FFIEC and NYDFS tighten bank cyber rules

FFIEC member agencies and the NYDFS are pushing banks and foreign branches in the United States toward a stricter compliance model, anchored in NIST CSF 2.0, verifiable technical controls, third-party management and clearer incident reporting deadlines. The shift also applies to subsidiaries and branches of banks from Argentina and Mexico operating in U.S. territory.

What changed in FFIEC supervision?

The FFIEC does not directly regulate institutions, but its member agencies, including the OCC, FDIC, Federal Reserve, NCUA, CFPB and state supervisors, use its manuals, the IT Handbook and URSIT ratings to examine cybersecurity and technology at financial entities. The FFIEC also withdrew its Cybersecurity Assessment Tool on August 31, 2025, and directed institutions to NIST Cybersecurity Framework 2.0 as the main reference.

That transition has a practical side. NIST published SP 1347, Cybersecurity Framework 2.0: Informative References Quick-Start Guide, to map concrete controls, such as NIST SP 800-53, ISO 27001 or CIS Controls, to the functions and categories of CSF 2.0. In practice, that gives banks and foreign branches a way to turn the framework into verifiable control lists for FFIEC agencies or the NYDFS.

What does New York require from financial entities?

NYDFS Part 500 requires a written cybersecurity program, risk assessments, technical controls such as multifactor authentication and encryption, the designation of a Chief Information Security Officer, awareness training, and annual penetration and vulnerability testing. It also applies to any institution licensed for banking or financial services in New York, including foreign banking organizations with a branch or agency in the state.

The technical reference now taking hold for that evidence is NIST CSF 2.0. According to compliance analysis cited by NHIMG, New York regulators expect documentation to be mapped explicitly to framework categories, such as GV.OV for governance. That forces policies, risk records, testing and metrics to be organized in that language to make inspections easier.

How does this affect incidents and third parties?

Notification rules also set tighter timelines. Under the Computer-Security Incident Notification Rule, a banking organization must notify its primary federal regulator as soon as possible and no later than 36 hours after determining that a notification incident occurred. For bank service providers, the obligation is to notify affected institutions as soon as possible if certain incidents cause, or are reasonably likely to cause, a material service disruption or degradation lasting four or more hours.

After a major event, financial institutions in the United States must meet the applicable federal and state reporting obligations, including cybersecurity incident notices and, when relevant, suspicious activity reports and other sector-specific requirements. On the same front, third-party management has been explicitly built into examinations for payment systems, operational risk and BSA/AML, where examiners ask for evidence of governance, risk assessments and alignment with NIST CSF 2.0 for critical vendors.

That includes payment processors, core banking and AML monitoring. For branches of Argentine and Mexican banks, the practical effect is that due diligence and monitoring criteria must be applied to both local and global vendors supporting U.S. operations.

What role has the U.S. Treasury taken?

The Treasury Department, through the Office of Cybersecurity and Critical Infrastructure Protection, coordinates the strategy to strengthen the security and resilience of the financial sector’s critical infrastructure and reduce operational risk. According to the department itself, it serves as a focal point for sector policy, resilience exercises and public-private coordination that reaches domestic banks and foreign banking groups with a presence in the country.

In parallel, sector compliance guidance places NIST CSF 2.0, NIST SP 800-53 Rev. 5 and NIST SP 800-63 as the technical reference set for security and identity controls. Add to that frameworks such as ISO/IEC 27001:2022 and PCI DSS v4.0, which bring regulatory and contractual obligations. For Latin American banks with U.S. operations, that usually means several frameworks must coexist in the control and reporting model.