NYDFS: New York State Department of Financial Services

DFS matters beyond New York because its rules reach every institution licensed there, which includes most large banks, insurers and crypto firms. Its cybersecurity regulation, 23 NYCRR Part 500, has a 72-hour incident-notice rule and an annual certification due April 15, and DFS enforces it with consent orders that name the section violated. There is no RSS feed anywhere on the site, and consent orders are PDFs served from URLs that look like HTML pages.

What NYDFS publishes

• Press releases (pr20260805 style IDs)
• Consent orders across three enforcement tables: banking and money transmitters, insurance, mortgage
• Industry Letters and Insurance Circular Letters
• Regulations under 23 NYCRR (Part 500 cyber, Part 200 virtual currency) and 3 and 11 NYCRR
• Cybersecurity advisories

Cadence. Two to three newsroom items a week, most not enforcement. Roughly 20 to 30 enforcement actions a year across the three tables (19 in 2025). DFS reported more than $100 million in penalties collected in 2025.

What to treat as urgent

• Consent orders citing Part 500 sections (500.9 risk assessment, 500.12 MFA); the amounts run from tens of thousands to tens of millions.
• Industry Letters that set a compliance expectation without a rulemaking.
• Emergency regulations under 23 NYCRR, which take effect on filing.

Quirks worth knowing

• No RSS at all; GovDelivery email is the only push channel.
• Enforcement tables have no year filter, no pagination and no penalty column; the amount is only in the PDF.
• The consent order can post to the table two days before the press release, and the release links to the table rather than the order.
• Not every order gets a press release.

Subscribe at the source

• Newsroom
• Enforcement actions (banking, money transmitters, crypto, cyber)
• Industry Letter email alerts
• Cybersecurity resource center

Official site: dfs.ny.gov