Fintech Companies Prepare For Forthcoming Updates To The NY Cybersecurity Regulation

Proposed Amendments to 23 NYCRR Part 500

If you are the chief information security officer ("CISO") of a fintech company operating in New York, you may already be aware that, on November 9, 2022, the New York State Department of Financial Services ("DFS") proposed a second amendment to 23 NYCRR Part 500 (the "DFS Cybersecurity Regulation"). While many of the requirements included in the original 2017 DFS Cybersecurity Regulation remain, the proposed amendments impose heightened requirements for companies covered by the regulation.

Here are some important takeaways on the proposed amendments for fintech companies (and tech companies generally):

• Covered Entities. The definition of "covered entity" remains largely the same under the proposed amendments. A fintech company will be considered a "covered entity" for purposes of 23 NYCRR Part 500 if it is subject to licensing, registration, or other requirements under New York State's Banking Law, Insurance Law, or