What cybersecurity do fintech companies need to have in place?

A fintech company needs a written, risk-based security program with a named owner, access controls including multi-factor authentication, encryption, regular testing, incident response and vendor oversight. In the United States, the FTC Safeguards Rule and, for licensed New York entities, 23 NYCRR Part 500 turn these into legal duties.

Does a fintech fall under these rules?

It depends on what you do and where you are licensed, and you should confirm with counsel. The FTC Safeguards Rule applies to non-bank financial institutions under FTC jurisdiction. Check the rule's definition of financial institution against your actual activities. New York's Department of Financial Services says Part 500 covers any individual or organization operating under a license, registration, charter or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law.

A fintech that partners with a bank may also inherit contract requirements from the bank. Those flow down in vendor agreements and are often stricter than the rule itself.

What does the FTC Safeguards Rule require?

The rule's text asks for an information security program built around a risk assessment. Several elements are concrete:

• A Qualified Individual to oversee the program. This person may be employed by you, an affiliate or a service provider, but you keep responsibility for compliance.
• Multi-factor authentication for anyone accessing an information system, unless the Qualified Individual approves in writing a reasonably equivalent or more secure control.
• Continuous monitoring, or else annual penetration testing plus vulnerability assessments at least every six months and after material changes.
• Secure disposal of customer information no later than two years after last use, with stated exceptions.
• Notice to the FTC within 30 days of discovery of a notification event involving the information of at least 500 consumers. A notification event means unauthorized acquisition of unencrypted customer information.

That last definition quietly rewards encryption: data that is encrypted, with keys not compromised, falls outside it.

What does New York Part 500 add?

DFS describes Part 500 as requiring covered entities to implement and maintain risk-informed cybersecurity policies and programs. The regulation's introduction says each company must assess its specific risk profile and design a program that addresses it, with senior management responsible and an annual certification filed. DFS publishes a resource center, FAQs and instructions for the annual compliance notification, and for notices of cybersecurity incidents. Read the current regulation text for deadlines and thresholds rather than relying on a summary, since amendments change them.

Where do fintechs usually have gaps?

The rules are broad, but the failures cluster in a few places. Application code handles money movement and identity data, so web and API flaws matter. Third-party dependencies carry known vulnerabilities into those same applications. Service accounts and API keys outlive the staff who made them. Vendors hold customer data, and the inventory of who holds what is out of date. Testing happens once a year, in time for the audit, and is not tied to release cycles.

A constructed example

A lending app stores applicant documents in cloud storage and calls a credit data vendor. Mapped to the rule: the Qualified Individual is the head of security; MFA is enforced for staff and admin consoles; documents are encrypted at rest with keys held in a managed service; a vulnerability assessment runs monthly, with an annual penetration test before the audit window; the vendor is assessed at onboarding and yearly; and a retention job deletes documents two years after a closed application unless a legal hold applies. Each item has an owner and a log, which is what an examiner will ask for.

How to check or apply this

1. Confirm which rules apply with counsel: federal, state, and bank-partner contracts.
2. Name the Qualified Individual or equivalent and write down who they report to.
3. Complete a written risk assessment and tie every control to a risk it reduces.
4. Enforce MFA technically, and report exceptions with written approvals.
5. Schedule vulnerability assessments and an annual penetration test, and keep results with remediation tickets.
6. Build a vendor inventory with data types, owners and review dates.
7. Run an incident drill that includes the 30 day FTC and state notice decisions.

Safeguard's dependency scanning and compliance automation can help you gather evidence for the application and software supply chain parts of this list. They support your program and do not certify you against either rule.

Quick check

Sources

• 16 CFR Part 314, Standards for Safeguarding Customer Information
• NYDFS Cybersecurity Resource Center
• 23 NYCRR 500.0, Introduction

Last reviewed: 18 October 2026.