"As of September 8, 2025, PSPs must have established risk management and funds safeguarding frameworks," the Bank of Canada states on its retail payments supervision page, and on 12 June 2026 the Bank announced that it would begin publishing Notices of Violation by payment service providers. Part of that framework is a testing methodology: section 9 of the Retail Payment Activities Regulations says a payment service provider "must establish and implement a testing methodology" to find gaps and vulnerabilities in its systems and controls. For the first time, a Canadian fintech that is not a bank answers to a federal supervisor for how it tests its own security.
The other pressure comes from customers. A fintech that sells to a bank meets OSFI Guideline B-10 in the bank's due diligence; one that sells to a Quebec caisse or an Ontario or British Columbia credit union meets the AMF, FSRA or BCFSA through its customer; one that touches card data meets PCI DSS. This ranking is written for the fintech: payment service providers, lenders, neobanks and wealth apps, crypto platforms and fintech SaaS sold to financial institutions. It sets out what each Canadian instrument actually says about testing, what the test has to cover, and which firms publish real Canadian financial services work. For a global view, see the global fintech ranking; for banks and credit unions buying testing for their own estate, see the banking and credit union ranking.
Quick answer. The best Canadian fintech penetration testing companies in 2026 are Stingrai, OKIOK, Forward Security, ISA Cybersecurity, Kobalt.io and Mirai Security. Stingrai ranks first: a CREST-accredited firm headquartered in Toronto that puts two named penetration testers on the payment flows, roles and APIs of a fintech product, includes retesting and an attestation letter a bank's vendor risk team can file, and delivers it as a one-time annual test or a continuous program. OKIOK follows for Quebec fintechs facing OSFI B-13, AMF and PCI DSS questions, and Forward Security for white box application testing in Vancouver. The only Canadian-facing text that requires a penetration test outright is PCI DSS requirement 11.4; the RPAA requires a testing methodology, and OSFI and the AMF name penetration testing in guidance that says "should".
What Canadian rules and customers require of a fintech in 2026
Each instrument below is quoted from its own text, with its version and date. Most of them do not name the penetration test; where they do, the verb is usually "should". The test still ends up as the evidence, because it is the most direct way to show that controls work.
The Retail Payment Activities Act and section 9 of its Regulations
The Retail Payment Activities Act applies to payment service providers that perform payment functions such as holding funds on behalf of an end user, initiating an electronic funds transfer at an end user's request, or authorizing and transmitting payment instructions. Section 17(1) requires a provider to "establish, implement and maintain a risk management and incident response framework that meets prescribed requirements." Provincially regulated financial institutions, including credit unions, caisses populaires, insurance companies, trust companies, and loan companies that accept deposits transferable by order, are excluded under section 9 of the Act, as the Bank of Canada's FAQ explains. Applications for registration were filed in a 15-day window opening on 1 November 2024, during a transition period that ran to 7 September 2025, and the framework obligations have applied since 8 September 2025.
The Retail Payment Activities Regulations (SOR/2023-229) set out what the framework contains. Section 9(1) is the testing rule:
"A payment service provider must establish and implement a testing methodology, for the purpose of identifying gaps in the effectiveness of, and vulnerabilities in, the systems, policies, procedures, processes, controls and other means provided for in its risk management and incident response framework..."
The methodology must be proportionate to the provider's ubiquity and connectedness, be "designed taking into account both high-likelihood and high-impact operational risks," involve relevant internal stakeholders, take into account reliance on third-party service providers, set "the frequency and scope of testing," and provide for "testing before the adoption of any material change." Section 9(2) requires a record of each test's date, methodology, results and the measures taken. Section 10(1) adds that a provider with an internal or external auditor must have a sufficiently skilled individual who had no role in the framework carry out an independent review "at least once every three years."
The Regulations do not use the words "penetration test." They require a testing methodology that finds vulnerabilities, and a penetration test of the payment application and its infrastructure is the most common way to show that one exists and works.
Section 5(3) matters for fintech vendors too. A provider that uses third-party service providers must assess each of them "no less than once a year" and before entering into, renewing or substantially amending a contract, including "the third-party service provider's ability to protect data and information" and "the security of the third-party service provider's connections to and from the payment service provider's systems." A fintech SaaS company serving payment service providers should expect that assessment every year.
The Bank of Canada's guideline: section 10 and Appendix G
The Bank's supervisory guideline Operational risk and incident response is dated October 2024. The PDF the Bank serves today was re-issued in June 2026 and still carries the October 2024 date. Section 10 gives guidance on section 9 of the Regulations:
10.2: "PSPs should document their testing methodology" with its scope, the reasoning for each test's method, frequency, stakeholders, internal reporting and how results are remediated.
10.4: "PSPs should take a risk-based approach to the scope and frequency of testing. They should test more important systems ... more frequently and in more depth."
10.6: providers "may use the results of testing conducted for other purposes" to show compliance, provided they meet the objectives of section 9. A PCI DSS penetration test can serve, if its scope covers what section 9 needs.
10.7: the Bank expects three categories of tests: verifying and validating controls, scenario-based testing, and testing of changes.
10.16: "PSPs must take timely actions to remedy gaps and vulnerabilities," restating the duty in the Act and Regulations.
Appendix G is where penetration testing appears by name. Paragraph 4: "When taking a proportional approach to testing, relatively more ubiquitous or interconnected PSPs could adopt additional testing for cyber and information technology risks, including penetration tests and attack simulation exercises." It adds that "Parties and teams that conduct penetration testing should have demonstrable skills and experience, including technical expertise in network, operating system or application-level security." Paragraph 5: "Tests may be conducted internally or by a third party. While this is largely at the discretion of the PSP, the Bank notes that qualified parties should conduct specialized testing, such as penetration testing."
Read precisely, the Bank does not require every payment service provider to run a penetration test. It requires a methodology, says larger and more connected providers "could" add penetration tests, and says whoever runs them "should" be qualified. The checklist below turns section 9 and the guideline into steps a payment service provider can act on.
OSFI Guideline B-13: what banks expect of themselves
Guideline B-13, Technology and Cyber Risk Management, dated 31 July 2022, applies to federally regulated financial institutions (FRFIs) and took effect on 1 January 2024, according to OSFI's release letter. Section 3.1.2, "Intelligence-led threat assessment and testing is conducted," reads:
"FRFIs should adopt a risk-based approach to threat assessment and testing. FRFIs should set defined triggers, and minimum frequencies, for intelligence-led threat assessments to test cyber security processes and controls. FRFIs should also regularly perform tests and exercises, to identify vulnerabilities or control gaps in its cyber security programs (e.g., penetration testing and red teaming) using an intelligence-led approach."
B-13 binds the bank, not the fintech. A fintech does not owe OSFI a penetration test. What it owes is answers: when a bank's test program covers the integration points with a vendor, or when the bank asks for evidence that the vendor's platform has been tested, the fintech's own report is what it hands over.
OSFI Guideline B-10: how banks pass expectations to fintechs
Guideline B-10, Third-Party Risk Management, dated 30 April 2023, took effect on 1 May 2024, per OSFI's response to consultation feedback. Three provisions shape what a bank asks a fintech vendor:
Section 4.2: "Where necessitated by risk and/or criticality, the FRFI should establish processes to ensure that third parties with elevated levels of technology and cyber risk comply with FRFI standards" (or recognized industry standards) "for mitigating risk, notably in the areas of access management, and data security and protection."
Principle 8: "The FRFI should also have the right to conduct or commission an independent audit of a third party," and section 2.3.3.3 says the FRFI "should employ a range of audit and information gathering methods (e.g., independent reports provided by third parties...)."
Annex 1 lists due diligence factors for high-risk and critical arrangements, including the "Strength of the third party's information security programs including their alignment with the FRFI's programs" and the third party's capacity to manage technology and cyber risks in accordance with B-13.
B-10 does not name penetration testing. In practice, a recent independent penetration test report, or a summary letter with retest results, is the independent report most vendor risk teams ask for. The completion letter versus full report guide covers what to share.
Quebec: the AMF's ICT guideline
The Autorité des marchés financiers' Guideline on Information and Communications Technology Risk Management, dated February 2020, applies to authorized insurers, federations of mutual companies, financial services cooperatives, authorized trust companies, savings companies and other deposit institutions, and the AMF expected them to adopt it by 27 February 2021. Its Appendix, under "ICT security," is more direct about penetration testing than any federal text:
"The financial institution should subject its information security controls to various types of periodic independent assessments, tests and reviews as well as penetration testing and red team exercises."
Footnote 36 qualifies it: penetration tests "produce an image of a computer system in a specific state and at a specific time" and "are not substitutes for an ICT risk assessment." The guideline also notes that "Outsourcing does not necessarily reduce ITC-related risks," so a fintech serving a Quebec caisse or insurer can expect questions about its own testing. Quebec privacy duties for the same fintech are covered in the Law 25 penetration testing guide.
Provincial credit union regulators: FSRA and BCFSA
Ontario's Financial Services Regulatory Authority issued Information Technology risk management guidance (GR0016INT), effective 1 April 2024 and due for review no later than June 2028. For credit unions and caisses populaires it is an interpretation of the Sound Business and Financial Practices Rule: "Credit Unions and Caisses Populaires ('CUs') must achieve the desired outcomes of the practices for effective IT risk management in order to satisfy requirements in the SBFP Rule," including notifying FSRA of a material IT risk incident "no later than 72 hours." For third-party providers, FSRA's examples of practices that support those outcomes include that the CU "Includes the rights to audit and access information in its third-party contracts" and "Has a process or mechanism to periodically test a TPP's compliance with the CU's IT risk management policies and procedures." The guidance does not mention penetration testing.
British Columbia's Financial Services Authority published a new Information Security Guideline in March 2025, which replaced the October 2021 version and took effect on 1 July 2025 for BC-incorporated credit unions, insurance companies and trust companies. Under "Protect," it says a provincially regulated financial institution "should" "Establish and implement a testing process that validates the robustness and effectiveness of the security measures" and "Ensure that tests are conducted in the event of changes to infrastructure, processes, or procedures." Where information management is outsourced, "BCFSA expects PRFIs to ensure that all service providers comply with all applicable legislation, regulations, and/or rules, as well as this Guideline in their treatment of the PRFI's information." Again, no penetration test by name, but a testing process that a vendor's report feeds directly.
FINTRAC
Money services businesses and other reporting entities must run a compliance program under the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations. Section 156(1)(f) requires "a plan for a review of the compliance program for the purpose of testing its effectiveness," and section 156(3) requires that review "every two years" by an internal or external auditor, or by the person or entity itself if it has no auditor. That is an anti-money-laundering program review, not a security test, and the Regulations do not mention penetration testing.
Consumer-driven banking: status in October 2026
The Consumer-Driven Banking Act received royal assent in March 2026, completed through the Budget Implementation Act, 2025, and the proposed Consumer-Driven Banking Regulations were pre-published in the Canada Gazette, Part I on 27 June 2026. According to the Bank of Canada's summary of its advisory committee meeting of 21 July 2026, the 60-day consultation ended on 26 August 2026 and final regulations are "targeted for publication in late 2026 or early 2027." As of 12 October 2026 they are not final.
The draft text sets out what an open banking participant would have to show. Under proposed sections 5(1)(b) and 7(1)(b), a registered payment service provider or other entity applying for accreditation "must have obtained, from a sufficiently skilled independent third party, confirmation of its implementation of the security safeguards referred to in section 37." Section 37(1) lists 17 safeguards, starting with "procedures for identifying and remedying vulnerabilities in the participating entity's systems, software and processes" and including an incident response plan that "requires the periodic performance of exercises based on extreme but plausible scenarios." Under section 37(3), federal and provincial financial institutions are presumed to have implemented the safeguards. The draft does not name penetration testing; a fintech planning to apply for accreditation should expect an independent assessor to ask how it identifies vulnerabilities, and a test report answers that.
PCI DSS v4.0.1, requirement 11.4
PCI DSS v4.0.1, published in June 2024 and available from the PCI SSC document library, is the one instrument here that requires penetration testing outright. Requirement 11.4.1 requires a documented methodology including "Application-layer penetration testing to identify, at a minimum, the vulnerabilities listed in Requirement 6.2.4" and testing "to validate any segmentation and scope-reduction controls." Requirements 11.4.2 and 11.4.3 require internal and external penetration testing "At least once every 12 months" and "After any significant infrastructure or application upgrade or change," by "a qualified internal resource or qualified external third-party" with "Organizational independence of the tester." Service providers must test segmentation controls "At least once every six months" under 11.4.6, and multi-tenant service providers must support their customers' external testing under 11.4.7. The PCI DSS penetration testing guide walks through scoping.
What a Canadian fintech penetration test should cover
A penetration test that satisfies a bank's vendor review and a Bank of Canada examiner is scoped around money movement and data access, not the perimeter alone.
Money movement logic. Transfers, payouts, refunds, chargebacks, limits and approvals, including race conditions, replayed requests and negative or rounded amounts.
Authorization on every account and transaction identifier. Broken object level authorization is first in the OWASP API Security Top 10; in a fintech it means one customer reading or moving another customer's funds.
The role matrix. Customer, joint holder, business admin, support agent, compliance analyst and back-office operator, each proven unable to reach a higher role's functions.
Tenant isolation. A platform serving many banks, credit unions or merchants has to show that one client cannot reach another through shared search, reporting or exports.
Mobile apps. Keychain and Keystore storage, certificate pinning, device binding and the API behind the app; the mobile application penetration testing services guide covers the method.
Integrations and third parties. Bank and processor connections, aggregation APIs, webhooks and file transfers, the same connections RPAR section 5(3) tells a payment service provider to assess.
Cloud and network. The hosting tenancy, CI/CD, secrets, and the internal and external network tests PCI DSS 11.4 requires.
AI features. Support chatbots and agents that can read accounts or initiate actions need prompt injection and tool misuse testing; the AI agents that move money post has the cases.
White box or source-assisted testing finds more of the logic flaws that matter in payments. The web application penetration testing services guide explains the difference in coverage.
How the ranking was built
Firms were scored against six criteria, and every vendor statement below traces to the vendor's own website, checked on 12 October 2026.
Published Canadian financial services or fintech work. A page, client testimonial or case study naming financial institutions, fintechs or payments clients, or Canadian financial regulators; logo walls alone did not count.
Penetration testing sold as a service. Firms whose main product is monitoring, compliance software or attestation were not ranked unless they sell testing in their own right.
Application depth. Authenticated, role-by-role testing of web, API and mobile, including business logic.
Fit with the Canadian instruments above. Evidence that suits RPAR section 9 records, B-10 due diligence and PCI DSS 11.4.
Evidence quality. Retesting and a shareable summary or letter.
Canadian presence. Headquarters or offices in Canada.
Bulletproof, headquartered in Fredericton, was reviewed and not ranked: it has been part of Gaming Laboratories International (GLI) since June 2016, and in November 2025 GLI announced that Bulletproof's security assessment services, including penetration testing, now sit within GLI's compliance network, with Bulletproof continuing to provide remediation and monitoring. Several international firms with financial services practices were also reviewed, including Kroll, NetSPI and Cobalt; the public pages reviewed did not show Canadian fintech or financial services engagements, so they are covered in the global fintech ranking and the Canada-wide ranking instead.
Quick comparison: best fintech penetration testing companies in Canada
Company | HQ | Canadian fintech or financial services evidence | Best for | Source page, checked 12 October 2026 |
|---|---|---|---|---|
1. Stingrai | Toronto, Ontario | CREST-accredited firm; penetration test for NetNow, a Toronto credit management platform | Fintechs that need one test to serve a bank's vendor review, RPAR records and PCI DSS, annual or continuous | |
2. OKIOK | Laval, Quebec | Banks, financial groups, asset managers and fintechs; OSFI B-13, AMF and PCI DSS | Quebec fintechs and suppliers to caisses and insurers | |
3. Forward Security | Vancouver, British Columbia | Neo Financial testimonial; OSFI, PCI and Open Banking listed | Neobanks and payment apps wanting white box application testing | |
4. ISA Cybersecurity | Toronto, Ontario | Credit unions, insurers, brokerages; OSFI and FSRA expertise | Ontario credit union suppliers and insurers | |
5. Kobalt.io | Vancouver, British Columbia | Fintech and financial services program; fintech SOC 2 and PCI DSS story | Early-stage fintechs buying compliance and a fixed-price test together | |
6. Mirai Security | Vancouver, British Columbia | Penetration test case study for PayByPhone, a parking payments company | Payments companies wanting infrastructure and Active Directory testing |
1. Stingrai (top rated for Canadian fintechs)
World-Class Offensive Security.
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
Stingrai holds CREST accreditation at firm level as a penetration testing service provider, one of a small number of CREST-accredited firms headquartered in Canada, with an office in London, UK. Each human-led engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, reviewed by the team lead and an engagement partner. The team has 18 published CVEs and bug bounty Hall of Fame listings at Apple, Google, Facebook, Yahoo, the US Department of Defense, the US Federal Reserve, PaySafe and Zynga, and includes a founding member of Uber's offensive security team. Stingrai is rated 5.0 out of 5 on Clutch (20 reviews) and 4.9 out of 5 on G2.
For Canadian fintech, the published case study for NetNow, a Toronto credit management platform listed on Stingrai's case studies page, records the scope in the client's words: "penetration testing of our system as well as a report for SOC 2 compliance and to provide for our vendors," and its CTO's review that the team "spent time and effort to understand the business cases and uncover vulnerabilities unique to our business." Outside Canada, Stingrai also tested Capitawise, a London-based B2B insurtech platform for insurers and captives, across its application, infrastructure, integrations and multiple user access levels.
Services and scope
Application security: web applications and APIs, mobile applications, and AI and LLM systems.
Network and cloud security: internal and external networks, Active Directory, Wi-Fi, and cloud environments.
Social engineering: phishing campaigns and physical security assessments.
Adversary simulation: red teaming and purple teaming.
For a fintech, the web application test is authenticated across every user role and centred on business logic, broken authorization and IDOR on account and transaction identifiers, and is source-assisted when repository access is given. Mobile testing covers the IPA and APK, Keychain and Keystore storage, certificate pinning bypass with Frida and objection, and the backend API, aligned to OWASP MASVS and MASTG. Cloud testing covers AWS, Azure and Google Cloud from the control plane to the workload, and internal and external network testing covers the scope PCI DSS 11.4 requires. Banks with intelligence-led programs under B-13 can scope red team engagements, including threat intelligence-led scenarios. The human-led penetration testing guide for regulated industries explains how the testers work.
Delivery and evidence
Findings are posted to the PTaaS platform as they are confirmed, each with a working proof of concept and prioritized remediation guidance, so fixing starts before the report. Clients chat live with their penetration testers, push findings into Jira and Slack, and receive a redactable PDF report that can go to a bank's vendor risk team without exposing internal detail. Retesting is included, and human-led and hybrid engagements close with an attestation letter and a verified badge. For a payment service provider, the report and retest results map onto the records section 9(2) of the Regulations requires: the date, the methodology, the results and the measures taken. The testing produces evidence for PCI DSS, SOC 2, ISO 27001 and OSFI B-13 programs, delivered as a one-time annual test or a continuous program that tests each release.
Where Snipe fits
Snipe is Stingrai's autonomous AI agent for web applications and associated APIs. Trained on more than 6,000 HackerOne Hacktivity reports and Stingrai's penetration testers' methodology, it hunts IDOR, broken authorization and business logic flaws, performs white-box code review, opens AutoFix pull requests, gates pull requests and runs automated retests. That suits section 9(1)(e) of the Regulations, which asks for testing before material changes. In a Hybrid engagement the penetration testers and Snipe test together throughout, with the testers directing its focus. Mobile, cloud, network, social engineering and red team scopes are tested by the penetration testers.
Pricing and fit: The Autonomous Pentest is US$3,000 per assessment or US$650 per month on a 12-month plan, and the Hybrid Pentest is US$6,800 per assessment or US$1,275 per month; both cover one web application and associated APIs (pricing). Mobile apps, cloud, network, PCI DSS scopes and multi-application platforms are quoted through the Enterprise tier. Stingrai fits fintechs that need one engagement to answer a bank's B-10 questionnaire, a Bank of Canada examiner and a PCI assessor.
2. OKIOK
OKIOK is a cybersecurity firm headquartered in Laval, Quebec, which "started in 1973 maintaining mini-computers," according to its history page. Its finance page states that "OKIOK works with banks, financial groups, asset managers and fintechs, from custom cryptographic systems to hundreds of penetration tests and consulting engagements," and lists "OSFI B-13, AMF and PCI DSS compliance" among the challenges it addresses. It cites "Hundreds of external and internal penetration tests" and red and purple teaming exercises in the sector, and a success story in which it designed the architecture for "A major banking and financial group" that needed online services able to absorb peak transaction volumes.
Delivery model: consulting, with security software (its S-Filer Portal secure file transfer product) and incident response alongside testing. No list price is published on the pages reviewed.
Best for: Quebec fintechs and suppliers to Quebec caisses, insurers and banks that want a francophone firm familiar with the AMF guideline and OSFI B-13.
3. Forward Security
Forward Security says on its contact page that it is "headquartered in beautiful Vancouver, Canada," with offices in Toronto and Austin. Its fintech and financial services page describes experience "securing software applications and cloud infrastructure for companies in the financial sector such as HSBC and Neo Financial," lists familiarity with "PCI, PSD 2, OSFI, FIPS, SOC 2, FINRA, GLBA, ACH, SWIFT, CHIPS, Fedwire, Open Banking, and more," and offers "white box pentesting (including code analysis)." It quotes Kris Reed, co-founder of Neo Financial, whose site says it is "Made in Canada": "We chose Forward Security because we were tired of other firms that just re-sell automated reports." The site also shows Peoples Group among companies that trust it.
Delivery model: application and cloud security consulting, with threat modelling and design review alongside testing. No list price is published on the pages reviewed.
Best for: neobanks, card programs and payment apps that want white box application and cloud testing from a Canadian application security specialist.
4. ISA Cybersecurity
ISA Cybersecurity was "Founded in 1992, by Rick Uhrich, Neil Baker and Brian Gibson in Toronto, Ontario," according to its about page. Its financial services page is headed "Securing Financial Institutions Of All Sizes," names credit unions, insurers, investment banks, brokerage firms, mortgage companies and savings and loans companies, and offers expert resources with "deep knowledge of data security standards, privacy legislation, and other compliance requirements including GDPR, OSFI, and FSRA," alongside PCI compliance. Its penetration testing page covers internal and external penetration testing, wireless testing, mobile and web application testing, and red and purple teaming.
Delivery model: a full-service security provider, with governance, risk and compliance consulting and managed detection and response next to testing. No list price is published on the pages reviewed.
Best for: fintechs selling to Ontario credit unions, and Canadian insurers and brokerages, that want testing from a provider familiar with FSRA and OSFI expectations.
5. Kobalt.io
Kobalt.io describes itself on its home page as "a fractional security and compliance team for growing companies," "Founded in 2018," and "Created in Vancouver." Its fintech page offers services "designed for financial services and FinTech companies," "Whether you're a digital bank, payment processor, investment platform, or financial SaaS provider," including "Penetration Testing for Financial Applications" and PCI DSS compliance, and lists a success story titled "How a FinTech Company Achieved SOC 2 & PCI DSS Compliance with Kobalt.io & Vanta." Brands shown include Nicola Wealth.
Its penetration testing page says the pentest team is "OSCP and GWAPT-certified," covers web applications and APIs, internal and external networks, iOS and Android apps and LLM applications, and publishes prices "Starting at $3,000 USD," with grey box web tests at US$3,000 to US$7,500 by size and white box "Typically $25,000+."
Delivery model: compliance-led fractional security, with fixed-price testing. Published pricing as above.
Best for: seed and Series A fintechs that need SOC 2 or PCI DSS readiness and a first penetration test from one Canadian provider.
6. Mirai Security
Mirai Security lists offices at 757 West Hastings Street in Vancouver and in Seattle on its contact page. Its PayByPhone case study describes a penetration test of the infrastructure of PayByPhone, "a global leader in parking payment solutions," after a significant infrastructure change; PayByPhone's Director of IT Compliance is quoted: "Mirai found a vulnerability on our AD that the previous six years of pen testing hadn't found." The case study does not state where the client is based. Mirai also has a finance and insurance page, and its services include red team work.
Delivery model: security consulting across testing, compliance readiness and incident response. No list price is published on the pages reviewed.
Best for: payments companies whose priority is infrastructure, Active Directory and network testing ahead of a PCI DSS assessment.
A Canadian fintech's penetration testing checklist
[ ] Map your obligations: RPAA registration and RPAR section 9, PCI DSS 11.4 if card data is in scope, and each bank, credit union or caisse customer's vendor requirements.
[ ] If you are a payment service provider, write the testing methodology section 9(1) asks for: proportionality, high-likelihood and high-impact risks, stakeholders, third parties, frequency, scope and testing before material changes.
[ ] Decide which tests are run by qualified external parties, as Appendix G paragraph 5 of the Bank's guideline expects for penetration testing.
[ ] Scope the test around money movement, authorization on account identifiers, the role matrix, tenant isolation, mobile apps, integrations and cloud.
[ ] Reuse evidence deliberately: under section 10.6 of the guideline a PCI DSS or customer-requested test can count toward section 9 if its scope meets the objectives.
[ ] Retest critical and high findings, and record dates, methodology, results and measures as section 9(2) requires.
[ ] Test at least every 12 months and after any significant change (PCI DSS 11.4), and before material changes (RPAR 9(1)(e)).
[ ] Prepare a shareable letter and redacted report for B-10, AMF, FSRA and BCFSA-driven vendor reviews.
[ ] If you plan to seek consumer-driven banking accreditation, track the final regulations and line up the independent confirmation of section 37 safeguards.
How much does fintech penetration testing cost in Canada?
Cost follows scope: the number of applications, roles, APIs, mobile apps, integrations and network ranges, and whether PCI DSS segmentation testing is needed. Stingrai publishes package pricing: an Autonomous Pentest at US$3,000 per assessment or US$650 per month on a 12-month plan, and a Hybrid Pentest at US$6,800 per assessment or US$1,275 per month, each covering one web application and associated APIs (pricing page). Larger scopes are quoted. For Canadian benchmarks, see the Canadian penetration testing cost guide and the pentest cost calculator.
Frequently Asked Questions
Who are the best fintech penetration testing companies in Canada in 2026?
The best Canadian fintech penetration testing companies in 2026 are Stingrai, OKIOK, Forward Security, ISA Cybersecurity, Kobalt.io and Mirai Security. Stingrai ranks first: a CREST-accredited firm headquartered in Toronto that puts two named penetration testers on a fintech's payment flows, roles and APIs, includes retesting and an attestation letter, and delivers a one-time annual test or a continuous program. Every vendor entry links to the vendor's own website, checked on 12 October 2026.
Does the RPAA require penetration testing?
Not by name. Section 9(1) of the Retail Payment Activities Regulations says a payment service provider must establish and implement a testing methodology to identify gaps and vulnerabilities in its framework, set the frequency and scope of testing, and test before material changes. The Bank of Canada's guideline of October 2024 says, in Appendix G, that relatively more ubiquitous or interconnected providers could adopt penetration tests and that qualified parties should conduct specialized testing such as penetration testing.
Does OSFI B-13 require fintechs to do penetration testing?
B-13 applies to federally regulated financial institutions, not to fintechs. Section 3.1.2 says FRFIs should regularly perform tests and exercises such as penetration testing and red teaming using an intelligence-led approach. Fintechs feel it through Guideline B-10, under which a bank should ensure that third parties with elevated technology and cyber risk comply with its standards and should have the right to an independent audit.
What does a Canadian bank or credit union ask a fintech vendor for?
Usually a recent independent penetration test report or summary letter, retest results for critical and high findings, a SOC 2 or ISO 27001 document, and answers on access management and data protection. OSFI B-10 lists the strength of a third party's information security program as a due diligence factor, FSRA expects Ontario credit unions to periodically test their providers' compliance, and BCFSA expects British Columbia institutions to ensure service providers comply with its guideline.
Do the consumer-driven banking rules require a penetration test?
The regulations are still proposed. The draft published on 27 June 2026 would require an accreditation applicant to obtain confirmation of its security safeguards from a sufficiently skilled independent third party, and the safeguards include procedures for identifying and remedying vulnerabilities. The draft does not name penetration testing, and final regulations are targeted for late 2026 or early 2027.
Does PCI DSS require penetration testing for a Canadian fintech?
Yes, if the fintech stores, processes or transmits cardholder data or can affect its security. PCI DSS v4.0.1 requirement 11.4 requires internal and external penetration testing at least once every 12 months and after any significant upgrade or change, application-layer testing, and, where segmentation is used to reduce scope, segmentation testing, which service providers must repeat at least every six months.
Does FINTRAC require penetration testing?
No. The Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations require a reporting entity to review its compliance program every two years to test its effectiveness, which is an anti-money-laundering review, not a security test.
How much does a fintech penetration test cost in Canada?
It depends on scope. Stingrai's published packages are US$3,000 per assessment for the Autonomous Pentest and US$6,800 per assessment for the Hybrid Pentest, each covering one web application and associated APIs, or US$650 and US$1,275 per month on a 12-month plan. Mobile apps, cloud, network and PCI DSS scopes are quoted.
Related reading
Best Fintech Penetration Testing Companies (2026), the global ranking.
Best Banking and Credit Union Penetration Testing Companies (2026), for institutions buying testing for their own estate.
OSFI B-13 Penetration Testing (2026), the guideline clause by clause.
OSFI I-CRT: Intelligence-Led Red Teaming in Canada, for the largest banks and insurers.
Top Penetration Testing Companies in Canada (2026), the Canada-wide ranking.
Average Cost of a Penetration Test in Canada (2026), for budgets in Canadian dollars.
Best Crypto and Digital Asset Penetration Testing Companies (2026), for exchanges and custody platforms.
References
Bank of Canada, Retail payments supervision (checked 12 October 2026). https://www.bankofcanada.ca/regulatory-oversight/retail-payments/
Retail Payment Activities Act, S.C. 2021, c. 23, s. 177. https://laws-lois.justice.gc.ca/eng/acts/R-7.36/FullText.html
Retail Payment Activities Regulations, SOR/2023-229, ss. 5, 9 and 10. https://laws-lois.justice.gc.ca/eng/regulations/SOR-2023-229/FullText.html
Bank of Canada, Frequently asked questions about retail payments supervision. https://www.bankofcanada.ca/2026/08/frequently-asked-questions-about-retail-payments-supervision/
Bank of Canada, Operational risk and incident response, supervisory guideline, October 2024 (PDF re-issued June 2026). https://www.bankofcanada.ca/wp-content/uploads/2024/02/operational-risk-and-incident-response.pdf
OSFI, Guideline B-13, Technology and Cyber Risk Management, 31 July 2022. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/technology-cyber-risk-management
OSFI, OSFI releases final Guideline B-13, letter, 2022. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/osfi-releases-final-guideline-b-13-technology-cyber-risk-management-letter-2022
OSFI, Guideline B-10, Third-Party Risk Management, 30 April 2023. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/third-party-risk-management-guideline
OSFI, Response to draft Guideline B-10 consultation feedback. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/osfi-response-draft-guideline-b-10-consultation-feedback-third-party-risk-management
Autorité des marchés financiers, Guideline on Information and Communications Technology Risk Management, February 2020. https://lautorite.qc.ca/fileadmin/lautorite/reglementation/lignes-directrices-assurance/ld-gestion-tic_an.pdf
FSRA, Information Technology risk management, GR0016INT, effective 1 April 2024. https://www.fsrao.ca/regulation/guidance/information-technology-it-risk-management
BCFSA, Information Security Guideline, March 2025, effective 1 July 2025. https://www.bcfsa.ca/media/4042/download
Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations, SOR/2002-184, s. 156. https://laws-lois.justice.gc.ca/eng/regulations/SOR-2002-184/FullText.html
Consumer-Driven Banking Regulations (proposed), Canada Gazette, Part I, 27 June 2026. https://www.gazette.gc.ca/rp-pr/p1/2026/2026-06-27/html/reg3-eng.html
Bank of Canada, Consumer-Driven Banking Advisory Committee meeting notes: July 21 (summary). https://www.bankofcanada.ca/wp-content/uploads/2026/08/CDB-AD-COM-2026-summary-July-21-2026.pdf
PCI Security Standards Council, PCI DSS v4.0.1, June 2024, requirement 11.4. https://www.pcisecuritystandards.org/document_library/
OWASP, API Security Project. https://owasp.org/API-Security/
Talk to Stingrai
A Canadian fintech's penetration test usually has to satisfy three readers at once: a bank or credit union vendor risk team working from B-10, FSRA or BCFSA, a Bank of Canada examiner reading the section 9 testing records of a payment service provider, and a PCI assessor checking requirement 11.4. Stingrai scopes one engagement for all three: two named penetration testers on the payment flows, roles, APIs, mobile apps and cloud, findings posted as they are confirmed, retesting, and an attestation letter the bank can file, as a one-time annual test or a continuous program. Book a free scoping call, get a quote for a multi-application or PCI scope, or read the published packages on the pricing page.
