Tag Archives: finance

Immature AI Bots, Or Immature Banks?

Are we dealing with immature AI bots who don’t know what they’re doing, or immature banks who are panicking?

When we introduce any new technology there are always growing pains. Many of us don’t understand how the technology works and we need to adjust our behaviors. As I’ve said before, business problems are tougher than technology problems. We can technically do many things…but do we want to?

Royal Bank of Canada blocks personal AI agents

Take bots and banking. We can remove the drudgery of banking operations by assigning an AI agent to perform our banking for us.

Well…unless you bank with the Royal Bank of Canada, which is banning the bots:

“Royal Bank of Canada (RBC) has decided to block third-party personal AI agents from direct access to online banking and other RBC digital properties due to concerns about fraud and consumer harm.”

Why?

“…as these systems become more autonomous, the stakes go up when something goes wrong—from fraud and consumer harm to risks that could ripple more broadly through the financial system. That’s why, after careful consideration and based on what we know today, RBC has decided to block third-party personal AI agents from direct access to authenticated RBC digital properties including online banking.”

Traditional banks tend to act conservatively, so it’s not surprising that this bank is leery of personal AI agents. Some consider this a tacit admission that RBC is not ready to integrate the new technology yet.

Then again, is anybody? Is your local bleeding edge financial rockstar entity truly prepared for what AI agents can do?

Proof suggests a solution

The identity company Proof is monitoring these bot blocks and thinks there is a better way. Proof acknowledges the problem that threw Royal Bank of Canada (and Amazon) into a frenzy:

“There is no reliable way to know who an AI agent is acting on behalf of, or whether that person authorized what it is doing.”

Taking FinCEN’s verifiable credentials clarifications into account, Proof launched a new product.

“Proof became the first company to put verified legal identity and transaction authorization for AI agents into production with the launch of x401, an open protocol that lets any website ask an AI agent to prove who it’s acting for and what that person approved. Proof works with Meta’s Muse, ChatGPT dots, Grok, Claude and other assistants that support the Model Context Protocol (MCP).”

Is this enough to calm RBC and Amazon? We’ll see.

Using AI Hacking Tools Against Latin American Banks

Using AI hacking tools? Then you’re ahead of the AI companies themselves, and the companies being hacked.

PYMNTS reported that Latin American banks were hacked by a group called CyberCartel. The group used AI tools, including Claude and Grok, to achieve their illicit aims.

The whole episode shows “hackers employing AI models to automate breaches into financial institutions. In this case, CyberCartel seems to have used the agents to help it steal password and consumer data, and to access customer bank accounts autonomously without much human effort.”

Because fraudsters have the same financial pressures as legitimate firms. If it’s too expensive to use U.S. humans, use offshore humans. And if that’s too expensive, use bots.

And if the tokens for the bots cost too much…well, that’s why CyberCartel was hacking banks.

Now of course Anthropic plugged CyberCartel’s access…after the fact. Because fraudsters can assemble AI hacking tools so quickly, they can often mount an attack BEFORE the target can defend against it.

The constant battle between fraudsters and the good people continues, just much more rapidly.

Nasdaq and 23×5

As a follow-up to my Friday post “Is Sleep Necessary, 23×5 Stock Exchange Traders?” Here are the specifics for Nasdaq, including the Nasdaq services that will NOT support 23×5 on December 6.

“On December 6, 2026, the Nasdaq Stock Market will introduce new trading hours from 9:00 pm-4:00 am ET. Together with the current extended trading hours that run from 4:00 am-9:30 am and 4:00 pm-8:00 pm ET, these hours will collectively constitute the Global Trading Session. Together with the US Trading Session 9:30am-4:00pm, and marked by the Opening and Closing Crosses, this will allow for continuous trading 23 hours a day, 5 days a week.”

So the non-trading hour is from 8-9pm ET, or 5-6pm PT.

Why? For the reasons I stated before.

“The worldwide economy and its stock exchanges are interconnected. As the University of Iowa reminds us, ‘An investor in Seoul may be buying while someone in Des Moines is selling.’”

NTX and PSX will NOT support 23×5 yet

But in the case of Nasdaq, the company operates multiple exchanges. And some are not affected by the change.

“Nasdaq Texas (NTX) and PSX equity exchanges will continue to operate on their current schedules; NTX: 7 a.m. to 7 p.m. ET and PSX: 8 a.m. to 5 p.m. ET. Nasdaq options exchanges will also continue to operate on their current schedules.”

I had never heard of Nasdaq Texas before. Turns out it’s new, just launched in March of this year. Why? To “expand Nasdaq’s services for companies across the state while bringing new growth and investment opportunities to U.S. investors.” Of course, anyone on Nasdaq Texas won’t innovate ANYTHING after 6:00 pm Central Time. So if you’re in Seoul, bypass Dallas and go straight to New York.

The Nasdaq Philadelphia Stock Exchange (PSX) is a little older, with a founding date of 1790. Older than the New York Stock Exchange (1792) or Nasdaq itself (1971). But again, they’re closed at night.

Nasdaq also owns Nasdaq Canada, but the Canadian exchanges (including the Toronto Stock Exchange (TSX), TSX Venture Exchange (TSX-V), Canadian Securities Exchange (CSE), and NEO Exchange (NEO)) aren’t part of the December 6 23×5 launch.

But they’re all moving in that direction.

Is Sleep Necessary, 23×5 Stock Exchange Traders?

23×5 stock exchange traders? This couldn’t have happened a century ago, but it will happen before the end of the year.

Sleep is unproductive and a waste of time

If you were on FriendFeed before Facebook bought it, you probably heard Louis Gray utter that sentence. But even in 2010, Gray was having second thoughts.

“I’m not 22 years old any more, like I was in 1999, when there was little keeping me from being 100 percent dedicated to the job. Now, staying a few extra hours at the office, or embedded in my laptop at home, takes time away from my wife and the twins. While I wouldn’t exchange them for anything, I do sometimes get jealous at the opportunity some Valley leaders have to feed the fire in their belly to achieve and achieve.”

Now the 2010 version of Louis Gray could have been active all night AND returned to his family. The solution was to hire an Indian, with roughly 12 hours’ time difference from Silicon Valley.

23x5 stock exchange coverage via India. Google Gemini.
23×5 coverage via India. Google Gemini.

Of course you can achieve 24 hour coverage without a human by employing a bot to do the work while you sleep. But those bots (or, in the old terms, “algorithmic trading”) are restricted in what they can do and can’t do.

23x5 stock exchange coverage via algorithmic trading. Google Gemini.
23×5 coverage via algorithmic trading. Google Gemini.

But some sort of help, human or non-human, is necessary. If you wanted to trade on the New York Stock Exchange in the 1920s, you had to have someone in New York. Maybe you were in Chicago, but you had to contact New York to execute the trade. There wasn’t really a call for someone in Korea to buy American stocks.

The 2026 financial markets require 23×5 stock exchange trading

There is now. The worldwide economy and its stock exchanges are interconnected. As the University of Iowa reminds us, “An investor in Seoul may be buying while someone in Des Moines is selling.”

To facilitate that, closing the stock markets at 1:00 pm Pacific Time will soon become a thing of the past.

“Starting in early December, the U.S. stock market will move toward an expanded 23×5 trading schedule — open roughly 23 hours a day, five days a week, with a one-hour daily break for system maintenance — marking ‘the most significant expansion of trading hours for U.S. national securities exchanges in decades,’ [Professor Bidisha] Chakrabarty said.”

Chakrabarty clarifies that this is not entirely a new thing, but recognizes what has already been going on with after-hours trading. This merely formalizes that process, and is expected to result in greater night-time trading activity as this becomes normal. Especially from international traders.

“There are certainly some benefits to a 23×5 trading schedule. For example, investors in Tokyo, Frankfurt and other parts of the world will have greater opportunities to trade U.S. stocks during their own waking hours. Investors who want to respond to important news in the evening will not necessarily have to wait until the next morning. And when information is incorporated into prices sooner, markets may be able to reflect that information more quickly.”

But…and there’s always a but…

“We can extend the trading day but cannot just assume that every piece of the financial system underneath it is ready to operate identically around the clock.”

System maintenance. Cybersecurity protection. You need to run and schedule these with the full knowledge that the system won’t shut down at 1pm Pacific.

Which is why everyone is preparing now.

Money Laundering Risk at Bank of America

Financial institutions are supposed to reduce money laundering risk. But sometimes they don’t.

The Financial Crimes Enforcement Network (FinCEN), the Office of the Comptroller of the Currency (OCC), and the Office of Foreign Assets Control (OFAC) fined Bank of America for numerous violations of anti-money laundering laws. The agencies found that the bank was guilty of the following:

  • A “failure to mitigate and report priority national security risks, including Chinese Money Laundering Networks and illicit finance along the southwest border.”
  • A “deficient and ineffective BSA/AML (anti-money laundering) compliance program.”
  • “[A]pparent violations of numerous sanctions programs, including on Iran, Russia, narcotics, and global terrorism.”

It all boils down to “Know Your Customer.” If you don’t know who is doing business at your financial institution, you’re in trouble. You could promote illegal efforts from China, Iran, Russia, terrorists, and drug dealers.

Money laundering risk. Google Gemini.
Money laundering risk. Google Gemini.

How do YOU minimize money laundering? Let Bredemarket help you communicate your solution. https://bredemarket.com/watch-book/

Revised 10/28/2026.

Banking Use of mDLs: Can the Bank Recognize an mDL?

If your bank can’t recognize an mDL (mobile driver’s license), your money may be in danger. Someone with a fake mDL can steal your money.

If you recall my September 18 post on banking use of mobile driver’s licenses (mDLs), you know that the U.S. Department of Treasury’s Financial Crimes Enforcement Network (FinCEN) participated in a joint statement that clarified acceptable identification for banks and credit unions.

“[The agencies] are issuing two new frequently asked questions (FAQs) that address the use of state-issued mobile driver’s licenses (mDLs) and other government-issued verifiable digital credentials, which may be used to verify identities of natural person customers under the Customer Identification Program (CIP) Rule.”

Slam dunk, right?

Not according to Anderson Insights, as PYMNTS reports.

“According to Anderson, the central issue is not whether digital identification is legally acceptable, but whether banks’ technology, records and exception-handling procedures can support a defensible identity-verification decision.”

To put it plainly, how does a bank teller know that I’m presenting a real mobile driver’s license? Does the teller have the knowledge and the equipment to detect fraudulent mDLs?

Whether evaluating a physical driver’s license or a mobile one, both knowledge and equipment are important. The person reviewing the license has to understand what a real license is like, and what a fake license is like. Ideally, the reviewer’s employer has provided the reviewer with equipment to help distinguish real licenses from fake ones.

If not, someone can present a fake mDL and steal your money.

Heck, we haven’t mastered this for physical driver’s licenses, which have been around for decades. What leads one to believe that we can detect mobile driver’s licenses?

Because sometimes a fake ID is obvious…and sometimes it isn’t.

Recognize an mDL? Recognize a fake one? Google Gemini.
Recognize an mDL? Recognize a fake one? Google Gemini.

Do you provide an identity solution and need to educate your audiences, both external and internal, about how it works?

Bredemarket can help. Learn more at https://bredemarket.com/watch-book/

Bredemarket services, processes, and pricing in 15 seconds. Revised 10/28/2026.

Is Cross-Border Payment Friction a Problem Or a Benefit?

We can avoid cross-border payment friction by using stablecoins, according to Mastercard, But is this a good or a bad thing?

Why cross-border payment friction

Back 50 years ago, the immediate transfer of money from one bank account to another was usually impossible. First you had to get your checkbook and a pen and write a check from your bank account. Then you had to mail the check to the other entity. The other entity would have to deposit the check into their bank account. Then they would have to wait for the check to clear.

Cross-border payments were even worse. Not only did you have to do all of the above (and account for the time it takes to send the check from one country to another), but you also had to deal with currency exchange.

And even if you used more “modern” methods than check writing, the process was still pretty manual. Typing transfer instructions into a Telex machine. Transferring money from the sending bank to the receiving bank via “correspondent banks.” Processing the transfer at odd local hours to meet the other bank’s regular business hours. Oh, and manual government monitoring of foreign transfers.

Things are a lot better today. Rather than one to three weeks, many transfers complete in one to three business days. While some are faster, other’s aren’t.

One to three business days isn’t fast enough.

Mastercard’s solution: stablecoins

Mastercard, which 50 years ago was known as MasterCharge, is one of four companies offering a much faster solution based upon stablecoins.

“[Michael] Miebach highlighted Mastercard’s backing of Open Standard and its recently issued U.S. dollar-backed stablecoin….

“Mastercard is one of the four integration paths through which businesses can get started with OUSD. The other three are Stripe, Coinbase, and Visa.”

Is the elimination of cross-border payment friction a good thing? Google Gemini.
Is the elimination of cross-border payment friction a good thing? Google Gemini.

Stablecoins are a form of cryptocurrency, pegged to specific real-world currencies such as the U.S. dollar. Because crypto transactions are instantaneous once they are recorded on the ledger, money can move much more quickly. No three-week wait to get your money from one country to another.

“For cross-border B2B transfers, stablecoins provide a solution for speed, cost and currency exposure. Stablecoins settle in seconds at a fraction of the cost of traditional cross-border wire transfers. In markets where local currencies are depreciating, stablecoins preserve purchasing power, access dollar-denominated liquidity and protect against inflation…”

So what could go wrong?

Four problems with using stablecoins for cross-border payment

There are potential drawbacks to using stablecoins for cross-border payments.

  • Converting to and from fiat currencies. If all of us, including the banks, used U.S. dollar denominated stablecoins, there would be no problem. But you have to transfer the money to stablecoins before sending, and then transfer it out of stablecoin (potentially into euros or a non-U.S. currency) after sending. And those processes aren’t necessarily as instantaneous as moving stablecoins across borders. Add in the conversion fees, and there’s still friction.
  • Regulations. Different countries impose different regulations on stablecoin transfers. Some ban “crypto-fiat” off-ramps. Some require collection and transmission of sender/receiver identity information, and hold up the transaction if any of this is missing.
  • Various risks. A fiat-backed stablecoin is only as safe as its issuer’s reserves. Market stress can affect this. And temporary issues in the market sometimes result in a “stable” coin not maintaining its 1:1 exchange rate with the fiat currency in question.
  • Lack of protection. Blockchain transfers are instantaneous and final. There’s no appeal procedure like you have with traditional financial institutions. If you send the stablecoin to the wrong wallet, tough.

If you are risk averse, then instantaneous stablecoin transactions are NOT for you.

CFTC Swaps, and the Differentiation Gambling Apps Are Missing

So the feds and states war over CFTC swaps. States say that Kalshi et al promote gambling, while the CFTC argues they are just “swaps.”

So, what is a “swap”?

“commission-regulated financial instruments where two parties agree to an exchange”

This is opposed to gambling, where a casino governs the entire transaction, sets the payouts, and the like.

Gambling depends upon the emotions of adventure. Google Gemini.
Gambling depends upon the emotions of adventure. Google Gemini.

However, a recent federal court ruling agreed with the states of Ohio and Tennessee that the practices of Kalshi, Polymarket, et al do NOT meet the legal definition of a swap.

So what is the CFTC doing? Amending its rules. The draft rules have been forwarded to the Office of Management and Budget, which performs a final review before the government adopts new rules.

Gambling firms’ missed opportunity

But the gambling firms could nip this in the bud, rule or no rule, if they just adopted proactive marketing messaging.

Prediction markets, CFTC regulated. Google Gemini.
Prediction markets, CFTC regulated. Google Gemini.

The prediction market apps are dancing on a high wire. On the one hand, they have to argue that their products offer predictions, which fall under the purview of the CFTC, and are not gambling. At the same time they have to attract customers who “predict” who will win at sports such as NFL football.

Oh, how I’d love to write the counter-messaging for pure gambling operations right now.

CFTC “swaps”: are they REAL gambling? Google Gemini.
CFTC “swaps”: are they REAL gambling? Google Gemini.

Gambling depends upon the emotions of adventure. The dings and sounds of the casino. The thrill of the big money win. The accomplishment in beating “the house.”

True gamblers aren’t tech weenies who trade in prediction markets when they’re not buying hog futures.

Music Google Lyria. Public Domain.

OK, so maybe Bredemarket won’t sign on a casino as a client any time soon. Then again, casinos certainly have a need for biometric products, and I am the biometric product marketing expert.

If I can help you, gambling firm or not, visit https://bredemarket.com/watch-book/.

Revised 10/28/2026.

Banking Use of mDLs

Is banking use of mDLs permitted when you have to prove your identity? Before we dive into this, let’s define some things.

This post looks at five acronyms:

  • CIP, for the Customer Identification Program (Rule)
  • VDC, for Verifiable Digital Credential
  • mDL, for mobile Driver’s License
  • FAQ, for Frequently Asked Question
  • FinCEN, for Financial Crimes Enforcement Network

Finally, we look at FinCEN’s FAQs regarding CIP acceptance of mDLs as VDCs.

Five acronyms

A Customer Identification Program (CIP), mandated by Section 326 of the USA Patriot Act and other legislation, specifies how financial institutions implement Know Your Customer (KYC) and anti-money laundering (AML) programs to stop terrorists and others from sending illicit money through the institutions. Each individual financial institution writes its own CIP, and at a minimum it dictates that the institution collect the customer’s name, address, government-issued identification number, and (for individuals) their date of birth.

A Verifiable Digital Credential (VDC) is one way to gather the information mandated by a financial institution’s CIP. NIST breaks down the three words in the name:

  • Verifiable: cryptographically, to verify the authenticity and integrity of the data.
  • Digital: on a smartphone, a cloud wallet, or somewhere similar.
  • Credential: issued by a government, educational institution, or some similar holder of personal information.

We’ve talked about mobile Driver’s Licenses (mDLs) before. They’re VDCs that display the same information (or a subset) that is contained on your physical driver’s license. And they’re not restricted to the United States.

A collection of Frequently Asked Questions (FAQs) supposedly answers the most pressing questions about a particular service. Even Bredemarket has a collection of FAQs, but they’re hopelessly outdated. Add to to-do list.

Finally, the Financial Crimes Enforcement Network (FinCEN) is part of the U.S. Department of the Treasury. We’ve talked about FinCEN before also: what it does, and what it doesn’t do.

Is banking use of MDLs allowed?

A mobile driver’s license does you no good if no one accepts it.

There are precious few places where I can use my California mDL. The Transportation Security Administration people at Ontario International Airport accept them, but that’s about it.

Which is why FinCEN’s new FAQs are so important.

“The U.S. Department of Treasury’s Financial Crimes Enforcement Network (FinCEN), jointly with the staffs of the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Office of the Comptroller of the Currency (the “Agencies”), are issuing two new frequently asked questions (FAQs) that address the use of state-issued mobile driver’s licenses (mDLs) and other government-issued verifiable digital credentials, which may be used to verify identities of natural person customers under the Customer Identification Program (CIP) Rule.”

I will save you from having to read the FAQs.

Yes, the industry supports banking use of mDLs.

Banking use of mDLs is permitted.
Google Gemini.

Breach Reporting For Financial Institutions, Including Car Dealers

(Update: Statement from IDScan.net. You heard it here last.)

I’ve talked about breach reporting a lot…and expect to talk about it more over the next few days.

Car dealers

But who has to report?

The Federal Trade Commission (FTC) is one of many agencies that regulate financial institutions.

Including one type of financial institution that we normally don’t think of as such.

A limousine with tinted windows in which one passenger is barely visible.
An automobile. Google Gemini.

From the FTC:

“The FTC’s Safeguards Rule, which dates back to 2003, requires financial institutions to maintain safeguards to protect customer information. The FTC issued the Rule to implement the requirements of the Gramm-Leach-Bliley Act, and it applies to financial institutions subject to the FTC’s authority.”

Go on…

“That includes most automobile dealers who finance or lease automobiles.”

The safeguards

So what safeguards do car dealers need to implement?

His private information leaked. Did the leaker perform required breach reporting?
The leak. Google Gemini.
  • Maintain a comprehensive written information security program that covers the customer information, including unauthorized access to the information. The program must cover any third-party service providers that can access the customer information, including anyone who bought or sold the data.
  • Create a written security incident response and recovery plan so that when things go wrong, you are prepared.
  • Update your information security program as necessary.

Mechanics of breach reporting

The most visible part of the response and recovery plan is breach reporting in accordance with federal law and state law.

Breach reporting requires notification of affected consumers.
Notifications. Google Gemini.

I previously outlined California breach reporting requirements:

“Under California SB 446, a firm must notify affected California residents within 30 calendar days of discovering or being alerted to the breach.”

Other states have their own notification requirements.

The third-party effect

And here’s where it gets interesting.

For the last few days, I’ve been waiting for a particular identity verification provider to report a breach of over 153 million driver’s licenses and other data.

But that firm will be just one of many firms that will be reporting. Many if not all companies that provided data to this identity verification provider will ALSO have to report.

Third party risk management, illustrated by a locked safe connected to a breached safe.
TPRM. Imagen 3.

Good old third-party risk management in a high-risk breach.

Expect a flood of notifications, possibly very soon.

What should you say in advance of breach reporting?

But breach reporting is not enough. Your firm, whether it’s a car dealer, an identity verification provider, or someone else, needs to proactively communicate how you handle breaches. And communicate this long before a breach occurs.

Why? To give your customers reassurance that if a breach happens, you’ll handle it.

Have you developed:

  • the strategy to explain how you will handle PII breaches?
  • the tactics to write these explanations for your content and your proposals?

If you haven’t, bring on an experienced identity, privacy, and product marketing consultant to help you with your strategy and tactics.

John E. Bredehoft in Bredemarket’s worldwide corporate headquarters in Ontario, California.

Bring on Bredemarket.

And book a free appointment to assess your needs.

Feel free to reshare using the “Share this” buttons below.