Money Transmitter Settles NYDFS Charges for Cybersecurity Program Failures

A licensed money transmitter settled New York State Department of Financial Services ("NYDFS") charges for failing to maintain adequate cybersecurity policies and risk assessments.

According to a release, NYDFS investigators found deficiencies in the firm's cybersecurity program and controls. NYDFS found that the firm failed to maintain adequate cybersecurity policies governing system updates and had inadequate risk assessments. The department stated that these gaps left the company exposed to vulnerabilities that could have been exploited by threat actors.

NYDFS noted in the release that the firm remediated the identified deficiencies and, based on its limited revenue, qualified for exemptions from many of the state's cybersecurity requirements.

NYDFS found that the firm violated 23 NYCRR Part 500 ("Cybersecurity Requirements for Financial Services Companies"). The firm agreed to resolve the matter without further proceedings and to pay a $250,000 penalty.