REGULATED
A cryptographic inventory of the systems that hold deposits, move payments and keep records for a decade, with a migration roadmap written for OSFI, a provincial regulator or a board. No downtime. No rip and replace.
LATEST FOR THIS SECTOR
Oct 10, 2026 Fabric guide: Refreshing a 2010 to 2020 network in the AI era, the order of operations
Jun 16, 2026 Bill C-8 receives Royal Assent: Critical Cyber Systems Protection Act now law
Sep 22, 2026 FIPS 140-2 certificates move to NIST's historical list
Oct 7, 2026 AV26-1017: SonicWall SMA1000 Remote Access Appliances Carry a Flaw Exploited in the Wild
Finance is one of the four sectors named in the Critical Cyber Systems Protection Act, which received Royal Assent in June 2026; the regulations that will designate operators and set timelines are being written now. Federally regulated institutions already answer to OSFI's Guideline B-13 on technology and cyber risk management. Provincially regulated credit unions and trust companies answer to their provincial regulators, and most are not yet designated under Bill C-8, which means nobody is asking them today what cryptography protects their core banking, their payment rails and their member data. The Cyber Centre's ITSM.40.001 gives every regulator the same yardstick: inventory first, high priority systems migrated by 2031, everything by 2035.
Financial records are the clearest harvest now, decrypt later case in the country. Account histories, loan files and transaction records must be kept for years and stay sensitive for the life of the customer. Traffic captured today between a branch, a data centre and a payment network can be decrypted when the capability arrives, and the obligation to protect it will not have expired.
The threat model is reputational and regulatory at once: a breach is a front page, a regulator's letter and a membership vote. Attackers treat regional institutions as the softer way in, on the assumption that a credit union or a trust company cannot match a big bank's security budget. Core banking, payments, online and mobile channels, ATM networks and the vendors behind them each carry their own cryptography, chosen at different times by different people, and the institution rarely holds one list of all of it. Consolidation is adding networks nobody has mapped. Boards sign for it all.
The Fall 2026 Discovery Program, scoped to a financial institution:
After the Discovery Program, if you want it: hardening the links that matter with quantum-safe keys delivered, device agnostic, into the firewalls you already run, and ongoing governance so the inventory stays current as vendors and channels change.
Detect first. Every finding is labelled customer supplied, discovered or our judgment, and the report is written for the technology lead who has to act on it and the CEO and board who have to sign for it. Fabric Networks designs, supplies, installs and operates in Canada, from Calgary, on a platform validated to FIPS 140-3. Findings are held in carrier neutral Canadian colocation operated by Fabric. Public demonstrations of the platform by other operators, including a sovereign key model with workloads in public cloud, are recorded in the Library, marked as demonstrations, not as our deliverables.
Credit unions and credit union centrals, provincially and federally regulated trust companies, regional and challenger banks, payment and settlement operators, and the technology, security and risk leads accountable to a board and a regulator for the systems that hold other people's money.
Services for this sector
Guidance
Start here
Not in the first wave, which designates federally regulated institutions. That is the window. Your provincial regulator already expects technology and cyber risk evidence, and the inventory you build now is the answer to both regulators when the second wave comes.
Yes. Discovery is passive: nothing is reconfigured, no agent runs on a core system, and payment connections are observed, not interrupted. Any hardening you choose later runs under its own change control, on the firewalls you already have.
Yes. Vendor run systems are a large part of the point. We map the cryptography at the boundaries you control and record what is customer supplied, what is discovered and what sits inside a vendor's black box, so the dependency is on the record and in the roadmap.
A report written for two readers at once: the technology lead who has to act on it and the directors who have to sign for it, with findings ranked by consequence to deposits, payments and records, and an evidence trail a regulator or an external auditor can follow.
It is one of the best times. An integration assessment inventories the other institution's cryptography before the networks join, so unmapped tunnels and weak key exchange are found before they become yours.
Twenty minutes, no slides. We ask about your sites, what is driving the interest now and what a useful outcome looks like, and we tell you plainly whether a Discovery Program fits or whether a smaller first step is right.
Questions first? Read the answers buyers ask for most.