NYDFS

The New York State Department of Financial Services (NYDFS) is the single agency that supervises insurance companies, banks, and other financial services firms operating in New York. It is younger than either of the offices it replaced. Under the Financial Services Law, the New York State Banking Department and the New York State Insurance Department were both abolished as of October 3, 2011, and the functions and authority of both moved to the new department. The legislature had created the Banking Department on April 15, 1851, and the Insurance Department in 1859. Since 2011 one superintendent has held both portfolios.

What it supervises

The mandate is written broadly on purpose. Financial Services Law § 201(a) records the legislature’s intent “that the superintendent shall supervise the business of, and the persons providing, financial products and services, including any persons subject to the provisions of the insurance law and the banking law.” How far that reaches shows in the Department’s cybersecurity rule, which defines a covered entity as any person operating, or required to operate, under a license, registration, charter, certificate, permit, accreditation, or similar authorization under the Banking Law, the Insurance Law, or the Financial Services Law.

NYDFS puts its own perimeter at more than 3,000 institutions holding nearly $10 trillion in assets: over 1,900 insurance companies with more than $6.4 trillion, and more than 1,300 banks and other financial institutions with more than $3.3 trillion.

Why a New York rule gets read outside New York

NYDFS has no authority past the state line. Its reach comes from licensing. An insurer authorized to write in New York answers to the Department for that business, and for a carrier that writes elsewhere too, a New York expectation lands inside a governance program built to serve every state it operates in. That is why compliance teams outside New York read the Department’s guidance early, rather than when their own regulator gets there. Whether it follows that a carrier should build one program to the strictest state’s specification is a separate question; the AI governance guide works through whether that is even the right test.

What NYDFS has done on AI

• March 1, 2017. 23 NYCRR Part 500, Cybersecurity Requirements for Financial Services Companies, takes effect. A Second Amendment followed on November 1, 2023. It applies to licensees of every kind rather than to insurers alone.
• January 18, 2019. Insurance Circular Letter No. 1 (2019) sets out what the Department expects of life insurers using external consumer data, algorithms, and predictive models in underwriting, five years before the AI label attached to the same problem.
• January 17, 2024. A proposed circular letter on artificial intelligence goes out for public comment.
• July 11, 2024. Insurance Circular Letter No. 7 (2024) is issued, covering AI systems and external consumer data in underwriting and pricing across all lines. What it actually asks of a carrier is the subject of its own guide.
• October 16, 2024. An industry letter addresses cybersecurity risks arising from artificial intelligence, again addressed to every regulated entity, not to insurers alone.
• December 16, 2025. The Department testifies at a New York State Assembly hearing on AI in insurance underwriting and pricing, telling legislators that “many of the laws that DFS enforces are technology-agnostic, meaning the core regulatory obligations are the same for manual processes as they are for AI models and systems.”

How NYDFS differs from the NAIC route

Most states that have acted on AI supervision arrived the same way: they took the NAIC Model Bulletin, adopted December 4, 2023, and issued a version of it to their own licensees. New York did not. The NAIC’s own implementation map, current to August 6, 2026, lists twenty-five adopting jurisdictions and files New York separately, under insurance-specific regulation and guidance, alongside California, Colorado, and Texas, citing Circular Letter No. 7.

That distinction is the practical one for anyone mapping obligations state by state. A program written against the Model Bulletin is not automatically a program that satisfies New York, and the two instruments are not drafted to the same shape. The New York state page records which instrument governs and when it issued.

Who has to watch it

Circular Letter No. 7 names its audience: every insurer authorized to write in the state, along with Article 43 corporations, health maintenance organizations, the New York State Insurance Fund, and licensed fraternal benefit societies. Part 500 reaches wider still, to every entity licensed under the Banking Law, the Insurance Law, or the Financial Services Law. The working test is licensing rather than domicile: a company chartered in Ohio that holds a New York authorization and runs automated decisions or holds consumer financial data has NYDFS among its regulators.