The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) has published the final report from the Financial Industry Forum on Artificial Intelligence Phase II (FIFAI II), consolidating industry, academic, government and regulatory discussions on AI-related risks and opportunities in Canadian financial services and introducing an AGILE framework for stakeholders. The report specifies that it reflects views and insights from individual forum speakers and participants and should not be interpreted as guidance from FINTRAC or other Canadian authorities. The report draws on four workshops held between May and November 2025, sponsored by the Global Risk Institute with participation across the series from the Office of the Superintendent of Financial Institutions, the Department of Finance Canada, FINTRAC, the Financial Consumer Agency of Canada and the Bank of Canada, and involving more than 170 participants. It frames AI risks as extending beyond the earlier FIFAI “EDGE” principles and organises key issues across strategic and governance risks, security and cybersecurity threats (including deepfakes, synthetic identities and AI-assisted cyberattacks), consumer protection and financial well-being risks (including transparency, explainability, bias and fraud exposure), knowledge and talent gaps, third-party concentration and supply-chain dependencies, and financial stability channels such as operational shocks, correlated trading behaviours and emerging risks from agentic AI. AGILE is presented as a set of implementation priorities spanning Awareness, Guardrails, Innovation, Learning and Ecosystem Resiliency, with suggested actions including stronger board and senior-management oversight and horizon scanning, “evergreen” governance and control frameworks, enhanced data governance and third-party due diligence, scaled responsible AI deployment in areas such as fraud detection and transaction monitoring, expanded workforce and consumer AI literacy efforts, and more coordinated ecosystem measures such as common standards for critical providers, improved threat information sharing, upgraded incident-response arrangements, and stronger digital identification and authentication.