Those still touch payment networks. Debit cards are basically cards from Payment networks that are partnered with Banks/Credit Unions. PSP/DC Payments is an example of a payment network, Everlink, Interac, Exchange, Cirrus, etc. Seeing as Carney/Canada are ok selling off those payment networks to US Private Equity, you're going to always be somewhat dependent at this point on US services. Like I'd bet you that most of Interac, even though it's "Canadian", is running in US Cloud platforms like Azure and AWS, meaning it's 'realistically' fair game for US AI harvesting etc. Canadian businesses that try to pretend they're 'good' on this front will almost always cite privacy legislation compliance, to things like "Data residency" -- pretending as though just because a copy of the data is stored in Canada, that it isn't exposed/leveraged/dependent on US/foreign services.