SEC/FINRA Compliance in New York: Federal Rules + Martin Act + NY DFS
New York is the world capital of financial markets, home to the NYSE, NASDAQ, and the highest concentration of SEC/FINRA-regulated entities globally. New York financial firms face federal SEC and FINRA requirements plus New York's Martin Act (giving the NY AG the broadest state securities enforcement authority in the country) and NY DFS cybersecurity requirements (23 NYCRR 500). The 2022-2023 off-channel communications enforcement sweep — which produced over $1.8 billion in combined penalties — primarily targeted New York-based financial institutions.
NY DFS enforces 23 NYCRR 500 cybersecurity requirements for DFS-regulated financial institutions; NY AG enforces Martin Act for securities fraud without intent requirement; both coordinate with SEC and FINRA
State Penalties: Martin Act: criminal penalties up to 4 years per count; civil injunctions; disgorgement. NY DFS: civil penalties up to $1,000/day per violation. FINRA: up to $385,000 per violation plus suspension/bar.
Federal Penalties: SEC: disgorgement, civil penalties up to $1M+ per violation; criminal securities fraud up to 25 years. FINRA: up to $385,000 per violation
How Federal + New York Law Overlap
SEC and FINRA govern all federally registered broker-dealers and investment advisors in New York. NY DFS regulates NY-chartered banks, insurance companies, and financial institutions — imposing cybersecurity requirements that intersect with Reg S-P. The Martin Act gives the NY AG independent authority to pursue securities fraud without proving intent.
Additional New York Requirements Beyond Federal Law
- NY DFS Cybersecurity Regulation (23 NYCRR 500, 2023 amendments) — CISO, pen testing, MFA, 72-hour incident reporting
- 23 NYCRR 500 2023 amendments: expanded to require board-level cybersecurity governance, annual compliance certification, and third-party service provider oversight
- Martin Act (N.Y. Gen. Bus. Law Art. 23-A) — AG can investigate securities fraud without proving intent; no private right of action
- FINRA's headquarters in New York means NY firms face the most direct FINRA enforcement proximity
- New York investment advisor registration — state registration through NY AG/DFPI for certain advisors
- NYSE and NASDAQ listing standards add corporate governance requirements beyond SEC rules for listed NY companies
Key Compliance Requirements for New York
- NY DFS 23 NYCRR 500 compliance: CISO appointment, annual penetration testing, MFA, 72-hour incident reporting, board-level governance
- Off-channel communications: comprehensive archiving policy for all business communications including messaging apps
- Regulation Best Interest: document best-interest analysis for all retail customer recommendations
- Form CRS: deliver to retail investors at account opening and required trigger events
- Reg S-P WISP: written information security program with 2024-2025 enhanced requirements
- Martin Act exposure monitoring: ensure investment disclosures are accurate and not potentially misleading — Martin Act doesn't require intent
Common Violations in New York
- Off-channel communications — the defining NY securities enforcement issue of 2022-2023; $1.8B in penalties
- NY DFS 23 NYCRR 500 cybersecurity program deficiencies
- Martin Act exposure for ESG disclosure, crypto asset marketing, and novel disclosure theories
- Reg BI documentation failures — the most common FINRA examination finding in New York
- Form CRS delivery at incorrect timing relative to Reg BI trigger events
Recent SEC/FINRA Enforcement in New York
Check Your SEC/FINRA Readiness in New York
Take our free compliance quiz to see how your organization stacks up against SEC/FINRA requirements in New York.
Take the Free Quiz → Risk Calculator →Frequently Asked Questions
What is the NY DFS Cybersecurity Regulation and how does it affect securities firms?
NY DFS 23 NYCRR 500 (2017, amended 2023) applies to DFS-regulated financial institutions including banks, insurance companies, and financial services companies. It requires a formal cybersecurity program, designated CISO, annual penetration testing, multi-factor authentication, and reporting cybersecurity events within 72 hours. The 2023 amendments added board-level governance requirements and expanded third-party service provider oversight.
Why was the off-channel communications enforcement so significant for NY firms?
In 2022-2023, the SEC and FINRA conducted an industry-wide sweep of off-channel communications at broker-dealers and investment advisors. The SEC found that employees at major Wall Street firms routinely used WhatsApp, Signal, and personal email for business communications without retention, violating recordkeeping requirements. The resulting penalties exceeded $1.8 billion and affected virtually every major NY-based financial institution.
What is the Martin Act and how does it create additional compliance risk?
The Martin Act (N.Y. Gen. Bus. Law Art. 23-A) allows the NY AG to pursue securities fraud without proving fraudulent intent — only that a fraudulent or deceptive practice occurred. This lower standard means NY financial firms can face Martin Act liability for disclosure practices that would not violate federal securities law. Recent NY AGs have used the Martin Act for novel theories including ESG disclosure accuracy and cryptocurrency marketing.
Who regulates investment advisors in New York?
Investment advisors with AUM of $100M or more register with the SEC. New York's state registration for smaller advisors is handled through the Investment Adviser Registration Depository (IARD) system coordinated with the NY AG's office. DFS-regulated financial holding companies have additional oversight. FINRA regulates all broker-dealer activity in New York.
What does Regulation S-P require for New York financial firms?
Regulation S-P requires broker-dealers and investment advisors to maintain a Written Information Security Program (WISP) and protect customer financial information. The 2024 amendments require incident response plans, vendor oversight programs, and notification to affected customers within 30 days of a breach. For DFS-regulated NY institutions, Reg S-P and 23 NYCRR 500 both apply and must be satisfied in a coordinated program.