Karsten Wenzlaff, Advisor
August 26th, 2025

Last Updated: July 14, 2026
Status: Strong
Organizations: Payments Canada, Bank of Canada, Wise Payments Canada, Float, KOHO, Paramount Commerce, Brim Financial, DoBusiness.com, Neo Financial, Meridian Credit Union, Tru Cooperative Bank, Beem Credit Union, Ebury Partners Canada, Shaype, Libro Credit Union, Newton, XTM, UK HM Treasury
Payment networks are opening to more fintechs and payment service providers, but access is becoming more conditional rather than less controlled.
Canada’s expanded Payments Canada membership rules now allow eligible PSPs and provincial credit unions to enter a system once dominated by banks and a limited group of financial institutions. New members may apply to participate in the Real-Time Rail, contribute to Payments Canada governance and build services closer to national payment systems.
That doesn’t give every member the same operating position. Membership, system participation, exchange access, clearing, settlement and governance remain separate layers. Each comes with its own eligibility, technical, fraud, liquidity, safeguarding and supervisory requirements.
Canada has already started opening access across payments and financial data. Regulated non-bank firms can now enter formal membership and participation pathways instead of relying entirely on bilateral relationships with incumbent banks.
The operating model still has gates. Payments Canada membership makes a PSP eligible to apply for participation. It doesn’t automatically provide production access, a settlement account or relief from ongoing compliance. Canada’s approved RTR rules and access framework distinguishes direct settlement, agent settlement and service-provider roles, each with different economics and responsibilities.
Published standards can make entry more transparent and less dependent on institutional status. They can also increase the cost of integration, testing, fraud controls, liquidity management and continuous operations.
The evidence points to access and control developing together. Regulators and network operators are using common rules to admit more participants without requiring every entrant to hold a bank charter or decades of bilateral operating history.
Click each item to expand
Payments Canada admitted Wise Payments Canada, Float, KOHO, Paramount Commerce and Brim Financial after federal changes expanded membership eligibility to registered payment service providers.
The intake opened a formal route into Canada’s payment-system structure. It did not provide automatic production or settlement access.
By June 3, Payments Canada reported that 15 organizations had joined during 2026 following the expansion of its eligibility rules.
The wider intake shows that expanded membership is becoming an operating pathway rather than a one-time group of approvals.
Payments Canada admitted uSecure Escrow Solutions, operating as DoBusiness.com, as a PSP member on April 16, 2026.
The approval shows that access can extend beyond consumer fintech brands to specialized business payment providers.
Payments Canada has published a participation pathway for PSPs preparing to join the Real-Time Rail, Canada’s planned instant exchange, clearing and settlement system.
The pathway takes access beyond policy eligibility, although onboarding, certification and settlement arrangements still determine whether a firm reaches production.
Meridian Credit Union became the first provincial credit union admitted under the expanded membership rules, followed by other cooperative institutions in the 2026 intake.
The additions extend formal membership beyond fintech PSPs and bring more regional institutions into national payment governance and participation pathways.
Click each item to expand
Payments Canada distinguishes membership from participation in the Real-Time Rail.
This separation prevents membership totals from being treated as proof that every new member has equal operating access.
The approved RTR By-law and Rules establish the legal framework for exchange, clearing, settlement, payment finality and participant responsibilities.
Legal certainty gives prospective participants a clearer basis for investment while setting the conditions under which access can be used.
Registered PSPs must continue meeting Bank of Canada reporting, risk-management and safeguarding requirements under the Retail Payment Activities Act.
The framework replaces an informal access environment with continuing regulatory accountability.
The Bank of Canada ordered XTM to stop retail payment activity in February 2026 and later permitted a controlled restart under court-supervised monitoring.
The case shows that supervision can affect production access, customer funds and business continuity, not only regulatory filings.
The RTR framework combines ISO 20022 payment data with centralized fraud services and participant-level controls.
Common controls can support wider participation, but they also become part of the cost and technical standard for entry.
Limited direct settlement is developing as a middle layer between full sponsor-bank dependence and unrestricted central-bank account access.
The distinction determines how much control new participants gain over liquidity, counterparties and settlement economics.
The UK Payments Vision programme links future retail payment technology with decisions about governance, commercial roles, procurement and accountability.
The UK model confirms that modernizing payments is also a decision about who sets the rules, funds the system and controls access.
Canada has created formal payment system pathways for more organizations. The commercial effect will depend on how many new members complete onboarding, enter production and gain enough control to improve their products or economics.
Some PSPs may participate directly. Others may still rely on settlement agents, technical gateways or incumbent financial institutions. Those choices will affect liquidity, operating costs, fraud responsibilities and the speed at which new services can reach customers.
Governance will be another test. New members may have a voice in Payments Canada consultations and rules, but it is too early to know how much influence they will have over system priorities, liability, pricing and future access requirements.
The customer outcome is also unresolved. Wider participation could produce more choice, better payment products and stronger competition. It could also leave control concentrated among the institutions that provide settlement, connectivity, fraud services and access to customer accounts.
Published standards can replace closed institutional relationships with clearer entry requirements. They can also raise the cost of joining and operating. The result will depend on whether qualified new participants can build differentiated services and reduce reliance on incumbent intermediaries without weakening security or consumer protection.
Do you agree the evidence is strong?
Click Agree or Disagree. Your vote is recorded anonymously and aggregate results are tracked.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: [www.ncfacanada.org](http://www.ncfacanada.org)
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
July 14, 2026

Canadian regulatory debates tend to focus on payments, open banking and digital assets. Online gambling rarely gets the same attention from the fintech community, yet Ontario's decision to open a regulated iGaming market in April 2022 stands as one of the more instructive regulatory experiments this country has run in recent years. It shows how a province can bring a large grey-market industry under domestic supervision without banning anything and without building the whole system in-house.
Under the Criminal Code, gambling in Canada is lawful only when a province conducts and manages it. For decades that phrase was read narrowly: provincial lottery corporations ran their own sites, and everything else operated offshore. Canadians could gamble on hundreds of internationally licensed platforms, but none of those sites answered to a Canadian regulator, paid Canadian taxes or followed Canadian consumer-protection rules.
Ontario's answer was structural rather than prohibitive. The province created iGaming Ontario, working alongside the Alcohol and Gaming Commission of Ontario (AGCO), and invited private operators to sign operating agreements with it. On paper, the province still conducts and manages the market, satisfying the Criminal Code. In practice, private brands compete within a supervised commercial environment. It is a workaround, but a deliberate and legally considered one, and so far it has held.
The model rests on a division of labour. AGCO acts as the regulator: it registers operators and gaming suppliers, sets standards and enforces them. iGaming Ontario handles the commercial side, including the operating agreements and the revenue-sharing arrangements that return a portion of gaming revenue to the province.
The standards themselves reach further than many observers expected. Operators must have their games independently tested for fairness, run anti-money-laundering controls, verify the age and identity of every customer, and report data to the regulator. Advertising is constrained too: AGCO later tightened its rules on marketing that could appeal to minors, including the use of athletes and celebrities. Operators that stay outside the system lose the ability to advertise legally in the province, which has proven a meaningful commercial incentive to register.
For consumers, the practical differences are easy to overlook because a regulated site looks much like an unregulated one. The protections sit underneath. Players on Ontario-registered platforms must be 19 or older and verified as such. They get enforceable complaint pathways, mandatory tools for setting deposit limits, and access to a centralized self-exclusion program that works across all registered operators rather than one site at a time.
Transparency has improved as well. Independent directories such as Canadian Online Casinos now document which operators hold registrations and on what terms, making it easier for a player to check a site's status before creating an account. That kind of third-party reference layer barely existed when the market was entirely offshore. None of this removes the risks of gambling, and the regulated model treats it accordingly: operators are required to present gambling as entertainment, encourage limit-setting and point players toward support services.
Other provinces are watching, and Alberta has already passed legislation to build a comparable market. Ontario's experience offers a few transferable lessons. First, players migrate to regulated sites when the legal offer is genuinely competitive; a restrictive market that pushes people back offshore defeats the purpose. Second, separating the regulator from the commercial entity avoids the conflict of interest that arises when one body both profits from gambling and polices it. Third, advertising guardrails are easier to set at launch than to retrofit after public complaints.
There are open questions too. Self-exclusion registries remain provincial, so a player barred in Ontario can still sign up elsewhere, and the long-term effect of regulated markets on problem-gambling rates will take years of honest measurement to establish.
For an association focused on financial innovation, the interest here is less about gambling than about method. Ontario took a digital industry that regulation had failed to reach, found a lawful structure to house it, and paired market access with enforceable standards. That template will look familiar to anyone following the open-banking file, and it deserves study for the same reasons.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
July 13, 2026 | NCFA Market Activity | Cybersecurity And Fraud, Artificial Intelligence And Data, Banking And Credit

On June 25, 2026, Jack Henry expanded its Google Cloud collaboration to develop agentic AI security for banks and credit unions. The U.S. banking technology provider serves about 7,400 community financial institutions and plans to combine Google Security Operations, Gemini Enterprise Agent Platform, and Mandiant Consulting across Google Cloud, other cloud services, and on-premises systems.
The deal is less about access to an advanced model than the work required to deploy one inside a bank. Security evidence is spread across user accounts, devices, applications, networks, and cloud services. Analysts must connect those records quickly enough to determine whether an alert is harmless or part of an attack. Smaller institutions often lack the security teams and integration capacity to do that across several enterprise products.
The divide and conquer commercial logic of the deal is Google brings the models, security software, and threat expertise. While Jack Henry brings the bank relationships and operating knowledge required to put them to work.
Google Security Operations collects security data from across an institution’s systems and connects related alerts into an investigation. Its Triage and Investigation Agent can retrieve evidence, apply threat intelligence, assess likely causes, and explain its findings.
Google says the agent has processed more than five million alerts and reduced a typical 30-minute manual investigation to about 60 seconds. Those are Google product results, not outcomes reported by Jack Henry customers.
The operating gain comes from completing the early investigation before an analyst steps in. Instead of opening several products, finding related records, and rebuilding the sequence of events, the analyst receives an assembled case with supporting evidence and a proposed response.
Sensitive actions still require clear limits and human oversight. Google can pair AI investigations with fixed playbooks and require approval before isolating a device, disabling an account, or blocking traffic. Jack Henry hasn’t said where it will draw those boundaries, how customers will audit agent decisions, or what happens when an automated recommendation is wrong.
Release timing, pricing, implementation requirements, and the first participating institutions also remain undisclosed, so the announcement is good on tech direction but light on adoption or performance figures inside an operating bank.
Mandiant Consulting adds threat modelling, security assessments, and red team testing. That work tests the design before attackers do. Gemini handles reasoning, while Google Security Operations provides the data and investigation tools.
Jack Henry must make the combined service fit each institution’s systems, controls, and support model. That integration is the difficult part.
A bank could buy Google’s security products directly. It would still need to connect the right data, define agent permissions, build response procedures, satisfy audit requirements, and decide who remains accountable for each action.
Jack Henry already operates inside that environment. Its core processing, digital banking, payments, lending, and operational products support institutions that rarely replace critical systems. It also manages hosted and on-premises deployments that a cloud provider may not control.
The companies began working together in 2022 on cloud data, reporting, and integration services. Security extends that relationship into a product Jack Henry can configure around each customer and deliver through an existing technology and support contract.
That could make AI security another banking software service rather than a separate enterprise purchase. Core providers already control the connections, implementation work, and customer access needed to distribute agents at scale.
Security specialists still compete on detection quality, threat intelligence, and response tools. CrowdStrike and Palo Alto Networks are adding agents to their products, while Fiserv offers managed cybersecurity services and is developing AI capabilities. Jack Henry competes from a different position. Its advantage is knowing how community institutions run and where security tools must connect.
Google gains a route into thousands of regulated institutions without implementing its products one bank at a time. Jack Henry can add a service whose value depends on its knowledge of each customer’s systems and operating requirements.
This is where enterprise AI economics become clearer. Foundation models can be sourced from a small group of large providers. The commercial asset is access to the workflow where the model can complete useful work under controlled permissions.
That favours software companies with deep customer integration. Fintech founders don’t need to build a foundation model, but a general AI interface won’t be enough. TD’s AI loan decisioning deployment shows why the value comes from placing verification and decision tools inside an active lending workflow. A specialized process, regulated decision, proprietary dataset, or difficult integration gives an agent work that an incumbent can’t easily reproduce.
Jack Henry hasn’t announced a Canadian release, but the deployment problem is familiar. Canadian regulated AI workshops have identified vendor dependence, data quality, model validation, and accountability as barriers to production use.
Access to a capable model isn’t the constraint. Banks need to connect it to existing systems without losing control of data, permissions, decisions, or operational risk. National Bank’s Sardine deployment follows that reality by embedding external device intelligence and risk scoring into retail, commercial, and wealth operations.
The Canada AI Consortium is working on common controls for models, agents, users, and enterprise systems. Its use cases differ from Jack Henry’s security project, but the operating requirement is the same: agents need restricted access, visible decisions, and accountable people.
For Canadian banks and fintechs, the commercial challenge is solving those controls inside regulated workflows. Products that leave the integration and governance work to the bank may struggle to progress beyond a pilot.
As foundation models become easier to replace, will banking software competition depend less on who owns the AI and more on who controls the workflows where agents can act?
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Payments Canada says Canada’s Real-Time Rail (RTR) By-law and Rules received all necessary approvals on June 30, 2026, take effect August 24, 2026, and support a planned Q4 2026 launch. RTR is Canada’s new real-time exchange, clearing and settlement system for instant, data-rich payments.
The approved Rules establish participant roles and the legal operating framework, but they do not provide automatic access. PSP participation can also require RPAA registration where applicable, Payments Canada membership, a direct or agent settlement model, ISO 20022 integration, centralized fraud services, testing, certification and continuous operations.
Coverage includes the RTR By-law, RTR Rules, public policies, PSP participation pathways, direct and indirect settlement, centralized fraud controls, ISO 20022, payment finality, testing, phased launch and the capabilities the framework can support.
Use this Regulatory Intelligence page to understand what is now approved, identify the operating path that fits your role, follow the dependencies behind each capability and open the official documents needed for implementation.
RTR is the result of a decade-long modernization effort, not a 2024 initiative. The journey includes early design work, vendor selection, missed launch targets, a 2023 delay acknowledgement, a 2024 program restart, legal consultation, rule approval and the current transition toward production.
This is the overview readers need before entering the detailed framework. It separates the changes now settled in the approved legal framework from the implementation work that still determines who can participate, how they connect and what they can offer.
The By-law and Rules establish the formal basis for payment-message exchange, clearing, settlement, participant roles, compliance, recourse and system operation. Implication: planning can proceed against approved rules rather than draft policy.
Canadian Payments Act changes and RPAA registration allow eligible PSPs to seek Payments Canada membership and RTR participation. Implication: eligibility opens the route; it does not grant automatic membership, direct settlement or production access.
Organizations may pursue direct settlement, use a settlement agent, build customer products through an RTR participant or provide connectivity and software services. Implication: control, cost, time and continuing obligations differ materially by pathway.
Direct settlement requires a Bank of Canada RTR settlement account; other participants may rely on a settlement agent. Implication: liquidity, funding, contracts, resilience and operating responsibility change with the settlement model.
Confirmation of Payee, Central Fraud Analytics, the Central Risk List and Central Fraud Reporting complement participant controls. Implication: firms must integrate, contribute data, make documented decisions and support continuous fraud operations.
Technical specifications, ISO 20022 mapping, security, testing, certification, operational readiness and 24/7 support remain production gates. Implication: time and cost now shift from rule uncertainty to execution readiness.
Choose the role you want to play, confirm whether RPAA registration applies, and map the Payments Canada membership, settlement, fraud, testing and 24/7 operating work that follows.
Start with the customer result you want to deliver. Then compare direct participation with partner, software, connectivity or managed settlement routes before committing to the highest-cost model.
Rule approval removes one source of uncertainty. The next signals are participant approvals, settlement agreements, certification, pricing, product launches, customer adoption and fraud performance.
Select any item to see what it requires, what it enables and where to go next. Follow the highlighted connections from legal authority and operating rules into participation, controls, customer use cases and infrastructure opportunities. For product nodes, the right panel also points to the numbered shared-rail functions shown directly below this map.
Select the role closest to the operating model being considered. The pathway below shows the sequence of gates, the regulatory and operating work that increases cost or time, what the route unlocks and where a lighter model may be available.
Move from the RTR rules into the distinct regulatory, implementation, competition and innovation questions that affect market entry and commercial deployment.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |