Court records, driver's licences, and an FTC bill

The number that matters here is not the state count, it is the four months between intrusion and detection, followed by another two before public disclosure. Every enterprise security questionnaire you fill out asks how quickly you detect and notify, and buyers are getting better at asking whether your clock starts at intrusion or at discovery. If your incident response policy commits to a 72 hour notice and you have no realistic way to know you were breached in the first place, that commitment is decoration.

Anyone doing KYC has an identity verification vendor, and most founders I talk to have never asked that vendor how long it keeps the document images after the check comes back clean. Retention is the control that would have made this a much smaller story, and it costs nothing to shorten. I would go find out this week what your provider's retention period is, get it in writing, and be ready to answer the same question when a US bank's third party risk team asks you.

The FTC is right on this one, and the useful detail for our readers is that being headquartered in Canada bought Nuvei nothing. If your platform onboards merchants, moves money, or resells payments as a feature, the standard the FTC is applying is what you should have known, not what you actually looked at. Screening and ongoing monitoring evidence belongs in the same folder as your SOC 2 artifacts, because that is where a US enterprise buyer's legal team will eventually go looking.

Read that filing from the other side of the table. You are the third-party application in somebody's stack, and when a customer of yours writes their own version of this disclosure, your name goes in it. What I would take from this is that the "not yet determined to be material" holding pattern is now the norm for the buyer, which means your contract notice obligations will keep getting shorter while theirs stay vague.

This is dependency confusion with a new delivery path, and the old defences still apply. Pin your dependencies, keep an internal registry that fails closed on unknown names, and make sure an agent cannot install anything that a human would not have been allowed to install. Worth checking whether your change management evidence still holds up now that some of your commits were written by a tool that resolves its own dependencies.