We are happy to announce that the New York State Department of Financial Services (DFS) has resolved a problem that prevented some New York licensed agents and brokers from submitting the appropriate cybersecurity notice of exemption form. The DFS addressed the issue after Big I New York contacted them about it.
New York’s Cybersecurity Requirements For Financial Services Companies regulation, 23 NYCRR 500, makes certain companies partially exempt from its requirements and certain individuals completely exempt. Those companies and individuals must submit a Notice of Exemption on the DFS website so that the department’s computer system is aware of the exemptions. Failure to do so will lead the department’s system to believe that these licenseholders are complying with all 23 of the regulation’s sections.
Licensed employees, agents, representatives or designees of a licensed business entity are completely exempt from the requirements to the extent they are covered by that entity’s cybersecurity program. The regulation’s text does not require the covering entity to be a company – it could be an individual such as a sole proprietorship. Some agencies, particularly those who were once captives but are now independent, have not formed companies. Regardless, the DFS computer system was rejecting Notice of Exemption filings from employees when they entered the license number of a person in the form, rather than that of a company.
After hearing about this problem from our members, Big I New York emailed a contact at DFS and held a conference call with him on March 26 to explain the problem. We received assurances that he would address it, and on April 7 he informed us that the problem had been resolved. Phone conversations with two agencies who were having this problem confirmed that the system is now working properly.
If you are an agency organized as a sole proprietorship, and your employees have had difficulty submitting a Notice of Exemption citing Section 500.19(b) as the reason for the exemption, we encourage them to try again. They should receive a different result now.