In response to challenges facing the financial services industry as a result of coronavirus (COVID-19), New York's Department of Financial Services (DFS) has issued a COVID-19 compliance order, along with a series of industry guidance letters related to the organizational preparedness of regulated institutions to manage risks associated with the outbreak.

Below is a summary of these recent actions and requests for information. Institutions are encouraged to visit the DFS website for additional updates and information. Hinshaw is well-positioned to assist impacted institutions in their review of the DFS instructions and the preparation of responses.

This March 12, 2020 Order extends certain compliance deadlines including: a 45 day extension of the date to file certifications of compliance with DFS Cybersecurity Regulations (Part 500); a 45 day extension of the date by which mortgage bankers, mortgage brokers, mortgage loan servicers, and student loan servicers must file a Volume of Operations Report, Volume of Servicing Report, or Annual Report, as specified; facilitates remote workforce activity, acknowledging that individuals conducting "licensable activities from their personal residences" remain subject to DFS's full supervision and must ensure compliance with required controls such as for cybersecurity and data protection; and waives the required advance notice where a DFS regulated entity seeks to temporarily relocate an authorized place of business or close a branch office.

This March 10, 2020 guidance and request seeks assurance that NYS regulated institutions have preparedness plans in place to address operational risks posed by COVID-19. It requires the submission of a response "as soon as possible and in no event later than thirty (30) days" describing the institution's plan of preparedness to manage the risk of disruption to its services and operations. The plan must include, among other things, preventative mitigation measures, an assessment of all facilities, systems, policies, and procedures necessary to continue critical operations, an assessment of potential increased cyber-attacks, employee protection strategies, and an assessment of critical third party supplier and service provider preparedness.

This March 10, 2020 guidance and request seeks assurance that NYS regulated institutions are identifying, monitoring and managing potential financial risk arising from the spread of COVID-19. It requires the submission of a response to DFS "as soon as possible and in no event later than thirty (30) days" describing the institution's plan for managing such risks. The plan must include, among other things, an assessment of the credit risk ratings and credit exposure of impacted customers, counterparties and business sectors, an assessment of the valuation of impacted assets and investments, the overall impact on earnings, profits, capital and liquidity, and an assessment of steps to assist those adversely impacted.

This March 10, 2020 guidance and request seeks assurance that NYS regulated virtual currency businesses have preparedness plans in place to address operational and financial risks posed by COVID-19. It requires the submission of a response to DFS "as soon as possible and in no event later than thirty (30) days" describing the institution's plan of preparedness to manage the risk of disruption to its services and operations. The guidance notes, in particular, the increased risk to virtual currency licensees of hacking, cybersecurity threats, and similar events, as bad actors attempt to take advantage of the outbreak and the possible resulting need for heightened security measures.

DFS also issued a circular letter seeking similar assurances from DFS-regulated insurance entities.