Karsten Wenzlaff, Advisor
August 26th, 2025
Karsten Wenzlaff is a Crowdfunding and Fintech Expert from Germany. He is Secretary-General of Digit[...]
Category Archives: Regtech, Compliance, Governance
UK Launches PISCES to Modernize Capital Markets
Report | May 29, 2025
Image: Freepik
New UK Pilot Helps Growth Companies Raise Capital Without Going Public
On May 15, 2025, the UK government announced a new capital markets pilot called PISCES (Public Intermittent Securities and Capital Exchange System), a public market model designed to help high growth private companies raise money from investors without going fully public. Backed by the UK Treasury and the Financial Conduct Authority, PISCES offers qualifying issuers a new way to raise funds with more flexibility and less burden than a traditional stock exchange public listing, while keeping investor protections in place.
See: How Fintechs Are Unlocking Value in Private Markets
The goal is to close the funding gap for companies that have outgrown early stage venture capital but aren't yet ready or suitable for an IPO. The UK government said this new model will be tested with select scale-ups in 2025, and if successful could become a long term option that strengthens capital markets and keeps fast-growing businesses in the UK.
Key features of PISCES include:
- Public fundraising without full-time listing for high growth companies
- Intermittent capital raising using specific time windows
- Digital infrastructure to handle share issuance and disclosures (faster and transparent)
- Designed for UK companies looking to scale up
- Built-in regulatory oversight during the pilot phase
What Does Intermittent Capital Raising Mean?
Unlike a regular public company that remains on a stock exchange after it's initial listing, a company in the PISCES model can only raise money during specific time windows. So, they don't have to meet ongoing reporting or trading requirements in between those times. This creates more flexibility for companies that need capital but don’t want (or can’t manage) the cost and complexity of being fully public company.
Does Canada Have Anything Similar?
Right now, Canada does not have a similar program like PISCES. Some similar options exist but they aren't the same:
See: State of UK Equity Crowdfunding Entering 2025
- The TSX Venture Exchange helps smaller public companies with lighter compliance requirements but still requires continuous listing
- The exempt market allows private fundraising but not from the general public
- Equity Crowdfunding allow small raises from retail investors but raises are capped at $1.5 million per year
- Regulatory sandboxes exist in Canada, but they haven’t yet been used to pilot new capital markets models
What Canada Can Learn
The UK’s PISCES pilot is a good example of how policy and tech can work together to create smarter capital markets. It offers private companies more options for raising money at scale, while giving investors access to early-stage growth opportunities in a safe and structured way. If it means keeping more home grown Canadian scale-ups in the country then that's a good thing. With the right mix of regulatory support, infrastructure, and industry input, Canada could create its own version of PISCES to strengthen domestic capital formation and innovation. This is another one to watch.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
|---|---|---|
 |  |  |
Global Open Finance Lessons for Canada’s Rulebook
Open Finance Policy Development | May 22, 2025
Image: Freepik/rawpixel.com
Global experts show why open finance needs clear rules, pricing, and trusted governance
On May 15, 2025, the Cambridge Centre for Alternative Finance (CCAF) hosted a webinar, “Open Finance in Practice: Implementation, Liability & Monetisation” with experts from Thailand, Rwanda, India, the UK, and Asia-Pacific who shared what's working and what's not, based on their practical experience. Open finance is progressing globally but real world experience shows that it is not just about technology or APIs, and successful implementation depends on clear rules, trusted governance, and strong infrastructure. These insights are especially relevant now as Canada prepares to implement its own open banking system in 2026.
5 Key Takeaways
1. Regulation Moves Faster Than Voluntary Participation
Sanjay Janeja, Open Banking Lead, CCAF:
“Our data shows that regulation-led models support faster implementation and broader data sharing.”
CCAF’s Global Regulatory Innovation Dashboard (GRID) shows that countries with clear regulatory mandates, like Brazil and Australia, have progressed faster than those relying on voluntary participation. India in contrast, moved slowly at first without regulatory mandates. Canada risks similar delays unless its upcoming rules are clear, enforceable, and consistent.
2. Governance Must Be Defined Early
Denise Dias, Regulatory and Supervisory Consultant:
“Governance is the soul of open finance.”
See: The Transition Towards Open Finance in the UK
Governance critically defines who sets the rules, allows the accreditation of participants, and resolves disputes. Rwanda is building shared oversight between its financial and telecom regulators. Countries that define this early see smoother adoption. Canada's future governance structure needs to include clear roles for regulators, industry, and consumer protection agencies.
3. Liability Needs a Rulebook
Rafael Mazer, Director, Fair Finance Consulting:
“Consumers should not have to wait for firms to assign blame before they are made whole.”
As more parties exchange financial data, legal clarity is paramount. The UK mandates reimbursement even before liability is settled. Oman and UAE require indemnity insurance for open finance participants. Canada needs to define who is liable, under what conditions, and how disputes will be resolved before open banking go live.
4. Pricing Must Be Transparent and Fair
Rafael Mazer:
“This is where the claws come out.”
See: Open Banking: Revolutionizing Financial Data Sharing
Camilla Bullock, CEO, Emerging Payments Association Asia:
“You cannot grow the pie if the small players cannot afford a slice.”
Thailand uses free access for consumers and capped pricing for commercial use. Brazil allows a set number of free requests per user. These models keep access open for small fintechs. Canada should consider following suit to avoid anti-competitive pricing that could exclude new entrants.
5. Local Context Shape Design
Pamela Umutesi, Lead for Open Finance, National Bank of Rwanda:
“Let your local context guide how you implement.”
Thailand focused on non financial data first because the infrastructure was already in place. Rwanda’s model prioritizes mobile money. Canada of course is considering its own requirements, including provincial data laws, legacy banking systems, and regional financial access gaps. Bottom line is that a one-size-fits-all model that works abroad will not necessarily work elsewhere.
Global Comparison Table
The table below primarily covers open banking implementations, with some jurisdictions extending toward open finance (Brazil, India, Thailand).
See: BoE Report: Open Banking Boosts Productivity, Competition
This is an important distinction because open banking generally refers to access to 'bank account data' which is often mandated for regulated institutions. While Open Finance expands beyond banking data to include insurance, investments, pensions, government data, mobile money, and more.
| Country | Pricing Model | Regulatory Status | Governance Approach |
| Brazil | Free access below threshold | Mandated and implemented | Central bank |
| Thailand | Free for consumers; capped for firms | Mandated and being implemented | Bank of Thailand and industry consortium |
| India | Commercial pricing; no fixed rules | Voluntary, evolving | NGO-led (Sahamati); gaining government support |
| Rwanda | Pilot phase; not-for-profit approach | Mandated, not yet implemented | Multi-agency regulator framework |
| UK | Free for regulated APIs | Mandated and implemented (OB only) | Regulators (CMA, then OBIE, now JROC) |
| Australia | Free basic; optional premium | Mandated and implemented | Treasury under Consumer Data Right law |
| EU (PSD2) | Mostly free under PSD2 | Mandated and implemented (OB only) | Regulator; preparing Financial Data Access (FiDA) |
| Singapore | Voluntary pricing; no mandate | Voluntary | MAS; market-driven with government-backed standards |
| Hong Kong | Commercial rates allowed | Voluntary with phased guidance | HKMA; implementation by industry associations |
| Canada | TBD (under consultation) | Mandated, not yet implemented | Department of Finance; FCAC |
What Canada Must Do Now
Canada has committed to implementing open banking but full rollout isn't expected until 2026. In June 2024, the Department of Finance enacted the Consumer-Driven Banking Act, the legal framework for open banking, and appointed the Financial Consumer Agency of Canada (FCAC) as the authority responsible for implementing, overseeing, and enforcing the framework. Final rules on liability, pricing, and participation are still under development.
See: CSA Seeks Industry Input on Data Portability Consultation
Countries that wait too long or rely only on voluntary models are playing catch-up. NCFA supports an open finance framework in Canada that protects consumers, enables competition, and accelerates innovation. Canada should learn from the world's most successful open finance systems, which are defined by clear regulation, fair pricing, and shared governance. As the CCAF’s global tracker and research show, clear rules work. Delay does not.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
GENIUS Act Advances as Bitcoin Hits Record High
Digital Assets | May 22, 2025
Image: Freepik
U.S. Stablecoin Bill Gains Traction as Bitcoin Hits New All Time High
Various sources have reported that the U.S. Senate has now approved the GENIUS Act to move forward, which is the proposed law that sets out national rules for the issuance of stablecoins and how they would be backed and managed in the U.S. Stablecoin adoption has been on fire recently, as they are increasingly used for crypto trading, cross-border payments, and digital services.
Only a couple of weeks ago on May 8, 2025, the GENIUS Act failed to clear a procedural vote in the Senate, receiving only 49 votes of the 60 needed to move forward, largely over Democrat conflict of interest concerns involving President Trump's family and their growing crypto ventures, including USD1 stablecoin backed by World Liberty Financial.
At the same time, Bitcoin just surged past $111,000 on May 21, reaching a new all-time-high (ATH), a clear signal of how fast the digital asset world is growing and that clear rules are needed.
Stablecoin Regulation Advances
Fifteen Democrats joined Republicans, showing rare bipartisan alignment with the U.S. Senate approving the GENIUS Act in a 66–32 vote, allowing it to move to a full vote soon where lawmakers may combine it with other similar proposals before sending it to the President for review and sign-off. Support from both major parties indicates a strong chance that the GENIUS Act will eventually become law.
A recent Congressional Research Service report also outlines how the bill could reshape the stablecoin landscape, clarifying rules around issuance, reserve backing, and oversight.
Under the GENIUS Act, only licensed banks, approved non-banks, and qualified state level issuers can offer stablecoins to people in the U.S., which is designed to help keep out unregulated or risky issuers.
See: U.S. Senate Moves to Regulate Stablecoins
The bill also requires stablecoins to be backed 1-1 by U.S. dollars or very liquid assets. Issuers would have to publish monthly updates showing what backs their coins and clearly explain how people can redeem them. Companies outside the U.S. would need approval from the Treasury and proof that they meet requirments and can follow similar rules.
Crypto and AI advisor to the President, David Sacks, said the GENIUS Act could “create trillions of dollars of demand for U.S. Treasuries practically overnight.” He is positioning stablecoins as a national economic strategy, not just about digital innovation. The White House has strongly backed the bill, although some Democrats remain concerned about conflicts of interest tied to President Trump’s family’s involvement in crypto.
Digital Assets Heating Up
Bitcoin’s latest surge puts digital assets back in the spotlight, and with more people using stablecoins and Bitcoin ATMs, regulators want to make sure these services are safe and clearly regulated. The GENIUS Act is one way to respond to this fast growth.
See: Fidelity Report Insights on Digital Assets in 2025
Other countries are moving quickly, too. Jurisdictions like the EU, UAE, and Singapore are building their own stablecoin frameworks. If the U.S. experiences further delays, it could risk losing ground in establishing the global standard and leadership role in digital assets.
Conclusion
The GENIUS Act would reduce uncertainty and make it easier for fintechs and investors to innovate in digital asset markets while establishing a foundation for a safer and more trusted digital asset financial ecosystem.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Ethereum Targets $1 Trillion in Security Upgrades
Crypto Security | May 16, 2025
Image from Ethereum 1TS announcement
Ethereum Launches $1 Trillion Security Push to Protect Global On-Chain Assets
On May 14, 2025, the Ethereum Foundation anounced a $1 Trillion Dollar Security (1TS) Initiative, a long term project to strengthen the security of the entire Ethereum ecosystem to support a future where trillions of dollars in value could move on-chain. The reality is that security isn't just a technical issue. It is the single biggest barrier to mainstream adoption of Web3, and Ethereum knows it.
See: Fintechs Face Rising SaaS Security Risks, JPMorgan CISO
Today, Ethereum is responsible for more than 50 percent of all total value locked (TVL) in decentralized finance platforms, already securing over $400 billion in on-chain assets. However a rise of exploits and protocol breaches unveil how fragile Ethereum's infrastructure actually is so the 1TS project aims to reinforce it.
How Big Is the Security Problem?
In 2024, hackers stole over $1.8 billion across crypto platforms with Ethereum-based DeFi applications accounting for more than half of the total losses. Despite improvements in protocol security, new vulnerabilities continue to be exploited at scale, such as:
- $290 million at PlayDapp lost after attackers exploited access controls to mint unauthorized tokens
- $97 million stolen at Muchables by a rogue developer through a smart contract backdoor
- $80 million at Orbit Chain was drained from an Ethereum bridge used for cross-chain transfers
- $55 million at Radiant Capital was lost through an access control flaw in Ethereum-based lending contracts
Notably the above figures don't include the growing number of targeted phishing campaigns, wallet drainers, and socially engineered scams that increasingly use AI to impersonate trusted actors and to slay 'pig butchering'. Collectively, these exploits show that Ethereum's security environment still has a way to go. For many prospective users and certainly institutions, the constant threat of permanent asset loss is a significant barrier to adoption and long term trust.
Goals and Leadership of 1TS
1. Map the risk. The Ethereum Foundation is conducting a full-stack vulnerability analysis, including risks in wallets, smart contract tooling, L2 infrastructure, consensus layer code, and even DNS and internet infrastructure.
2. Fund what matters. 1TS will identify the highest priority attack surfaces and fund long term solutions. These could include upgrades to client software, fuzz testing, formal verification, or developer tooling that requires and enforces safer default settings.
See: Spot Ethereum ETFs Debut in the U.S. (Without Staking)
3. Communicate clearly. The final goal is to make Ethereum’s security infrastructure easier to understand, and to establish transparent benchmarks and metrics that will allow users, enterprises, and governments to compare the safety of Ethereum’s ecosystem to other financial systems.
The 1TS initiative is being led by Fredrik Svantes, Ethereum Protocol Security Lead, and Josh Stark, part of the Ethereum Foundation’s core leadership. They are joined by several other well known people from the security ecosystem, all bringing deep experience in incident response, smart contract audits, and secure protocol design.
What to Get Involved?
The Ethereum Foundation is opening the initiative to input from the community. Anyone can share suggestions, flag concerns, or apply to collaborate by completing this form or to discuss, reach out to the team directly by email at trilliondollarsecurity@ethereum.org.
Outlook
If Ethereum wants to be the financial base layer for billions of people, it needs a security model at least as robust as global banking systems. The Trillion Dollar Security Initiative is welcomed and necessary to get to the next step. It is about showing regulators, institutions, and the public that Ethereum and all the companies and transactions that feed off of the ecosystem can scale safely.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Canada’s Competition Plan Is Getting More Serious
Competition | May 15, 2025
Image: Competition Bureau 2025 2026 Annual Plan
Canada's Competition Watchdog is Upping Its Response to Rising Costs, Weak Productivity, and Digital Market Dominance
On May 15, 2025 the Competition Bureau released its 2025 to 2026 plan and they intend to move earlier, faster, and deeper into markets that matter to Canadians, such as grocery pricing, housing, banking, telcom, artificial intelligence, and environmental claims. Instead of reacting after harm is done, the Bureau plans to use the new, more modernized, legal tools at its disposal to focus on affordability, digital power, and slow innovation.
Cracking Down on Hidden Fees and Market Power
With expanded powers from recent updates to the Competition Act, investigators can act more quickly and use more data to build stronger cases to tackle problems like drip pricing and greenwashing. They can target areas where high market concentration makes life less affordable, working to prevent harmful behaviour before it becomes a crisis.
Pushing Government to Rethink the Rules
The Bureau is already pushing governments across the country to remove rules that hold back competition. They encourage use of its Competition Assessment Toolkit, which is designed to help policymakers identify and fix outdated regulations.
See: Will Competition Reforms Boost Fintech? Inside the Fight
The Bureau will also launch a new market study this year and expand its work on emerging issues like algorithmic pricing and data portability. They will also make compliance easier for small businesses with tools like the Compliance Hub and Compliance Bootcamp. Promoting competition is now mandatory, and part of how the Canadian government can help grow the economy and protect consumers.
Modernizing the Bureau
To support all of the changes, the Bureau is hiring staff with digital skills, updating its systems to manage large volumes of data securely, and training teams to use AI and new enforcement tools. There is also a revitalized focus on diversity, mental health, bilingualism, and accessible leadership training. The Bureau plans to work more closely with domestic and international partners, and play a key role during Canada’s G7 presidency.
Competition Matters
This year’s plan shows that Canada is taking competition more seriously. It's not just about enforcement anymore; it's about using smarter tools, faster action, and better policy to lower costs and open up markets.
See: UK Banking Competition Remedies, Lessons for Fintech Growth
For fintechs and startups, this creates a chance to grow in a market environment that rewards fair play and transparency. And to incumbent players relying on hidden fees or dominant behaviour, the pressure is rising to adapt.
Learn more: download the 7 page PDF '2025-2026 Annual Plan: Strengthening Competition in a Changing Economy'
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Crypto.com Canada Gains Canadian Regulatory Approval
Crypto | May 15, 2025
Image from Crypto.com Canada website
Crypto.com Canada Receives Restricted Dealer Registration to Continue Serving Customers
On May 12, 2025, Crypto.com Canada announced that on May 8 they received a restricted dealer registration across all Canadian provinces and territories, allowing the platform to continue offering crypto asset products and services while it works toward full investment dealer registration and CIRO membership.
This regulatory milestone aligns with Crypto.com’s earlier commitment to the Canadian Securities Administrators and Ontario Securities Commission in August 2022, when it became the first crypto trading platform to sign a Pre-registration Undertaking (PRU). The PRU was created to provide a temporary path for firms to continue operations while meeting Canada’s robust regulatory standards.
See: Stablecoin Payments Have Wings – Are You Ready?
Eric Anziani, President and Chief Operating Officer at Crypto.com:
“We have strong protocols for our Canadian operations which were put in place or strengthened during the course of the registration process and are designed to enhance the protection of our customers and their asset. We have invested heavily in our compliance infrastructure around the world, and specifically in relation to Canada, because we want our customers to have greater peace of mind knowing that they are dealing with a regulated firm in Canada.”
Crypto.com Custody Trust Company (chartered trust company licensed in New Hampshire) will be the primary digital asset custodian for Canadian clients.
According to Joe Anzures, President of the custody unit, “Crypto.com Custody Trust Company looks forward to providing secure custody services to the Canadian market and to registered cryptocurrency trading platforms who will operate in accordance with the high standards established by Canadian securities regulators.”
See: Robinhood Acquires WonderFi for C$250M
Crypto.com’s Canadian registration adds to a growing global portfolio of licenses including:
- MiCA license in the European Union
- Money Transmitter Licenses (MTLs) in multiple U.S. states
- Designated Contracts Market (DCM) and Derivatives Clearing Organization (DCO) status in the U.S.
- Major Payment Institution (MPI) license in Singapore
- Electronic Money Institution (EMI) license in the UK
- Virtual Asset Service Provider (VASP) license in Dubai
Outlook
Crypto.com’s restricted dealer registration highlights regulatory progress and a maturing market in Canada’s crypto sector. As more platforms become licensed and registered to operate in Canada both retail and institutional clients will benefit from more competition and improved confidence and safeguards. It also shows that top global crypto players are willing to meet Canada's high compliance standards, if there is a clear path to registration and market opportunities.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Fintechs Face Rising SaaS Security Risks, JPMorgan CISO
Cybersecurity | May 14, 2025
Image: Freepik/DC Studio
Third-party Integration Flaws Are Exposing Fintechs to Spreading Attacks
Patrick Opet, JPMorgan Chase’s Chief Information Security Officer, has dropped a rare public warning that the modern SaaS (Software-as-a-service) model is enabling cyberattacks and embedding systemic risk into the global economy. His message is that the security architecture is breaking down, and software providers are not doing enough to fix it. Below are some urgent quotes from his discourse and why they matter for Canadian fintechs, investors, and regulators.
5 Select Quotes From Opet's Letter
1. “SaaS has become the default... embedding concentration risk into global critical infrastructure.”
Many fintechs are using the same core SaaS vendors for payments, data, and automation, exposing them to a single point of failure. If one of these vendors is compromised, the effects can spread fast like wild fire on a dry summer's night. For fintech startups, the risks may be inherited without full visibility.
See: India Biometric Data Breach Highlights Cybersecurity Risks
2. “Over the past three years, our third-party providers experienced a number of incidents... requiring us to act swiftly and decisively.”
Canadian fintechs with lean security teams need contingency plans for third party supplier compromise and must monitoring vendor behaviour or risk the full wrath of a serious attack that will disrupt operations, result in data theft or leakage, fraud and financial loss, regulatory and legal exposure, reputational damage and even cascading or 'fourth party' risks. Even a global bank must isolate vendors during incidents. Read OSFI's Guidance here: Third-Party Risk Management Guideline.
3. “Fierce competition among software providers has driven prioritization of rapid feature development over robust security.”
Security is often sacrificed for speed. Fintechs should require vendors to provide (1) strong and secure default settings, (2) regular third-party audits, and proof or evidence of strong internal security programs such as SOC 2 Type II or ISO/IEC 27001 certification.
See: Perplexity’s Security Flaws A Red Flag for Industry
4. “Modern integration patterns dismantle essential boundaries... relying on overly simplified interactions between third-party services and firms’ sensitive internal resources.”
OAuth tokens and API integrations are often misused, allowing third and unwanted parties to access internal systems. Without strong segmentation and logging, attackers can move quickly once access is gained. Microsoft Threat Intelligence recently confirmed state actors are now targeting common SaaS apps to infiltrate customers.
5. “The most effective way to begin change is to reject these integration models without better solutions.”
Canadian fintechs should ensure procurement policies require secure integration design, advanced authorization models, and greater transparency from vendors. Startups should reference the Canadian Center for Cybersecurity Top 10 IT Security Actions for implementation guidance.
What This Means for Canadian Fintechs
SaaS brought convenience and speed but also concentrated risk across fintech infrastructure. For smaller Canadian firms who often lack internal security engineering, the consequences of a poorly or unsecured SaaS integration can be severe. This warning should not be ignored.
See: New Cyber Threats Financial Service Firms Need to Know
Fintech leaders should:
- Audit all third-party SaaS integrations especially those with read or write access to sensitive systems. The CSA's Staff Notice 33-321 offers baseline expectations for registrants
- Require vendors to support multi-factor authentication, token expiration, and role-based access controls
- Push for data residency transparency and vendor dependency disclosures, including fourth-party services
- Include security breach notification clauses in service agreements
- Explore secure options such as customer-managed encryption keys, confidential computing, and bring your own cloud models
Final Thought
OSFI and the CSA have made it clear that third party oversight is now a priority, so fintechs can expect questions on cybersecurity controls and operational resilience during regular reviews. SaaS is here to stay but without stronger default security and safer integrations and oversight, it'll remain a growing liability.
See: Can Cloned Voices Crack Bank Security? Need to Know
Fintech startups and scale-ups cannot rely on vendors to lead. Security must be a shared responsibility across the ecosystem, and it begins with better architecture, more transparency, and smarter procurement.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
