022 when former-PM Trudeau invoked the Emergencies Act to freeze more than 76 bank accounts worth $3.2 million CAD tied to the Freedom Convoy. The Federal Court later ruled this unconstitutional, and the decision is under appeal.
In another reported case, a trucker convoy lawyer said that her Royal Bank of Canada account was closed after small cryptocurrency transactions. Crypto business operators have also described difficulty maintaining accounts, though no comprehensive national data exists.
Canadian banks operate under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and oversight from the Office of the Superintendent of Financial Institutions. Reputational risk is explicitly considered in supervisory frameworks. Consumers are entitled to open personal bank accounts unless specific conditions apply, and must be given written reasons for refusal under the Access to Basic Banking Services Regulations. Complaints can be escalated to the Financial Consumer Agency of Canada or the Ombudsman for Banking Services and Investments, but there is no mandated systemic review or reinstatement process.
| Feature | United States (Post-EO) | Canada |
| Stance on Debanking | Prohibits ideological or industry-based debanking | No federal rule prohibiting ideological or lawful industry debanking |
| “Reputational Risk” | Removed from regulatory supervision criteria | Integral to OSFI guidance and AML compliance |
| Remediation Process | Regulator-led review, possible fines, reinstatement | Individual complaints through FCAC or Ombuds |
| Transparency | Mandated objective, individualized reasoning for account decisions | Written refusal required, but criteria remain broad |
The U.S. executive order aims to reduce bias in access to financial services which should not be denied based on lawful activity or beliefs. For fintech and crypto entrepreneurs, the change should make banking access more predictable and less influenced by subjective judgments. While Canada’s regulatory approach emphasizes prudence and reputational safeguards, it may need to review these protections that remain at the expense of inclusion and competitiveness.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
RPAA | Aug 11, 1015

Image: Freepik
The Bank of Canada is making important updates to the Retail Payment Activities Act (RPAA), with a new registry of payment service providers (PSPs) set to be published on September 8, 2025. Below is an overview of the key points:
If you’re a PSP subject to the RPAA and haven’t registered with the Bank of Canada by November 15, 2024, you must apply immediately. You must apply at least 60 days before starting retail payment activities. Failure to register could lead to enforcement action by the Bank. Learn more: Guide: PSP Registration with Bank of Canada (RPAA)
On September 8, the Bank will start publishing a list of PSPs that have registered under the RPAA, as well as entities whose applications have been refused. The registry will be updated on a rolling basis as more applications are processed. If your application hasn’t been fully processed by this date, it will be included in the list of unfinalized reviews.
Once the registry is live, registered PSPs will be subject to supervisory assessments by the Bank of Canada. They will need to comply with:
PSPs still on the applicants list must follow the same regulatory obligations but won’t have to meet all reporting requirements until their registration is finalized.
The Bank of Canada will start charging fees to PSPs to recover supervision costs, once the cost recovery formula and regulations are finalized.
The new PSP registry and supervisory requirements are critical to improving the oversight of retail payment activities in Canada. Ensuring that Payment Service Providers comply with the RPAA will improve operational security and protect client funds, benefiting the entire payments ecosystem.
Stay updated by visiting the Bank of Canada website or by checking PSP Connect for further updates. If you have questions about the registration application process, email RPS Compliance or get in touch with general inquiries via their contact form.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |