Judging from phone calls and emails we've been receiving, it looks like many Big I New York members are doing work they don't have to do, at least when it comes to New York's cybersecurity requirements for financial services companies regulation. The confusion seems to be around the requirement for individuals and business entities to file notices of exemption with the New York State Department of Financial Services. Therefore, we want to remind you:
- An agency or brokerage is not required to file a notice of exemption at all after filing the first one in 2019. If the business no longer qualifies for the limited exemption, it must fully comply with the regulation within six months of the end of its fiscal year, but it is not required to file anything.
- An individual license holder is not required to file a notice of exemption after filing the first one in 2019 unless that person has changed employers, changed their name, or changed some other information that was contained in the initial filing.
If nothing has changed, then it is simply unnecessary to file the notice of exemption again. More information is available in this video.
Also remember that the business (but not individuals) must file the annual certification of compliance by April 15.