A small covered entity under NYDFS 500.19(a) is exempt from specific sections, including 500.4, 500.5, 500.6, 500.8, 500.10, parts of 500.14, 500.15 and 500.16. It is not exempt from the rest, such as risk assessment, access privileges, third party policy and a modified MFA duty. It must file a notice of exemption.
This is general information, not legal advice.
Who qualifies
Subsection (a) is met by any one of three tests: fewer than 20 employees and independent contractors of the entity and its affiliates; less than 7,500,000 dollars in gross annual revenue in each of the last three fiscal years from covered business operations; or less than 15,000,000 dollars in year end total assets, including affiliates. Check the full text for how affiliates and New York operations are counted.
What the exemption removes and keeps
| Still applies | Removed for the exempt entity |
|---|---|
| 500.2 cybersecurity program | 500.4 CISO and board reporting |
| 500.3 policies | 500.5 vulnerability management |
| 500.7 access privileges | 500.6 audit trail |
| 500.9 risk assessment | 500.8 application security |
| 500.11 third party providers | 500.10 qualified personnel |
| 500.12 MFA, in a narrower form | 500.14(a)(1), (a)(2) and (b) |
| 500.13 asset inventory | 500.15 encryption |
| 500.14(a)(3) awareness training | 500.16 incident response and BCDR plans |
| 500.17 notices |
The right column follows the sections named in 500.19(a). The left column is drawn from sections the exemption does not name. Confirm with the text before relying on the table.
What this means for engineering
Even without the removed sections, a small fintech still needs a risk assessment, access controls, an asset inventory and vendor policy. Customers and bank partners often ask for secure development and incident plans anyway, so many exempt teams keep lightweight versions. Exemption is a legal position, and the practical expectations of partners may be higher.
Two administrative points
First, an entity that qualifies must file a Notice of Exemption electronically within 30 days of determining it is exempt, under 500.19(f). Second, under 500.19(h), an entity that stops qualifying has 180 days from that date to comply with all applicable requirements. Growth can end an exemption, so plan ahead of the threshold, not after it.
A practical approach
- Confirm status with counsel or your compliance lead.
- Build the sections that still apply first.
- Adopt short versions of removed sections that your partners ask about.
- Track revenue, headcount and assets against the thresholds each year.
Mistakes to avoid
Teams sometimes assume that exempt means unregulated, when several core sections still apply. Others forget the filing, or let growth push them past a threshold without noticing. A third error is dropping basic practices that partners will still ask for. Keep the notice of exemption on file, watch the thresholds, and maintain light versions of incident response and secure development that you can show on request.
Quick check
Does the exemption remove the MFA duty?
It narrows it. An exempt entity still needs MFA for remote access to systems, remote access to third party applications holding nonpublic information, and privileged accounts other than non interactive service accounts.
How long to comply after losing exemption?
180 days from the date the entity ceases to qualify.
Sources
Last reviewed: 19 October 2026.
