The New York State Department of Financial Services (DFS) has released new cybersecurity guidance to help financial institutions manage risks stemming from third-party service providers (TPSPs).
The announcement underscores the department’s ongoing efforts to safeguard consumers and regulated entities amid increasing reliance on external vendors.
DFS Acting Superintendent Kaitlin Asrow said that while the growing use of third-party providers has boosted innovation and efficiency across the financial system, financial institutions remain accountable for maintaining security and protecting consumers’ sensitive information.
“While third-party service providers have driven innovation and enabled significant efficiencies in our financial system, regulated entities are still ultimately accountable for protecting consumers and managing risk,” said DFS acting superintendent Kaitlin Asrow. “To ensure the safe and secure operation of financial services and the protection of nonpublic information, entities must establish and maintain appropriate internal risk management controls when using third-party service providers.”
The new guidance does not introduce additional obligations or compliance requirements. Instead, it serves to clarify existing expectations under the DFS Cybersecurity Regulation and outline best practices that institutions should adopt. These include strengthening due diligence procedures, maintaining oversight of vendor cybersecurity standards, and ensuring that contractual agreements with third parties align with DFS regulations.
By issuing this guidance, DFS aims to reinforce its position as a leader in cybersecurity supervision, highlighting that the integrity of New York’s financial sector depends on robust risk management across the entire ecosystem, including vendors and partners.
The department continues to enhance its regulatory framework to reflect emerging threats, following a series of updates designed to support a more resilient and secure financial infrastructure.
Keep up with all the latest RegTech news here
Copyright © 2025 RegTech Analyst
Copyright © 2026 RegTech Analyst
