Compliance & Privacy · 2026-06-19

NYDFS Part 500 Amendments and Continuous Authentication: 23 NYCRR 500.12

By J. W. Bouckaert

On November 1, 2023, the New York Department of Financial Services adopted the Second Amendment to 23 NYCRR Part 500—the most substantive rewrite of the rule since its original 2017 adoption. The amendment introduced a phased compliance schedule whose final transition dates landed on November 1, 2025, with access-privilege controls under 500.7 reaching enforceability on May 1, 2025 and multi-factor authentication under 500.12 reaching enforceability on November 1, 2025. The published DFS Implementation Timeline is the authoritative source.

As of mid-2026, every phase is in force. The examination cycle has had two quarters to run against the fully-amended text, and the consent-order tempo since the January 2025 PayPal settlement indicates the Department is comfortable scoring covered entities against the new standard rather than its predecessor.

What the amendment changed is not surface-level. It converts authentication from a one-time perimeter event into a continuous evidentiary obligation, and it puts the Chief Information Security Officer's personal certification—alongside the highest-ranking executive's—on the line for material compliance. For the roughly 3,000 entities holding a DFS Covered Financial Institution licence—every chartered bank, virtually every insurer, every cryptocurrency exchange operating under a BitLicense, every money transmitter—the rule has stopped being aspirational.

This article reads the amended text against the threat environment it is responding to, then maps the controls Part 500 now demands onto the continuous carrier-signal attestation architecture PasskeyBridge runs in production. The thesis is straightforward: continuous, low-latency identity attestation already produces every artefact 500.12 and 500.7 ask for, without the operational cost of building or buying a parallel UEBA stack.

Changes in the Second Amendment

The Second Amendment was published with a tiered effective-date schedule documented in the official DFS Implementation Timeline. The dates that matter for identity practitioners, for Covered Entities that are not Class A companies and do not qualify for limited exemptions under 500.19:

The May 2025 and November 2025 milestones are the access-management wave. Two clauses define the engineering brief.

500.12—Multi-Factor Authentication. The pre-amendment text required MFA only for remote access to internal networks and for individuals with privileged access. The amended text requires MFA for any individual accessing any information systems of the covered entity, with limited and CISO-approved exceptions. The expansion of scope is the headline; the operational consequence is that every customer-facing portal, every internal SaaS console, every service-account interactive login now sits inside the rule.

500.7—Access Privileges and Management. The amendment requires limiting the number of privileged accounts and the access functions of privileged accounts to those necessary to perform the user's job, periodically reviewing access privileges and removing those no longer necessary, disabling or securely configuring all protocols that permit remote control of devices, implementing a written password policy to the extent passwords are used, and promptly terminating access following personnel departures. Each clause is independently auditable, and the periodic-review obligation runs in perpetuity.

The threat model the amendment is responding to

The 2023 amendment did not appear in a vacuum. The stretch from 2022 through early 2025 produced a cluster of DFS-enforceable settlements that demonstrate exactly what 500.12 and 500.7 are trying to prevent.

The pattern across the four matters is the same. An attacker obtains valid credentials—through phishing, credential stuffing, or third-party breach reuse—and then uses those credentials successfully because the authentication system terminated its analysis at the password and a weak second factor, or because the access-control architecture granted the compromised credential more privilege than its purpose required.

The amendment's 500.12 rewrite is the direct policy response. The Department is no longer satisfied that MFA exists; it now insists MFA be sufficient for the threat. The CISA phishing-resistant MFA guidance is the reference text DFS examiners are bringing into examinations, and the implication is that SMS OTP and push notifications are now compliance liabilities even where the covered entity has technically deployed MFA.

Limits of MFA at login

Three operational realities make login-time MFA insufficient under the amended risk-based standard.

1. Session token theft is now a commodity attack. Open-source adversary-in-the-middle frameworks such as Evilginx and the broader phishing-as-a-service market document the post-2022 reality that a proxy can capture a session cookie even when MFA was correctly performed at login. The user types their TOTP, the proxy forwards it, the server issues a valid session cookie, and the attacker takes the cookie. Login-time MFA detected nothing because nothing was wrong at login.

2. SIM-swap and port-out attacks now run at scale. The FBI IC3 2023 Annual Report recorded over $48M in direct losses from SIM-swap fraud—a figure widely understood to be an undercount because most successful SIM-swap attacks are reported as the downstream account takeover rather than the underlying carrier compromise. If MFA depends on SMS or voice OTP, and the adversary has swapped the SIM, the MFA is providing zero security against the attacker the rule is meant to stop.

3. Sessions outlive the credential-review window. A typical enterprise SaaS session token is valid for 8 to 24 hours. A refresh token is often valid for weeks. The periodic access-review cadence in 500.7 is structurally unable to revoke compromised access if the only re-attestation event is the next interactive login.

The combined effect is that login-time MFA, even strong MFA, leaves an exposure window of hours to weeks between the moment a credential is compromised and the moment the compromise is detectable by the access-management programme. Closing that window is not optional under a risk-based reading of 500.12; it is the entire point.

Continuous authentication, defined

"Continuous authentication" is a term of art that has accumulated meanings since around 2018, and the loose usage has caused real confusion in DFS examinations. The defensible technical definition has three parts:

1. Identity evidence is re-evaluated during the session, not only at session establishment.
2. The re-evaluation uses signals independent of the initial credential, so the same credential compromise that produced the initial session cannot also satisfy the re-evaluation.
3. A failed re-evaluation has a defined session consequence—step-up authentication, scope reduction, or session termination—recorded in an auditable log.

Most marketed "continuous authentication" products satisfy clause 1 by polling a device-posture agent and clause 3 by writing logs. Where many fall short is clause 2: if the re-evaluation signal is derived from the same device that produced the initial credential, an attacker who has compromised the device satisfies the re-evaluation by definition. Genuine clause-2 independence requires a signal anchored outside the device—at the carrier, at the network, or at the issuer of a non-device credential.

Carrier-signal attestation as the independent re-evaluation channel

A carrier-signal feed produces exactly the off-device, identity-grade telemetry clause 2 demands. The signals available through GSMA Open Gateway and direct MNO integrations include:

Each row is a clause-2 re-evaluation channel. The signals derive from none of the user's device, the user's password, or any artefact the attacker who phished the credential can manipulate. The only way to defeat them at scale is to also compromise the carrier—the threat model the rule is asking covered entities to harden against.

Mapping carrier attestation onto 500.12 and 500.7

This is the part that matters for examination defensibility. The amended rule does not name specific technologies; it names control objectives. Translating those objectives into the carrier-signal architecture:

500.12(a)—MFA for any individual accessing any information system. Satisfied at initial login by WebAuthn passkey plus carrier-signal attestation as the second factor—the deployment pattern documented in the MFA alternative overview. The passkey provides phishing-resistance per the CISA definition; the carrier signal provides the second authentication factor—demonstrable possession of the originally-bound SIM.

500.12(b)—CISO-approved equivalent or more secure controls. The clause permits substitution where the CISO certifies in writing that the substitute is reasonably equivalent or more secure. Continuous carrier-signal re-attestation, evaluated every 60 to 300 seconds throughout the session, is demonstrably more secure than a single login-time TOTP—the freshness of the evidence is two orders of magnitude better. The CISO certification is the artefact that must exist in writing; the engineering evidence to support it falls out of the architecture.

500.7 periodic access review. Each continuous re-attestation event is a logged access-evaluation against the user's current entitlements. The periodic review consumes the rolled-up log and certifies that every continued access decision during the period was either supported by a passing carrier attestation or gated by a step-up event. The evidentiary artefact for the review is generated as a side-effect of the authentication architecture; no separate access-review tooling is needed.

500.7 remote-control protocol hardening. Carrier-signal evaluation gates the session in which remote-control tooling runs. Even if RDP or SSH is exposed, the underlying session cannot continue without a fresh carrier attestation.

500.7 privileged-account limitation. Continuous attestation enables true just-in-time privileged access: the elevated entitlement is granted only for the duration that the carrier signal continuously attests, and revoked the instant any signal fails. This is the operational pattern NIST SP 800-207 Zero Trust Architecture calls dynamic access control, and it is the cleanest way to satisfy the 500.7 "limit access functions" obligation without requiring privileged accounts to be permanently downgraded.

The conventional architecture it replaces

The conventional architecture for satisfying the amended 500.12 + 500.7 stack looks like this: a User and Entity Behavior Analytics platform (Exabeam, Splunk UBA, Microsoft Sentinel) ingests endpoint and identity telemetry, a separate privileged-access management product (CyberArk, BeyondTrust) brokers elevated-access requests, and a separate access-review tool (SailPoint, Saviynt) orchestrates the periodic recertification. The combined licence cost for a regional bank typically sits in the high six-figure to low seven-figure range per year, plus implementation services in the same range, plus dedicated FTE headcount to operate the stack.

The carrier-attestation stack does not replace every component—the IdP still issues sessions, the audit pipeline still aggregates logs—but it collapses the three middle layers into a single zero-PII telemetry feed. The result is the difference between satisfying examiners with a 200-page programme document and satisfying them with the underlying evidence the rule actually asked for.

An examination-ready programme

For covered entities whose Part 500 programme was built against the pre-amendment text and is now being re-examined against the fully-amended rule, the minimum viable remediation has five line items.

1. Written CISO determination under 500.12(b). If the entity has any MFA factor that is not phishing-resistant per the CISA definition, the CISO needs a written equivalency determination on file. Continuous carrier-attestation is one of the cleanest equivalency arguments because the freshness gain is quantifiable.
2. Documented inventory of every information system accessed by individuals. The amended 500.12(a) scope is "any information system"; the inventory has to be exhaustive enough to defend the scoping decision, and the 500.13 asset inventory now provides the structural place for it.
3. Privileged-account census under 500.7. Count the privileged accounts, justify each one, document the access functions, and remove the standing privilege that cannot be justified. Continuous attestation makes the JIT alternative practical.
4. Periodic access-review cadence under 500.7. The text says "periodically"; the defensible floor is at least annually, and quarterly is appropriate for high-risk populations.
5. Audit-ready log of authentication and re-evaluation events. The audit-trail retention obligations in 500.6 are three years for cybersecurity event records and five years for systems necessary to reconstruct material financial transactions. Continuous re-attestation generates more log volume; the storage architecture has to scale.

The annual Certification of Material Compliance under amended 500.17(b) requires joint sign-off by the highest-ranking executive and the CISO. Both certifying officers are exposed to administrative action if the certification is materially false. The Department has demonstrated it will pursue enforcement; the PayPal consent order cited 500.17(b) violations explicitly alongside the underlying control failures.

Reading for 2026

The amended Part 500 is, when read against the threat environment, a regulator's clear instruction that login-time identity is no longer sufficient evidence of identity. The risk-based clauses in 500.12 and 500.7 have crossed the threshold where the Department will examine for continuous evidence, not periodic attestation. The transition windows closed in 2025; 2026 is the year covered entities are scored against the fully-amended rule.

The carrier-signal attestation architecture is one defensible path. It is not the only one—a fully passkey-bound session with DPoP-bound access tokens and a behavioural-biometric layer is another. What is not defensible is shipping the next examination with SMS OTP as primary MFA, standing privilege as the default for administrative accounts, and a periodic access review that consumes a spreadsheet rather than an authenticated event log.

The Department has written what it wants. The rule means what it says. The engineering has to match.

---

Further reading:

• 23 NYCRR Part 500 (current consolidated text, NYDFS)
• Second Amendment to 23 NYCRR 500 (adoption text, November 1, 2023)
• DFS Implementation Timeline for Covered Entities
• NYDFS Cybersecurity Industry Guidance and FAQs
• CISA: Implementing Phishing-Resistant MFA
• NIST SP 800-207: Zero Trust Architecture
• PasskeyBridge: The CISO Guide to Zero-PII Identity Verification
• PasskeyBridge: Edge-First Identity Verification with CDN and Carrier Signals
• PasskeyBridge: Cyber Insurance Underwriting and Authentication Risk

Start free · Test the API