What are the NYDFS Cybersecurity Regulation (Part 500) compliance deadlines?

Mar 1, 2017: Part 500 effective. Nov 1, 2023: Second Amendment effective. Dec 1, 2023: Amended notification requirements (500.17). Apr 15, 2024: Annual compliance notification. Apr 29, 2024: General 180-day transition ends. Nov 1, 2024: Governance, encryption, IR/BCDR, exemptions. May 1, 2025: Vulnerability scans, access privileges, malware controls, Class A monitoring. Nov 1, 2025: Universal MFA and asset inventory. Apr 15, 2026: Annual compliance notification.

When does NYDFS Cybersecurity Regulation (Part 500) take effect?

NYDFS Cybersecurity Regulation (Part 500) took effect on Mar 1, 2017.

Who does NYDFS Cybersecurity Regulation (Part 500) apply to?

Covered entities: persons operating under a DFS license, registration, charter or similar authorization (banks, insurers, money transmitters, etc.). Class A companies: at least $20,000,000 gross annual revenue in each of the last two fiscal years from NY business, and either over 2,000 employees averaged over two years or over $1,000,000,000 gross annual revenue in each of the last two fiscal years. Limited exemption for fewer than 20 employees and contractors, under $7,500,000 gross annual revenue in each of the last 3 fiscal years, or under $15,000,000 year-end total assets.

What are the penalties under NYDFS Cybersecurity Regulation (Part 500)?

Penalties under the Banking Law, Insurance Law and Financial Services Law. 500.20 lists the factors DFS weighs; the regulation sets no fixed maximum. A single act or failure, including failing to comply for any 24-hour period, is a violation.

NYDFS Cybersecurity Regulation (Part 500)

Amended New York · In force Mar 1, 2017 · no upcoming deadlines

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

ReportingApr 15 · 6 months ago · Source

Annual compliance notificationAnnual certification or acknowledgment covering calendar year 2025 due.

ComplianceNov 1, 2025 · 12 months ago · Source

Universal MFA and asset inventory500.12 multi-factor authentication for all users and 500.13(a) asset inventory requirements apply.

ComplianceMay 1, 2025 · 18 months ago · Source

Vulnerability scans, access privileges, malware controls, Class A monitoring500.5(a)(2) automated scans, 500.7 access privilege restrictions, 500.14(a)(2) malicious code protection, and 500.14(b) Class A endpoint detection and centralized logging apply.

ComplianceNov 1, 2024 · 24 months ago · Source

Governance, encryption, IR/BCDR, exemptions500.4 governance, 500.15 encryption, 500.16 incident response and business continuity plans, and 500.19(a) revised exemptions apply.

ComplianceApr 29, 2024 · 2.5 years ago · Source

General 180-day transition endsMost new Second Amendment requirements apply, e.g. annual reporting to the board and risk assessment updates.

ReportingApr 15, 2024 · 2.5 years ago · Source

Annual compliance notificationCertification of compliance or acknowledgment of non-compliance due (recurs every April 15).

ComplianceDec 1, 2023 · 2.9 years ago · Source

Amended notification requirements (500.17)New 72-hour event notice, 24-hour extortion payment notice and certification changes apply (30 days).

Takes effectNov 1, 2023 · 3 years ago · Source

Second Amendment effectiveSecond Amendment takes effect; 500.19(e)-(h), 500.20, 500.21, 500.22 and 500.24 apply immediately.

Takes effectMar 1, 2017 · 9.7 years ago · Source

Part 500 effectiveOriginal cybersecurity regulation takes effect.

Summaries for reference, not legal advice. Check the official text.

What it does

DFS-licensed financial companies must keep a risk-based cybersecurity program, CISO, policies, access controls, MFA, encryption, an asset inventory, and incident response and business continuity plans. They must notify DFS within 72 hours of a cybersecurity event and within 24 hours of any extortion payment, and certify compliance or acknowledge non-compliance each April 15. The 2023 Second Amendment added governance duties, Class A company requirements and phased controls through November 1, 2025.

Who it applies to: Covered entities: persons operating under a DFS license, registration, charter or similar authorization (banks, insurers, money transmitters, etc.). Class A companies: at least $20,000,000 gross annual revenue in each of the last two fiscal years from NY business, and either over 2,000 employees averaged over two years or over $1,000,000,000 gross annual revenue in each of the last two fiscal years. Limited exemption for fewer than 20 employees and contractors, under $7,500,000 gross annual revenue in each of the last 3 fiscal years, or under $15,000,000 year-end total assets.
Penalties: Penalties under the Banking Law, Insurance Law and Financial Services Law. 500.20 lists the factors DFS weighs; the regulation sets no fixed maximum. A single act or failure, including failing to comply for any 24-hour period, is a violation.
Enforced by: New York State Department of Financial Services (DFS)
Official name: New York DFS Cybersecurity Requirements for Financial Services Companies (23 NYCRR Part 500), Second Amendment
Citation: 23 NYCRR Part 500 (Second Amendment effective 2023-11-01)
Topics: Cybersecurity, Breach notification, Financial

Verified 2026-09-22 dfs.ny.gov

Research notes

Dates are computed from the 500.22 transitional periods (30 days, 180 days, 1 year, 18 months and 2 years from the November 1, 2023 Second Amendment) and match DFS guidance. DFS also issued 2026 industry letters on frontier-AI cyber risk (May 21, 2026) and risk assessment (September 10, 2026); these are guidance, not rule changes.

AmendedCalifornia

CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months

In forceNew York

NY Algorithmic Pricing Disclosure ActAny business that sets a price using personalized algorithmic pricing must show the disclosure 'THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA' next to the price. Insurers, GLBA financial institutions and certain subscription prices are exempt.In effect since Nov 10, 2025

In forceNew York

NY Child Data Protection ActOnline operators may not collect, use, share or sell personal data of users under 18 unless it is strictly necessary for the service or they obtain informed consent. It covers sites and apps directed to minors or with actual knowledge that a user is a minor.In effect since Jun 20, 2025

EnactedNew York

NY RAISE ActFrontier AI developers must publish transparency reports when they deploy models and report critical safety incidents to a new DFS oversight office within 72 hours, or within 24 hours to authorities where there is imminent risk of death or injury. Large frontier developers must also publish and annually update a Frontier AI Framework, submit catastrophic-risk assessments, file disclosure statements with DFS every two years, and pay a share of the office's costs. The March 2026 chapter amendment realigned the law closely with California SB 53.Next: Jan 1, 2027 RAISE Act takes effect · in 2 months

EnactedNew York

NY SAFE for Kids ActSocial media platforms may not show algorithmically personalized feeds to users under 18, or send them notifications between midnight and 6 a.m., without parental consent. The AG's final rules set age assurance accuracy standards, certification and parental consent methods.Next: Jan 25, 2027 Act and rules take effect · in 3 months

In forceNew York City, New York

NYC Local Law 144 (AEDT)Employers and employment agencies may not use an automated employment decision tool (AEDT) to screen candidates or employees for hiring or promotion unless the tool has had an independent bias audit within the past year. They must publish a summary of the audit results and give candidates at least 10 business days' notice that an AEDT will be used.In effect since Jul 5, 2023

Questions about NYDFS Cybersecurity Regulation (Part 500)

What are the NYDFS Cybersecurity Regulation (Part 500) compliance deadlines?: Mar 1, 2017: Part 500 effective. Nov 1, 2023: Second Amendment effective. Dec 1, 2023: Amended notification requirements (500.17). Apr 15, 2024: Annual compliance notification. Apr 29, 2024: General 180-day transition ends. Nov 1, 2024: Governance, encryption, IR/BCDR, exemptions. May 1, 2025: Vulnerability scans, access privileges, malware controls, Class A monitoring. Nov 1, 2025: Universal MFA and asset inventory. Apr 15, 2026: Annual compliance notification.
When does NYDFS Cybersecurity Regulation (Part 500) take effect?: NYDFS Cybersecurity Regulation (Part 500) took effect on Mar 1, 2017.
Who does NYDFS Cybersecurity Regulation (Part 500) apply to?: Covered entities: persons operating under a DFS license, registration, charter or similar authorization (banks, insurers, money transmitters, etc.). Class A companies: at least $20,000,000 gross annual revenue in each of the last two fiscal years from NY business, and either over 2,000 employees averaged over two years or over $1,000,000,000 gross annual revenue in each of the last two fiscal years. Limited exemption for fewer than 20 employees and contractors, under $7,500,000 gross annual revenue in each of the last 3 fiscal years, or under $15,000,000 year-end total assets.
What are the penalties under NYDFS Cybersecurity Regulation (Part 500)?: Penalties under the Banking Law, Insurance Law and Financial Services Law. 500.20 lists the factors DFS weighs; the regulation sets no fixed maximum. A single act or failure, including failing to comply for any 24-hour period, is a violation.

Deadlines

What it does

Related