Hey, fintech fam 💜

On Tuesday, I went deep on TabaPay, Chime, and Block, and the growing push among fintech companies to acquire banks, pursue charters, and own more of the financial infrastructure underneath their businesses.

If you missed it, here's the short version: TabaPay plans to buy Transact Bank, while Chime and Block are pursuing their own paths toward bank ownership. Different strategies, same bigger question: what changes when fintechs control more of the infrastructure underneath their products?

Today, we're covering 3 different news stories, but a thread connects all three.

First, South Korea is rolling out a national AI program giving its 52 million citizens access to AI, which immediately made me wonder: what does it look like when AI access becomes national infrastructure, and what does that mean for financial services?

Then, Visa, Mastercard, and Ant International are working on a shared framework for verifying AI agents making purchases on our behalf. It's the identity side of a problem I’ve been tracking closely as agents move from answering questions to actually moving money.

And finally, a $320 million crypto hack raises a pretty uncomfortable question: if most breached platforms had already passed a security audit, what exactly are those audits protecting against?

Three very different stories, one thread underneath all of them: as AI gets closer to actually moving money, the infrastructure deciding who gets trusted to do that is being built right now, often by companies most people have never heard of… and some of them are joining us at FTW: SF at the end of this month.

Let’s get into it. ✨

#TRENDING

Every Thursday, I break down the fintech stories that matter most — grounded in my reporting, interviews with industry leaders, and what I’m seeing unfold across the industry.

By the end of this year, any of South Korea's 52 million citizens will be able to open a government-backed AI chatbot under an initiative called “AI for All”. 

South Koreans can use it to file taxes, search public housing listings, or check what federal benefits they qualify for, with no token limits, no subscription tier, and no fee. It will also handle things like: 

At first glance, this looks more like an AI infrastructure story than a fintech story. But look at what people are actually being encouraged to use it for: taxes, government benefits, housing, subsidies, and small-business reporting.

These are financial workflows.

And if 52 million people begin getting comfortable asking an AI system what benefits they qualify for, calculating what they owe, or navigating financial paperwork on their behalf, the implications extend well beyond government services.

South Korea could become one of the first large-scale experiments in what happens when consumers begin expecting financial services to be conversational, personalized, and increasingly handled by AI.

The Ministry of Science and ICT selected South Korean companies SK Telecom, KT, and Kakao to build the infrastructure, backed by 512 NVIDIA B200 GPUs and a mandate that at least half of the underlying models be built domestically. 

The public beta program starts in late September.

NVIDIA, SK hynix, and TSMC all sit in this supply chain. 

Jensen Huang, co-founder and CEO of NVIDIA, told analysts that NVIDIA now expects sovereigns and neoclouds to represent roughly half of its data center business, calling Korea one instance of a template other governments will repeat. 

(Btw, if you don’t know Jensen’s story: you should. He was a dishwasher at Denny’s 10 years before founding NVIDIA, and later, he and his co-founders came up with the idea for NVIDIA at a Denny’s booth. His story is definitely considered a piece of tech lore!)

I’ll be fully honest: I don’t come from a computing background, and much of this jargon isn’t my first language.

But I do know that the 512-GPU allocation is, according to sources, a tiny fraction of what a single frontier lab (think Anthropic, OpenAI, etc.) consumes in a week.

So what this actually adds up to, at scale, is still an open question.

NVIDIA also hasn't disclosed any volume or dollar figure for the Korean LG or Hyundai partnerships it flagged. 

South Korea has framed 'AI for All' around a specific set of stated goals: treating AI as a public utility on par with internet access and electricity. 

AI for All ensures every citizen 'regardless of income level or location' can access it, reducing national dependence on US and Chinese AI platforms, and using the guaranteed user base to accelerate its own domestic AI industry. 

The domestic-model quota serves two goals at once. 

Requiring at least half the deployed models to be Korean-built protects the sovereignty goal, since the country isn't leaning on international AI platforms for a service this central to daily life. 

It also directly builds the domestic AI industry: guaranteeing Korean model developers a base of tens of millions of users on day one gives them the training data and real-world feedback that usually take years to accumulate.

In the US, no comparable policy exists. Plus, only 2% of Americans currently pay for AI tools versus 25% of South Koreans.

For fintech leaders, this is where the experiment gets especially interesting.

If South Korea succeeds in making AI an everyday interface for millions of people, fintech companies entering the market won't just be competing for customers who are more comfortable with AI. They may be competing for customers whose expectations of financial software have fundamentally changed.

A consumer accustomed to asking an AI agent to navigate taxes, benefits, housing, and government paperwork may increasingly expect their bank, wealth platform, lender, or payments provider to work the same way.

That makes South Korea worth watching not simply as an expansion market, but as a preview of what an AI-native financial-services customer might eventually expect everywhere.

👀 And if you're interested in building this future, come to FTW: SF. 

Leaders from companies like Chime, Visa, Legora, and more who have already built AI-native features will be at the event ready to share their learnings with you – both on stage and in the audience. Join us! 

The most useful point buried in the chipmaker coverage is this: the 'no limits' promise is going to run into rate limits, waitlists, and the domestic-model rules before it runs into the bigger physics problem: there's only so much AI computing power to go around, even for a government. 

Here's the basic idea as I understand it: building and running AI takes an enormous amount of specialized computer chips and memory, and right now the whole world doesn't have enough of either to keep up with demand. 

So when South Korea says 'free and unlimited,' that promise is only as strong as the hardware behind it, and the hardware is genuinely scarce. 

That scarcity isn't hypothetical for South Korea, either. 

SK hynix, one of the country's own chipmakers, is currently living through a memory shortage that NVIDIA says is being driven by the AI buildout itself, happening in South Korea's own backyard.

There are two honest ways to read this program right now, and both are worth talking about.

One is that South Korea just set a new global template for treating AI access as public infrastructure rather than a subscription product.

The other is that “free and unlimited” is a promise made before the queueing and quota mechanics have been tested against 52 million real users, and the gap between those two things is exactly what the September beta will reveal.

But in financial services, another experiment is happening underneath both.

What happens when millions of people become accustomed to an AI system helping them navigate some of the most complicated financial decisions and administrative tasks in their lives?

Banks and fintechs have spent years trying to teach customers how to navigate financial products. AI could flip that relationship: customers may soon expect financial products to learn how to navigate them.

South Korea may give us one of the earliest looks at what that shift actually means at national scale.

Visa, Mastercard, and Ant International announced this week that they're collaborating on a Know-Your-Agent framework, a shared standard for identifying and verifying AI agents that make purchases on a user's behalf. 

The idea is that card networks, digital wallets, agent platforms, and online marketplaces can recognize a trusted agent across different payment ecosystems, while each company keeps its own approval and risk-management process intact.

The framework builds on protocols each company already has in place individually: 

Rather than compete on separate standards, the three are collaborating through BuildFin.ai, a platform convened by the Monetary Authority of Singapore that brings financial institutions and researchers together to build AI solutions.

The stated goal is practical: lower integration costs and faster rollout of agentic commerce services by giving every network in the chain more visibility into whether an agent claiming to act on someone's behalf actually has the authorization to do so.

This reminded me of Rain's acquisition of Ansa last month. 

The pitch was giving AI agents a limited, rules-based budget instead of unrestricted account access, essentially building the permission layer for what an agent is allowed to spend, where, and for how long. 

Visa, Mastercard, and Ant are approaching the same underlying problem from the identity side: not what an agent can spend, but whether the agent is who it claims to be. 

Spending limits and identity verification are two halves of the same trust problem in agentic commerce.

Agentic commerce doesn't scale past pilot programs until a merchant, a card network, and a consumer's bank can all independently confirm an agent is authorized before money moves. 

A shared identity standard, even a narrow one built by three competitors, is a more concrete step toward that than any single company's protocol running in isolation.

Liquid Network, a Bitcoin sidechain used by several crypto exchanges to settle transactions, lost roughly $320 million this week after attackers exploited a software bug to mint unbacked tokens and cash them out through a standard withdrawal process. 

No private keys were compromised; the funds moved through a valid authorization path that should have caught the manipulation and didn't. 

The attackers say they're white hats and have offered to return the funds once the vulnerability is patched, a claim the security community has met with open skepticism given the size of what moved.

A CoinGecko report released that same week showed that crypto platforms have lost more than $3.63 billion to cyberattacks since January 2025. 

About 88% of that stolen amount, and 60% of the affected platforms, had already completed independent security audits before they were hit. 

The attacks consistently targeted areas standard audits don't typically cover.

An audit is a point-in-time check on the systems a team already thought to test, but it says nothing about the authorization paths, edge cases, and operational assumptions nobody flagged as a risk in the first place. 

(Which is exactly where Liquid Network and most of the platforms in CoinGecko's report got hit.)

This lines up with something Green Dot's Chief Risk Officer, Kim Olson, told me earlier this summer, and I want you to remember this: safeguards have to get built into a product's foundation, not patched in after the fact. 

This seems simple, but you’d be surprised at how many companies aren’t following this guidance. 

A passed audit =/= the pinnacle of security in crypto, and the platforms treating it like the only thing they have to do are the ones experiencing nine-figure losses as we speak. 

Fraud and exploit tactics are industrializing faster than the current standard review cycle can catch, and the operators building compliance and security into the architecture itself (not just scheduling their next audit and calling it a day) are the ones who close that gap.

There is nothing more critical than security in the financial space. We handle the most sensitive information a person has. 

That’s why Day 3 of FTW: SF is dedicated entirely to security in fintech, drawing in CISOs, CTOs, Chief Compliance Officers, and CPOs.

Fraud is getting more sophisticated. We have to do the same. Join us at FTW:SF! 

VIP tickets are the only guaranteed ticket type that grants you access to FTW:SF speakers.

Secure your VIP tickets today!

​On October 1, Growth Stage: Candidly brings three leaders into the spotlight for an invite-only evening of storytelling, connection, and shared insight.

​Founder & CEO Laurel Taylor will be joined by two key figures in Candidly’s evolution. Each will take the stage alone, but together, their stories will reveal the conviction, relationships, and transformational technology carrying Candidly into its next chapter.

​Because behind every great leader is a team turning vision into reality.

It’s never a bad day for The Miseducation of Lauryn Hill.

📰 Share this newsletter with a friend and start growing your network.

🔗 Connect with me on LinkedIn for daily insights on female leadership.

🤝 Grow your business through content & community by partnering with me.

📣 Promote yourself to 50,000 subscribers by sponsoring this newsletter.

🎤 Host an epic event by booking me as a speaker, moderator, or emcee.

📚 Increase your expertise by ordering your copy of my book, Fintech Feminists: Increasing Inclusion, Redefining Innovation, and Changing the Future for Women Around the World.

That wraps up today’s edition—thanks for reading! Until next week, keep innovating and challenging the status quo.

See you Tuesday!

Love,

Nicole 💜