Netcoins is the first Canadian platform to go live on the infrastructure. The rollout builds on an existing relationship rather than starting from zero. BIGG Digital Assets invested in APX and announced the Netcoins partnership in May 2025, and Netcoins later added an in app lending page and calculator while the companies worked toward full integration.
The new launch turns APX’s securities law relief into infrastructure another Canadian platform can distribute. APX can now place its lending system behind a partner’s customer relationship rather than relying only on borrowers who arrive through its own channel.
Netcoins Keeps The Customer While APX Runs The Loan
Netcoins brings the app, customer relationship and regulated crypto trading channel. Netcoins became one of Canada’s early restricted dealer crypto platforms in 2021. It is owned by publicly traded BIGG Digital Assets, which combines Netcoins with blockchain analytics and compliance technology under a compliance first operating model.
APX runs the lending operation behind the interface. It supplies capital, reviews each application, performs the required account appropriateness assessment, manages collateral, handles servicing and monitors loan to value levels around the clock. APX or a wholly owned special purpose vehicle remains the lender under the loan agreement.
The partnership lets Netcoins add credit without creating its own lending balance sheet, underwriting team or collateral controls. APX gains distribution through an established Canadian platform, while Netcoins can add a new revenue line and give customers another reason to keep assets inside its ecosystem.
The model resembles other forms of embedded lending infrastructure, but the collateral is digital. The customer sees a loan inside a familiar platform even though a specialist provider operates the credit system behind it.
Collateral Rules Matter More Than A Fast Application
Netcoins’ lending page currently shows loans starting at C$10,000 or USDC 10,000, using Bitcoin or Ether as collateral. Terms can run for up to 60 months, and the displayed interest rate starts at 12.99%. Final terms and eligibility are determined during APX’s application process.
Borrowers can access Canadian dollars or USDC without a conventional credit check, but the loan is secured by crypto. If the collateral value falls, the loan to value ratio rises. APX can require more collateral or partial repayment and may liquidate assets when the applicable threshold is reached.
The April 2025 OSC decision permits APX to accept Bitcoin and Ether unless the principal regulator approves another asset. It also requires client disclosures, account appropriateness reviews and third party custody controls. The relief is time limited, expires three years after the decision and should not be treated as a general precedent for other lenders.
APX says collateral is held in segregated BitGo Trust cold storage, remains visible on chain and is not pooled, re-lent or rehypothecated. Customers should still understand that crypto collateral is not protected by the Canadian Investor Protection Fund and can be sold if the loan breaches its terms.
Competition Now Includes The Lending Layer
Netcoins adds crypto backed credit to trading, custody, staking and card products without building a lending operation internally.
Ledn operates a specialist Bitcoin backed lending business and has connected crypto loans with institutional funding markets.
Canadian crypto platforms that focus mainly on trading and custody may now need to decide whether lending belongs in their product mix.
Banks and fintechs could eventually use similar infrastructure if they want to offer digital asset secured credit without holding or operating the full crypto lending stack.
A Shared Interface Doesn't Remove Shared Responsibility
The commercial appeal is clear, but do users understand who is doing what?
Netcoins controls the experience, but APX approves and services the loan. Customers need clear information about the lender, collateral transfer, interest costs, margin notices, liquidation rules, data sharing and complaint handling before they apply.
Andrei Poliakov has followed this compliance first approach before. In a 2019 NCFA interview with Coinberry, he described the goal of building a trusted Canadian crypto business with supportive banking and long term operating discipline.
Coinberry was later acquired by WonderFi for C$38.5 million as regulatory costs encouraged consolidation. APX applies that experience to shared infrastructure that several platforms may be able to use rather than each one building a separate lending operation.
If the model performs well, APX could become a common lending layer behind several crypto platforms. If servicing, disclosures or liquidations create friction, the platform presenting the loan will share the reputational cost.
Talking Point
Will APX become the lending layer behind several Canadian crypto platforms, or will larger exchanges eventually build or acquire their own credit infrastructure?
NCFA Company Intelligence Snapshot
APX Lending
Regulated crypto backed lending and partner infrastructure for digital asset platforms
Last updated Jul 21, 2026
Company At A Glance
Founded2023 by Andrei Poliakov
HeadquartersToronto, Canada
StatusPrivate
Regulatory StructureTime limited securities law relief issued Apr 1, 2025
ProductsDirect crypto backed loans, private client lending and Lending as a Service
CollateralBitcoin and Ether in Canada
Loan CurrencyCanadian dollars and USDC
Funding CapacityC$20M accordion credit facility announced Oct 2025
CustodySegregated BitGo Trust cold storage
Milestones
Select a milestone to follow APX Lending’s development
1Formation2023
2US Expansion2024
3Regulatory ReliefApr 2025
4BIGG InvestmentMay 2025
5Credit FacilityOct 2025
6Embedded LaunchJul 2026
Milestone 1
APX Lending Is Founded (2023)
Andrei Poliakov founded APX Lending in 2023 after helping build Coinberry, one of Canada’s early regulated crypto trading platforms. APX focused on secured credit that lets borrowers access liquidity without selling Bitcoin or Ether.
Company
APX LendingCrypto backed lending built around regulated infrastructure
Stage
FormationA new lender develops after the Coinberry operating experience
Capital
Private FundingEarly financing details not publicly disclosed
Markets
CanadaA compliance first route into digital asset credit
Customers
Crypto HoldersIndividuals and businesses seeking liquidity without selling
Competition
Custody First LendingSegregated collateral and no rehypothecation
Additional Company Data
Poliakov previously co-founded and led Coinberry
The first product focused on loans secured by digital assets
APX developed proprietary loan and collateral management technology
Revenue and early funding remain private
NCFA Perspective
APX began with a founder who had already worked through Canadian crypto compliance, banking and custody challenges. The new company applied that experience to lending rather than another trading platform.
Milestone 2
US Lending And Netcoins Partnership Begin (2024)
APX expanded into the United States and signed a partnership with Netcoins USA. The companies began coordinating crypto backed lending and trading services before the Canadian embedded product was available.
Company
APX USThe lender extends beyond its Canadian base
Stage
Market ExpansionUS operations and partner distribution develop
Capital
Growth FundingExpansion capital not publicly separated by market
Markets
United StatesSelected state availability and institutional demand
Customers
Retail And BusinessBorrowers using crypto to secure liquidity
Competition
Cross Border ReachCanadian operating experience applied in a larger market
Additional Company Data
Netcoins USA announced an APX partnership in October 2024
The agreement combined preferred lending and trading access
APX reported more than US$100 million in prospective borrower interest after entering the US
The Canadian product still required a separate regulatory route
NCFA Perspective
The early Netcoins relationship shows that the 2026 Canadian launch came from a longer distribution strategy. APX was testing how lending and trading platforms could complement each other before full embedded infrastructure went live.
Milestone 3
Canadian Securities Law Relief Is Granted (Apr 2025)
The OSC granted APX time limited relief from dealer registration and prospectus requirements, with passport relief across Canada. The decision created a regulated framework for loans secured by Bitcoin or Ether.
Company
APX Inc.The Canadian lending entity covered by the decision
Stage
Regulatory ApprovalA time limited operating framework is established
Capital
Secured LendingLoans funded by APX or wholly owned SPVs
Markets
Across CanadaSubject to applicable provincial lending requirements
Customers
Individuals And BusinessesBorrowers complete an account appropriateness assessment
Competition
First Mover FrameworkThe decision is tailored to APX and is not a general precedent
Additional Company Data
The decision was issued April 1, 2025
Bitcoin and Ether are the approved collateral assets
At least 95% of qualifying collateral must generally remain with an acceptable third party custodian
The relief expires three years after the decision unless amended
NCFA Perspective
The order did more than permit a direct lending product. It created the compliance base APX later used to build lending infrastructure for other Canadian platforms.
Milestone 4
BIGG Invests And Netcoins Partnership Forms (May 2025)
BIGG Digital Assets invested in APX and connected the lender with Netcoins. The agreement paired APX’s secured credit operation with a regulated Canadian crypto distribution platform.
Company
APX And NetcoinsLending infrastructure meets regulated platform distribution
Stage
Strategic PartnershipInvestment and product planning begin
Capital
BIGG InvestmentInvestment amount not publicly disclosed
Markets
Canada And USCoordinated market development across both countries
Customers
Netcoins UsersTrading clients become a future lending audience
Competition
Platform DistributionAPX expands beyond direct customer acquisition
Additional Company Data
BIGG announced the investment on May 13, 2025
Netcoins is wholly owned by BIGG Digital Assets
The partnership followed APX’s April regulatory decision
Coordinated go to market activity was planned before full integration
NCFA Perspective
The investment aligned APX with both capital and distribution. Netcoins had an economic reason to help the lending product succeed before the infrastructure was fully embedded.
APX secured a C$20 million accordion credit facility from Cypress Hills. The facility increased the capital available for Canadian crypto backed loans and future partner programs.
Balance Sheet ScaleMore loans can be supported without relying only on equity
Capital
C$20M FacilityAccordion structure from Cypress Hills
Markets
CanadaFunding supports domestic loan growth
Customers
Retail And InstitutionalDirect borrowers and partner distributed loans
Competition
Funding CapacityReliable capital becomes part of the partner proposition
Additional Company Data
Cypress Hills is a private credit investment firm
The accordion structure can increase capacity under agreed conditions
Pricing, maturity and detailed covenants were not publicly disclosed
APX continued developing white label infrastructure during this period
NCFA Perspective
Embedded credit needs dependable capital as well as software. The facility strengthened APX’s ability to promise partners that approved loans could actually be funded.
Milestone 6
Netcoins Launches On APX Lending Infrastructure (Jul 2026)
APX launched its Canadian Lending as a Service platform with Netcoins on July 21, 2026. Eligible users can access crypto backed loans through the Netcoins app while APX runs the lending operation behind the experience.
Company
APX Lending as a ServicePartner branded crypto backed credit infrastructure
Stage
Commercial LaunchThe first Canadian platform goes live
Capital
APX SuppliedAPX provides the lending capital behind the program
Markets
CanadaRollout begins for eligible Netcoins users
Customers
Netcoins UsersBorrowers access liquidity without selling BTC or ETH
Competition
Embedded Credit LayerOther platforms can add lending without becoming lenders
Additional Company Data
Netcoins is the first Canadian platform live on the partner infrastructure
APX supplies underwriting, compliance, collateral management, technology and servicing
Loan terms and eligibility are provided during the APX application process
Commercial economics between APX and Netcoins were not disclosed
NCFA Perspective
The launch turns APX from a specialist lender into shared market infrastructure. The next test is whether other Canadian platforms adopt the same lending layer or build competing systems.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
July 20, 2026 | NCFA Story Intelligence | Regulation And Policy, Capital Markets And Market Infrastructure, Competition And Market Structure
How Ontario Finally Chose Canada’s Securities Passport
On July 15, 2026, Ontario Finance Minister Peter Bethlenfalvy announced that Ontario had committed to joining Canada’s securities regulatory passport system. The federal Finance Department highlighted the commitment following the federal, provincial and territorial finance ministers’ meeting in Charlottetown, ending almost two decades as the only jurisdiction outside the system.
Finance ministers described the decision as regulatory harmonization, removal of an interprovincial trade barrier and progress toward one Canadian economy. It also resolved a contradiction Ontario had carried for years. The province repeatedly documented duplication, delay and disproportionate compliance costs while continuing to require a separate Ontario decision where most of Canada relied on one principal regulator.
Ontario stayed outside because passport was never the prize it wanted. The province backed a single national regulator, then a cooperative authority with a wider institutional redesign. The first model failed in court. The second survived legally but never opened.
Companies carried the cost of waiting. Equity crowdfunding showed what fragmentation did at company level. A financing model designed to connect issuers and investors online became a provincial compliance exercise that excluded supporters, consumed employee time and made some smaller raises uneconomical.
The story isn’t that Ontario suddenly discovered regulatory friction in 2026. Every alternative gradually weakened while the economic cost of maintaining a separate process became harder to defend.
Canada has one capital market but several securities authorities. Each province and territory retains its legislation, regulator and enforcement powers. The Canadian Securities Administrators develops common instruments, policies and filing systems so companies don’t face entirely different frameworks in every jurisdiction.
Coordination reduces differences without eliminating repeated work. A filing, interpretation, fee or local review may appear reasonable on its own. A company raising capital or operating nationally experiences the accumulated cost through the same legal budget, employees and management time needed to build the business.
Passport Offers A Practical National Compromise2004
Passport gives one principal regulator the leading role in reviewing a company while participating jurisdictions rely on that decision. Provincial laws, commissions and enforcement remain in place. The system reduces repetition without creating one national regulator.
Most jurisdictions accept mutual reliance. The principal regulator can develop familiarity with the company, conduct the main review and issue a decision recognized elsewhere. The market gains a national operating mechanism without requiring provinces to surrender jurisdiction.
Ontario remains outside the compromise. An interface arrangement connects it to passport jurisdictions, but companies can still require a separate Ontario decision to access Canada’s largest capital market. The additional step remains while Ontario pursues a more ambitious institution.
Ontario Chooses Institutional Ambition Over Immediate Relief2004 to 2011
Ontario backs a single federal regulator with authority over ordinary securities regulation. The larger proposal promises one statute and one institution, but companies continue paying for the existing provincial structure while governments test whether the new model is constitutional.
The federal proposal reaches far beyond passport. The Canadian Securities Act would place registration, prospectuses, disclosure, derivatives, civil remedies and market offences within one federal regime. Ontario supports a structure that could replace the provincial coordination model rather than simply improve it.
The constitutional loss leaves Ontario without its preferred destination. In 2011, the Supreme Court rejected the proposed Act because Parliament couldn’t assume ordinary provincial securities regulation through its general trade and commerce power. Ontario loses the national model but still doesn’t join passport.
The National Project Survives By Becoming Harder To Build2011 to 2018
Governments redesign the national regulator around voluntary provincial participation. The compromise preserves provincial authority and survives in court, but implementation now depends on several governments aligning legislation, governance, funding and institutional transfers.
The cooperative model fixes the constitutional problem. Participating provinces would enact uniform laws administered by a common authority, while complementary federal legislation would address systemic risk and national criminal matters. Each legislature remains free to join, amend or leave.
Legal approval cannot assemble the institution. The Supreme Court approved the design in 2018, but major provinces remain outside and implementation dates recede. The first model fails because it takes too much provincial authority. The second preserves authority so carefully that no common regulator opens.
Companies Pay While Governments Keep Designing2013 to 2021
Equity crowdfunding turns regulatory fragmentation into a company level loss. A financing model designed to reach investors online is divided by provincial exemptions, portal requirements and investor limits before the market can prove its economics.
Why Small Financings Feel Fixed Costs First
Legal advice, audited or reviewed statements, portal controls and continuing disclosure don’t decline in proportion to the amount raised. The smaller the financing, the larger the share consumed by fixed compliance costs.
Large institutions can spread those costs across more transactions and revenue. Young issuers and new platforms can’t. A requirement that appears manageable in isolation can make a modest financing uneconomical when combined with every other obligation.
Investor protection still requires disclosure, gatekeeping and enforcement. The policy question is whether those safeguards can be delivered without preventing legitimate companies from testing the market.
The losses appear outside ordinary regulatory statistics. No portal initially registers under MI 45-108. More than 100 startups reportedly lose economical access to Ontario supporters, while one small firm assigns two employees for months to historical compliance work. The underlying record is available in March 1, 2019: NCFA Submission to the Ontario Securities Commission on Regulatory Burden. NI 45-110 harmonizes the market in 2021, but it cannot recover the financing, participation and productive work already lost.
Ontario Diagnoses A Burden It Cannot Remove Alone2017 to 2019
Ontario turns from defending its framework to documenting its friction. The review confirms that repeated filings, unclear expectations and disproportionate requirements are not isolated complaints. It also exposes the limit of reform inside one provincial regulator.
The OSC confirms a pattern rather than a few difficult files. It receives 199 suggestions and identifies 34 underlying concerns, including repeated filings, difficult regulatory navigation, unclear service expectations, outdated technology and requirements that fall more heavily on smaller firms.
The response reveals the jurisdictional limit. The OSC announces 107 initiatives to improve service and remove avoidable work. Related NCFA coverage: OSC Makes Doing Business Easier for Ontario Market Participants. Ontario can improve its own processes, but it cannot eliminate national duplication while continuing to require a separate Ontario decision.
Ontario Modernizes Without Completing The Modernization2020 to 2023
Ontario accepts that the problem is structural. The Capital Markets Modernization Taskforce proposes a wider reconstruction, but only part of the 74 recommendation program becomes reality.
Ontario divides authority inside the OSC while preserving duplication outside it. Capital formation and competition enter the mandate, the Chair and CEO roles are separated and adjudication is placed within a distinct tribunal. The proposed Capital Markets Act does not replace the existing statutes, and no public tracker supports a claim that the complete 74 recommendation program was implemented.
The Alternative Disappears While The Extra Process Remains2021 to 2024
The cooperative regulator stops looking like a credible replacement. Ontario is left defending a separate process after the institution used to justify that position recedes.
The cooperative transition project winds down without transferring authority. Existing commissions remain responsible, the CSA continues coordinating national policy and passport keeps serving the jurisdictions that joined it. The practical system survives while the ambitious replacement recedes.
Ontario’s holdout loses its destination. The province is no longer choosing between passport and an approaching national regulator. It is choosing between passport and continued duplication with no replacement institution in sight. The original reason for waiting has disappeared, but companies still face the additional process.
Canada Breaks The Glass On Productivity2024 to 2026
Regulatory duplication stops looking like a tolerable feature of federalism. It becomes labour, capital and company capacity an economy with weak investment and productivity can no longer afford to waste.
The Bank of Canada turns weak productivity into an emergency. In March 2024, Senior Deputy Governor Carolyn Rogers says it is time to break the glass. Weak investment, limited competition and lengthy or unpredictable approvals discourage companies from committing capital.
Ontario’s separate review becomes part of the economic diagnosis. Every repeated filing, legal opinion and approval cycle uses the same employees, financing and management attention needed for technology, customers and expansion. Related NCFA coverage: How Competition Powers Canada’s Economic Growth. Passport doesn’t remove scrutiny. It prevents several regulators from consuming company resources to deliver substantially the same protection.
The cost of duplication is no longer only regulatory. It is productive work that doesn’t happen.
Ontario Chooses The System That Outlasted The AlternativesJuly 15, 2026
Ontario doesn’t obtain the single national regulator it once sought. It accepts the working national compromise that remained in place while larger institutional projects stalled. Bethlenfalvy said participation would advance regulatory harmonization while maintaining investor protection and that he had directed the Ontario Securities Commission to build on discussions for Ontario’s full participation.
What Ontario Still Needs To Clarify
When will Ontario formally enter the passport system?
Which registration, prospectus and discretionary relief decisions will qualify?
Which duplicate filings, reviews and approvals will end?
How will active applications be treated during the transition?
What legislative, policy and systems changes will be required?
What service standards and performance measures will be published?
How will Ontario measure effects on smaller issuers and registrants?
How will investor protection and enforcement quality be preserved?
Ontario gives up duplication rather than jurisdiction. One principal regulator can conduct the main review while Ontario retains its legislation, commission, enforcement capability and voice in national policy. The province no longer has to choose between complete institutional control and surrendering its capital market.
The political commitment now faces an operating test. Industry advocates said passport can create a “single regulator experience through a principal regulator,” but harmonization in policy must also deliver harmonization in practice across legislation, policy and regulatory operations. Investment Executive reports the implementation direction and industry response. The strongest evidence of success will be fewer repeated reviews, lower compliance costs and faster interprovincial access while maintaining investor protection.
The Practical System Outlasts The Perfect One
Ontario’s decision closes a long loop in Canadian capital markets policy.
The province rejected passport because it wanted a more ambitious national regulator. The first version failed constitutionally. The cooperative version survived in court but never became operational. Ontario then documented extensive burden inside its own market, implemented selected modernization reforms and continued requiring a separate provincial process after the national alternative receded.
Equity crowdfunding showed what the delay meant for companies. The market was divided before it could mature nationally. Legal work, platform controls and continuing obligations consumed a large share of modest financings. Investors were excluded by geography. Employees were assigned to compliance work instead of customers and growth.
The productivity emergency raised the stakes. Canada cannot describe weak investment, limited competition and poor productivity as urgent while treating avoidable duplication as institutionally harmless. The same capital and employee time cannot be used twice.
Passport is not a single national regulator, and it does not eliminate provincial authority. Its value is practical. One qualified regulator does the principal work while the others rely on the result.
Ontario didn’t suddenly discover regulatory friction in 2026. It gradually accepted that preserving every layer of control carried an economic cost that internal reform and an unfinished national project had not removed.
The Commitment Is Only The Beginning
Ontario should publish an implementation schedule, identify the decisions covered by passport and report whether review periods, professional costs and duplicate regulatory interactions decline. Results for smaller firms should be reported separately because they carry fixed compliance costs most heavily.
Investor protection remains central. Reliance should remove repetition, not scrutiny. Principal regulators need the information, expertise and authority required to make decisions every participating jurisdiction can trust.
The larger question extends beyond securities regulation. Canada often pursues national economic outcomes through provincial institutions. Governments may continue debating the ideal architecture, but companies shouldn’t be required to finance avoidable friction while they wait.
Talking Point
When governments measure regulatory burden, should they count only compliance expenses that appear on company records, or also the financings, investment and productive work that never occur because the combined process makes them uneconomical?
Share this story → Explore related intelligence → Subscribe
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
The notice is most useful as a compliance review tool. Firms can compare their written controls, operating practices, and supporting records against the deficiencies and effective practices identified by securities regulators. The guidance is particularly relevant for smaller and medium sized firms that may not have dedicated cybersecurity teams.
What It Does In Practice
The notice organizes cybersecurity readiness around five areas that regulators examined under section 11.1 of National Instrument 31-103:
written cybersecurity policies and procedures
employee cybersecurity training
cybersecurity risk assessments and controls
oversight of third party service providers
written and tested incident response plans
The review found useful benchmarks. 8% of firms had no written cybersecurity policies, while 55% had policies that needed improvement. Twenty one per cent provided no employee cybersecurity training. Forty five per cent completed risk assessments that could have been stronger, and 12% had no documented assessment during the review period.
Third party oversight was one of the clearest weaknesses. All examined firms used service providers with access to systems or data, but 62% had no documentation or limited documentation supporting their cybersecurity oversight. The CSA expects firms to complete and document due diligence before onboarding a provider and repeat that review throughout the relationship.
The guidance identifies information firms should assess, including data storage, encryption, access controls, patch management, incident notification, subcontractors, operating jurisdictions, and shared responsibility in cloud environments. It also recommends maintaining a complete vendor register and reviewing current SOC 2 or similar reports where available.
Incident preparedness also receives detailed attention. Fifteen per cent of firms had no written incident response plan. Among firms with a plan, 53% needed stronger procedures and 63% should have tested their plans more regularly. The notice describes tabletop exercises and simulated attacks as practical ways to test whether people, processes, and technical controls work together during an incident.
Who Gets Value
The primary audience is firms registered as dealers, advisers, portfolio managers, investment fund managers, exempt market dealers, and restricted portfolio managers. Chief compliance officers, directors, technology leaders, privacy professionals, and internal audit teams can use the notice to organize a control review and identify missing documentation.
Boards and senior executives can also use it to test whether cybersecurity oversight is tied to clear responsibilities, regular reporting, and evidence that controls operate as intended. Written policies alone aren’t enough when actual practices, testing schedules, or access controls differ from the documented process.
Cybersecurity consultants, legal advisers, insurance providers, managed service providers, and software vendors can use the findings to better understand the records and evidence registered firms may need during a regulatory review.
Strengths And Limits
The notice is strong because it combines regulatory expectations with observed deficiencies, percentages, effective practices, and practical takeaways. It covers both governance and technical controls, including multifactor authentication, encryption, backups, access rights, patching, email filtering, endpoint protection, and activity logging.
It also makes documentation a central requirement. Firms should be able to show when policies were reviewed, who completed training, how risks were assessed, what vendor due diligence occurred, and when incident plans or backup recovery procedures were tested.
The guidance does not create a complete technical cybersecurity standard, and it doesn’t replace obligations under privacy, securities, corporate, or other applicable laws. Expectations also vary with the firm’s size, operating complexity, client information, service provider reliance, and exposure to cyber risk.
Firms should therefore use the notice as a regulatory gap assessment and evidence checklist, then supplement it with appropriate legal advice, technical standards, testing, and controls suited to their operations.
Key Resources
CSA Staff Notice 33-322 (cybersecurity examination findings and guidance for registered firms)
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
July 20, 2026 | NCFA Market Activity | Cybersecurity And Fraud, Artificial Intelligence And Data, Risk Compliance And Regtech
Former SentinelOne Leaders Build A Control Layer For Agentic Software
On July 20, 2026, Neo emerged from stealth with US$100 million in combined seed and Series A financing from Andreessen Horowitz, Bessemer Venture Partners, Craft Ventures and Merlin Ventures.
The Boston cybersecurity company was founded in 2025 by Nick Warner, Shlomi Salem and Eran Shirazi. Note that it's unrelated to Calgary based Neo Financial. Warner previously served as SentinelOne president and COO, Salem led detection engineering and threat research at SentinelOne, and Shirazi previously co-founded EasySend after leading vulnerability research in Israel’s Unit 8200.
Neo is building what it calls an agentic software control layer. The platform gives security teams an inventory of AI agents, AI enabled applications, plugins, extensions, MCP servers and traditional software that has gained agentic capabilities. It then maps permissions, attributes actions and applies policy before software reaches sensitive data or systems.
The company plans to use the financing to expand engineering and go to market operations. Neo hasn't disclosed revenue, customer counts, named customers, valuation or the allocation between its seed and Series A rounds.
Agents Can Operate Inside Trusted Permissions
Enterprise security was built around human users, known applications and recognizable data flows. AI agents can act differently. They may inherit a user’s permissions, call several tools, reach files and credentials, communicate with other agents and continue operating without a conventional interface.
That means risky activity may not even resemble a conventional intrusion. An agent can use valid credentials and approved applications while still exporting too much data, reading a secret, pushing code or initiating an action that exceeds the authority its operator intended to grant. NCFA’s analysis of AI agents gaining identity and wallet access shows how quickly this issue reaches financial APIs and real infrastructure.
Neo’s platform combines four functions. It finds AI software, checks what it can access, shows who or what is behind each action, and lets security teams allow, block or pause that action for approval.
Threat's aren't limited to deliberately malicious agents. ShadowLeak demonstrated how hidden instructions could manipulate an AI agent and expose private information without a user clicking a malicious link.
Its Neoverse knowledge base maps the capabilities, risks and behaviour of agentic software before it enters an enterprise environment. Neo says enforcement occurs natively at the endpoint, where the software can intercept tool calls, API access, credential reads and data transfers before the action is completed.
Competition Is Forming Around Agentic Security
Neo combines software inventory, posture intelligence, attribution and endpoint enforcement across agentic and traditional applications.
Check Point is developing a wider AI security control plane covering employee AI use, AI applications and agentic systems.
SailPoint is extending identity governance to AI agents and other non-human identities.
Existing endpoint security providers already control devices, files and processes, but may not yet map the permissions and chained actions occurring inside agentic software.
Cloud and application security companies can govern models, APIs and data access, creating a competitive question around whether customers will buy a separate agentic control layer or expect existing security platforms to absorb the function.
Financial Institutions Will Need Authority Maps For Agents
Banks and other regulated organizations will need more than a list of approved AI tools. They need to know which person authorized an agent, what credentials it inherited, which systems it can call, what information it can export and when human approval is mandatory.
Neo’s opportunity is to show who or what can access each system and enforce clear limits on what they can do. Its challenge is that endpoint, identity, cloud and network security companies are all pursuing parts of the same problem. Large institutions may prefer one more specialized control layer, or they may demand that existing suppliers add agent governance to products already deployed across the organization.
Financial institutions are adopting AI while remaining accountable for privacy, cybersecurity, third party risk, operational resilience and auditability. An agent that can access customer information, initiate a payment, change code or communicate externally will need authority limits that security, risk and compliance teams can understand.
Neo has the capital and founding team to compete early, but the category is still forming. Enterprise adoption, integration depth and the quality of its policy enforcement will matter more than the size of the launch financing.
Talking Point
Will enterprises buy a dedicated control layer for agentic software, or will endpoint, identity and cloud security providers absorb the function before the category becomes independent?
NCFA Company Intelligence Snapshot
Neo
Agentic software inventory, attribution and real time policy control for enterprise security teams
Last updated Jul 20, 2026
Company At A Glance
Founded2025 by Nick Warner, Shlomi Salem and Eran Shirazi
HeadquartersBoston, United States
StatusPrivate
Capital / FundingUS$100M across seed and Series A financing
InvestorsAndreessen Horowitz, Bessemer Venture Partners, Craft Ventures and Merlin Ventures
ProductsNeo platform and Neoverse agentic software knowledge base
CustomersEnterprise SecOps teams; named customers not publicly disclosed
Public LaunchJuly 20, 2026
DisclosureRevenue, valuation and round allocation not publicly disclosed
Milestones
Select a milestone to follow Neo’s development
1Formation2025
2Platform Build2025–2026
3Neoverse2025–2026
4Public LaunchJul 2026
Milestone 1
Founding Team Assembles (2025)
Nick Warner, Shlomi Salem and Eran Shirazi founded Neo in 2025 to build security controls for enterprise software gaining autonomous and agentic capabilities.
Company
Neo SecurityEnterprise cybersecurity company focused on agentic software
Stage
FormationExperienced operators assemble before the public launch
Capital
Early Institutional BackingSeed and Series A allocation not publicly disclosed
SecOps TeamsLarge organizations adopting AI enabled software
Competition
Operator ExperienceFounders previously built and scaled enterprise security companies
Additional Company Data
Warner previously served as SentinelOne president and COO
Salem led detection engineering and threat research at SentinelOne
Shirazi previously co-founded EasySend
The company is unrelated to Canada’s Neo Financial
NCFA Perspective
Neo begins with founders who have built cybersecurity products and commercial organizations before. That lowers some execution risk, but it does not yet establish enterprise adoption.
Milestone 2
Agentic Software Control Platform Built (2025–2026)
Neo developed an endpoint control layer that discovers AI enabled software, assesses permissions and configuration, attributes actions and enforces policy before activity reaches sensitive systems or data.
Company
Neo PlatformInventory, posture, attribution and enforcement
Stage
Product BuildControl layer developed before public launch
Capital
Venture FundedCombined prelaunch financing later disclosed at US$100M
Markets
AI Enabled EnterprisesEndpoints, browsers, identities and applications
Customers
Security OperationsTeams governing human and non-human activity
Competition
Runtime ControlPolicy applied before an agent completes an action
Additional Company Data
Discovers agents, models, extensions, plugins and MCP servers
Maps permissions, identities, configurations and data access
Attributes actions to a human, agent, application or identity
Can allow, block or hold activity for approval
NCFA Perspective
Neo is joining discovery with enforcement. That is commercially stronger than another inventory dashboard, provided the controls work across the applications and workflows enterprises actually use.
Milestone 3
Neoverse Knowledge Layer Developed (2025–2026)
Neo built Neoverse as a continuously updated knowledge base of agentic software capabilities, risks and behaviour. The intelligence feeds inventory classification, posture assessment and policy decisions inside the platform.
Company
NeoverseAgentic software knowledge base
Stage
Knowledge LayerSoftware capabilities and risk profiles mapped continuously
Capital
Product InvestmentResearch and engineering support platform intelligence
Markets
Agentic SoftwareModels, agents, extensions, applications and MCP servers
Customers
Enterprise Security TeamsOrganizations assessing software before and after deployment
Competition
Software IntelligenceRisk context added to inventory and enforcement
Additional Company Data
Neoverse is included with every Neo deployment
It maps capabilities, risks and behaviour across agentic software
The knowledge base supports software classification and policy creation
Neo has not disclosed an independently verified scale figure for the database
NCFA Perspective
Neoverse could become a defensible asset if Neo keeps pace with rapid changes in models, applications, extensions and agent frameworks.
Milestone 4
US$100M Public Launch From Stealth (Jul 2026)
Neo emerged from stealth on July 20, 2026 with US$100 million in combined seed and Series A financing and a public product built around real time control of agentic software.
Company
NeoAgentic Software Control company
Stage
Public LaunchCommercial expansion begins after stealth development
Capital
US$100MCombined seed and Series A financing
Markets
Global EnterpriseOrganizations adopting AI enabled and autonomous software
Customers
Large EnterprisesNamed customers not publicly disclosed
Competition
Category FormationEndpoint, identity, cloud and AI security vendors converge
Additional Company Data
Andreessen Horowitz and Bessemer Venture Partners backed the company
Craft Ventures and Merlin Ventures also participated
Capital will support engineering and go to market hiring
Revenue, valuation, customer count and financing allocation remain undisclosed
NCFA Perspective
The launch capital gives Neo room to build quickly. The central question is whether enterprises will buy a separate agentic control layer or expect existing security suppliers to add the capability.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
On July 20, 2026, OnePay launched personal loans ranging from US$1,000 to US$50,000 through a new partnership with Upgrade. Eligible customers can check rates, review an offer, accept the terms and manage repayment without leaving the OnePay app.
OnePay is the consumer finance platform backed by Walmart and Ribbit Capital. Its app already offers banking, high yield savings, a digital wallet, credit cards, investing, crypto, credit building and point of sale lending. Customers who bank through OnePay may receive funds as soon as the same day. Annual percentage rates range from 7.74% to 35.99%, depending on eligibility.
Upgrade provides and services the loans, while Cross River Bank issues them. OnePay controls the app experience and customer distribution. That division of work gives OnePay a lending product without requiring it to build the full underwriting, funding and servicing operation internally.
OnePay Is Building A Wider Consumer Finance Relationship
Personal loans extend that relationship beyond everyday payments and retail financing. The new product is designed for debt consolidation, major purchases and unexpected expenses rather than financing a single transaction at Walmart checkout.
Point of sale lending helps complete a purchase. A personal loan gives OnePay a role in a customer’s wider balance sheet and monthly cash flow. A borrower may use the proceeds to refinance higher cost debt, fund a large expense or cover an emergency.
OnePay says the application can use information customers have already supplied, reducing repeated data entry. That may improve conversion, but it also makes data permissions and decision responsibilities more important. Customers need to understand which company holds their information, which institution makes the loan and who controls servicing or collection decisions.
The expansion follows OnePay’s work with Synchrony on a Walmart credit card program and Klarna on OnePay Later. Together, those products give the app several ways to serve consumers across everyday spending, retail financing, credit building and larger borrowing.
Upgrade Operates As The Embedded Credit Infrastructure
Upgrade brings the credit machinery behind the product. The company has delivered more than US$50 billion in credit to over 8 million customers since 2017 across personal loans, cards, buy now pay later, home improvement and auto financing.
For Upgrade, the OnePay agreement adds distribution through an app connected to millions of consumers and Walmart’s retail ecosystem. Instead of acquiring every borrower through its own brand, Upgrade can supply lending inside another company’s customer relationship.
This is the same operating structure seen across embedded finance. The distributor owns the interface and customer traffic, while a regulated bank and specialist technology provider supply the financial product behind it.
That structure can lower customer acquisition costs and shorten product development. It also creates dependencies. OnePay relies on Upgrade’s underwriting and servicing performance. Upgrade relies on OnePay to present the product responsibly and bring suitable borrowers into the funnel. Cross River Bank carries the regulated lending role.
Competitive Snapshot
OnePay combines Walmart linked distribution with banking, payments, rewards and credit inside one app.
Upgrade supplies underwriting, loan technology and servicing rather than requiring OnePay to build those capabilities.
SoFi offers personal loans inside a broader consumer finance relationship that includes banking and investing.
Robinhood is also extending beyond its original product into a wider lifestyle finance relationship spanning investing, credit, banking and rewards, although OnePay brings Walmart linked retail distribution rather than a brokerage led customer base. See NCFA’s analysis of Robinhood’s lifestyle finance strategy.
LendingClub competes in unsecured personal credit with a bank funded model and direct consumer acquisition.
Major banks already hold deposits and customer data, but may offer slower applications or less integrated digital experiences.
Scale Raises The Stakes For OnePay
Personal loans could deepen OnePay’s role in customers’ financial lives, especially when borrowing, banking, payments and rewards sit inside the same app. Will the app's convenience produce durable trust rather than simply more credit volume is the question.
Pricing near the top of the 35.99% APR range carries the clearest risk. Approval may be fast, but repayment can become difficult when the loan is used for an emergency or to consolidate existing debt.
OnePay will also carry much of the reputational impact even when lending decisions and servicing sit with partners. Unclear terms, poor servicing or aggressive collections could affect how customers view the wider platform.
Canadian banks, retailers and fintechs face the same trade-off. Embedded lending through consented financial data could help companies add credit faster, but the business controlling the interface still needs to make pricing, data use, lender identity and repayment responsibility clear.
Talking Point
Can OnePay turn Walmart scale distribution into a primary consumer finance relationship, or will it remain a storefront for credit products supplied by banks and specialist lenders?
NCFA Company Intelligence Snapshot
Cover Genius
Embedded insurance infrastructure for digital platforms, global carriers and claims operations
Last updated Jul 17, 2026
Company At A Glance
Founded2014 by Angus McDonald and Chris Bayley
HeadquartersSydney, Australia
StatusPrivate
Capital / FundingUS$320M across major disclosed rounds since 2021
Latest ValuationUS$1.9B at the Jul 2026 Vista Credit financing
ProductsXCover, XClaim, BrightWrite, RentalCover and embedded protection programs
PartnersMore than 200 digital platforms and over 50 insurance carriers
CustomersMore than 70 million customers protected through 240 million policies
MarketsMore than 60 countries and all 50 US states
Milestones
Select a milestone to follow Cover Genius’s development
1RentalCover Launch2014
2Claims Come In House2015
3Analytics And APIs2017
4Multi Industry Build2018
5XCover Launch2019
6New Industries2020
7Series C2021
8Booking Protect2022
9Clyde And Series E2023–2024
10Vista Credit2026
Milestone 1
RentalCover Launch (2014)
Angus McDonald and Chris Bayley founded Cover Genius after encountering fragmented insurance distribution while operating an online travel business. RentalCover became the first use case for combining digital distribution, policy administration and claims support.
Company
RentalCoverRental vehicle protection distributed through digital booking platforms
Stage
LaunchA focused first product built around a clear travel use case
Capital
Founder LedEarly development preceded the company’s later institutional funding rounds
Markets
Travel And MobilityRental car bookings across multiple countries
Customers
Travel PlatformsOnline travel agencies and rental car booking businesses
Competition
Integrated ProtectionInsurance offered inside the booking flow rather than through a separate purchase
Additional Company Data
The founders encountered the distribution problem while operating an online travel agency
RentalCover provided a narrow market in which to prove embedded protection
The early model joined digital distribution with policy and claims operations
Mobility gave Cover Genius transaction data before it expanded into other industries
NCFA Perspective
The first product mattered because it gave Cover Genius a practical route into a difficult market. The company learned the operating work before expanding the platform.
Milestone 2
Booking Partnership And In House Claims (2015)
A major Booking Holdings relationship helped establish distribution scale. Cover Genius also brought customer and claims support inside the company, giving it direct control over what happened after a policy was purchased.
Company
Cover GeniusThe operating model expanded beyond policy distribution
Stage
Claims BuildCustomer support and claims became internal capabilities
Capital
Operating InvestmentResources shifted into service, evidence review and payment workflows
Markets
Global TravelDistribution through a major international booking platform
Customers
Booking UsersTravellers purchasing protection during the booking process
Competition
Claims ControlDirect ownership of the post purchase experience
Additional Company Data
The Booking relationship increased policy distribution through a major travel platform
Claims ownership created direct data on customer questions and evidence requirements
Internal claims support reduced dependence on a disconnected third party experience
The capability later became part of the value offered to larger enterprise partners
NCFA Perspective
Claims ownership became an early competitive advantage. Embedded insurance only strengthens a partner’s customer experience when the post purchase process also works.
Milestone 3
Analytics And Claims APIs Take Form (2017)
Cover Genius introduced analytics, pricing tools, API connectivity and instant claim payment capabilities. These functions became the foundation for a platform that could support products beyond rental vehicles.
Company
Cover GeniusThe business began developing reusable insurance infrastructure
Stage
Platform BuildAPIs and analytics replaced more manual product workflows
Capital
Technology InvestmentEngineering expanded across pricing, claims and payment functions
Markets
Digital CommerceThe technology could support more than one travel product
API InfrastructureProduct and claims functions exposed through software connections
Additional Company Data
Analytics supported product configuration and pricing decisions
API connectivity reduced manual work for partner integrations
Instant payment capabilities improved the approved claims process
The technology created a base that could be reused across industries
NCFA Perspective
This was the point where Cover Genius began becoming infrastructure. APIs and operating data made the model more repeatable across partners.
Milestone 4
Multi Industry Platform Build (2018)
Cover Genius began building one platform for insurance, warranties and other protection products across industries. Development of XCover started as the company expanded into the United States.
Company
XCover BuildThe company began creating its main multi product platform
Stage
ExpansionThe business extended beyond rental vehicle protection
Capital
Product And Market BuildInvestment supported software development and US entry
Markets
United StatesA New York office supported expansion into a major insurance market
Customers
Multi Industry PlatformsTravel, retail and other digital businesses
Competition
Broader Product ScopeInsurance, warranties and protection managed through one platform
Additional Company Data
The company began writing the first XCover code in Sydney
US expansion increased the importance of local licences and carrier relationships
The product thesis broadened from one vertical to several transaction types
The platform had to support different policy rules without losing one integration experience
NCFA Perspective
The strategic decision was to solve for several industries rather than remain a specialist travel product. That increased the opportunity and the regulatory burden.
Milestone 5
XCover Global Platform Launch (2019)
XCover launched as one integration for distributing several insurance and protection products across markets. Carrier relationships, local authorizations, pricing and claims became part of the same operating system.
Company
XCoverThe core embedded protection platform
Stage
Product LaunchA single integration connected multiple products and markets
Capital
Platform ScaleInvestment supported carrier, compliance and technology expansion
Markets
60+ CountriesThe platform was built for multinational distribution
Customers
Digital EnterprisesPlatforms needing protection across several jurisdictions
Competition
End To End InfrastructureDistribution, policy administration and claims under one connection
Additional Company Data
XCover supports insurance, warranties and other forms of protection
The platform operates across more than 60 countries and all 50 US states
Policy content is available in more than 40 languages
Approved claim payments are supported in more than 90 currencies
NCFA Perspective
XCover turned fragmented carrier, policy and claims relationships into one integration. That operating simplification is the core commercial proposition.
Milestone 6
Diversification Beyond Travel (2020)
Travel disruption exposed the risk of relying heavily on one sector. Cover Genius expanded into ecommerce, shipping, ticketing and retail, reducing its dependence on travel activity.
Company
Cover GeniusThe platform expanded into several transaction driven industries
Stage
DiversificationCOVID accelerated the need for a wider revenue base
Capital
ReallocationResources shifted toward new verticals and partner integrations
Markets
Ecommerce And LogisticsRetail, ticketing, shipping and related digital transactions
Customers
Merchants And MarketplacesPlatforms adding protection to non travel purchases
Competition
Reusable PlatformThe same infrastructure adapted to new product categories
Additional Company Data
Travel disruption exposed concentration risk in the original market
New partners included ecommerce, ticketing and shipping businesses
The platform could be reused without rebuilding the full operating stack
Diversification reduced dependence on one source of transaction volume
NCFA Perspective
Diversification was defensive at first, but it also proved the platform could serve transaction flows outside travel.
Milestone 7
Series C Growth Capital (2021)
A US$70 million Series C supported further international expansion and new enterprise relationships as Cover Genius developed a larger global distribution network.
Company
Cover GeniusA global embedded protection provider entering a larger growth phase
Stage
ScaleThe company expanded after proving the multi industry platform
Capital
US$70M Series CGrowth funding supported product and international distribution
Markets
InternationalAdditional countries, carriers and enterprise integrations
Customers
Large PlatformsTravel, ecommerce and financial service companies
Competition
Distribution ScaleA broader partner and carrier network increased platform utility
Additional Company Data
The round followed evidence that XCover could operate across industries
Capital supported partner acquisition and international coverage
Enterprise distribution became the main route to customer volume
The company continued investing in product and claims infrastructure
NCFA Perspective
The Series C reflects a company funding distribution after establishing product market fit. The key question became how efficiently new enterprise relationships could scale.
Milestone 8
Booking Protect Acquisition And Series D (2022)
Cover Genius acquired Booking Protect and its network of ticketing partners, then raised another US$70 million. The acquisition added established industry relationships that could use the wider XCover platform and claims infrastructure.
Company
Booking ProtectA ticketing protection business added to Cover Genius
Stage
Vertical ExpansionAcquisition accelerated entry into live events and ticketing
Capital
US$70M Series DFunding supported continued platform and market growth
Markets
Ticketing And EventsMore than 350 ticketing partner relationships
Customers
Venues And Ticket PlatformsBusinesses selling access to live events
Competition
Acquired DistributionIndustry relationships added faster than building them internally
Additional Company Data
Booking Protect brought more than 350 ticketing relationships
The acquisition added specialist knowledge of live events
Revenue nearly tripled and the partnership base doubled around this period
XCover and claims operations could be extended across the acquired network
NCFA Perspective
Booking Protect shows how acquisitions can add vertical distribution faster than building every partner relationship internally.
Milestone 9
Clyde Acquisition And Series E (2023–2024)
The Clyde acquisition expanded Cover Genius further into retail warranties and strengthened distribution among mid sized merchants. A US$80 million Series E followed in 2024 after strong reported growth.
Company
ClydeRetail warranty infrastructure added to the wider platform
Stage
Retail ExpansionCover Genius deepened its position beyond travel and ticketing
Capital
US$80M Series ESpark Capital led the 2024 growth round
Markets
Retail And EcommerceWarranty and protection programs for merchants
Vertical DepthSpecialist retail distribution connected to global infrastructure
Additional Company Data
Clyde strengthened Cover Genius in retail warranties
The company reported 107% revenue growth for 2023
Net revenue retention was reported at 145%
The business had approximately 500 employees around the financing period
NCFA Perspective
Clyde and the Series E expanded both market reach and capital requirements. The company was becoming a multi vertical insurance infrastructure provider.
Milestone 10
Vista Credit And AI Expansion (2026)
Vista Credit Partners supplied US$100 million at a US$1.9 billion valuation. The financing supports AI personalization, agent based distribution, claims automation and further international expansion.
Company
Cover GeniusGlobal infrastructure for embedded protection
Stage
Infrastructure PhaseA mature platform entering a debt financed expansion period
Capital
US$100M CreditInstitutional private credit from Vista Credit Partners
Markets
GlobalMore than 60 countries and all 50 US states
Customers
200+ PartnersLarge digital platforms across several industries
Competition
AI And Operating ScalePersonalization, claims automation and global carrier access
Additional Company Data
The financing valued Cover Genius at US$1.9 billion
The company reported 50% revenue growth in 2025
The facility’s pricing, maturity and covenants weren’t disclosed
The company plans AI work across personalization, agentic distribution and claims
NCFA Perspective
Private credit marks a more mature financing stage, but the economics now depend on durable partner revenue, disciplined acquisitions and claims automation that improves rather than weakens customer outcomes.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
July 11, 2026 | NCFA Fintech Whisperer | Risk Compliance And Regtech, Digital Assets Blockchain And Tokenization, Payments And Money Movement, Wealth Investing And Trading, Capital Markets Infrastructure And Funding, Competition And Market Structure, Digital Banking And BaaS, Lending Consumer Credit And BNPL, Regulation And Policy, Identity Privacy And Data Governance Cybersecurity Fraud And Financial Crime
July 15, 2026, United Kingdom / Singapore / Global
Standard Chartered standardized its global infrastructure on a software defined private cloud using VMware Cloud Foundation to support critical banking services across 54 markets.
Approximately 70% of the bank’s global infrastructure footprint already operates on the new architecture.
The platform embeds zero trust security into the infrastructure layer and reduces infrastructure deployment time from weeks to one day.
Private cloud remains a production architecture for regulated banks that need consistent control across countries and critical workloads. The 70% deployment gives other banks a concrete benchmark for weighing resilience, security, workload portability and regulatory oversight when deciding which systems belong in private environments and which can run with hyperscalers.
July 17, 2026, Marshall Islands / United States / Global
BitGo Bank & Trust will provide qualified custody and off exchange settlement for USDM1, a dollar denominated sovereign bond issued natively onchain by the Republic of the Marshall Islands.
USDM1 is structured under New York law, backed 1:1 by U.S. Treasuries and available to institutions on Stellar, Ethereum and Solana.
Eligible clients can deploy USDM1 to connected venues around the clock with T+0 settlement without transferring the asset onto an exchange.
The structure places sovereign issuance, Treasury backing, regulated custody and continuous settlement inside one institutional collateral workflow. It gives banks, dealers and custodians a concrete test of how tokenized sovereign instruments could support secured finance while reducing intraday exposure and prefunding requirements.
CSA Consultation Paper 51-406 opens a 120 day review of how Canadian public companies are regulated, with comments accepted until November 13, 2026.
The consultation asks whether venture and non-venture issuer status should be determined differently to support more proportionate requirements.
The CSA is considering whether some venture issuers should receive relief from parts of International Financial Reporting Standards.
The paper also examines private placement hold periods, material change reporting and how U.S. reforms to reporting, disclosure and capital raising should influence Canada.
More than 10% of eligible companies have adopted the CSA’s voluntary semi-annual reporting framework, while recent Listed Issuer Financing Exemption changes have generated significant financing activity.
The review extends beyond one exemption or reporting rule. It connects the semi-annual reporting pilot and higher LIFE financing limits to the cost of staying public, the information investors receive and Canada’s ability to compete for issuers and capital.
Ontario committed to join Canada’s national securities regulatory passport system following discussions among federal, provincial and territorial finance ministers.
Under the passport system, a market participant obtains a decision from its principal regulator that applies across participating jurisdictions under harmonized laws.
Ontario has been the only jurisdiction outside the system and currently uses an interface that can require a separate Ontario Securities Commission decision; implementation timing has not been announced.
Ontario’s commitment could remove a longstanding layer of duplicated review for issuers and registrants operating nationally. The operational test is whether full participation reduces filing cost and approval time without weakening investor protection. It also delivers the coordinated model sought in earlier calls for Ontario to adopt passport.
Grove committed a US$500 million warehouse facility to finance institutional loans originated and serviced by Galaxy Digital.
The senior secured loans may use BTC and ETH as collateral, including staked ETH, with assets held by Anchorage Digital and BitGo.
The facility uses USDS capital, defined eligibility requirements, concentration limits and continuous loan to value monitoring through independent price feeds.
The facility brings a familiar credit structure into institutional digital asset lending at substantial scale. It places onchain liquidity closer to loan origination and gives the market a clearer test of how stablecoin capital, qualified custody and crypto collateral can support structured credit.
Reuters reported that Stripe and Advent International submitted a joint offer of US$60.50 per share for PayPal, valuing the company at more than US$53 billion.
The proposal is backed by approximately US$50 billion in committed bank financing and would give Stripe and Advent equal ownership of PayPal.
PayPal, Stripe and Advent declined to comment, PayPal had not responded to the proposal when it was reported, and there is no certainty that an agreement will result.
A combined Stripe and PayPal would connect merchant processing, consumer checkout, Venmo and stablecoin distribution under one ownership structure. Even without a transaction, the bid tests whether control of merchant acceptance and consumer distribution will become a defining advantage across wallets, agentic commerce and digital payments.
ConnectOne Bank is building multiple commercial lending agents on nCino’s Agentic Operating System.
The deployment targets frontline efficiency across commercial lending workflows rather than one isolated task.
nCino positions the system as an operating layer for agents working across lending data, processes and institutional controls.
Commercial lending agents are entering regulated bank workflows at the operating system level. Their value will depend on whether banks can reduce manual work while keeping credit judgment, accountability and exception handling under institutional control.
Blockchain.com partnered with Polymarket to add prediction market access inside its app for users in eligible markets.
Users will be able to use assets already held in their Blockchain.com accounts to open and manage event positions without a separate wallet connection or deposit process.
Blockchain.com said it serves more than 43 million verified users across more than 70 jurisdictions, giving Polymarket a large new distribution channel.
Prediction markets are becoming a standard feature inside crypto trading apps. Wider distribution could increase participation and liquidity, while raising sharper questions about eligibility, market integrity and the trust controls surrounding prediction markets.
Alipay+ integrated with Argentina’s Transferencias 3.0 national QR payment network through Latin American payment technology provider PVS.
International travellers using participating Alipay+ wallets will be able to scan the QR codes already displayed by millions of Argentine merchants.
Alipay+ connects more than 50 wallets and banking apps representing 2 billion user accounts with 150 million merchants globally, with the Argentine service launching in phases.
Argentina is turning a domestic interoperable QR standard into an international acceptance layer without requiring merchants to replace their checkout technology. It gives Canadian operators a useful comparator as Canada opens payment infrastructure to more PSPs and credit unions while developing instant payment access, shared acceptance and stronger operating controls.
Thredd joined Visa’s Agentic Ready programme to help issuers support payments initiated by AI agents.
The processor said its platform provides tokenisation, authentication and fraud capabilities needed for agent initiated transactions.
Zilch is among the first issuers using the platform to support agent initiated payments in Europe.
Agentic commerce is reaching the issuer processing layer. Delegated authority, transaction controls, authentication and dispute handling are becoming core payment functions rather than responsibilities left only to agents and merchants.
Stable launched StablePay, a mobile app for instant USDT transfers using phone numbers, email addresses or QR codes.
The self custody service removes the need for users to manage blockchain accounts, gas fees or separate wallet connections.
Stable said the app is already supporting peer payments, cross border remittances and international payroll, with a built in feature for earning yield on USDT.
StablePay packages payment, custody and yield inside one consumer experience. Its traction will show whether simplified stablecoin products can win users beyond crypto markets while meeting the compliance expectations attached to global payments and yield.
Emirates NBD went live on Partior’s multicurrency blockchain clearing and settlement network.
The bank completed a live USD transaction with J.P. Morgan acting as settlement bank and beneficiary bank.
Corporate and institutional clients can now send real time USD payments to beneficiary accounts held at J.P. Morgan, with additional currencies and bank connections planned.
This is live bank settlement rather than another proof of concept. Partior now has a regional deployment that can test whether continuous liquidity, faster finality and programmable treasury services improve cross border banking at production scale.
The European Central Bank selected 36 payment service providers from more than 50 applicants to participate in the digital euro pilot.
The 12 month pilot is scheduled to begin during the second half of 2027 using a beta version of the digital euro across the ECB and 19 national central banks.
The programme will test online and offline person to person payments, merchant acceptance, software point of sale and ecommerce transactions with banks, payment firms and selected merchants.
The digital euro has entered a new implementation stage. Attention now turns from policy design toward operational readiness, participant integration and whether the pilot demonstrates that public digital money can work alongside existing payment networks.
JCB and Circle signed a memorandum of understanding to explore USDC payments across JCB's merchant network.
The collaboration will examine cross border payments, merchant acceptance and settlement using stablecoin infrastructure.
The initiative builds on JCB's existing digital payment work with Japanese banking and technology partners.
Stablecoin adoption is expanding beyond crypto native platforms into established payment networks. The next phase will depend on merchant acceptance, operational integration and regulatory treatment across major consumer payment markets.
Siam Commercial Bank became the first financial institution client to go live with Citi's integrated 24/7 USD Clearing and Citi Token Services solution.
The service enables near real time cross border USD payments at any time of day using tokenized deposits within Citi's regulated banking network.
The first live transaction transferred U.S. dollars between Citi in London and Siam Commercial Bank in Thailand during the U.S. holiday weekend, demonstrating continuous cross border payment capability.
The industry is beginning to demonstrate how tokenized deposits can support continuous cross border payments inside regulated banking networks. Alongside Swift’s bank ledger work with RBC and TD, the next measure is how quickly live services spread across institutions and payment corridors.
FIS joined Anthropic’s Project Glasswing and is actively testing the Mythos 5 frontier model against its own systems.
FIS operates software that clears payments, transfers money and runs core banking for thousands of financial institutions worldwide.
The controlled security initiative is separate from FIS’s commercial AI agent partnership with Anthropic and focuses on identifying vulnerabilities in critical software infrastructure.
Frontier AI is entering the security testing layer of widely shared banking and payment infrastructure. The initiative extends AI security across mixed banking systems into controlled testing of critical financial software. Banks and infrastructure providers will need clear controls for model access, finding validation, remediation ownership and disclosure as advanced models identify vulnerabilities faster than conventional security teams can process them.
CSA Staff Notice 33-322 reports findings from a focused compliance examination of 73 registered firms.
The review examined policies, employee training, risk assessments, controls, third party oversight and incident response planning.
CSA staff identified gaps across the firms reviewed and issued practical guidance intended to scale across small, medium and large registrants.
Cybersecurity expectations are becoming more concrete through examination findings rather than high level principles alone. Registered firms now have a clearer basis for testing governance, third party controls and incident readiness before the next compliance review.
INETCO added agentic AI investigation capabilities to BullzAI for banks, payment processors and other financial institutions.
The agents collate transaction data, triage alerts, prioritize high risk cases and provide explainable scores and recommendations for fraud teams.
The capability uses a proprietary model deployed within the customer environment and improves through supervised human feedback.
Fraud operations are beginning to automate the investigation layer, not only transaction detection. The practical value will come from cutting case backlogs while preserving analyst control, explainability and sensitive payment data inside the institution.
ENISA released a maturity model and downloadable assessment tool for SMEs that manufacture or supply products with digital elements covered by the Cyber Resilience Act.
The model evaluates governance, security by design, risk management, vulnerability management, product lifecycle practices and cybersecurity skills.
An accompanying survey of 194 organizations across 31 countries found that 66% knew about the Act, while practical understanding, incident response and product lifecycle readiness remained limited.
Canadian fintech and software vendors selling covered products into Europe need operational evidence behind their compliance claims. The model gives customers and partners a common way to examine product security maturity as the Act’s vulnerability reporting requirements begin in September 2026 and its main obligations approach.
FATF found that 83% of surveyed jurisdictions, 91 of 109, had passed legislation implementing the Travel Rule, up from 73% in 2025.
However, 55 of those 91 jurisdictions had not issued findings or directives or taken Travel Rule related supervisory or enforcement action.
FATF reported that a Cambodia based financial services conglomerate laundered at least US$4 billion between August 2021 and January 2025, including at least US$37 million linked to North Korean cyber thefts.
Travel Rule adoption is advancing faster than supervision and enforcement. Crypto firms, banks and compliance providers need stronger counterparty screening, interoperable originator and beneficiary data, offshore VASP controls, and escalation procedures for stablecoins and unhosted wallet exposure.
FINTRAC updated its advisory for Canadian reporting entities following the Financial Action Task Force’s June plenary.
Bosnia and Herzegovina and Iraq were added to the FATF list of jurisdictions under increased monitoring, while Algeria and Namibia were removed after completing their action plans.
Canadian reporting entities must account for connections to monitored jurisdictions when assessing geographic risk, applying controls and determining whether suspicious transaction reports are required.
Transactions connected to the Democratic People’s Republic of Korea and Iran remain subject to specific Canadian directives covering high risk treatment, identity verification, source of funds or virtual currency, beneficial ownership, recordkeeping and sanctions evasion controls.
The advisory also preserves enhanced requirements and reporting considerations for Myanmar, Russia, Afghanistan, Islamic State controlled areas and transactions connected to the Middle East.
The update requires banks, fintechs, payment companies, money services businesses and virtual asset firms to review country risk classifications, transaction monitoring rules and correspondent banking controls. Grey list status should inform a risk based assessment rather than automatic rejection of every transaction, while Canadian ministerial directives create specific mandatory treatment for designated jurisdictions.
The Bank of England, PRA and FCA began joint oversight of the first Critical Third Parties designated by HM Treasury.
The regime covers Amazon Web Services, Google Cloud, Microsoft and Oracle services that support the UK financial system.
Designated providers must manage risks to critical services, communicate with regulators during major incidents and support system level resilience.
Direct supervision of major technology providers changes where operational resilience responsibility sits. Financial firms still own their outsourcing risk, but the largest shared dependencies now face regulatory scrutiny at source.
FINMA regulated AMINA Bank integrated Mesh’s verified deposit technology directly into its online banking platform.
Clients will be able to select a wallet provider, verify ownership and deposit stablecoins or other digital assets through connections spanning more than 300 wallets and providers.
The deposit capability will soon become available to AMINA clients, with withdrawals, payouts and simplified wallet verification during onboarding planned as later additions.
Regulated crypto banking still breaks at the point where customers must prove ownership of external wallets. Embedding verification into deposit authorization can reduce manual address checks while preserving compliance controls. Banks considering similar connections will need clear responsibility for wallet screening, transaction monitoring, sanctions controls and failed transfers.
Interest free Buy Now Pay Later products are now regulated by the Financial Conduct Authority, covering providers including Klarna, PayPal and Clearpay.
Providers must conduct affordability checks before extending credit and give consumers clearer information during checkout.
Consumers gain enforceable refund protections for faulty goods, access to the Financial Ombudsman Service and support before debt collection when experiencing financial difficulty.
BNPL now operates as supervised consumer credit across the customer journey. Providers serving the UK need affordability, disclosure, complaints, refunds and collections controls that work inside merchant checkout flows. Canadian policymakers and lenders have a live comparator for testing whether product specific safeguards can protect consumers while preserving short term payment flexibility.
HM Treasury opened a 12 week consultation containing 42 questions on payment services and electronic money regulation, with responses due October 6, 2026.
The proposals create common regulated activities for traditional and tokenised payments, bring certain stablecoins into the payments perimeter and require firms to obtain permission for tokenised payment services.
The consultation addresses agentic payment consent, authentication and liability alongside variable recurring payment access, commercial Open Banking pricing and expanded FCA supervision.
One consultation connects digital money, AI agents and Open Banking to the same operating rulebook. Payment firms need to test which permissions, safeguarding models, access rights and liability controls their products would require. Canadian regulators can compare this integrated approach with separate domestic work on stablecoins, consumer driven banking and Real Time Rail implementation.
Austria’s Administrative Court confirmed that statistically calculated political affinities are special categories of personal data protected under Article 9 of the GDPR.
The profiles covered approximately 2.2 million people and were stored and partly sold to third parties without consent or another applicable exception.
The court set the administrative fine at €13 million and confirmed that group wide annual revenue could be considered when determining the penalty.
The decision extends sensitive data protection beyond information people expressly provide to conclusions generated about them. Fintechs using behavioural analytics, customer segmentation, alternative data or AI models must consider whether inferred attributes can create heightened privacy obligations even when the underlying inputs appear ordinary.
The Dutch Data Protection Authority published GDPR guidance for organizations developing generative AI models or taking responsibility for putting them into use.
The guidance addresses lawful grounds, indirect collection, training data and how personal information is managed, cleaned, enriched, retained and protected.
A separate implementation checklist asks organizations purchasing or using generative AI to first determine whether they can achieve their purpose without processing personal information.
The guidance brings privacy decisions into AI procurement and development before deployment. Financial institutions and fintechs using customer information with generative AI will need to justify why personal data is necessary, identify their legal role and preserve evidence across training, vendor selection, implementation and ongoing use.
Faster Finance Needs Faster Control
This week’s developments share one operating pattern. BitGo and Galaxy place tokenized assets inside collateral and lending. Alipay+, Partior and Citi connect domestic payment access with international distribution. FIS, the CSA and FATF reinforce the control layer required to run these systems safely at speed. For Canadian operators, the strategic question is which layer they truly control. Distribution without settlement access creates dependency. Automation without governance creates liability. Tokenization without custody, liquidity and legal certainty stays experimental. Durable businesses will own a useful layer, meet its control burden and connect cleanly to the rest.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
July 17, 2026 | NCFA Market Activity | Payments And Money Movement, Embedded Finance, Competition And Market Structure
Bank Owned Contactless Payments Across iOS And Android
On July 15, 2026, Mastercard launched Wallet Services, a development package that helps banks, fintechs and digital businesses add contactless payments to their own iOS and Android apps. Mastercard supplies the software development kits, Secure Element applet and tokenization through Mastercard Digital Enablement Service.
The product reduces work that previously required separate operating system integrations, security approvals and EMVCo certification. Mastercard says its software kits are available wherever Mastercard Digital Enablement Service operates, covering more than 200 countries and territories. Several banks are already building with the product, although Mastercard hasn’t named them or confirmed their launch markets.
A bank can now keep tap to pay inside mobile banking instead of sending customers to Apple Wallet or Google Wallet. Payments can sit beside card controls, rewards, instalments, merchant offers and account data. Mastercard gains another role beneath the customer interface even when the issuer owns the app.
Apple Opened Device Access Without Giving Up Control
Apple created the opening. With iOS 18.1, approved developers gained access to the iPhone Secure Element and near field communication functions for contactless transactions. Canada joined the first group of supported markets. Developers can also ask users to select another app as the default contactless wallet.
Access still comes with conditions. Developers need an Apple commercial agreement, an entitlement, security approval and payment of associated fees. Apple permits more competition while retaining control over device permissions and the economics of iPhone access.
Mastercard packages that access into a bank ready product. Push provisioning already lets issuers send cards into Apple Wallet or Google Wallet. Wallet Services goes further because the bank or fintech app can become the contactless payment interface.
Banks Gain The Interface While Networks Keep Control
Issuer control improves, but independence remains limited. Mastercard still manages the payment token and credential process. Apple still decides which iPhone apps receive access. Consumers must also choose the bank app over wallets they already use for cards, tickets, transit passes and identification.
Wallet Services fits a wider pattern of payment networks opening access while tightening control. Banks receive a new route to the customer, but Mastercard and Apple retain authority over the credential, security standards and device access that make the wallet work.
Mastercard benefits from that split. Banks can own more of the customer experience while Mastercard supplies tokenization, security and cross platform integration. The network can strengthen its position even when its brand isn’t visible at checkout.
Apple Wallet and Google Wallet retain the strongest consumer distribution. Visa can answer with its own tokenization and issuer software. Paze follows a different model. The bank consortium wallet focuses on online checkout, not device level contactless payments, though it reflects the same effort to retain wallet distribution. Independent providers such as Thales also sell branded NFC wallet technology to banks and fintechs.
Mastercard’s advantage comes from combining network credentials with the wallet build. Its weakness comes from the same design. Banks with Visa, Interac and Mastercard cards may not want separate wallet logic for each network. A single network product works more cleanly for a fintech running one Mastercard card program than for a large Canadian bank serving customers across several payment schemes.
Canadian Adoption Depends On Coverage And Consumer Use
Canada offers an immediate test because Apple already permits third party NFC access here. A bank could connect contactless payment with credit card controls, loyalty, fraud alerts and merchant offers inside mobile banking. A fintech could combine a prepaid or credit product with budgeting, expense management or instalment features.
The customer use case is less certain. Apple Wallet and Google Wallet already give users one place for several cards and services. A bank owned wallet needs a clear reason to replace that convenience. Better rewards, stronger controls or a more useful account experience could help. Branding alone won’t.
Coverage will shape adoption as well. Mastercard’s release focuses on Mastercard credentials. Canadian consumers often carry Visa credit cards and Interac debit cards alongside Mastercard products. Banks will need to know whether Wallet Services can exist inside a wider wallet or whether each network requires separate development and commercial terms.
Mastercard hasn’t disclosed pricing, data ownership, merchant data access, fraud liability or support for non Mastercard credentials. It also hasn’t identified the first banks or launch markets. Those omissions limit any claim that the product will change wallet competition quickly.
The technology lowers a real build barrier. Commercial success now depends on whether banks can assemble complete wallets and give customers a reason to use them.
Talking Point
Can banks turn contactless payments inside mobile banking into a better customer experience, or will Apple and Google remain the default because one wallet already serves every card?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. 
