NYDFS Risk Assessment Guidance: A 500.9 Template for Crypto

Video transcript

New York's DFS has set out what it expects in a Part 500 risk assessment. The letter never mentions crypto, so you decide where wallets, keys and contracts fit.

It is guidance on a regulation already in force. DFS does apply Part 500 to crypto firms, as its 2022 Robinhood Crypto penalty shows.

DFS expects a repeatable assessment built on your asset inventory, covering third parties and emerging risks, updated on material change, and traceable to controls.

DFS lists five gaps seen in exams. For a crypto firm, that can mean unlisted signer devices, no inherent and residual split, or an unowned admin key.

DFS calls the asset inventory the foundational input. Including onchain assets is the cautious approach, so list every wallet and key share, contract and admin role, multisig, bridge and signer device.

DFS does not require a specific method. Rate likelihood and impact consistently, score each risk inherent and residual, then record the treatment and owner.

Update at least annually and on material change. The letter's examples are not crypto-specific, so add contract upgrades, new chains or bridges, and signer changes.

Guardian's Cybersecurity Maturity Assessment scores your program from evidence and maps every role that can move value. Managed Security reviews each multisig transaction before signing.

Read the full article for the scoring scale and sample register rows, or talk to Guardian.

On September 10, 2026, the New York State Department of Financial Services (DFS) issued an industry letter on the risk assessment that 23 NYCRR 500.9 requires.

It is guidance on a regulation in force: “This Guidance does not create new obligations.”

The letter never mentions crypto. DFS does apply Part 500 to crypto firms: its 2022 penalty on Robinhood Crypto cited Part 500 alongside Part 200, the virtual currency regulation.

This article explains the technical and security side of DFS's industry letter on risk assessments under 23 NYCRR 500.9. It is not legal advice; confirm how it applies to you with counsel.

What the Letter Expects

Section 500.9 requires a periodic risk assessment “sufficient to inform the design of the cybersecurity program”. Written policies and procedures must set:

• Criteria for evaluating and categorizing risks.
• Criteria for assessing confidentiality, integrity, security and availability, including existing controls.
• How identified risks will be mitigated or accepted.

The letter adds that DFS “expects each Covered Entity to be able to demonstrate how its Risk Assessment informed cybersecurity controls”, compensating controls and risk acceptance.

It also lists five gaps DFS has seen in examinations and investigations. What each can look like at a crypto firm:

The template below follows the letter's five numbered sections.

1. Governance and Oversight

The letter's governance points:

• Written policies approved at least annually by a Senior Officer or the Senior Governing Body.
• A CISO, or a Senior Officer, overseeing the process.
• Input from business units, operations, compliance and legal. Add treasury, custody and contract engineers.
• Results reported to senior management and, where appropriate, the Senior Governing Body.
• Material risks in the CISO's report to the Senior Governing Body, under 500.4(b)(3).

The letter notes that Part 500 does not require formal board or senior management approval of the assessment itself.

2. A Repeatable Methodology

DFS does not require a specific methodology. The letter notes many firms align with NIST CSF 2.0, the Cyber Risk Institute Profile v2.2 or ISO 27005:2022.

Whatever you choose should define likelihood and impact with consistent criteria, so results compare over time.

Inputs, where available: threat intelligence, incident trends, vulnerability scans, pentests and prior audit findings. Onchain, add contract audits and monitoring alerts.

A four-point scale you can copy:

Score each risk twice: inherent, before controls, and residual, after them. Skipping that split is a gap DFS lists.

Impact should cover the letter's list: loss of NPI, financial loss, operational disruption, legal or regulatory exposure, reputational damage and replacement costs.

3. Scope and Coverage

All assets

DFS writes that the 500.13(a) asset inventory “should serve as the foundational input to the Risk Assessment”. That inventory requirement has applied since November 1, 2025.

The letter counts hardware, software, infrastructure, human capital, processes and data as assets. Keys, contracts, signer devices and signers map onto those categories.

List every wallet, key and key share, contract and admin role, multisig, bridge and signer device. Then fill the fields 500.13(a) lists:

Emerging risks

The letter's examples: artificial intelligence, quantum computing's effect on future cryptographic protections, software supply chain attacks, ransomware and nation-state activity.

Wallet keys rest on cryptography, so give quantum its own register row and owner.

Third parties and concentration

Rate each third-party service provider on the letter's four factors: criticality, data sensitivity, connectivity and impact if it fails.

Beyond the letter's examples, such as cloud and software vendors, add custodians, MPC and wallet vendors, RPC providers, oracles and bridges.

Then find single points of failure, as the letter asks. Onchain, that might be one cloud region hosting every MPC node.

Section 500.11 requires third-party policies “based on the risk assessment”. Our vendor due diligence questionnaire covers what to ask.

4. The Risk Register

Firms “must maintain documentation sufficient to demonstrate how cybersecurity risks were identified, assessed, and addressed”, the letter says.

It recommends a risk register that records results, monitors remediation and documents changes to residual risk over time.

Give every row these seven columns.

1. Risk ID, and the asset from the inventory.
2. Threat and vulnerability.
3. Inherent likelihood and impact.
4. Controls and compensating controls, with the Part 500 section each supports.
5. Residual likelihood and impact.
6. Treatment: mitigate, transfer or accept, with the justification.
7. Owner, remediation date and next review trigger.

Sample rows, scored on the scale above:

5. Updates on Material Change

Section 500.9(a) requires review at least annually, and whenever a business or technology change causes a material change to cyber risk.

The letter's examples of material change:

• Major system migrations.
• Mergers or acquisitions.
• Significant outsourcing.
• Significant developments in cybersecurity technologies, such as frontier AI models.
• Changes in threat actor capabilities.
• Adoption of emerging technologies.

It also asks firms to weigh active exploitation of critical vulnerabilities, and geopolitical events.

None is crypto-specific. Add these triggers to your procedure:

• A contract upgrade or new deployment.
• A new chain or bridge.
• A new custodian, MPC vendor or RPC provider.
• A change of signers, threshold or timelock.
• An exploit at a protocol or vendor you depend on.

Record the decision either way. For upgrades, see our change management process.

How Guardian Helps

Guardian's Cybersecurity Maturity Assessment scores your program from evidence, not interviews, with a CSF 2.0 profile mapped to NYDFS 500.9.

Guardian's evidence includes an asset inventory of domains, hosts, cloud assets and deployed contracts, each with an owner. It also maps every role that can move value, upgrade or pause, with its holder, threshold and timelock.

Managed Security maps every path to your funds in a live threat model, and reviews every multisig transaction before it is signed.

Frequently Asked Questions

Does the NYDFS risk assessment guidance create new obligations?

No. The September 10, 2026 industry letter says “This Guidance does not create new obligations.” It explains what 23 NYCRR 500.9 already requires and describes best practices, such as a risk register.

How often must a Part 500 risk assessment be updated?

At least annually, and whenever a business or technology change causes a material change to cyber risk, under 500.9(a).

Do wallets and smart contracts belong in the NYDFS asset inventory?

The letter does not mention them. It says a comprehensive assessment should cover all assets, including hardware, software, processes and data. Keys, wallets and contracts map onto those categories, so including them is the cautious approach; confirm it with counsel.

Does DFS require a specific risk assessment methodology?

No. The letter says DFS does not require one, and notes that many firms align with NIST CSF 2.0, the Cyber Risk Institute Profile or ISO 27005. The method should rate likelihood and impact consistently.

Sources

• NYDFS: Industry Letter, Guidance on How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation (September 10, 2026)
• NYDFS: Second Amendment to 23 NYCRR Part 500, unofficial text published by DFS (November 2023)
• Cornell Legal Information Institute: 23 NYCRR 500.9, Risk assessment
• Cornell Legal Information Institute: 23 NYCRR 500.13, Asset management and data retention requirements
• NYDFS: DFS Announces $30 Million Penalty on Robinhood Crypto for Anti-Money Laundering, Cybersecurity & Consumer Protection Violations (August 2, 2022)
• Guardian: Regulatory and Compliance Assessments
• Guardian: Managed Security