10.21.25

New York Says Banks Responsible for Vendors' Cyber Risk

by: Carter Pape

The New York Department of Financial Services (NYDFS) reaffirmed that banks remain fully accountable for cybersecurity risks posed by third-party vendors. While the guidance does not impose new requirements, it stresses that banks cannot delegate compliance responsibility, highlighting past enforcement actions. Institutions must implement robust due diligence, contractual provisions, ongoing monitoring and risk management policies, including assessing “fourth parties,” contingency plans and geopolitical risks.

Read the full article on American Banker