Karsten Wenzlaff, Advisor
August 26th, 2025
July 20, 2026 | NCFA Resource | Cybersecurity And Fraud, Risk Compliance And Regtech, Capital Markets And Market Infrastructure

On July 15, 2026, the Canadian Securities Administrators published new cybersecurity guidance for registered dealers, advisers, and investment fund managers (Download the 12 page PDF report). CSA Staff Notice 33-322 combines findings from a focused review of 73 firms with practical expectations for policies, employee training, risk assessments, third party oversight, and incident response.
The notice is most useful as a compliance review tool. Firms can compare their written controls, operating practices, and supporting records against the deficiencies and effective practices identified by securities regulators. The guidance is particularly relevant for smaller and medium sized firms that may not have dedicated cybersecurity teams.
The notice organizes cybersecurity readiness around five areas that regulators examined under section 11.1 of National Instrument 31-103:
The review found useful benchmarks. 8% of firms had no written cybersecurity policies, while 55% had policies that needed improvement. Twenty one per cent provided no employee cybersecurity training. Forty five per cent completed risk assessments that could have been stronger, and 12% had no documented assessment during the review period.
Third party oversight was one of the clearest weaknesses. All examined firms used service providers with access to systems or data, but 62% had no documentation or limited documentation supporting their cybersecurity oversight. The CSA expects firms to complete and document due diligence before onboarding a provider and repeat that review throughout the relationship.
The guidance identifies information firms should assess, including data storage, encryption, access controls, patch management, incident notification, subcontractors, operating jurisdictions, and shared responsibility in cloud environments. It also recommends maintaining a complete vendor register and reviewing current SOC 2 or similar reports where available.
Incident preparedness also receives detailed attention. Fifteen per cent of firms had no written incident response plan. Among firms with a plan, 53% needed stronger procedures and 63% should have tested their plans more regularly. The notice describes tabletop exercises and simulated attacks as practical ways to test whether people, processes, and technical controls work together during an incident.
The primary audience is firms registered as dealers, advisers, portfolio managers, investment fund managers, exempt market dealers, and restricted portfolio managers. Chief compliance officers, directors, technology leaders, privacy professionals, and internal audit teams can use the notice to organize a control review and identify missing documentation.
Boards and senior executives can also use it to test whether cybersecurity oversight is tied to clear responsibilities, regular reporting, and evidence that controls operate as intended. Written policies alone aren’t enough when actual practices, testing schedules, or access controls differ from the documented process.
Cybersecurity consultants, legal advisers, insurance providers, managed service providers, and software vendors can use the findings to better understand the records and evidence registered firms may need during a regulatory review.
The notice is strong because it combines regulatory expectations with observed deficiencies, percentages, effective practices, and practical takeaways. It covers both governance and technical controls, including multifactor authentication, encryption, backups, access rights, patching, email filtering, endpoint protection, and activity logging.
It also makes documentation a central requirement. Firms should be able to show when policies were reviewed, who completed training, how risks were assessed, what vendor due diligence occurred, and when incident plans or backup recovery procedures were tested.
The guidance does not create a complete technical cybersecurity standard, and it doesn’t replace obligations under privacy, securities, corporate, or other applicable laws. Expectations also vary with the firm’s size, operating complexity, client information, service provider reliance, and exposure to cyber risk.
Firms should therefore use the notice as a regulatory gap assessment and evidence checklist, then supplement it with appropriate legal advice, technical standards, testing, and controls suited to their operations.
CSA Staff Notice 33-322 (cybersecurity examination findings and guidance for registered firms)
CSA Staff Notice 33-321 (foundational 2017 cybersecurity and social media guidance)
NIST Cybersecurity Framework (risk management structure for identifying, protecting, detecting, responding, and recovering)
CIS Critical Security Controls (prioritized technical and operational safeguards)
Wealthsimple Confirms Breach Impacting Clients (third party exposure and incident response)
Proposed Class Action Targets Equifax Access Controls (access governance and third party permissions)
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
July 20, 2026 | NCFA Market Activity | Cybersecurity And Fraud, Artificial Intelligence And Data, Risk Compliance And Regtech

On July 20, 2026, Neo emerged from stealth with US$100 million in combined seed and Series A financing from Andreessen Horowitz, Bessemer Venture Partners, Craft Ventures and Merlin Ventures.
The Boston cybersecurity company was founded in 2025 by Nick Warner, Shlomi Salem and Eran Shirazi. Note that it's unrelated to Calgary based Neo Financial. Warner previously served as SentinelOne president and COO, Salem led detection engineering and threat research at SentinelOne, and Shirazi previously co-founded EasySend after leading vulnerability research in Israel’s Unit 8200.
Neo is building what it calls an agentic software control layer. The platform gives security teams an inventory of AI agents, AI enabled applications, plugins, extensions, MCP servers and traditional software that has gained agentic capabilities. It then maps permissions, attributes actions and applies policy before software reaches sensitive data or systems.
The company plans to use the financing to expand engineering and go to market operations. Neo hasn't disclosed revenue, customer counts, named customers, valuation or the allocation between its seed and Series A rounds.
Enterprise security was built around human users, known applications and recognizable data flows. AI agents can act differently. They may inherit a user’s permissions, call several tools, reach files and credentials, communicate with other agents and continue operating without a conventional interface.
That means risky activity may not even resemble a conventional intrusion. An agent can use valid credentials and approved applications while still exporting too much data, reading a secret, pushing code or initiating an action that exceeds the authority its operator intended to grant. NCFA’s analysis of AI agents gaining identity and wallet access shows how quickly this issue reaches financial APIs and real infrastructure.
Neo’s platform combines four functions. It finds AI software, checks what it can access, shows who or what is behind each action, and lets security teams allow, block or pause that action for approval.
Threat's aren't limited to deliberately malicious agents. ShadowLeak demonstrated how hidden instructions could manipulate an AI agent and expose private information without a user clicking a malicious link.
Its Neoverse knowledge base maps the capabilities, risks and behaviour of agentic software before it enters an enterprise environment. Neo says enforcement occurs natively at the endpoint, where the software can intercept tool calls, API access, credential reads and data transfers before the action is completed.
Neo combines software inventory, posture intelligence, attribution and endpoint enforcement across agentic and traditional applications.
Check Point is developing a wider AI security control plane covering employee AI use, AI applications and agentic systems.
SailPoint is extending identity governance to AI agents and other non-human identities.
Existing endpoint security providers already control devices, files and processes, but may not yet map the permissions and chained actions occurring inside agentic software.
Cloud and application security companies can govern models, APIs and data access, creating a competitive question around whether customers will buy a separate agentic control layer or expect existing security platforms to absorb the function.
Banks and other regulated organizations will need more than a list of approved AI tools. They need to know which person authorized an agent, what credentials it inherited, which systems it can call, what information it can export and when human approval is mandatory.
Neo’s opportunity is to show who or what can access each system and enforce clear limits on what they can do. Its challenge is that endpoint, identity, cloud and network security companies are all pursuing parts of the same problem. Large institutions may prefer one more specialized control layer, or they may demand that existing suppliers add agent governance to products already deployed across the organization.
Financial institutions are adopting AI while remaining accountable for privacy, cybersecurity, third party risk, operational resilience and auditability. An agent that can access customer information, initiate a payment, change code or communicate externally will need authority limits that security, risk and compliance teams can understand.
Neo has the capital and founding team to compete early, but the category is still forming. Enterprise adoption, integration depth and the quality of its policy enforcement will matter more than the size of the launch financing.
Will enterprises buy a dedicated control layer for agentic software, or will endpoint, identity and cloud security providers absorb the function before the category becomes independent?
Nick Warner, Shlomi Salem and Eran Shirazi founded Neo in 2025 to build security controls for enterprise software gaining autonomous and agentic capabilities.
Neo SecurityEnterprise cybersecurity company focused on agentic software
FormationExperienced operators assemble before the public launch
Early Institutional BackingSeed and Series A allocation not publicly disclosed
Enterprise SecurityAI driven software environments
SecOps TeamsLarge organizations adopting AI enabled software
Operator ExperienceFounders previously built and scaled enterprise security companies
Neo begins with founders who have built cybersecurity products and commercial organizations before. That lowers some execution risk, but it does not yet establish enterprise adoption.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
July 20, 2026 | NCFA Market Activity | Lending Consumer Credit And BNPL, Embedded Finance, Banking And Credit

On July 20, 2026, OnePay launched personal loans ranging from US$1,000 to US$50,000 through a new partnership with Upgrade. Eligible customers can check rates, review an offer, accept the terms and manage repayment without leaving the OnePay app.
OnePay is the consumer finance platform backed by Walmart and Ribbit Capital. Its app already offers banking, high yield savings, a digital wallet, credit cards, investing, crypto, credit building and point of sale lending. Customers who bank through OnePay may receive funds as soon as the same day. Annual percentage rates range from 7.74% to 35.99%, depending on eligibility.
Upgrade provides and services the loans, while Cross River Bank issues them. OnePay controls the app experience and customer distribution. That division of work gives OnePay a lending product without requiring it to build the full underwriting, funding and servicing operation internally.
Personal loans extend that relationship beyond everyday payments and retail financing. The new product is designed for debt consolidation, major purchases and unexpected expenses rather than financing a single transaction at Walmart checkout.
Point of sale lending helps complete a purchase. A personal loan gives OnePay a role in a customer’s wider balance sheet and monthly cash flow. A borrower may use the proceeds to refinance higher cost debt, fund a large expense or cover an emergency.
OnePay says the application can use information customers have already supplied, reducing repeated data entry. That may improve conversion, but it also makes data permissions and decision responsibilities more important. Customers need to understand which company holds their information, which institution makes the loan and who controls servicing or collection decisions.
The expansion follows OnePay’s work with Synchrony on a Walmart credit card program and Klarna on OnePay Later. Together, those products give the app several ways to serve consumers across everyday spending, retail financing, credit building and larger borrowing.
Upgrade brings the credit machinery behind the product. The company has delivered more than US$50 billion in credit to over 8 million customers since 2017 across personal loans, cards, buy now pay later, home improvement and auto financing.
For Upgrade, the OnePay agreement adds distribution through an app connected to millions of consumers and Walmart’s retail ecosystem. Instead of acquiring every borrower through its own brand, Upgrade can supply lending inside another company’s customer relationship.
This is the same operating structure seen across embedded finance. The distributor owns the interface and customer traffic, while a regulated bank and specialist technology provider supply the financial product behind it.
That structure can lower customer acquisition costs and shorten product development. It also creates dependencies. OnePay relies on Upgrade’s underwriting and servicing performance. Upgrade relies on OnePay to present the product responsibly and bring suitable borrowers into the funnel. Cross River Bank carries the regulated lending role.
OnePay combines Walmart linked distribution with banking, payments, rewards and credit inside one app.
Upgrade supplies underwriting, loan technology and servicing rather than requiring OnePay to build those capabilities.
SoFi offers personal loans inside a broader consumer finance relationship that includes banking and investing.
Robinhood is also extending beyond its original product into a wider lifestyle finance relationship spanning investing, credit, banking and rewards, although OnePay brings Walmart linked retail distribution rather than a brokerage led customer base. See NCFA’s analysis of Robinhood’s lifestyle finance strategy.
LendingClub competes in unsecured personal credit with a bank funded model and direct consumer acquisition.
Major banks already hold deposits and customer data, but may offer slower applications or less integrated digital experiences.
Personal loans could deepen OnePay’s role in customers’ financial lives, especially when borrowing, banking, payments and rewards sit inside the same app. Will the app's convenience produce durable trust rather than simply more credit volume is the question.
Pricing near the top of the 35.99% APR range carries the clearest risk. Approval may be fast, but repayment can become difficult when the loan is used for an emergency or to consolidate existing debt.
OnePay will also carry much of the reputational impact even when lending decisions and servicing sit with partners. Unclear terms, poor servicing or aggressive collections could affect how customers view the wider platform.
Canadian banks, retailers and fintechs face the same trade-off. Embedded lending through consented financial data could help companies add credit faster, but the business controlling the interface still needs to make pricing, data use, lender identity and repayment responsibility clear.
Can OnePay turn Walmart scale distribution into a primary consumer finance relationship, or will it remain a storefront for credit products supplied by banks and specialist lenders?
Angus McDonald and Chris Bayley founded Cover Genius after encountering fragmented insurance distribution while operating an online travel business. RentalCover became the first use case for combining digital distribution, policy administration and claims support.
RentalCoverRental vehicle protection distributed through digital booking platforms
LaunchA focused first product built around a clear travel use case
Founder LedEarly development preceded the company’s later institutional funding rounds
Travel And MobilityRental car bookings across multiple countries
Travel PlatformsOnline travel agencies and rental car booking businesses
Integrated ProtectionInsurance offered inside the booking flow rather than through a separate purchase
The first product mattered because it gave Cover Genius a practical route into a difficult market. The company learned the operating work before expanding the platform.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |