New York Department Of Financial Services Issues Final Cybersecurity Regulations

On February 16, 2017, the New York Department of Financial Services (DFS) released final cybersecurity regulations to be codified under 23 N.Y.C.R.R. Part 500 (the Final Rule). The Final Rule contains few substantive revisions from the proposed rule issued by the DFS in late December 2016 (the Revised Proposal), which superseded the original proposed rule issued by the DFS in September 2016.

New York State-chartered or licensed banks, insurance companies, licensed lenders, check cashers, money transmitters, and their holding companies, and other firms that are licensed by, operating under approval orders of, or otherwise subject to regulation by the DFS are subject to the Final Rule (Covered Entities). The Final Rule does not purport to treat federally-chartered banks or federal branches of non-US banks licensed by the Office of the Comptroller of the Currency (OCC) as Covered Entities. The Final Rule directly regulates Covered Entities that operate under DFS licenses