Each year by April 15, every covered entity under 23 NYCRR Part 500 submits to the New York State Department of Financial Services either a certification that it materially complied with the cybersecurity regulation in the previous calendar year, or an acknowledgment that it didn't (500.17(b)).
Check the date against your own records.
Who files
Anyone operating, or required to operate, under a license, registration, charter or similar authorization under New York's Banking Law, Insurance Law or Financial Services Law. That includes licensed money transmitters, banks and insurers.
Certification or acknowledgment
- Certify material compliance for the previous calendar year, backed by data and documentation that show it
- Or acknowledge you didn't comply with everything: name each section you didn't meet, describe the extent, and give a remediation timeline or confirm it's done
Who signs
Your highest-ranking executive and your CISO. If you don't have a CISO, the senior officer responsible for the cybersecurity program signs instead. The filing goes in electronically on the form on the DFS website.
Keep the evidence
Keep the records, schedules and documents behind the filing for 5 years, including what needed improvement and your remediation plans. DFS can ask for them in an examination.
Other New York deadlines
Report a cybersecurity incident to DFS within 72 hours of deciding one has happened (500.17(a)). Licensed money transmitters also certify their transaction monitoring and filtering program under Part 504 by April 15, and file their annual report within 120 days of the year end.
Get reminded before it's due
Regmindr tracks this alongside the rest of your compliance calendar, and emails your team before each deadline.
Sources
- 23 NYCRR 500.17: Notices to superintendent
- NYDFS: Cybersecurity resource center
- NYDFS: Annual report for licensed transmitters of money on NMLS, 2025
This page is a summary, not legal or regulatory advice. The rules in the sources above take precedence.