For most of the past three decades, cryptography sat in the background of financial services. Security and PKI teams managed it quietly, and compliance functions rarely touched it. That era is over. NYDFS Part 500 cryptographic compliance is now a question examiners ask directly, backed by fines and personal accountability.
Part 500 is not moving alone. It arrives alongside DORA, the amended PCI DSS, and a broader wave of prescriptive cryptographic rulemaking. Regulators are shifting away from broad language like “appropriate security measures” toward precise, enforceable requirements. In New York, that shift is already complete: the Second Amendment was adopted in November 1, 2023 and phased in through November 1, 2025. Every transition period has passed. Since November 1, 2024, §500.15 has allowed no substitute for encrypting nonpublic information in transit over external networks, with only few exceptions.
This guide walks through who Part 500 applies to, the cryptographic controls it names, and the evidence you should be able to produce today.
What NYDFS Part 500 is and who it applies to
NYDFS 23 NYCRR Part 500 is the New York Department of Financial Services cybersecurity regulation. It sets baseline security obligations for regulated financial services companies, with encryption, multi-factor authentication, and annual certification named directly.
Its reach is broader than many teams expect. Part 500 applies to any organization operating under a New York license, registration, charter, or similar authorization, regardless of where it is headquartered, or whether it is also regulated by other government agencies. The scope is set by the license, not the address.
A short history of the regulation
Part 500 was first enacted in 2017, and it was the first comprehensive state cybersecurity regulation for financial institutions. The Second Amendment substantially rewrote it, taking effect November 1, 2023, then phasing in through November 1, 2025.
That phased rollout matters for one reason: it is finished. All provisions of the amended rule are now in full force, so there is no remaining runway to treat any cryptographic control as future work.
Who counts as a covered entity
A covered entity is any bank, insurer, licensed lender, or virtual currency business regulated by NYDFS. If your organization holds a New York license, registration, or charter, Part 500 likely reaches you even if your headquarters sit in another state or country.
This license-based scope is what surprises many teams. A firm can be based far from New York and still owe the full set of Part 500 cryptographic obligations because of a single authorization.
Class A Companies and the additional bar
The largest covered entities are designated Class A Companies, and they carry a heavier load. On top of the baseline encryption and authentication requirements, Class A Companies face independent audits, privileged access management, and endpoint detection and response.
If your institution meets the Class A thresholds, examiners will expect concrete evidence of these enhanced controls in addition to everything required of smaller covered entities.
Why the stakes are higher than ever
NYDFS has levied fines up to $30 million for cybersecurity compliance failures. That alone changes the conversation, but the Second Amendment added something sharper: personal accountability.
The annual Certification of Material Compliance must be signed by both the covered entity’s highest-ranking executive and its CISO. It is due April 15 each year, and the supporting documentation must be retained for five years. A dual signature turns cryptographic control status into something two named executives attest to on the record, backed by five years of retained evidence. It does not stay with the security team.
The core cryptographic requirements of NYDFS Part 500
Part 500 addresses cryptography through several interlocking control areas. Each one maps to evidence an examiner can test. The subsections below use an answer-first structure so each requirement is easy to extract and act on.
Section 500.15: encryption of nonpublic information
Section 500.15 requires encryption of nonpublic information both at rest and in transit. Where encryption at rest is infeasible, the CISO must approve effective compensating controls in writing, and that approval must be reviewed at least annually.
Encryption in transit over external networks does not come with the same flexibility. There is no compensating-control path for data moving across external networks, so the expectation is straightforward: encrypt it.
Section 500.11: third-party service provider security
Covered entities are responsible for managing third-party cybersecurity risk, not just their own. Under Section 500.11, that means maintaining policies for third-party service providers that address due diligence and contractual protections.
Those contractual protections extend to cryptographic practice. Vendors should be held to minimum security requirements, breach reporting obligations, and controls covering encryption and access, including multi-factor authentication. Your cryptographic assurance now depends on evidence you can extract from vendors, not only from your own environment.
Section 500.12: multi-factor authentication for all system access
Section 500.12 requires multi-factor authentication for any individual accessing any information system, regardless of role, location, or device. Since November 1, 2025, this coverage is universal, not limited to remote or privileged access.
The method matters too. NYDFS’s July 2025 guidance escalated DFS’s position, flagging SMS and push-based authentication as weaker options that warrant careful risk-based justification. Certificate-based, phishing-resistant MFA gives you a stronger posture and a cleaner audit answer.
Section 500.7: privileged access and key custody
Section 500.7 ties privileged access management to cryptographic credential issuance. In practice, that means enforcing least privilege for the administrators who issue and manage keys and certificates.
The people who can mint or revoke cryptographic credentials hold significant power over your trust foundation. Part 500 expects that power to be scoped, controlled, and evidenced.
Section 500.13: asset and certificate inventory
Section 500.13 requires a complete, accurate, documented inventory of information systems, which imply an asset inventory including certificates and cryptographic key material with the same requirements. Specifically, the inventory must cover the certificates and keys supporting systems that hold nonpublic information.
You cannot protect or certify what you cannot see. A current inventory tied to nonpublic-information systems is the foundation the other cryptographic controls rest on.
Section 500.8: secure application development
Section 500.8 folds cryptographic controls into secure development. For in-house applications that process nonpublic information, that includes integrating code-signing controls into the development lifecycle.
The requirement also reaches outward. Covered entities need procedures for evaluating and testing the security of externally developed applications they use, so third-party code receives the same scrutiny as internal builds.
Section 500.17: annual certification evidence
Section 500.17(b) sits behind the dual-signature certification. To support the CEO and CISO who sign, teams need a consolidated evidence package on cryptographic control status.
Assembling that package should not be a fire drill each April. A single, current view of encryption, MFA, inventory, and access control status is what makes the certification defensible.
Getting audit ready: questions examiners will ask
The clearest way to test your readiness is to answer the questions an examiner would. If you can answer each of these today, with evidence, you are in strong shape.
- Is nonpublic information encrypted at rest and in transit, with any CISO-approved compensating controls documented and reviewed annually? If not, do you qualify for an excemption?
- Since November 1, 2025, is MFA enforced for every individual accessing any information system? If using weaker methods, can you show where they are used and justify that in writing?
- Your 500.13 inventory tracks support expiration dates for information systems. Can it tell you which certificates those systems depend on, and when they expire?
- Are compensating-control approvals and other CISO determinations documented and revisited at least annually?
- For Class A Companies, is there evidence of independent audits, privileged access management, and EDR coverage?
- Is supporting documentation for the annual certification retained for the required five years?
Looking ahead: post-quantum readiness on the horizon
The certificate and key inventory work you do for Sections 500.13 and 500.15 has a second payoff. When the standards it points to stop accepting RSA and ECC, 500.15 stops accepting them too. Thus your work is also the foundation for crypto-agility and post-quantum readiness, the direction nearly every framework is now heading.
To be clear, post-quantum migration is not a Part 500 requirement today. But NIST has published a transition timeline that deprecates today’s algorithms toward 2030, and the inventory expectations you are already meeting are exactly what a future migration depends on. Inventory work done now has dates attached to what comes next.
How Keyfactor helps with NYDFS Part 500 cryptographic compliance
Keyfactor maps directly to the Part 500 control areas above, so you can meet each requirement and generate the evidence examiners expect.
- Annual certification evidence (500.17): AgileSec consolidates cryptographic control status into an audit-ready package.
- Encryption and certificate-based MFA (500.15, 500.12): EJBCA issues and manages the certificates behind encryption and phishing-resistant authentication.
- Secure application development (500.8): SignServer integrates code-signing controls into your development pipeline.
- Privileged access, key custody, and inventory (500.7, 500.13): Keyfactor Command gives continuous visibility into certificates and keys and enforces controlled issuance.
These tools come together in the Keyfactor Trust Control Plane, a single system of record that observes, analyzes, provisions, orchestrates, and governs every cryptographic asset. The result is one place to produce the evidence any framework asks for.
Conclusion: a program, not a project
Part 500 compliance is not a task you finish once and file away. And while this regulation does not specify which algorithm to use, it tells you that two named executives will sign for whatever you chose, and that you will hold the documentation for five years. That is not a technology prescription; however, it is a requirement for you to know, continuously, what your cryptography actually is.
Institutions that build it this way absorb each new requirement more easily, whether it arrives as a state rule, a card network mandate, or an executive order. The next requirement lands on infrastructure that already answers it.
Ready to see where you stand against Part 500? Request a demo to assess your cryptographic visibility and build audit-ready evidence.
Got NYDFS Part 500 questions? We’ve got answers.
What is NYDFS Part 500?
NYDFS 23 NYCRR Part 500 is the New York Department of Financial Services cybersecurity regulation. It sets security obligations for regulated financial companies, naming encryption, multi-factor authentication, and annual certification directly.
Who has to comply with Part 500?
Banks, insurers, licensed lenders, and virtual currency businesses regulated by NYDFS. Its reach is not tied to a location: any organization operating under a New York license, registration, or charter is covered regardless of where headquarters are or which other regulations they must follow.
Is NYDFS Part 500 fully in effect?
Yes. The Second Amendment took effect November 1, 2023, and phased in through November 1, 2025. Every transition period has passed, so all amended requirements are now fully enforceable.
What does Part 500 require for encryption?
Section 500.15 requires encryption of nonpublic information at rest and in transit. Where encryption at rest is infeasible, the CISO must approve compensating controls in writing and review that approval at least annually.
What are the MFA requirements under Part 500?
Section 500.12 requires multi-factor authentication for any individual accessing any information system. NYDFS’s July 2025 guidance flags SMS and push-based methods as weaker, favoring certificate-based, phishing-resistant MFA.
What is a Class A Company under Part 500?
Class A Companies are the largest covered entities. They have at least $20M in gross annual revenue in each of the last two fiscal years and either more than 2,000 employees or more than $1B in revenue. Class A companies owe independent audits, privileged access management, and endpoint detection and response — but no additional encryption requirements. §500.15 is identical for every covered entity.
What are the penalties for non-compliance?
NYDFS has levied fines up to $30 million for cybersecurity failures. The rule also adds personal accountability through a dual-signature annual certification signed by the top executive and the CISO.
When is the NYDFS annual certification due?
The Certification of Material Compliance is due April 15 each year. It must be signed by the highest-ranking executive and the CISO, with supporting documentation retained for five yea
