NY DFS PART 500 GUIDE

NY DFS Part 500 document transmission requirements: what 23 NYCRR 500 demands when nonpublic information leaves your systems.

Part 500 is the most prescriptive cybersecurity regulation a financial institution in the United States operates under, and after the November 2023 amendment it is the least forgiving about transit encryption. This guide maps the sections that bite when a document moves, and what a compliant channel looks like.

All guides → What is Secure Digital Transport? →

Who Part 500 covers and why documents are in scope

23 NYCRR Part 500 applies to every entity operating under a license, registration, charter, or similar authorization from the New York Department of Financial Services: banks, insurers, mortgage lenders and servicers, money transmitters, and the agents and brokers who work with them. The regulation protects nonpublic information, which includes any business information whose disclosure would materially harm the entity and any personal, financial, or health information about an individual. Nearly every document a covered entity sends or collects qualifies.

The sections that govern a moving document

Section 500.15, encryption. Covered entities must implement a written policy requiring encryption of nonpublic information both in transit over external networks and at rest. The 2023 amendment removed the option to substitute compensating controls for encryption in transit; compensating controls remain available only for data at rest, with the CISO's written approval reviewed at least annually. A document that leaves your network unencrypted at any hop is a 500.15 violation, full stop. Section 500.12, multi-factor authentication. MFA is required for remote access to information systems and third-party applications, and, since the amendment, for access to any information system of a covered entity with limited exceptions. A customer portal holding nonpublic information is an information system; a credential-based portal without MFA is a finding, and a portal with MFA is one more thing recipients will not complete. Section 500.7, access privileges. Access to nonpublic information must be limited to what is necessary, reviewed at least annually, and promptly revoked. For a document, that is the question of who can open it after it is sent. Section 500.13, asset inventory and data retention. Nonpublic information that is no longer necessary for business operations or other legitimate purposes must be securely disposed of on a periodic basis. Every uncontrolled copy of a document in a mailbox, archive, or backup is a retention item. Section 500.14, monitoring. Risk-based controls to protect against unauthorized access and monitoring of user activity. For transmitted documents that means knowing who received what, when. Section 500.17, notices to the superintendent. Notice within 72 hours of determining that a cybersecurity incident has occurred, and the annual certification of compliance signed by the highest-ranking executive and the CISO. A document that reached the wrong party is an incident whose 72-hour clock starts when you determine it happened, which requires knowing where documents go. Section 500.11, third-party service providers. Written policies and due diligence for any vendor with access to nonpublic information, which includes any vendor that transmits documents for you.

Why email fails 500.15 by design

Email is hop-by-hop at best. TLS between your mail server and the next relay is opportunistic, and when negotiation fails the message is delivered in cleartext. That is not encryption in transit over external networks; it is encryption when the network cooperates, and 500.15 no longer allows a compensating-control argument for transit. The attachment then persists unencrypted in mailboxes and backups, which engages 500.13 retention and 500.15 at rest, and nobody can say who opened it, which fails 500.14 and makes the 500.17 determination impossible to make on time.

Why portals create new Part 500 obligations

A portal brings documents under 500.15 at rest and 500.14 monitoring, which is good, and simultaneously creates an information system full of customer credentials that 500.12 says must be behind MFA. Customers, agents, and counterparties who will not create an account to receive one document will certainly not enroll in MFA to do it, so the portal becomes the compliant channel nobody uses while the documents travel by email. The covered entity also now governs a stored copy of every document for the life of the account.

What Part 500 compliant document transmission looks like

A transport that satisfies the sections looks like this: the sender's system creates a one-time encrypted delivery for a named recipient; the recipient opens it from a notification with no account, password, or app; the document is encrypted from pickup to delivery and the encrypted container is destroyed once delivered, so nothing persists on a relay, in an inbox, or in a backup; and every pickup is logged per document with who, when, and from where. That is the Secure Digital Transport model, and it is the control, not a workaround. The practical walkthrough is in how to send sensitive documents without a portal.

Mapped to the regulation: encryption from pickup to delivery satisfies 500.15 in transit with no opportunistic hop and no compensating-control argument required; a delivery bound to one recipient, with identity verification at open where risk warrants, satisfies 500.7 without creating a credentialed information system that 500.12 must govern; destruction of the encrypted container after delivery means there is no residual copy for 500.13 to retain or 500.15 to protect at rest; and the per-document access log satisfies 500.14 and gives the 500.17 determination a factual basis within minutes rather than days. The transport vendor is a third-party service provider under 500.11 and should hold an independent examination of its controls; Botdoc maintains SOC 2 Type 2.

Frequently asked questions

Does NY DFS Part 500 require encryption of documents in transit?

Yes. Section 500.15 requires encryption of nonpublic information in transit over external networks and at rest. Since the November 2023 amendment, compensating controls may substitute for encryption at rest only, with CISO approval; there is no compensating-control option for data in transit.

Is email compliant with NY DFS Part 500?

Standard email is not. Its transit encryption is opportunistic and fails open, the attachment persists unencrypted in mailboxes and backups, and there is no per-document record of access. Encrypted-email products close the transit gap but typically push recipients into a credentialed portal and leave stored copies.

Does a customer portal satisfy Part 500 for document exchange?

It can satisfy encryption at rest and monitoring, but it creates an information system that Section 500.12 requires to be behind multi-factor authentication, and external recipients rarely complete enrollment. A transport that delivers or collects documents without a recipient account meets the encryption, access, retention, and monitoring sections without creating a credential base to govern.

What counts as nonpublic information under Part 500?

Business information whose unauthorized disclosure would cause material adverse impact, any information about an individual that can identify them combined with identifiers such as account numbers, Social Security numbers, or credentials, and health information. Nearly every document a bank, insurer, or lender sends or collects contains at least one category.

What is the Part 500 notice deadline for a misdirected document?

Section 500.17 requires notice to the superintendent within 72 hours of determining that a cybersecurity incident has occurred. A document containing nonpublic information delivered to the wrong party can be an incident, which is why knowing exactly who received each document, and being able to show it, is a prerequisite for meeting the clock.