Summary
- On 16 Oct 2024 DFS sent an industry letter to all regulated entities on AI-related cyber risk. It says plainly that it adds no new requirements; it shows how Part 500 already covers AI.
- It names four risks: AI-enabled social engineering (deepfake calls, video and email), AI-enhanced cyberattacks (faster reconnaissance and malware), exposure of large volumes of nonpublic information (NPI) and biometric data collected for AI, and third-party and supply chain dependence on AI vendors.
- It then lists the controls DFS expects, each tied to a Part 500 section: risk assessments, incident and continuity plans, board oversight, third-party service provider (TPSP) management, access controls and MFA, training, monitoring, and data management.
- Key Part 500 deadlines it highlights: MFA for all Authorized Users and data and asset inventories by November 2025, which DFS says should include systems that use or rely on AI.
- It also encourages using AI for defence (log review, anomaly detection, threat triage).
Who it applies to
- DFS Covered Entities: banks, insurers, licensed lenders, money transmitters, virtual currency businesses and other entities licensed or chartered by DFS (Part 500.1(e), cited in the letter).
- This includes New York branches and agencies of foreign banks licensed by DFS.
- Not extraterritorial in itself: it reaches only DFS licensees. Vendors (including Indian IT and SaaS providers) are pulled in indirectly as TPSPs through Part 500.11 contracts and due diligence.
Key dates
- 23 NYCRR Part 500 (Cybersecurity Regulation) first takes effect, including MFA
- Second Amendment to Part 500 adopted, with phased compliance dates
- DFS issues the AI cybersecurity industry letter
- Part 500 phase-in: MFA for all Authorized Users and asset and data inventories required (as described in the letter)
Full date record
| Date | Event |
|---|---|
| 2017-03-01 | Part 500 first effective; MFA has been required since then (letter footnote 18) |
| 2023-11-01 | Second Amendment to Part 500 adopted (phased dates) |
| 2024-10-16 | AI cybersecurity industry letter issued |
| 2025-11-01 | Data and asset inventories required (letter footnote 34); MFA extended to all Authorized Users "November 2025" per the letter |
Penalties and enforcement
- The letter creates no penalties.
- Enforcement happens under Part 500 through DFS examinations and enforcement actions. Penalty amounts are not stated in the letter.
- In practice, an AI-related breach (for example a deepfake-driven fraudulent transfer) will be judged against the controls in this letter: was the risk assessed, was MFA deepfake-resistant, were staff trained, were vendors vetted.
What it means for an Indian company
- Indian banks with a DFS-licensed New York branch: the branch's Part 500 program must explicitly cover AI. Update the branch risk assessment for deepfake fraud and AI vendors, move away from SMS and voice OTP for staff and customers where possible, and give the branch's governing body AI risk reporting. Head office AI tools used by the branch (for example GenAI assistants on shared systems) belong in the branch's inventory.
- Indian IT services firms and SaaS vendors serving NY banks and insurers: expect tougher TPSP questionnaires on how you use AI with client NPI, contract clauses limiting AI training on client data, notice of AI-related security events, and requests for enhanced security options.
- Indian fintechs and payment firms with a DFS money transmitter or virtual currency licence: same Part 500 expectations apply directly.
- Much of the work overlaps with ISO/IEC 42001 and ISO 27001; mapping both to Part 500 avoids duplicate effort.
Obligations
Each line is a control the letter expects, tied to the Part 500 section the letter cites. "Para" means the paragraph of the Controls and Measures section.
Showing 22 of 22
| ID | Obligation | Reference | Applies to | Controls |
|---|---|---|---|---|
| NYDFSAI-01 | Base the cybersecurity program, policies and procedures on a risk assessment that includes AI-related risks | Part 500.2, 500.3 (fn 10) | Deployer | |
| NYDFSAI-02 | Cover in that assessment the firm's own AI use, AI used by TPSPs and vendors, and vulnerabilities in AI applications that could hurt confidentiality, integrity or availability | Part 500.11 (fn 11) | Deployer | |
| NYDFSAI-03 | Update the risk assessment at least yearly and on material change (including AI changes), and update policies when it shows a gap | Part 500.2, 500.3, 500.9 (fn 12) | Deployer | |
| NYDFSAI-04 | Keep and test incident response, business continuity and disaster recovery plans that cover AI-related cybersecurity events | Part 500.16(a) (fn 13) | Deployer | |
| NYDFSAI-05 | Make sure the senior governing body understands cyber risk including AI, oversees it, and gets management reports that cover AI | Part 500.4(d) (fn 14) | Deployer | |
| NYDFSAI-06 | Do due diligence on TPSPs with access to systems or NPI, considering AI threats to them and to you | Part 500.11(a) (fn 15) | Deployer | |
| NYDFSAI-07 | Set TPSP minimum requirements for access controls and encryption, and require timely notice of cybersecurity events, including AI-related ones | Part 500.11(a); Para 6 | Deployer | |
| NYDFSAI-08 | Where a TPSP uses AI, consider contract terms on secure use of your NPI and on using enhanced privacy, security and confidentiality options | Para 6 | Deployer | |
| NYDFSAI-09 | Apply MFA to all Authorized Users (customers, staff, contractors, TPSPs) by November 2025 | Part 500.12 (fn 17, 18) | Deployer | |
| NYDFSAI-10 | Choose authentication that resists deepfakes: prefer digital certificates and physical keys over SMS, voice or video; use liveness detection or multiple biometric types | Part 500.12; Para 8 | Deployer | |
| NYDFSAI-11 | Give users only the access they need, limit privileged accounts, and restrict NPI access (zero trust is described as best practice, not a requirement) | Part 500.7 (fn 21, 22) | Deployer | |
| NYDFSAI-12 | Review access at least yearly, remove unneeded access, cut off leavers promptly, and limit remote control of devices | Part 500.7(a)(4) to (6) (fn 23) | Deployer | |
| NYDFSAI-13 | Give all staff, including senior executives and governing body members, annual awareness training that covers AI-enabled social engineering such as deepfakes | Part 500.14(a)(3) (fn 24, 28) | Deployer | |
| NYDFSAI-14 | Train cybersecurity staff on AI-enabled attacks and on using AI defensively | Part 500.10(a)(2) (fn 25) | Deployer | |
| NYDFSAI-15 | Train staff who build or deploy AI on securing AI systems, and staff who use AI tools on not putting NPI into prompts | Part 500.14(a)(3); Para 11 | Deployer | |
| NYDFSAI-16 | Set verification steps for unusual requests (such as urgent fund transfers), and use simulated phishing and voice or video impersonation drills | Part 500.14(a)(3); Para 10 | Deployer | |
| NYDFSAI-17 | Monitor systems to spot unauthorised access, use or tampering and to find new vulnerabilities quickly | Part 500.5(b) (fn 29) | Deployer | |
| NYDFSAI-18 | Monitor Authorized User activity and filter email and web traffic for malicious content | Part 500.14(a)(1), (2) (fn 30) | Deployer | |
| NYDFSAI-19 | For AI-enabled products, watch for unusual query patterns that suggest NPI extraction, and block prompts that would expose NPI to public AI tools | Part 500.5(b), 500.14(a)(2); Para 13 | Deployer | |
| NYDFSAI-20 | Dispose of NPI no longer needed for business, including NPI used for AI | Part 500.13(b) (fn 31) | Deployer | |
| NYDFSAI-21 | Maintain data inventories (required by 1 Nov 2025) and data governance covering collection, storage, processing and disposal | Part 500.13(a), 500.3(b) (fn 32, 33) | Deployer | |
| NYDFSAI-22 | Identify and inventory all systems that use or rely on AI, and prioritise mitigation for those that are critical | Part 500.13 (fn 34) | Deployer |
Controls that do the most work here
- SC-AI-007 Third-party and vendor AI due diligence4 obligations
- SC-AI-029 AI-specific security controls (prompt injection, model abuse)4 obligations
- SC-AI-030 Access control for AI systems and agents4 obligations
- SC-AI-005 AI risk assessment3 obligations
- SC-AI-008 AI literacy and staff training3 obligations
- SC-AI-031 AI incident management and regulator reporting2 obligations
Evidence an auditor will ask for
- Latest Part 500 risk assessment with an AI section (own AI, vendor AI, AI-enabled threats) and evidence of annual and change-driven updates.
- Incident response, BCP and DR plans with AI scenarios (for example a deepfake CFO call), and test or tabletop results.
- Board or governing body minutes and reports covering AI cyber risk.
- TPSP due diligence files and contracts showing AI clauses, encryption and event notice terms.
- MFA coverage report for all Authorized Users and the list of authentication factors used (showing SMS and voice phased down).
- Access review records, privileged account lists and leaver deprovisioning evidence.
- Training materials and completion records for staff, executives, board, cyber team and AI developers; phishing and deepfake simulation results.
- Call-back or dual approval procedure for payment and credential requests.
- Monitoring and DLP rules for AI tools, including blocked public GenAI uploads.
- Data inventory, retention and disposal records, and an AI system inventory flagged for criticality.
Common mistakes
- Filing the letter as "just guidance". Each expectation maps to a binding Part 500 section.
- Treating MFA as done while still relying on SMS or voice codes that deepfakes and SIM swaps defeat.
- Running a generic phishing course with no deepfake voice or video content, or leaving the board out of training.
- Leaving vendor AI (chatbots, CRM AI features, outsourced KYC tools) out of the risk assessment and inventory.
- Letting staff paste customer NPI into public GenAI tools with no blocking or monitoring.
- Keeping large biometric and training data sets longer than needed.
- Foreign bank branches assuming head office controls are enough without branch-level evidence.
Glossary
- Covered Entity: a firm licensed or chartered by DFS that must follow Part 500.
- Part 500 (23 NYCRR Part 500): New York's Cybersecurity Regulation for financial services firms.
- NPI (nonpublic information): sensitive business, personal and health data defined in Part 500.1.
- TPSP (third-party service provider): an outside firm with access to the covered entity's systems or NPI.
- Authorized User: any person allowed to use the firm's systems, including customers, staff and contractors.
- MFA (multi-factor authentication): logging in with at least two different types of proof, such as a password plus a physical key.
- Deepfake: AI-generated audio, video or text that imitates a real person.
- Liveness detection: a check that a biometric sample comes from a live person, not a photo, recording or synthetic copy.
- Senior governing body: the board or equivalent body that oversees the firm's cybersecurity.
- Zero trust: a security approach that treats every access request as untrusted until verified.
Key takeaways
- Guidance only (status supervisory): no new rules, but every expectation rests on a binding Part 500 section.
- 22 practical controls across risk assessment, governance, vendors, MFA and access, training, monitoring and data management.
- The November 2025 universal MFA and inventory deadlines have passed; examiners now expect AI systems in the inventory and deepfake-resistant MFA.
- Indian banks with DFS-licensed NY branches must show branch-level AI cyber controls; Indian IT vendors should expect AI clauses in NY financial client contracts.
Official sources
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.