A blockchain lender confronted the cost of weak security. Hong Kong reinforced one of the world’s strictest crypto regimes. A major banking platform and an open-data giant collapsed integration friction. A Japanese wallet lined up Visa and Wall Street for a U.S. push. And in Saudi Arabia, global card infrastructure expanded its mobile footprint under Vision 2030.
Different geographies. Same pattern.
Fintech is consolidating power where it matters most – inside licenses, compliance layers, data networks, and payment rails that already touch billions of transactions.
1) Figure Confirms Data Breach After Phishing Attack, Customer Information Exposed
Blockchain lender Figure Technology has confirmed a cyberattack that resulted in the theft of sensitive customer data after an employee fell victim to a phishing scheme.
Figure, a U.S.-based fintech that originates and records loans on its proprietary blockchain – primarily home equity lines of credit – said a “limited number of files” were accessed by attackers. While the company has not disclosed the total number of affected individuals, reporting indicates the exposed data includes full names, postal addresses, dates of birth, and phone numbers.
The hacking group ShinyHunters has claimed responsibility and reportedly posted sample data on its leak site to validate the breach. According to reporting, the intrusion may be linked to the broader Okta single sign-on incident that affected multiple companies.
Figure has stated that it is offering free identity theft protection and credit monitoring services to impacted customers. The company said email addresses do not appear to have been compromised, which may reduce phishing risks, though security experts warn that exposed personal details heighten the threat of voice phishing, especially as generative AI tools make impersonation easier and more convincing.
The breach underscores a hard truth for fintech infrastructure players: speed and blockchain innovation do not insulate firms from traditional cybersecurity vulnerabilities.
2) Hong Kong Approves First New Crypto License Since June, Adds Victory Fintech to Strict Registry
Hong Kong’s crypto regime just moved again – carefully.
The Securities and Futures Commission (SFC) has granted a digital asset trading platform license to Victory Fintech (VDX), an affiliate of publicly listed financial services firm Victory Securities (8540). The approval marks the first addition to Hong Kong’s licensed crypto registry since June 17 of last year.
With the approval, Victory Fintech is now authorized to operate a regulated digital asset trading platform under one of the most stringent crypto frameworks among major financial jurisdictions. The SFC’s regime, introduced in 2023, requires firms to meet strict standards around custody, governance, compliance, and investor protection.
There are now 12 approved platforms on the SFC’s registry. Among them are HashKey Exchange and OSL Digital Securities – the first two firms licensed under the current framework – as well as NYSE-listed Bullish (BLSH), parent company of CoinDesk.
The slow pace of approvals is not incidental. Hong Kong’s framework has developed a reputation for rigorous scrutiny, with high-profile exchanges such as OKX and Bybit withdrawing their license applications in 2024.
Victory’s approval reinforces Hong Kong’s positioning strategy: controlled openness. The city is welcoming digital asset businesses, but only those willing to operate inside a tightly supervised regulatory perimeter.
3) Backbase and Plaid Partner to Put Open Finance at the Heart of AI-Driven Banking
Two of financial services’ most consequential infrastructure players are combining forces to tackle one of banking’s most persistent problems – fragmented data.
Backbase, known for its AI-powered digital banking platform, and Plaid, the data connectivity network behind thousands of financial apps and institutions, have announced a strategic partnership to deliver pre-integrated open finance capabilities to banks worldwide.
The collaboration directly addresses a core fintech challenge: data silos that slow customer onboarding, limit personalization, and hinder real-time insight. By merging Backbase’s real-time engagement layer with Plaid’s secure financial data aggregation and enrichment, banks can gain a unified, 360-degree view of customer accounts and behaviour without having to build complex integrations themselves.
What sets this partnership apart is not just the technology, but the way it enables incumbent banks to compete with fintechs on experience without rebuilding their entire stack. Instead of wrestling with legacy APIs and costly point-to-point connections, financial institutions can now tap into continuous, real-time data flows that feed into Backbase’s AI tooling. That means faster onboarding, richer personalization, and actionable insights delivered at scale.
Backbase says the solution is generally available now, with implementation support and guidance globally. Plaid’s network already spans more than 12,000 institutions and 7,000 fintech users, while Backbase serves more than 100 banking clients across multiple regions.
This partnership illustrates not just another technical integration, but a broader shift in how open finance is industrialized – shifting from experimental pilot projects to standards-based, bank-ready infrastructure that supports AI-enabled banking experiences at scale.
4) Japanese Fintech PayPay Eyes U.S. Entry With Visa Partnership and IPO Plans
Japan’s most widely used mobile wallet is lining up a bold next act.
PayPay Corp., the fintech behind one of Japan’s largest QR-based payments ecosystems, is preparing to expand into the U.S. market through a strategic partnership with Visa and by filing for an initial public offering with the U.S. Securities and Exchange Commission.
The move targets two chokepoints that typically slow foreign entrants: brand recognition and payment-rail access. By integrating PayPay’s key products – the PayPay mobile wallet, PayPay Balance (a prepaid e-money method), PayPay Card, and PayPay Bank services – into a single Visa credential, the company aims to offer more familiar, globally accepted payment options for U.S. consumers while preserving its own ecosystem’s advantages.
Going public in the U.S. is part of the strategy to establish financial legitimacy and market presence in a highly competitive payments environment. PayPay has tapped major Wall Street underwriters – including Goldman Sachs, J.P. Morgan, Mizuho Securities USA, and Morgan Stanley – to manage the upcoming IPO, signaling a serious commitment to the U.S. plan.
The Visa partnership also opens the door for improved cross-border payment experiences, a key advantage as PayPay looks to link its existing Japanese user base with global commerce. For a company built on QR code payments within Japan, moving into a four-party card system with issuer, acquirer, processor, and network roles requires deep integration and market knowledge.
PayPay’s U.S. push reflects a larger pattern: mobile wallets and super-apps are increasingly testing paths into mature payments markets not just through product launches, but through strategic network partnerships and public market positioning. Success won’t be easy, but the plan – combining global rails, public credibility, and integrated services – sets PayPay up as a fintech to watch outside its home market.
5) Google Pay Expands to Mastercard Cards in Saudi Arabia – A Milestone for Mobile Wallet Adoption
Contactless mobile payments just took a meaningful step forward in one of the Middle East’s fastest-digitizing markets.
Google Pay has expanded support for Mastercard cardholders in Saudi Arabia, enabling Android users across the Kingdom to make in-store purchases by tapping their phones at contactless terminals. The rollout reflects growing adoption of digital wallets and contactless payment infrastructure under Saudi Arabia’s Vision 2030 economic transformation agenda, which prioritizes cashless commerce and broader financial inclusion.
Under the expanded service, Mastercard holders can add their cards to Google Pay and complete transactions via NFC-enabled devices without needing a physical card. Transactions are secured through tokenization and device-level authentication such as biometrics or passcodes, which replaces sensitive card data with unique cryptographic identifiers – a standard fintech security model that reduces exposure to fraud.
The expansion follows rising consumer use of mobile payments in Saudi Arabia, where contactless transactions have grown rapidly across retail, transit, and services sectors. By building on existing Mastercard acceptance infrastructure, Google Pay’s availability adds a widely used digital wallet interface to a payments ecosystem already supported by local banks and merchant terminals.
For the wider fintech landscape, this partnership between a global wallet platform and a major card network illustrates how digital payment adoption advances not just through new products, but through integration of global rails with local demand. Mobile wallets increasingly operate as the user layer atop traditional card rails, and this expansion signals how that relationship is maturing in key emerging markets.
As smartphone penetration continues to rise and contactless terminals become ubiquitous, services like Google Pay – supported by international networks like Mastercard – are likely to become default payment options for consumers, merchants, and banks alike, helping to accelerate the region’s transition to a fully digital payments economy.
