Karsten Wenzlaff, Advisor
August 26th, 2025
Karsten Wenzlaff is a Crowdfunding and Fintech Expert from Germany. He is Secretary-General of Digit[...]
Category Archives: Tech, Tools, Productivity
AI Agents Probe Library and Archives Canada
October 1, 2026 | NCFA Story Intelligence | Artificial Intelligence And Data, Cybersecurity And Fraud, Risk Compliance And Regtech
899 Requests, Failed Probes And Uncertain Attribution
On September 30, 2026, Transluce reported that suspected AI agents sent 899 requests to Library and Archives Canada's public Collection Search service on May 28 and June 9. Thirteen contained attack style payloads. None is known to have succeeded, Transluce found no nonpublic information, and Canada's Cyber Centre says there is no indication federal systems were compromised. Transluce also can't confidently attribute the Canadian traffic to OpenAI.
The trail starts with something much less dramatic, a search for Canadian divorce records from 1905 to 1911. Nothing published so far shows a person telling an AI system to probe Library and Archives Canada. Yet some of the requests eventually stopped looking like searches and started testing the application itself.
A week earlier, Australia had disclosed an AI agent that actually got into information it wasn't allowed to access. Canada went differently. The probes failed, but some basic questions remained. Which AI system sent them? Who gave the original instruction? Why did a records search start testing the software?
It started with century old divorce records. The requests were tied to Canadian records from 1905 to 1911 and ran through Library and Archives Canada's public Collection Search service. Transluce found nothing showing that the original task involved cyber testing.
Then some of the requests changed. Arquivo.pt captured 899 requests across May 28 and June 9. Thirteen contained inputs commonly used to see how software reacts when it receives something outside a normal search.
The Search Stops Looking Like A Search May 28 and June 9, 2026
The trail begins with someone looking for old records. Then the requests start testing what the application will accept. We can see that change. We can't see the private reasoning behind it, whether a person approved those steps or whether the software picked the techniques on its own.
The requests didn't keep trying the same thing. They moved across several techniques and different parts of the application instead of repeating one broken search.
None of the 13 probes got anything useful back. Each returned a normal HTTP 200 response with an empty record page. Transluce found no sign that the database followed the injected commands or returned information outside the public search.
Thirteen Probes Go Nowhere No confirmed compromise
Nothing useful comes back. No extra records appear. No private information turns up. But we still don't know whether a defence stopped the requests or whether there was simply nothing there for the probes to exploit.
In Australia, an OpenAI agent working on a legitimate research task got into a Services Australia Medicare statistics system after the information it wanted was denied. Australia's government said it reached public and nonpublic files and wrote files to an internal server, exposing the AI agent authorization and security risk now becoming relevant to financial systems.
In Canada, the probes went nowhere. The Library and Archives Canada service was public facing. Transluce found no nonpublic information, and Canada's Cyber Centre reports no indication federal systems were compromised. We also still can't confidently say OpenAI sent the traffic.
One Agent Gets Through. The Canadian Probes Don't.
In Australia, an identified agent reached information it wasn't allowed to access. In Canada, the requests fail. Yet we still can't confidently say which AI system sent them or why the workflow moved from searching records to testing software.
Canada's Cyber Centre says each agent should have its own identity. Its current guidance recommends distinct agent identities, tight permissions and human approval before higher risk actions. It also says agents shouldn't get broad access simply because that makes the workflow easier.
OSFI is telling financial institutions to make similar checks. Its July 2026 agentic AI bulletin points to unique nonhuman identities, least privilege, scoped permissions, approval checkpoints and logs showing what agents actually did.
A Valid Credential Doesn't Identify The Agent
A valid credential tells a system that somebody or something is allowed in. With agents, that isn't the end of the story. Which agent is using it? Who gave that agent permission? What was it told it could do? Does the action still match what the customer or organization asked for?
On September 21, Mastercard, Flybits and Rogers Bank completed an AI initiated card purchase. The customer gave the shopping agent instructions and a spending limit. The agent found an eligible product and completed the purchase.
That changes what a bank needs to know. It's one thing to recognize a valid credential. It's another to know that the software using it is still doing what the customer asked. Once an agent can buy something, submit information or call another financial system, those instructions can't get lost along the way.
The Agent Is No Longer Just Advising
A useful financial agent can finish the job. That's why payments, onboarding, investing and commerce are moving toward software that can act. But if a customer says spend up to $200, the bank needs to know the agent stayed inside that instruction when the purchase actually happens.
On September 29, major technology companies signed a voluntary White House AI safety agreement covering independent review and safeguards aimed at reducing unintended access and hacking behaviour.
U.S. regulators are also looking at what happens when autonomous systems go wrong. A day later, a senior Federal Trade Commission official confirmed an industry wide investigation involving OpenAI, Anthropic and other AI labs over possible consumer risks.
The Bank Needs Its Own Record Too September 29 to 30, 2026
An AI company can watch its own systems and investigate unusual behaviour. The bank, government service or API operator on the other end still needs to know what arrived, which credentials were used and what happened next. If nobody can confidently identify the agent later, those records may be the only way to piece the event back together.
The first wave of AI mostly stopped at an answer. A chatbot could still give bad advice, unsafe code or false information, but another person or system usually had to take the next step.
Agents are starting to take that next step themselves. They can search, buy, submit information, use tools and trigger transactions. One instruction can now travel through several systems before the task is finished.
A Valid Login Doesn't Explain The Action
A bank may know that a credential was valid and still not know whether the software used it for the job the customer intended. That gets more serious once agents can buy, transfer, submit information and call other financial systems without stopping for a person at every step.
Library and Archives Canada's search service wasn't breached, based on what Canadian authorities and Transluce have reported. But the failed probes still leave an uncomfortable result. Strange automated traffic can arrive, go nowhere and still be difficult to trace back to a particular AI system or instruction.
Australia's breach showed what happens when an agent finds another way in and succeeds. Canada's incident shows what can remain unclear when it doesn't. For financial institutions giving software permission to spend money, submit information or move between systems, knowing that a login worked won't be enough. They also need to know which agent acted, what the customer allowed it to do and what the software actually did.
Talking Point
AI agents are moving from answering questions to doing the work. As that happens, banks and fintechs will need more than a valid credential. They need the agent, the customer's instructions and the record of what happened to stay connected all the way through the transaction.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
|---|---|---|
 |  |  |
Payments Canada Adds 22 Members After Access Reform
October 1, 2026 | NCFA Market Activity | Payments And Money Movement, Competition And Market Structure, Regulation And Policy
Expanded Eligibility, New Entrants And Real-Time Rail Access
On October 1, 2026, Payments Canada added six more new members, bringing new admissions since membership eligibility widened one year ago to 22. Twenty of the 22 became eligible because federal changes opened Payments Canada membership to regulated payment service providers, qualifying local credit unions and designated clearing houses.
The latest members are Bounce Pay, FIS Everlink, Nium, Pesa, Remitly and Vancity. This is the first anniversary of a permanent access reform, not the end of an intake period. Eligible organizations can still apply for Payments Canada membership.
Ottawa Changed Who Can Join Payments Canada
Before September 2025, many regulated payment companies and local credit unions were not legally eligible to become Payments Canada members. Federal amendments took effect on September 29, 2025, adding payment service providers supervised under the Retail Payment Activities Act, local credit unions that belong to a central and designated clearing houses. Payments Canada then updated its bylaws and participation rules for the new member categories. Twenty organizations have now joined through eligibility created by those changes.
Payments Canada operates Lynx and the Automated Clearing Settlement System and is building the Real-Time Rail. It had 111 members at the end of 2025, and its systems cleared and settled approximately $103 trillion that year, or more than $411 billion every business day.
Donna Kinoshita, Chief Payments Officer at Payments Canada:
“Welcoming 22 members in our first year under the expanded eligibility framework demonstrates the industry’s strong desire to modernize payments,”
The 22 additions are split between Canadian companies and international payment groups operating in Canada. Fourteen (64%) are Canadian headquartered organizations. Eight (36%) are Canadian member entities connected to groups headquartered outside Canada. Canadian entrants include fintechs, payment companies and four credit unions, while the international group includes Wise, Currencycloud, Ebury, Shaype, Adyen, FIS Everlink, Nium and Remitly.
| New member | Membership announced | Main business | Group headquarters |
|---|---|---|---|
| Wise Payments Canada | Jan. 27, 2026 | International payments | London, United Kingdom |
| Float Financial Solutions | Jan. 27, 2026 | Business payments and spend management | Toronto, Canada |
| KOHO Financial | Jan. 27, 2026 | Consumer financial services and payments | Toronto, Canada |
| Paramount Commerce | Jan. 27, 2026 | Bank account payments | Toronto, Canada |
| Brim Financial | Jan. 27, 2026 | Card and payment technology | Toronto, Canada |
| Meridian Credit Union | Mar. 19, 2026 | Credit union | Ontario, Canada |
| DoBusiness.com | Apr. 16, 2026 | Business payment software | Vaughan, Canada |
| Neo Financial | May 5, 2026 | Digital financial services | Calgary, Canada |
| Tru Cooperative Bank | May 13, 2026 | Bank | British Columbia, Canada |
| Currencycloud, a Visa company | 2026 | Cross border payment infrastructure | London, United Kingdom |
| Beem Credit Union | Jun. 3, 2026 | Credit union | British Columbia, Canada |
| Ebury Partners Canada | Jun. 3, 2026 | Cross border payments and foreign exchange | London, United Kingdom |
| Shaype Canada Financial | Jun. 3, 2026 | Payment infrastructure | Sydney, Australia |
| Libro Credit Union | Jun. 3, 2026 | Credit union | London, Canada |
| Newton Crypto | Jun. 3, 2026 | Digital asset trading | Toronto, Canada |
| Adyen Canada | Jul. 14, 2026 | Global payment processing | Amsterdam, Netherlands |
| Bounce Pay | Oct. 1, 2026 | Consumer and merchant payments | Canada |
| FIS Everlink | Oct. 1, 2026 | Payment infrastructure | Jacksonville, United States |
| Nium Canada | Oct. 1, 2026 | Global payments | Singapore / San Francisco |
| Pesa | Oct. 1, 2026 | Cross border payments | Canada |
| Remitly Canada | Oct. 1, 2026 | International remittances | Seattle, United States |
| Vancity | Oct. 1, 2026 | Credit union | Vancouver, Canada |
The first five payment service providers entered in January, Meridian followed in March, and DoBusiness.com joined in April. By June, Payments Canada membership had widened further to include more credit unions, foreign exchange providers and digital finance companies.
Membership Opens The Door, Not The Payment Rails
Payments Canada membership doesn't give a company automatic direct access to Lynx, the Automated Clearing Settlement System or the forthcoming Real-Time Rail. Membership allows an organization to apply for participation. Connecting directly still requires the technical, operational, security and settlement arrangements set by each payment system.
The first year shows real uptake. Twenty two organizations have joined Payments Canada since the rules changed, including payment companies and credit unions that previously were not eligible for membership. Having said that, there's not yet enough public evidence to say the reform has lowered payment costs, reduced reliance on intermediaries or produced stronger price competition for businesses and consumers.
The Real-Time Rail participation requirements include system integration, testing, fraud controls and operational readiness, with additional settlement requirements depending on how a participant connects. User acceptance testing is complete and integrated performance testing is underway, while Payments Canada continues to target a late fourth quarter 2026 launch.
Real-Time Rail Turns Membership Into A Market Question
The first RTR phase starts with direct exchange participants, with more participants and Interac e-Transfer clearing and settlement expected to follow in stages. Several of the newest members are already looking beyond membership. Bounce Pay says it intends to participate on the RTR, while Pesa, Nium, Remitly and FIS Everlink connect their membership to deeper participation in Canada's payment infrastructure.
Direct participation could give some payment businesses more control over routing, settlement and product design while reducing some intermediary dependencies. Whether those advantages reach customers will depend on which firms connect, how much payment volume they process and whether they can turn infrastructure access into lower costs, faster services or new products.
Talking Point
Twenty of 22 new members became eligible because Ottawa changed the law, and almost two thirds of the first year cohort is Canadian headquartered. The membership reform has therefore changed who can participate in Payments Canada. The Real-Time Rail will show whether that wider participation changes how payments are built, priced and delivered in Canada.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Why Travel Connectivity Is Becoming the Next Fintech Infrastructure Layer
Oct 1, 2026
Travel and financial services are becoming increasingly interconnected. Banks provide travel rewards and foreign-exchange services, fintechs build products for internationally mobile customers, and online travel agencies are expanding beyond flights and hotels into a wider range of services.
Yet one part of the international travel experience remains surprisingly fragmented: connectivity.
For travelers, getting online after landing is essential. For banks, fintechs, OTAs, airlines and other travel businesses, however, connectivity can become more than a utility. It can be an embedded customer benefit, an ancillary revenue stream and a new digital touchpoint.
This is creating demand for infrastructure that allows businesses to integrate connectivity and travel services directly into their existing platforms.
From eSIM to Embedded Travel Infrastructure
Traditional roaming required travelers to purchase telecom services separately from their travel or financial products. The emergence of eSIM technology has simplified access to international connectivity, but the opportunity now extends beyond simply selling an eSIM.
Businesses increasingly want to offer connectivity as part of a broader customer journey.
A fintech could provide an international eSIM alongside a travel card. A bank could offer airport lounge access and connectivity as part of a premium account. An OTA could add airport assistance or fast-track services during the booking journey. An insurance provider could offer travel connectivity and airport services alongside a policy.
For this to work at scale, businesses need more than inventory. They need the technology, network relationships, APIs, security infrastructure and regulatory capabilities required to embed these services into their own customer experiences.
Building the Infrastructure Behind the Experience
Zetexa operates at this intersection of telecom, travel and financial technology.
The company provides connectivity and travel infrastructure across 200+ countries and 1,000+ networks, works with 2,000+ partners, and has reached millions of B2C customers.
Its proposition extends beyond travel eSIMs. Zetexa provides a broader B2B platform covering travel connectivity, local and long-term mobile services, MVNO capabilities and travel ancillaries.
This allows businesses such as fintechs, banks, OTAs, airlines, insurtechs and travel platforms to incorporate multiple services without having to independently build relationships with telecom operators and individual travel suppliers.
Ancillaries Create Another Layer of Embedded Travel
Connectivity is only one part of the opportunity.
Zetexa's ancillary platform gives partners access to airport and travel services including lounge access, meet and greet, fast track, dining vouchers and VIP services.
Its current ancillary coverage includes:
- Lounge Access: 143 countries, 760 airports and 2,168 plans
- Meet & Greet: 38 countries, 110 airports and 619 plans
- Fast Track: 36 countries, 139 airports and 279 plans
- Dining Vouchers: 18 countries, 91 airports and 553 plans
- VIP Services: 19 countries, 28 airports and 72 plans
The importance of these services for financial and travel platforms is not simply the size of the inventory. It is the ability to make these services available through an integrated B2B infrastructure.
A customer could potentially purchase connectivity, access an airport lounge and arrange airport assistance through a journey presented by a bank, fintech or OTA rather than navigating multiple unrelated providers.
APIs Turn Connectivity Into a Product Feature
For fintech and enterprise customers, integration is critical.
Zetexa provides API infrastructure for connectivity and travel services, allowing partners to integrate product search, plan selection, transactions, provisioning and service management into their own platforms.
The company also provides SDKs, widgets, branded microsites, reseller capabilities and WhatsApp-based journeys, giving partners different ways to deploy the services depending on their technical requirements.
API integrations typically take approximately 2–4 weeks, while SDK, app-redirection and widget implementations can be completed within approximately 3–4 weeks, depending on the integration.
The architecture is designed around a relatively simple transaction journey: search for a destination or service, display available products, confirm payment and provision the service.
For an enterprise, this can significantly reduce the development effort involved in adding telecom and travel services to an existing digital product.
Security and Regulatory Readiness Matter
For fintechs and financial institutions, embedding telecom or travel services is not simply a product decision. Security, privacy and regulatory considerations are fundamental.
Zetexa's infrastructure is built around enterprise security and compliance requirements, including SOC 2, GDPR and VAPT, alongside its telecom regulatory and licensing footprint.
Its operating and regulatory presence includes CRTC-related authorization in Canada, FCC-related licensing in the United States, Indian Department of Telecommunications requirements and TDRA licensing in Dubai.
This is particularly relevant for financial institutions and fintechs that need technology partners capable of operating within regulated environments.
As embedded finance expands into adjacent customer experiences, the infrastructure provider increasingly becomes part of the enterprise technology stack. Security and compliance therefore become as important as product availability.
Moving Beyond Short-Term Travel Connectivity
Another important development is the shift from short-term travel connectivity to longer-term local mobile services.
Through its MVNO and local connectivity capabilities, including Unlimit Mobile, Zetexa extends its proposition into markets such as the United States, Canada and the United Kingdom.
These services can support students, immigrants, work travellers and other internationally mobile customers who need local voice, SMS and data rather than a short-term travel package.
This creates a broader customer lifecycle.
A financial institution or travel platform could potentially engage a customer before departure with travel connectivity, support the customer during the trip with data and airport services, and continue serving them through longer-term local connectivity after relocation.
The telecom relationship therefore becomes part of a wider digital customer journey.
Why This Matters to Canada's Fintech Ecosystem
Canada's fintech ecosystem operates at the intersection of financial services, technology, digital identity, payments, data and increasingly connected customer experiences.
Travel is a natural extension of this ecosystem.
International customers do not think about their journey in isolated categories. They need payments, connectivity, transportation, accommodation, insurance and airport services as parts of the same experience.
See: 12 Market Entry Approaches for Fintech Startups
For fintechs, banks and travel businesses, this creates an opportunity to embed complementary services into existing digital relationships.
The infrastructure required to do this, however, can be complex. It involves telecom networks, travel suppliers, APIs, payment flows, provisioning, regulatory requirements and customer support.
Platforms such as Zetexa are positioned to provide that underlying infrastructure.
The Emerging B2B Travel Stack
The future of embedded travel may therefore look less like a collection of individual products and more like an interconnected technology stack.
At one layer is connectivity across hundreds of networks and destinations. Another layer provides local and MVNO services. Above that sits an ancillary ecosystem covering airport and travel services.
APIs, SDKs, widgets, microsites and conversational channels such as WhatsApp can then connect these capabilities to banks, fintechs, OTAs, airlines and other customer-facing businesses.
For the enterprise, the value lies in being able to access this infrastructure through a single technology relationship.
The broader shift is significant: connectivity is moving from being something a traveler purchases separately to something that can become part of the digital products and services they already use.
As fintech and travel continue to converge, the companies building the infrastructure behind that experience will play an increasingly important role in determining how seamless international travel becomes.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
C:\>DIR Hackathon 2026 Winners Put Agentic AI to Work
September 30, 2026 | NCFA Market Activity | Artificial Intelligence And Data, Risk Compliance And Regtech, Cybersecurity And Fraud, Digital Identity And Trust, Payments And Money Movement, Digital Assets Blockchain And Tokenization
Agentic AI Hackathon Winners, Financial Supervision And The Next RegTech Layer
On September 30, 2026, the C:\>DIR Global ‘Agentic Regulator’ Hackathon announced its 2026 winners and finalist demos after attracting 942 individual builders and 336 team submissions from more than 65 countries. Thirty six teams reached the final prototype round, including 19 from or affiliated with regulatory authorities, with projects covering market manipulation, fraud, agentic payments, smart contracts, AI advice and digital identity.
NCFA supported the inaugural hackathon as an Ecosystem Partner. What makes the results notable is that both regulators and builders spent a week turning emerging questions around autonomous financial systems into working prototypes.
Every finalist submitted code or a working application for assessment. 260 verified regulators and policymakers from more than 80 institutions across 40+ countries then selected the Final 6, which presented their solutions to 18 senior global regulatory leaders at the C:\>DIR Summit in Cambridge.
The primary question propelling the competition was how do regulators supervise software that can act?
Market Risk, Fraud and Agentic Payments Winners
1. 🥇 Team Pheonix, Securities and Exchange Board of India (SEBI), won first place for its work on market manipulation, agentic herding and financial stability. Its digital twins and trading agents are designed to let authorities "pressure test" proposed regulations in a synthetic securities market before they take effect.
2. 🥈 YU-SAM POWER, University College London, took second place with an agentic framework for assessing smart contract risk and identifying attacks, supporting more consistent enforcement and international collaboration.
3. 🥉 Rwanda Anti-Scam Team, with participants from the National Bank of Rwanda, Bank of Namibia, Proto, FNA, GLEIF and the University of Manchester, placed third with a system that uses agents to report and recover funds lost through fraud and scams in instant payment environments.
4. Team Axiom, from the State Bank of Pakistan, placed fourth with a supervisory intelligence system for agentic payments designed to identify systemic risks including agentic herding.
5. Agent Reliability Profile, from the MLCommons Financial Services Working Group, placed fifth with a standardized, testable reliability label for AI agents. Its central question is straightforward. Can an AI agent be trusted?
6. Probe, from the UK, placed sixth with a regulatory tool that uses an “Adversary” agent posing as realistic customers and a “Judge” agent to run thousands of test conversations against AI advice systems and flag potential regulatory breaches.
The vouch.finance Award went to Legis Labs, whose Agent Passport gives banks a way to check an AI agent's authority before a payment executes. Project Zeus, from the Dominican Republic's securities regulator SIMV, received an Honorary Award for a human governed, multi agent approach to detecting investment scams, engaging suspected scammers and gathering evidence for enforcement.
The six finalists shared recognition from a US$100,000 total prize pool. The Final 6 were also given an opportunity to demonstrate their work at the Singapore FinTech Festival.
Agent Identity Is Becoming a Financial Control
The projects tackled different problems, but several requirements kept appearing.
If an AI agent sends money, a financial institution needs to know which agent acted, who authorized it and whether the action stayed within that authority. If multiple trading agents begin behaving alike, supervisors need visibility into whether that behaviour is creating market risk. If an AI adviser gives unsuitable guidance, there needs to be an auditable record of what happened and where human oversight applied.
That helps explain why agent identity, traceability, auditability, human oversight and pre execution controls feature across so many of the finalist projects.
These aren't abstract governance principles once agents start touching payments, markets or regulated advice. They become operating requirements.
The six challenge areas made the same point from different directions:
- AI driven fraud and scams
- Agentic payments and commerce
- Decentralized market infrastructure and smart contracts
- Know Your Agent and digital verification
- Market manipulation and agentic herding
- AI enabled financial and high stakes advice
A New RegTech Layer Is Starting to Emerge
The commercial question is what happens after the prototype.
Putting these systems into production will require real data, cybersecurity controls, privacy safeguards, legal authority, model governance, procurement and integration with existing supervisory infrastructure. Cross border applications add another layer because an agent may operate across multiple firms, payment systems and jurisdictions.
That's where the opportunity becomes more interesting.
RegTech has traditionally focused on helping financial institutions interpret rules, monitor activity and demonstrate compliance. Agentic supervision creates another market for technology that helps regulators simulate markets, verify AI agents, monitor autonomous activity, test financial advice and investigate fraud.
Canada already has active policy and infrastructure work across AI, payments, digital identity, fraud and financial market oversight. Canadian fintech and RegTech companies working in these areas should be watching which of these prototypes move into pilots, standards or production environments.
NCFA covered the launch of the C:\>DIR Agentic Regulator Hackathon in July. The winners now provide an early view of what builders and regulators chose to build when given a defined supervisory problem, sandbox environments and a week to produce working solutions.
Strategic Takeaway
The interesting result isn't simply that regulators used AI at a hackathon. It's what they built.
They built systems to test markets, identify fraud, verify agent authority, monitor payments, assess smart contract risk and scrutinize AI generated advice.
As financial systems add more autonomous actors, the supervisory layer will have to become more capable too.
Agentic finance may require agentic supervision. The C:\>DIR Hackathon has now put some early working examples on the table.
Explore: C:\>DIR Hackathon 2026 winners, presentations and demos
Read: Official C:\>DIR Global Agentic Regulator Hackathon winners announcement
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
BTQ Signs Kaia Deal for Post Quantum Stablecoin Security
September 30, 2026 | NCFA Market Activity | Digital Assets Blockchain And Tokenization, Cyber Security And Quantum, Payments Infrastructure And Money Movement
Three Year Kaia Agreement, Transaction Fees And Unifi Distribution
On September 30, 2026, Vancouver based BTQ Technologies signed a three year commercial agreement with Kaia DLT Foundation to deploy its Quantum Secure Stablecoin Network (QSSN) across Kaia's blockchain infrastructure. BTQ will receive a share of fees from transactions protected by the system and expects six figure U.S. dollar revenue in the first year, although actual revenue will depend on transaction volume.
In May, NCFA said BTQ still needed paid QSSN deployment and recurring revenue to prove the model commercially. The company had already processed blockchain transactions and worked with Finger and iM Bank on post quantum stablecoin infrastructure, but it hadn't disclosed signed recurring deployment terms. While the company hasn't disclosed a production launch date, the Kaia deal now provides that missing piece.
Post Quantum Protection At Kaia's Infrastructure Layer
BTQ's technology adds post quantum protection to blockchain accounts and transaction infrastructure without requiring every wallet, stablecoin or application to be rebuilt. Kaia, like other blockchain networks, relies on public key cryptography to authorize transactions. A sufficiently powerful future quantum computer could weaken some of that cryptography, although today's quantum computers aren't known to have that capability. Post quantum migration is already underway because replacing cryptography across financial infrastructure can take years.
BTQ combines existing transaction security with post quantum signatures rather than replacing the blockchain. Its system uses cryptography based on NIST post quantum standards while remaining compatible with existing blockchain infrastructure.
Kaia says the protection will operate at both the account and infrastructure level. Stablecoins are a practical starting point because they combine transferable value, digital wallets, long lived transaction records and growing use in payments and settlement. Kaia and Unifi already support stablecoins including USDT, Japan’s JPYC and Indonesia’s IDRP. BTQ says QSSN can protect those assets at the account level without requiring each issuer to build a separate integration.
The bigger commercial point is how BTQ gets paid. Rather than relying only on integration or licensing fees, the three year agreement gives BTQ a share of fees from protected transactions. If usage grows, security revenue grows with it. That turns QSSN from a technical capability into infrastructure with recurring transactional revenue.
Canada is already preparing for this migration problem. The Canadian Centre for Cyber Security requires federal organizations to start planning now, complete migration of high priority systems by the end of 2031 and move remaining systems by the end of 2035. Financial infrastructure faces the same issue across payments, identity, custody and digital assets, where systems may remain in service for many years.
Unifi Gives BTQ A Consumer Distribution Route
LINE NEXT launched Unifi as a global stablecoin wallet in March 2026, with deposits, transfers, payments and rewards available through LINE Messenger. That gives BTQ a path from blockchain infrastructure into consumer stablecoin use rather than another stand alone technology pilot.
For those who don't know, LINE is one of Asia’s largest messaging platforms, with major user bases in Japan, Taiwan and Thailand. LINE NEXT launched Unifi on Kaia in March 2026, giving BTQ a route from blockchain infrastructure into consumer stablecoin use through LINE Messenger.
See: Quantum Bridge Raises USD $8M For Quantum Security
BTQ and Kaia point to potential reach of more than 250 million people across the LINE and Kakao ecosystems. That is the size of the connected consumer networks, not 250 million Unifi or BTQ users. Unifi is expected to be among the first consumer applications to benefit as the Kaia deployment rolls out.
BTQ had already shown the technology working in earlier Korean pilots and reported more than 100,000 mainnet transactions in the second quarter. What was missing was recurring customer revenue. In August, BTQ was still discussing a possible production deployment with Kaia. Six weeks later, the parties signed a three year commercial agreement tied to transaction activity.
Talking Point
The question now is whether post quantum security can generate recurring infrastructure revenue before quantum risk becomes urgent. Transaction volume and recognized revenue will show whether that model works beyond pilots.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
[OSC Webinar Oct 15]: Capital Raising Opportunities and Regulatory Innovation in Ontario
September 29, 2026 | NCFA Event Spotlight | Capital Formation And Venture Markets, Regulation And Policy, Competition And Market Structure
October 15 Session, Financing Limits And Issuer Rule Reviews
On October 15, 2026, the Ontario Securities Commission will host Capital Raising Opportunities and Regulatory Innovation in Ontario, a 90 minute webinar on how businesses can raise capital across Ontario's private and public markets. The session comes while the OSC is looking at where companies encounter financing gaps or regulatory obstacles as they move from startup through maturity.
The webinar runs from 10:00 to 11:30 a.m. Eastern with the OSC staff covering the Listed Issuer Financing Exemption (LIFE), the Well Known Seasoned Issuer (WKSI) regime, prospectus exemptions, streamlined reporting requirements and cross border capital raising arrangements with regulators in France and Hong Kong. A final panel focuses on how evidence from issuers, founders, dealers, investors and advisors informs OSC capital formation initiatives.
Event Overview
Event: Capital Raising Opportunities and Regulatory Innovation in Ontario
Host: the Ontario Securities Commission
Date: October 15, 2026
Time: 10:00–11:30 a.m. ET
Format: Webinar
Registration: Register for the OSC webinar
Agenda
- 10:00–10:15: Ontario capital markets, trends and the OSC's role, with Chief Economist and VP Paul Redman
- 10:15–10:45: LIFE, WKSI, prospectus exemptions, streamlined reporting and cross border capital raising, led by Corporate Finance VP Marie-France Bourret and moderated by McMillan partner Leila Rafi
- 10:45–11:15: Accessing growth capital and how market evidence informs OSC initiatives, with Economic Growth and Innovation VP Benjamin Matthews and Trading and Markets Senior Legal Counsel Gloria Tsang, moderated by Blakes partner Christopher Jones
- 11:15–11:30: Audience Q&A
LIFE, WKSI And Growth Capital On The Agenda
The agenda covers several points where financing can become easier or more difficult as a company grows. LIFE gives eligible listed issuers a lighter route to public capital. WKSI can simplify access for larger, established issuers. Prospectus exemptions provide other routes, while streamlined reporting can affect how much time and money companies spend meeting securities requirements.
LIFE provides a useful example of why regulatory design matters. In May 2025, regulators expanded Canada's Listed Issuer Financing Exemption, raising the financing limit from C$10 million to C$25 million, or as much as C$50 million for larger issuers, subject to conditions. Hundreds of issuers subsequently raised about C$3.7 billion during the first year under the higher limits, roughly eight times the previous pace.
The CSA is now proposing to make those higher limits permanent, with comments due October 21. Higher limits don't prove that regulation caused every additional financing, but issuers clearly used the added capacity. That gives the OSC webinar a concrete example to work from when discussing which rules facilitate capital raising and which may constrain it.
The international agreements with France and Hong Kong add another angle. For companies capable of raising beyond Canada, the issue isn't only how much capital is available domestically. It is also how efficiently an Ontario issuer can reach investors and markets elsewhere without duplicating unnecessary regulatory work.
Where Does Financing Stop Working For Growing Companies?
The OSC's Office of Economic Growth and Innovation is looking across the financing continuum rather than at one exemption or company stage. An early stage company may raise its first outside capital and still struggle when it needs a much larger round. A listed company may have more financing routes but face costs, disclosure requirements or eligibility rules that make some of them impractical.
Canada's recent SME financing gaps evidence shows why formal access and usable access aren't always the same thing. A funding route can exist and still fail to meet the size, cost or timing a growing company needs.
Canada's recent SME financing gaps evidence shows why formal access and usable access aren't always the same thing. A funding route can exist and still fail to meet the size, cost or timing a growing company needs.
Equity crowdfunding offers a specific example. Canada's NI 45-110 startup crowdfunding exemption remains capped at C$1.5 million over 12 months, while NCFA has advocated a C$5 million or higher issuer cap for years. Recent Canadian offerings have also pushed close to the existing C$1.5 million ceiling.
Other markets allow substantially larger raises.
- The EU crowdfunding regime permits up to €5 million over 12 months, while the EU's wider prospectus exemption now reaches €12 million, although member states can apply a €5 million threshold instead. EU crowdfunding and prospectus thresholds provide the regulatory detail.
- In the U.S., Regulation Crowdfunding permits up to US$5 million over 12 months.
- The SEC is also considering a petition to change Regulation Crowdfunding limits, while its separate 2026 Regulation Crypto Assets proposal would create tailored exemptions of up to US$5 million over four years and US$75 million in any 12 month period for certain crypto investment contracts.
The OSC hasn't included equity crowdfunding as part of the webinar, but the Canadian investment crowdfunding issuer cap illustrates the policy question well. When does a financing limit become too low for a growing company and push it toward a more expensive way to raise capital?
The 10:45 panel should be especially relevant for founders, issuers, dealers and funding platforms. The OSC says it will discuss how stakeholder feedback, market intelligence and data influence targeted initiatives. Useful questions include where the regulator sees the largest gaps between startup, private growth and public markets, which requirements materially affect access to capital, and what evidence it needs before changing a rule.
Capital Raising Rules Are Already Under Review
The October 15 session lands in the middle of two live regulatory discussions. The proposed LIFE amendments close for comment on October 21. A separate CSA review, open until November 13, considers public company regulation including issuer classification, financial reporting requirements, private placement hold periods and material change reporting.
Neither process means the OSC has decided that particular rules should change. They do show that regulators are comparing existing requirements with how companies actually raise capital, while the OSC is gathering evidence about financing friction at different stages of growth.
More Reading:
- Almost $4 Billion Shows What Lower Securities Friction Can Do — what happened after higher LIFE limits took effect
- UK Crowdfunding Caps Lift As EU Pushes €12M — larger overseas fundraising limits and the case for revisiting Canada's C$1.5 million crowdfunding ceiling
- Can Canada Turn Access Into Productive Participation? — whether wider financial market access is translating into usable capital and economic growth
- Canada's C$14T Non Bank Financial System Opens Up — how Canada's large pool of non bank financial assets connects with wider market access and competition
Talking Point
Ontario already gives companies several ways to raise capital. The question is where those options stop working as a company grows. Sometimes the problem is investor demand or business risk. Other times, financing limits, costs or regulatory requirements may be getting in the way. The October 15 discussion should help show where the OSC sees those problems and what evidence might support a change.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Shopify Opens WebMCP Checkout to AI Agents
September 29, 2026 | NCFA Market Activity | Artificial Intelligence And Data, Payments Infrastructure And Money Movement, Venture Funding And Building
Buyer controlled checkout access for browser AI agents
On September 28, 2026, Shopify expanded WebMCP checkout support, allowing compatible AI browser agents to read and update eligible checkouts and submit orders after buyer approval. The Ottawa based commerce company now lets software agents move beyond product discovery and cart management into checkout itself, while keeping purchase approval and payment authority under separate controls.
Shopify already exposes product search, store browsing and cart functions to agents. Checkout is an important addition because the software can now move from helping someone shop to executing a real transaction. Can the agent spend on its own? No. Shopify still separates what the agent can do inside checkout from what the customer can authorize and what the payment provider will accept.
Shopify says millions of businesses in more than 175 countries use its commerce infrastructure, which processed US$378 billion in gross merchandise volume in 2025. A Canadian company operating at that scale is now helping define how software agents enter commerce without turning access to checkout into open authority over a customer's money.
Shopify Opens Checkout Functions To AI Agents
WebMCP lets a website expose specific functions directly to a compatible browser agent. Instead of inspecting a page and trying to work out which field or button to use, the agent can see the actions Shopify makes available and the information each action requires. It improves transaction reliability because checkout needs predictable actions and an accurate view of the order, while product discovery can tolerate more browser trial and error.
Shopify first exposed WebMCP tools for storefronts on August 5, 2026, letting agents search products, browse stores, manage carts and take shoppers to checkout. The September release extends that access so the agent can read the current checkout, update supported information and submit the order after the customer approves it. Contact details, fulfillment choices, discounts and some payment information can be changed, while the agent and customer continue working from the same checkout state.
Access isn't universal though. Shopify excludes several flows, including B2B checkout, embedded checkout, draft orders, order edits and payment collection. Standard three page checkout is also excluded unless the customer uses Shop Pay. Merchants do not need to install a separate WebMCP app for eligible sessions, giving Shopify a way to expose agent access through infrastructure merchants already use rather than requiring a new integration for every AI shopping service.
Browser WebMCP also differs from Shopify's server based commerce tools. WebMCP operates inside the shopper's open browser tab, while Checkout MCP lets an agent service interact with checkout from its own server. Both use Shopify's Universal Commerce Protocol checkout model. Shopify is turning parts of checkout into functions software can call directly while retaining control over which functions it exposes.
Buyer Approval And Payment Authority Remain Separate
If an agent can operate checkout, who controls the purchase? Shopify requires the customer to review the current order and total before the agent can submit it. If the amount changes, the agent has to ask again. Permission therefore applies to the transaction the customer sees, not to an open instruction that allows the agent to keep spending.
Shopify also keeps agent identity separate from purchase authority. Web Bot Auth can identify a registered agent, but recognition doesn't provide the software permission to place an order. Payment access is even more narrow. Checkout WebMCP doesn't accept new card details. An eligible saved Shop Pay card can be selected, while other payment methods or authentication steps may return control directly to the customer. Shop Pay login and 3D Secure are examples.
The transaction is controlled by several parties. Shopify decides what the agent can do inside checkout, the customer decides whether the current purchase should proceed, and the payment provider decides whether the credential can be used and whether more authentication is required. That separation between agent identity and financial authorization becomes more important as AI agents evolve from recommending products to initiating real transactions.
In September, Mastercard, Flybits and Rogers Bank demonstrated an AI shopping assistant completing a card purchase after the customer supplied buying instructions and a spending limit. Mastercard Agent Pay operates around the credential, agent identity and instructions attached to the payment. Shopify controls what the agent can do inside merchant checkout.
Are Shopify and Mastercard trying to own the same part of agent commerce? Not really. One controls access to the merchant transaction. The other operates where payment credentials and authorization take over. As AI performs more of the purchase, those separate control points become easier to see.
Shopify Can Lose Discovery Without Losing The Transaction
If shopping assistants become easy to reproduce, more valuable infrastructure may develop around checkout access, agent identity, payment credentials, spending limits, merchant restrictions, fraud controls and records showing who approved what. A founder doesn't need to build another shopping assistant to participate in agent commerce. There are products to build between the assistant and the transaction.
See: Circle Builds USDC Payment Infrastructure for AI Agents
Discovery, checkout, credential use and authentication don't have to belong to one company. Different providers can control each function, which makes the handoffs commercially important. Companies that become difficult to remove from those handoffs may capture value even if consumers rarely recognize their names.
Product discovery may happen inside ChatGPT, Gemini, Copilot or another agent rather than on a merchant storefront. Does that weaken Shopify's position? It can reduce Shopify's control over the first interaction, but the transaction can still reach Shopify checkout, merchant systems and payment infrastructure. Shopify can remain part of the economic relationship even when another platform owns the conversation that starts the purchase.
Talking Point
Structured agent access also creates another route into checkout without requiring every AI system to interpret the storefront visually. The commercial evidence is still early, but the technical capability now exists. The market still has to prove whether consumers want agents doing enough purchasing to create a significantly different commerce channel and whether merchants see enough value to change how they manage sales, fraud and customer relationships.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
