Canada FinTech Landscape 2024-2025: Navigating Innovation and Regulation

INTRODUCTION

As the Canadian financial technology (“FinTech”) industry advances, regulators and legislators are adapting to manage new risks while still supporting responsible innovation. According to research by KPMG, investments in Canadian FinTechs grew to USD $7.8 billion in the first half of 2024 alone, marking a sharp rise from the USD $1.1 billion total investments in Canadian FinTechs in 2023.¹Pulse of Fintech H1’24, Global Analysis of Investment in Fintech, KPMG International (data provided by PitchBook), *as of June 30, 2024. See: https://assets.kpmg.com/content/dam/kpmg/ ca/pdf/2024/08/pulse-of-fintech-h1-2024-canada-en.pdf This rise in investments and adoption is stated to be primarily spurred by the digital payments and wealth management sectors.

Regulators including the Office of the Superintendent of Financial Institutions (“OSFI”), the Financial Transactions and Reports Analysis Centre of Canada, and the Canadian Securities Administrators (“CSA”), continue to provide guidance and information to ensure responsible innovation in the FinTech sector, especially with respect to areas such as AI and open banking that are certain to transform the FinTech sector in 2025.

MARKET TRENDS

FinTech Business Model Shifts

Advances in digital payments in Canada have significantly transformed the financial landscape, driven by innovations in mobile and digital payment platforms. One notable development is the introduction of the Real-Time Rail (“RTR”), Canada’s first real-time payment system, which is set for industry testing in 2026. This system will enable near-instant transactions between bank accounts, enhancing liquidity for businesses and providing consumers with 24/7 payment capabilities.

Additionally, the surge in contactless payment solutions, such as mobile wallets and tap-to-pay options, has seen widespread adoption. Regulatory and compliance frameworks have evolved to support these advancements. The Retail Payment Activities Act (“RPAA”) mandates that all payment service providers engaged in retail payment activities in Canada register with the Bank of Canada by mid-November 2024. This law aims to safeguard consumers and ensure the integrity of the payment ecosystem.

Open Banking

Current State in Canada

The phased implementation of open banking in Canada is progressing. The federal government outlined its commitment to introducing Canada’s open banking framework in its 2024 Budget. The framework aims to modernize the financial services sector by enabling consumers and small businesses to securely transfer their financial data among financial institutions and accredited third-party service providers, which are developments that will be overseen by several regulatory bodies, including the Financial Consumer Agency of Canada (“FCAC”), OSFI, and privacy regulators.

Stakeholder involvement is crucial to the success of open banking in Canada. The Advisory Committee on Open Banking has recommended the establishment of industry working groups and a steering committee to support the open banking lead. These groups include balanced representation from banks, prospective open banking participants, and consumer representatives.

Data Protection Standards

The legal requirements for data privacy, consent, and security in open banking initiatives in Canada are governed by a robust framework designed to protect consumer data while fostering innovation in the financial sector. Central to this framework is the Personal Information Protection and Electronic Documents Act (“PIPEDA”), which mandates that organizations obtain consent from individuals before collecting, using, or disclosing their personal information. Such consent may need to be express (opt-in) in nature before “sensitive” personal information, which may include financial information, is collected, used, or disclosed.

Provincial private sector privacy laws may also regulate open banking activities, including, British Columbia’s Personal Information Protection Act, Alberta’s Personal Information Protection Act, and Quebec’s Act respecting the protection of personal information in the private sector, together with applicable regulations under each of the above laws.

In addition to PIPEDA and provincial private sector privacy laws, a proposed federal bill, Bill C-27, the Digital Charter Implementation Act, 2022, aims to enhance data privacy protections by introducing the Consumer Privacy Protection Act (“CPPA”). If passed, the CPPA would effectively replace PIPEDA, and introduce new consent requirements and more stringent penalties for non-compliance.

Quebec’s Act respecting the protection of personal information in the private sector also recently introduced requirements that apply to the transfer of personal information outside of the Province, such as the requirement to conduct a privacy impact assessment and informing data subjects that their personal information may be transferred or disclosed outside of the Province.

The RPAA complements privacy regulations by requiring payment service providers to adhere to data protection standards.

Competitive Impact

Open banking in Canada promises to reshape the competitive landscape in the banking sector, providing smaller FinTechs with the opportunity to compete with established local banks. This transformation is driven by regulatory frameworks and technological advancements that facilitate secure data sharing and innovation. The resulting democratization of data access promises to level the playing field, allowing FinTechs to offer innovative services that were previously within the domain of large banks.

One specific example of open banking’s impact is the rise of aggregation platforms that allow consumers to view and manage their financial information from multiple institutions in one place. This not only enhances consumer experience but also promotes healthy competition between FinTechs and traditional banks. In addition, FinTechs can leverage open banking to offer personalized financial products and services, such as budgeting tools and investment advice, which were traditionally offered by banks.

Use of AI in FinTech

AI technology is expected to revolutionize financial services by, among other things, enabling financial institutions and FinTech companies to offer more sophisticated, accessible, and customized products. In September 2024, OSFI and the FCAC jointly issued a report entitled “AI Uses and Risks at Federally Regulated Financial Institutions”, which highlighted that 70% of federally regulated financial institutions (“FRFIs”) plan to use AI by 2026.²OSFI-FCAC Risk Report – AI Uses and Risks at Federally Regulated Financial Institutions, September 24, 2024. See: https://www.osfi-bsif.gc.ca/en/about-osfi/reports-publications/osfi-fcac-risk-report- ai-uses-risks-federally-regulated-financial-institutions The report noted that the current top AI use cases in the financial services industry include applications to assist with operational efficiency, customer engagement, document creation and fraud detection. In many cases, FinTech companies are leading in the application of AI within the industry.

One prominent application that is of particular focus among many FinTechs is the use of AI for automated financial advisory services. This includes the development of robo-advisors, which are often powered by AI algorithms, that provide accessible and affordable investment advice and portfolio management to a wider audience, which challenges traditional wealth management models and encourages the growth of digital wealth platforms.

Many FinTechs are also using AI as an instrumental tool for fraud detection and risk management. Machine learning models can analyse vast amounts of transaction data in order to identify unusual patterns indicative of fraud, which makes fraud prevention more efficient and proactive. For example, Canadian FinTech firms increasingly use AI to monitor transactions in real-time, reducing potential security risks and enhancing trust in digital financial services. Additionally, AI enables the creation of personalized financial products by analysing consumer behaviour and preferences, which allows FinTech firms to tailor their offerings, such as credit products, based on individual needs and credit risk profiles.

REGULATORY DEVELOPMENTS

There are many regulatory developments in Canada that impact the manner in which FinTech companies offer their products and services. Below we highlight a few noteworthy developments.

OSFI Risk Management Policies

OSFI has recently introduced new and amended guidelines that will impact the evolving landscape of FinTechs. One such guideline is Guideline B-13, which

was implemented as of January 1, 2024 and focuses on Technology and Cyber Risk Management. This guideline sets out expectations for the sound management of technology and cyber risk for FRFIs and foreign bank branches. The guideline emphasizes a risk-based approach, allowing institutions to effectively compete while maintaining robust technology risk management practices. Guideline B-13 requires FRFIs to implement comprehensive measures to manage technology and cyber risks, including enhanced governance, risk management, and incident response protocols. While FinTechs are not regulated by OSFI, this guideline as well as others are relevant for FinTechs when providing services to FRFIs. Depending on the nature of the services provided, it is common for FinTechs working with FRFIs to be contractually obligated to abide by the heightened technology and cyber risk management obligations set out in the guideline.

Additionally, OSFI has updated Guideline B-10, which includes updates to its policies on operational resilience, cybersecurity, and third-party risk management. These updates again will impact FinTechs when operating as third-party service providers to FRFIs.

AI Law and Regulations

FinTechs dealing with AI continue to operate in an evolving legislative and regulatory environment in Canada. Given the sensitive consumer financial data that some FinTech’s allow AI programs to train on and analyse, and the risks relating to certain AI use cases, Canadian legislators and financial regulators are acutely aware of the need for AI usage to be ethical, transparent, and fair. To this end, Canadian lawmakers are currently considering the adoption of the Artificial Intelligence and Data Act (“AIDA”), a comprehensive piece of AI legislation which would impose requirements for certain AI systems on a nation-wide basis. In addition, Canadian regulators have signaled their intention to introduce robust guidelines that would address AI risks, including potential biases in AI models, reflecting concerns over fairness and non-discrimination.

For example, OSFI has developed what it calls the EDGE principle for responsible AI, which stands for explainability, data, governance, and ethics.³Financial Industry Forum on Artificial Intelligence: A Canadian Perspective on Responsible AI, April 2023. See: https://www.osfi-bsif.gc.ca/sites/default/files/documents/ai-ia_en.pdf. The EDGE principle outlines the key considerations that financial institutions should take into account when developing and using AI tools. In addition, in October 2023, the Ontario Securities Commission issued a report entitled “Artificial Intelligence in Capital Markets” which explored the current use cases of AI in Ontario’s capital markets, which was intended to serve as a key stepping stone to determine what further oversight, regulation or guidance would be needed to best support responsible innovation and adoption of AI in Ontario’s markets.⁴Artificial Intelligence in Capital Markets: Exploring Use Cases in Ontario, October 10, 2023. See: https://oscinnovation.ca/resources/Report-20231010-artificial-intelligence-in-capital-markets. pdf.

The global influence of AI standards, such as those from the European Union’s AI Act and the OECD’s AI Principles,⁵Organisation for Economic Co-operation and Development AI Principles. See: https://www.oecd.org/en/topics/sub-issues/ai-principles.html. has also played a role in shaping Canadian legislative and regulatory policies, positioning Canada as an active participant in international regulatory dialogues on AI ethics and safety.

Crypto-Asset Regulation

OSFI and the CSA have recently introduced significant regulatory updates to address the evolving landscape of crypto platforms and digital asset management in Canada. One notable development is OSFI’s advisory on the regulatory capital and liquidity treatment of crypto-asset exposures held by federally regulated financial institutions. An interim approach was outlined by OSFI in August 2022, when the organization issued guidelines that set out their expectations for managing the risks associated with crypto assets, including that institutions must maintain adequate capital and liquidity buffers when dealing with crypto assets. As a follow-up, OSFI recently disclosed in their Semi-annual update for Fiscal Year 2024-2025 that the “final revised guidance on capital and liquidity treatment or crypto”, and the “final guideline on public disclosure of crypto assets”, are planned to be issued in Q1 of 2025.⁶OSFI Annual Risk Outlook – Semi-annual update – Fiscal Year 2024-2025, October 2, 2024. See: https://www.osfi-bsif.gc.ca/en/about-osfi/reports-publications/annual-risk-outlook-semi-annual- update-fiscal-year-2024-2025.

In addition, the CSA has been proactive in ensuring compliance with securities laws by participants in the crypto industry, particularly crypto asset trading platforms (“CTPs”). To that end, the CSA recently issued two important Staff Notices on crypto asset trading platforms, including CSA Staff Notice 21-332 on pre-registration undertakings (“PRUs”), and CSA Staff Notice 21-333 on value-referenced crypto assets (“VRCAs”) (which are colloquially referred to as stablecoins).

Regarding CSA Staff Notice 21-332, the CSA sought to better protect Canadian investors in light of recent large CTP insolvencies. The Notice imposed increased commitments on CTPs that sought to operate in Canada while seeking registration and other exemptive relief, through an enhanced pre-registration undertaking. Regarding CSA Staff Notice 21-333, the CSA sought to provide additional guidance to, and impose further obligations on, CTPs in relation to VRCAs, including additional terms and conditions to which CTPs and the issuer of the VRCA must subscribe when CTPs allow their clients to continue trading certain specified VRCAs.

CONCLUSION

The Canadian FinTech industry stands at a crucial crossroads, balancing the need for regulatory oversight with the desire for continued innovation. Looking ahead, FinTech regulations in Canada are expected to evolve, addressing both emerging technologies like AI and blockchain, and areas like privacy and consumer protection. On the global stage, Canada’s approach to FinTech regulation—especially in areas like AI and open banking—positions it as a proactive leader among comparable economies, potentially offering a model for other countries navigating similar regulatory and technological landscapes