InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
NYDFS imposes $5 million fine against cruise line for cybersecurity violations
On June 24, NYDFS announced a consent order imposing a $5 million fine against a group of Florida-based cruise lines for alleged violations of the state’s Cybersecurity Regulation (23 NYCRR Part 500). According to a Department investigation, the companies were subject to four cybersecurity incidents between 2019 and 2021 (including two ransomware attacks). The companies determined that unauthorized parties gained access to employee email accounts, and that, through a series of phishing emails, the parties were able to access email and attachments containing personal information belonging to the companies’ consumers and employees. NYDFS claimed that although the companies were aware of the first cybersecurity event in May 2019, they failed to notify the Department as required under 23 NYCRR Part 500 until April 2020. The investigation further showed that the companies allegedly failed to implement multi-factor authentication and did not provide adequate cybersecurity training for their personnel. NYDFS determined that in addition to the penalty, since the companies were licensed insurance producers in the state at the time of the cybersecurity incidents they would be required to surrender their insurance provider licenses.
The settlement follows a $1.25 million data breach settlement reached with 45 states and the District of Columbia on June 22 (covered by InfoBytes here).
NYDFS proposes check-cashing fee regulations
On June 15, NYDFS issued a proposed check cashing regulation following an emergency regulation announced in February that halted annual increases on check-cashing fees and locked the current maximum fee set last February at 2.27 percent (covered by InfoBytes here). The proposed regulation establishes a new fee methodology which evaluates the needs of licensees and consumers who use check cashing services. Two tiers of fees for licensed check cashers are recommended: (i) the maximum fee that a check casher may charge for a public assistance check issued by a federal or state government agency (including checks for Social Security, unemployment, retirement, veteran’s benefits, emergency relief, housing assistance, or tax refunds) is set at 1.5 percent; and (ii) the maximum fee a check casher is permitted to charge for all other checks, drafts, or money orders is $1 or 2.2 percent, whichever is greater. NYDFS added that starting January 31, 2027 (and annually every five years thereafter), licensed check cashers may request an increase in the maximum fees established. Comments on the proposed regulation will be accepted for 60 days.
NYDFS releases stablecoin guidance
On June 8, NYDFS released new regulatory guidance on the issuance of U.S. dollar-backed stablecoins, establishing criteria for regulated virtual currency companies seeking to issue stablecoins in the state. The guidance outlines baseline criteria for USD-backed stablecoins, including that: (i) a “stablecoin must be fully backed by a Reserve of assets,” such that the Reserve’s market value “is at least equal to the nominal value of all outstanding units of the stablecoin as of the end of each business day”; (ii) stablecoin issuers “must adopt clear, conspicuous redemption policies, approved in advance by [NYDFS] in writing, that confer on any lawful holder of the stablecoin a right to redeem units of the stablecoin from the Issuer in a timely fashion at par for the U.S. dollar”; (iii) Reserve assets must be segregated from an issuer’s proprietary assets and “held in custody with U.S. state or federally chartered depository institutions and/or asset custodians”; (iv) a Reserve must consist of specific assets subject to NYDFS-approved overcollateralization requirements and restrictions; and (v) a Reserve must undergo an examination of its management’s assertions at least once a month by a licensed certified public accountant.
NYDFS emphasized that these criteria are not the only requirements it may impose when issuing stablecoins, and informed regulated entities that it will also consider a range of potential risks prior to granting a regulated entity authorization to issue stablecoins. This includes risk related to “cybersecurity and information technology; network design and maintenance and related technology and operational considerations; Bank Secrecy Act/anti-money-laundering [] and sanctions compliance; consumer protection; safety and soundness of the issuing entity; and the stability/integrity of the payment system, as applicable.” Additional requirements may be imposed on regulated entities to address any of these risks.
NYDFS noted that the regulatory guidance is not applicable to USD-backed stablecoins listed, but not issued, by regulated entities, and stated it “does expect regulated entities that list USD-backed stablecoins to consider this guidance when submitting a request for coin issuance or seeking approval for a coin self-certification policy.”
NYDFS commits to mitigating virtual currency risks
On May 20, NYDFS Superintendent Adrienne A. Harris emphasized the role regulation plays in protecting consumers from cybercriminals in the virtual currency marketplace. According to Harris, NYDFS is committed to mitigating risks in this space by guarding against sanctions evasion and illicit activity and making sure corporate infrastructure and consumer data are well protected from bad actors. Harris stressed that NYDFS “will continue to improve upon [its] regulation and supervision; engage with key stakeholders on important trends and issues; collaborate with state, federal and international regulators; and strive to be a forward-looking, innovative regulator, including through [its] VOLT initiative,” which supports the department’s efforts to increase transparency and enhance supervision related to virtual currency.
NYDFS issues industry letter on reverse mortgage lending
On May 17, NYDFS announced an industry letter to establish its expectations for all institutions engaged in reverse mortgage lending in the State on cooperative apartment units (coop-reverse mortgages) once newly enacted Section 6-O*2 of the New York Banking Law takes effect May 30. The letter noted there is a comprehensive regulatory framework that addresses the marketing, origination, and servicing of reverse mortgages in New York and stated that most of the existing requirements apply equally to coop-reverse mortgages. This includes Title 3 of the New York Code of Rules and Regulations Part 79 (3 NYCRR 79), which establishes various requirements relating to the marketing, origination, servicing, and termination of reverse mortgage loans in New York, and Title 3 of the New York Code of Rules and Regulations Part 38 (3 NYCRR 38), which addresses issues involving, among other things, commitments and advertising for mortgage loans generally. Even so, the letter noted that NYDFS is considering amending its existing regulations to specifically address coop-reverse mortgages, or issuing a separate regulation governing this as a new product. Finally, the letter explained that “institutions that seek to originate, or service coop-reverse mortgages are directed to comply with the provisions of 3 NYCRR 79, and 3 NYCRR 38 in originating or servicing such mortgages” (subject to described clarifications, modifications, and exclusions). However, NYDFS stated that “in the event of any inconsistency between the provisions of Section 6-O*2 and provisions of either 3 NYCRR 79 or 3 NYCRR 38, the provisions of Section 6-O*2 will govern; and in the event of any inconsistency between the provisions of 3 NYCRR 79 and 3 NYCRR 38, provisions of 3 NYCRR 79 will govern.”
New York enacts new consumer protection measures
Recently, the New York governor signed legislation regarding consumer protections and student transcripts. The first piece of legislation, S.1684/A.8293 directs NYDFS to conduct a study of underbanked communities and households in the state and to make recommendations on improving access to financial services. The bill, among other things, updates the data on households that are unbanked and underbanked and analyzes the data to develop an assessment for NYDFS. Additionally, S.4894/A.1693 prohibits banking institutions from issuing unsolicited mail-loan checks, defined by NYDFS as “an unsolicited loan offer that is sent by mail and once cashed or deposited binds the recipient to the loan terms, which may include high interest rates for multiple years.”
The New York governor also signed legislation that prohibits colleges and universities from withholding transcripts from individuals who owe the schools money. This legislation, S.5924/A.6938 establishes, among other things, that no institution, under certain circumstances, can “condition the provision of a transcript on a student's payment of a debt to such institution or school.”
NYDFS encourages virtual currency licensees to use blockchain analytics tools for sanctions and AML compliance
On April 28, NYDFS announced new guidance on virtual currency entities that are establishing the use of blockchain analytics tools. NYDFS explained that virtual currency activities can involve, among other things, different sources, destinations, and types of funds flows than are found in more traditional, fiat-currency contexts. Such characteristics of virtual currencies can create compliance challenges, but also can present new possibilities for new technology-driven control measures. In the guidance, NYDFS outlined expectations for New York State-regulated virtual currency companies, including: (i) establishing control measures that may leverage blockchain analytics; (ii) augmenting due diligence controls; (iii) conducting transaction monitoring of on-chain activity; and (iv) conducting sanctions screening of on-chain activity. NYDFS also emphasized "the importance of risk-based policies, processes, and procedures to identify transaction activity involving virtual currency addresses or other identifying information associated with sanctioned individuals and entities listed on the SDN List, or located in sanctioned jurisdictions."
As previously covered by InfoBytes, NYDFS issued a framework outlining industry best practices for state-regulated property/casualty insurers writing cyber insurance, which provided guidance for effectively managing cyber insurance risk. The framework is the first guidance released by a U.S. regulator on cyberinsurance. NYDFS noted it has “engaged with external stakeholders to inform this new guidance and continues to conduct significant outreach to state, federal and international regulators; industry; and other experts in the field to ensure New York maintains a robust regulatory regime and remains a destination for virtual currency companies to operate.”
NYDFS encourages banks to expand access to low-cost banking services
On April 15, NYDFS issued guidance determining that offering a “Bank On” certified deposit accounts would satisfy a New York Basic Banking services law that requires institutions to offer low-cost banking services to consumers. According to NYDFS, Bank On accounts (which offer services that eliminate several fees, including overdraft, account activation, closure, dormancy, inactivity, and low balance fees) may be offered as an alternative to existing basic banking accounts. Following an assessment of the New York banking industry to determine the receptiveness and operational viability of offering Bank On accounts, NYDFS concluded that “all New York State regulated banking institutions, as defined under Section 14-f.9(a) of the New York Banking Law . . ., will be deemed to satisfy the Basic Banking requirements under the New York Banking Law and the General Regulations of the Superintendent, by offering Bank On accounts as an alternative to Basic Banking accounts.” Banking institutions may offer Bank On accounts instead of Basic Banking accounts without the need to submit a separate application to the NYDFS for approval. However, because the national standards for Bank On accounts are subject to change without input from NYDFS, institutions that offer the accounts should keep up to date on the national standards.
The guidance follows an announcement from New York Governor Kathy Hochul stating that the “COVID-19 pandemic has shown how important it is for every New Yorker to have financial security.” Stressing that “access to low-cost banking services is critical to managing and securing their financial needs,” Hochul stated that “[t]hese new accounts will help hard working individuals in underserved communities get the affordable, accessible banking options they need and is a crucial step towards ensuring a more inclusive economy for all.”
NYDFS encourages banks to expand access to low-cost banking services
On April 15, NYDFS issued guidance determining that offering a “Bank On” certified deposit accounts would satisfy a New York Basic Banking services law that requires institutions to offer low-cost banking services to consumers. According to NYDFS, Bank On accounts (which offer services that eliminate several fees, including overdraft, account activation, closure, dormancy, inactivity, and low balance fees) may be offered as an alternative to existing basic banking accounts. Following an assessment of the New York banking industry to determine the receptiveness and operational viability of offering Bank On accounts, NYDFS concluded that “all New York State regulated banking institutions, as defined under Section 14-f.9(a) of the New York Banking Law . . ., will be deemed to satisfy the Basic Banking requirements under the New York Banking Law and the General Regulations of the Superintendent, by offering Bank On accounts as an alternative to Basic Banking accounts.” Banking institutions may offer Bank On accounts instead of Basic Banking accounts without the need to submit a separate application to the NYDFS for approval. However, because the national standards for Bank On accounts are subject to change without input from NYDFS, institutions that offer the accounts should keep up to date on the national standards.
The guidance follows an announcement from New York Governor Kathy Hochul stating that the “COVID-19 pandemic has shown how important it is for every New Yorker to have financial security.” Stressing that “access to low-cost banking services is critical to managing and securing their financial needs,” Hochul stated that “[t]hese new accounts will help hard working individuals in underserved communities get the affordable, accessible banking options they need and is a crucial step towards ensuring a more inclusive economy for all.”
NYDFS to collect assessment fees from licensed virtual currency businesses
On April 9, the New York governor signed S. 8008-C, which enacts the state’s 2023 fiscal year budget and requires, among other things, NYDFS to start charging a new assessment fee to all virtual currency businesses licensed in New York in order to cover the costs associated with their oversight and “defray operating expenses.” Specifically, Section 206 is amended to read: “The expenses of every examination of the affairs of any person regulated pursuant to this chapter that engages in virtual currency business activity shall be borne and paid by the regulated person so examined, but the superintendent, with the approval of the comptroller, may in the superintendent’s discretion for good cause shown remit such charges.” The amendments do not specify a specific assessment amount, however regulated companies engaged in virtual currency business activity “shall be assessed by the superintendent for the operating expenses of the department that are solely attributable to regulating such persons in such proportions as the superintendent shall deem just and reasonable.”
NYDFS Superintendent Adrienne A. Harris issued a press release the same day praising the budget adoption as it now allows the Department to collect supervisory costs from licensed virtual currency businesses as it does for banking and insurance companies. Noting that “New York was the first to start licensing and supervising virtual currency companies,” Harris said that the “new authority will empower the Department to build staff with the capacity and expertise to best regulate and support this rapidly growing industry.”