NYDFS levies $250,000 fine on licensee for inadequate cyber risk assessment

What happened

On 5 August 2026 NYDFS entered a consent order with money‑transmitter Order Express, Inc., imposing a $250,000 fine for three violations of the NYDFS cybersecurity regulation. The regulator found the company’s risk assessment insufficient to inform its cyber program, the program itself not based on that assessment, and its third‑party update policies incomplete. Order Express, a limited‑exemption licensee with under $7.5 million annual revenue, had reported a ransomware‑related outage in September 2022. The fine represents about 3.3% of the firm’s global revenue.

Why it matters

Limited‑exemption licensees must treat risk assessments as the foundation of their cyber programs and maintain comprehensive third‑party update policies, not just the minimal baseline.

Business impact

Failure to meet these baseline requirements can trigger significant fines and expose firms to heightened breach risk.

Checklist

• Conduct a thorough risk assessmentHigh priority

  Identify and evaluate cybersecurity threats specific to your organization and existing controls.

• Design the cybersecurity program on the assessmentHigh priority

  Ensure the program addresses identified risks to nonpublic personal information.

• Implement written third‑party update policiesMedium priority

  Cover all applications and software used, including patch deployment procedures.

• Notify NYDFS promptly of security incidentsMedium priority

  Follow the regulator’s reporting timeline for any breach affecting NPI.

Who reported it

Discussion