Superintendent Harris’s Operations and Technology Transformation Hits Major Milestones with DFS Connect Launch and 1000 Hires and Promotions Since January 2022

The New York State Department of Financial Services (DFS) today launched the DFS Connect platform, marking a significant milestone in the Department’s ongoing operations and technology transformation. Under Superintendent Adrienne Harris’s leadership, over the past three years, DFS has executed a strategic plan to invest in human capital, modernize technological resources, and streamline processes. These efforts ensure that DFS remains a forward-thinking, responsive regulator in an evolving financial landscape.

“Over the last three years, we have cultivated a culture of innovation, invested in new technological infrastructure, and updated key processes,” said Superintendent Harris. “DFS Connect is a pivotal example of how we are innovating to enhance regulatory oversight while making it easier for New Yorkers and businesses to engage directly with the agency,”

Over the course of the next three years, the DFS Connect digital portal will centralize the Department’s interactions with regulated entities and consumers. DFS Connect is eliminating outdated, fragmented systems and replacing them with a single, streamlined platform that enhances efficiency, improves oversight, and ensures better service to businesses and consumers.

With today’s launch, New Yorkers can now submit complaints about prescription drug costs, pharmacy benefit managers (PBMs), and drug manufacturers. Once a complaint is submitted, an individual can track its status in real-time and communicate directly with DFS staff about their issue. By 2027, all consumer complaints and regulatory functions agency-wide, such as licensing, renewals, examinations, financial statements and legal filings, will be handled seamlessly through DFS Connect. 

Since 2022, DFS has prioritized modernizing its regulatory infrastructure to ensure it is well-equipped to manage emerging risks. This has included a comprehensive technology overhaul, the establishment of the agency’s first Data Governance Office, and the hiring of the Department’s first-ever Chief Technology Officer and Chief Risk Officer. These steps have allowed DFS to enhance its analytical capabilities, implement real-time risk monitoring, and improve decision-making processes.

DFS has also invested heavily in strengthening its workforce, hiring and promoting more than 1,000 individuals over the past three years, including the first class of financial services examiner trainees since 2018. Additionally, the Department has expanded its regulatory capabilities by establishing the Climate Division and the Pharmacy Benefit Unit and elevating key operational functions by creating an executive leadership role dedicated to internal operations.

These staffing investments, combined with business process redesign efforts, have eliminated backlogs that had persisted for years. Since implementing a new regulatory tracking system in 2023, DFS has now cleared more than 30,000 backlogged regulatory filings, ensuring more efficient oversight of financial institutions.

The Department will continue to invest in cutting-edge technology, data-driven oversight, and a highly skilled workforce to maintain its status as a 21st-century regulator. By enhancing its efficiency and responsiveness, DFS is not only adapting to the complexities of the modern financial landscape but also strengthening protections for New Yorkers and the financial system at large.

For more information or to sign up for DFS Connect, visit the DFS website or the DFS Connect platform.

Download the regulation HERE

Check this Newsblog and the Calendar for announcements on cybersecurity training and compliance education, currently under development.

Released on April 13, 2020

https://www.dfs.ny.gov/industry_guidance/industry_letters/il20200413_covid19_cybersecurity_awareness

Re: Guidance to Department of Financial Services (“DFS”) Regulated Entities Regarding Cybersecurity Awareness During COVID-19 Pandemic

To: All New York State Regulated Entities

As we face an unprecedented threat from the novel coronavirus known as “COVID-19,” every organization’s highest priority must be health and safety.  The extraordinary steps necessary to combat the COVID-19 pandemic have also created new challenges as regulated entities work to continue operating and providing critical services.  Among these new risks is a significant increase in cybercrime, as criminals seek to exploit the situation.^[1]

The Department of Financial Services (“DFS”) has identified several areas of heightened cybersecurity risk as a result of this crisis.  As called for by DFS’s cybersecurity regulation, 23 NYCRR Part 500, regulated entities should assess the risks described below and address them appropriately.^[2]

We also remind all regulated entities that, under 23 NYCRR Section 500.17(a), covered Cybersecurity Events must be reported to DFS as promptly as possible and within 72 hours at the latest.  Prompt reporting will enable DFS to respond quickly to new threats as DFS works to protect consumers and the financial services industry in these difficult times.

Heightened Risks

1. Remote Working

   The abrupt shift to mass remote working forced by COVID-19 has created new security challenges, and attackers are exploiting these new vulnerabilities.^[3]  These heightened risks to regulated entities’ networks and Nonpublic Information^[4] include: 

   • Secure Connections.  Companies should make remote access as secure as possible under the circumstances.  This includes the use of Multi-Factor Authentication and secure VPN connections that will encrypt all data in transit.  See 23 NYCRR §§ 500.12 & 500.15.
   • Company-Issued Devices.  As new devices such as computers and phones are acquired or repurposed for remote working, regulated entities should ensure that they are properly secured.  This includes locking down the devices so applications cannot be added or deleted by the user, and installing appropriate security software, such as Endpoint Detection & Response and Mobile Device Management.
   • Bring Your Own Device (BYOD) Expansion.  Regulated entities that have expanded their BYOD policies to enable mass remote working should be aware of the security risks and consider mitigating steps.  Some personal devices are not properly secured or are already compromised.  If an expanded BYOD policy is necessary, compensating controls should therefore be considered.
   • Remote Working Communications.  Remote working has increased reliance on video and audio-conferencing applications, but these tools are increasingly targeted by cybercriminals.  Regulated entities should configure these tools to limit unauthorized access, and make sure that employees are given guidance on how to use them securely.
   • Data Loss Prevention.  Employees may be using unauthorized personal accounts and applications, such as email accounts, to remain productive while remote working.  Regulated entities should remind employees not to send Nonpublic Information to personal email accounts and devices.  Anticipating and solving productivity problems will reduce the temptation to use such devices.


2. Increased Phishing and Fraud

   There has been a significant increase in online fraud and phishing attempts related to COVID-19.  For example, the FBI has reported that criminals are using fake emails that pretend to be from the Centers for Disease Control and Prevention (“CDC”), ask for charitable contributions, or offer COVID-19 relief such as government checks.^[5]
   
   

3. Regulated entities should remind their employees to be alert for phishing and fraud emails, and revisit phishing training and testing at the earliest practical opportunity.  Now that face-to-face work is curtailed, authentication protocols may need to be updated – especially for key actions, like security exceptions and wire transfers.



4. Third-Party Risk

   The challenges created by the COVID-19 pandemic have also affected third-party vendors, and regulated entities should re-evaluate the risks to critical vendors.  See 23 NYCRR § 500.11.  Regulated entities should coordinate with critical vendors to determine how they are adequately addressing the new risks.

Conclusion

The COVID-19 pandemic has disrupted normal operations in the financial services industry and beyond, and cyber criminals are exploiting the crisis. Despite the extraordinary challenges, regulated entities should remain vigilant.  By following good cybersecurity practices, entities can identify, mitigate, and manage the risks.

^[1] See DHS Cybersecurity and Infrastructure Security Agency (“CISA”), COVID-19 Exploited by Malicious Cyber Actors (April 8, 2020).

^[2] Heightened cyber risk should also be addressed in the COVID-19 operational preparedness plans called for by DFS guidance issued on March 10, 2020.  See Guidance to New York State Regulated Institutions and Request for Assurance of Operational Preparedness Relating to the Outbreak of the Novel Coronavirus.

^[3] See FBI, Cyber Actors Take Advantage of COVID-19 Pandemic to Exploit Increased Use of Virtual Environments (April 1, 2020); U.S. Secret Service, Secret Service Issues COVID-19 (Coronavirus) Phishing Alert (March 9, 2020).

^[4] 23 NYCRR § 500.01(g).

^[5] See FBI, FBI Sees Rise In Fraud Schemes Related to the Coronavirus (COVID-19) Pandemic (March 20, 2020).

Guidance to Insurance Producers regarding Electronic Delivery of Notices

The Department of Financial Services (“Department”) is aware of insurance producers (“Producers”) facing challenges complying with the notice obligations in new 11 NYCRR § 229.5(b) and 3 NYCRR § 405.6(b)(4) described below (“Notice Obligations”).

First, regarding obtaining consumers’ consent to electronic communications, please see the Department’s Current Guidance Regarding Electronic Signatures, Transactions, and Filings with DFS.

Second, the Department is accommodating Producers by reducing their burden to fulfill the Notice Obligations during the current state of emergency. Specifically, for the duration of the current state of emergency, Producers may comply with the Notice Obligations by emailing the notices to the consumers for which the Producers have email addresses, regardless of whether the consumers have consented to receiving this notice via email.

Producers with websites should post the information on their websites as soon as possible. The Department also encourages supplemental dissemination of the content of the Notice Obligations by other means, including social media.

Finally, Producers should maintain records of their communications with consumers, electronic or otherwise, used to satisfy the Notice Obligations for a period of time sufficient to satisfy applicable statutes of limitation and, where an action or claim is pending, for such period of time until the matter is resolved. See Office of General Counsel Opinion 05-03-32 (March 24, 2005). In addition, if a Producer obligated itself by contract with its principal, the insurer or insured, to retain records for a period of time, then such obligation, if legally enforceable, must be satisfied, subject to an alternative acceptable to the principal. These communications used to satisfy the Notice Obligations may be subject to Department review, including but not limited to, on examination.

Below is a summary of the insurance producer requirement in the relevant emergency regulations.

New 11 NYCRR § 229.5(b) and 3 NYCRR § 405.6(b)(4) require a licensed insurance producer who services an in-force life insurance policy, annuity contract, or fraternal benefit society certificate or who procured a property/casualty insurance policy for the policyholder or contract holder to mail or deliver notice to the policyholder or contract holder of the provisions of 11 NYCRR 229 and 3 NYCRR § 405.6 within ten business days following the promulgation of 11 NYCRR 229 and 3 NYCRR § 405.6.

To NYSLTA Members –

As you may have seen in the New York Times, The NY Law Journal, Crain’s NY and The Real Deal, on July 5, 2018, Judge Eileen Rakower in New York County Supreme Court ruled in favor of the NYSLTA, Venture Title and Great American Title Agency by declaring NYDFS Regulation 208 annulled in its entirety.

The following day, the DFS filed an appeal with the Appellate Division.

The judge’s ruling and the DFS appeal can be viewed online, here: https://bit.ly/2KO7u8T

There is a natural exuberance at our victory in Supreme Court and a sense of vindication. These emotions are to be enjoyed but tempered with an understanding of the “big picture” and the realization that this matter is not yet settled.

First, act professionally.
When this is all behind us, there will still be a DFS and we will still be a regulated industry. Heed the advice of Ron Burgundy and “stay classy”. This is not a time for grandstanding and chest-thumping.

Second, be mindful of everything we have learned about DFS in this process.
We can assume greater scrutiny, an expanded market conduct investigation and efforts to provide evidence for the DFS claims of deceptive practices. Don’t give your adversary the rope she will use to hang you.

The “safe harbor” is to operate one’s business conservatively.  Are your disclosures in order? Are you fully in compliance with Regulation 206? Does your cybersecurity program meet all requirements of the regulation?

Third, silence is golden.
Resist the lure of a request for comment from a reporter “on a tight deadline”. If you have seen some of the news stories, you can see how innocuous statements can appear disparaging to the entire industry.

As we learn more about the implications of the DFS appeal, more information will be forthcoming to Members. Town Halls are being planned for Westchester and Long Island. Details to follow.

The Underwriters and the Agent Members have funded a significant victory for the title industry. A handful of people have dedicated hundreds of hours to prosecuting this case for the benefit of everyone.

Thank you for your support.

Thank you for being the New York State Land Title Association.