On November 14, 2016, the Securities Industry and Financial Markets Association (SIFMA), the American Bankers Association (ABA), BITS — the technology policy division of the Bank Policy Institute (commonly referred to as “BPI,” formed in 2018 following the merger of The Clearing House Association and the Financial Services Roundtable) — the Mortgage Bankers Association (MBA), the American Financial Services Association (AFSA), the American Land Title Association (ALTA) and the New York Mortgage Bankers Association (NYMBA) submitted a comment letter to the New York State Department of Financial Services (NYDFS) regarding the agency’s proposed rulemaking on cybersecurity requirements for financial services companies (the “Proposal”).

The letter requests that any rule resulting from the Proposal (a) be complementary and consistent with existing cybersecurity requirements; (b) embody a risk-based approach; and (c) be revised in accordance with our detailed comments. Cybersecurity regulations issued by only one state— or by several states— without an effort to converge and coordinate with existing cybersecurity requirements will lead to confusion, additional costs, and a misalignment of cybersecurity operations within the industry.