What does 23 NYCRR Part 500 say about AI in banking?

What are the key points of 23 NYCRR Part 500?

• Second Amendment effective Nov 1, 2023; §500.17 notice changes at 30 days; governance, incident response, BCDR at one year (Nov 1, 2024); vulnerability management, access privileges, and training at 18 months (May 1, 2025); MFA and asset inventory at two years (Nov 1, 2025).
• Creates 'Class A companies' (at least $20 million in NY gross annual revenue in each of the last two years plus either 2,000+ employees or $1 billion+ global gross revenue) with added duties: independent audits, privileged-access management, and endpoint detection and response.
• §500.17: notify the Superintendent within 72 hours of determining a cybersecurity incident at the entity, an affiliate, or a third-party service provider; notify within 24 hours of any extortion payment and explain it within 30 days.
• §500.9 risk assessment must be documented, updated at least annually and on material change, and drive the entire program — the hook DFS uses to require AI-specific threats to be assessed.
• §500.11 third-party service provider policy, §500.12 MFA, §500.13 data retention and asset inventory, §500.14 monitoring and annual training — the sections DFS's AI letters cite by number.
• §500.17(b) annual certification of material compliance (or acknowledgment of non-compliance with a remediation plan) signed by the highest-ranking executive and the CISO by April 15.
• §500.20 enforcement: DFS has imposed multi-million-dollar penalties, including a $2.25 million consent order against Delta Dental in April 2026, its first cyber enforcement of the year.

What did 23 NYCRR Part 500 change for banks?

Before the Second Amendment, Part 500 already required a risk-based program, but the 2023 rewrite added board-level oversight, Class A tiering, 24-hour ransom-payment notice, universal MFA, and CEO/CISO certification — turning it from a policy requirement into a control set DFS examines line by line. Because DFS regulates AI by reading these sections rather than writing new ones, Part 500 compliance is in practice the AI-cyber compliance standard for any bank with a New York charter, branch, or agency.

What does 23 NYCRR Part 500 require, who does it apply to, and what are the deadlines?

23 NYCRR Part 500 is the New York Department of Financial Services cybersecurity regulation. It applies to every 'covered entity' — any person operating under, or required to operate under, a DFS license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, Insurance Law or Financial Services Law, which includes New York-chartered banks, DFS-licensed branches and agencies of foreign banks, insurers, mortgage lenders and money transmitters. It requires a written cybersecurity program built on a risk assessment that is updated at least annually, a chief information security officer who reports to the board, multi-factor authentication for anyone accessing the entity's information systems, notice to the Superintendent within 72 hours of a cybersecurity incident and within 24 hours of any extortion payment, and an annual certification of material compliance filed by April 15. The Second Amendment took effect November 1, 2023 and its last provisions — universal MFA and asset inventories — became mandatory on November 1, 2025, so every requirement is now in force.

The compliance calendar comes from §500.22. The Second Amendment took effect November 1, 2023; new §500.17 notice requirements applied 30 days later (December 1, 2023); most other new requirements 180 days later (April 29, 2024); governance, encryption, incident response and the revised limited-exemption thresholds at one year (November 1, 2024); vulnerability scanning, access privileges, malicious-code protection and training at 18 months (May 1, 2025); and universal multi-factor authentication under §500.12 together with the asset inventory under §500.13(a) at two years (November 1, 2025). The first annual certification under the amended rule was due April 15, 2024. Nothing is still phasing in.

'Class A' is the tier that matters for large banks. The test is New York revenue of at least $20 million in each of the last two fiscal years (counting affiliates' New York operations) plus either more than 2,000 employees or more than $1 billion in global revenue, both averaged over the last two fiscal years and both counting affiliates wherever located. Class A companies must commission independent audits of their cybersecurity program, implement privileged access management with automated blocking of commonly used passwords, and deploy endpoint detection and response with centralised logging. Foreign banks with a DFS-licensed New York branch are commonly caught because the employee and revenue tests look at the whole group.

DFS regulates AI in cybersecurity by reading Part 500 rather than by writing AI rules. The October 2024 industry letter and the May 2026 letters on frontier AI models and the heightened threat environment each take a threat — deepfake voice and video social engineering, AI-accelerated vulnerability discovery, data exposure through AI tools, dependence on AI vendors — and point to the section that already covers it: §500.9 for assessing it, §500.11 for vendors, §500.12 for authentication that resists AI-generated impersonation, §500.14 for monitoring and training, §500.15 for encryption. That is why the annual §500.17 certification is, in practice, also a certification that AI-era threats have been assessed.

WHAT THIS MEANS IN PRACTICE

• The annual certification signed on April 15 by the CEO and CISO is personal: it attests material compliance with every section, so the §500.9 risk assessment it rests on must have been updated within the year and must address the AI threats DFS has named.
• Universal MFA has been mandatory since November 1, 2025 — the limited-exemption carve-outs (remote access, privileged accounts, third-party applications) apply only to §500.19 entities.
• The 72-hour clock runs from determining that an incident has occurred, including at an affiliate or a third-party service provider; the 24-hour clock runs from an extortion payment, followed by the 30-day written explanation.
• Test the Class A thresholds at group level every fiscal year; crossing them adds the independent audit, privileged access management and EDR duties for the following period.
• Small covered entities lose the §500.19 exemption once they exceed any one of the three thresholds and then have 180 days to comply in full.

Which banks' AI programmes does 23 NYCRR Part 500 reach?

10 of the 100 largest US banks profiled on this site cite 23 NYCRR Part 500 among the documents their AI work answers to.