NYDFS Part 500 vs Reg S-P for Multi-Agent Systems: Which Controls Overlap for Dually Regulated Firms?

Scope decides which obligations apply

Part 500 applies to covered entities, and which sections bind a given entity depends on whether it qualifies for an exemption under Section 500.19 or is a Class A Company as defined in Section 500.1(e). Privileged access management and blocking of commonly used passwords, for example, apply to Class A Companies under 500.7(c). The Second Amendment took effect on November 1, 2023.

Amended Reg S-P applies to broker-dealers, investment companies, SEC-registered investment advisers, funding portals and transfer agents. The amendments were adopted in 2024 under Release No. 34-100155 and took effect on August 2, 2024.

For a dually regulated firm, the first task is therefore an applicability map by legal entity and activity: which entities fall under Part 500, which under Reg S-P, and which under both. Document exemption and Class A decisions, because obligations differ by entity type. The two regimes also frame protected data differently, Part 500 around nonpublic information and Reg S-P around customer information. Resolve that definitional scope with counsel before deciding which agent data flows are in scope for which regime.

Control-by-control comparison

The rows below summarize the provisions most relevant to AI systems that touch protected data. Whether an agent counts as a user, a system or a service provider is not settled by either text, so the AI column reflects our interpretation, not regulator guidance.

• Access control: Part 500: limit user access privileges to systems holding nonpublic information to what the job requires, review at least annually, terminate promptly after departures. Reg S-P: safeguards for customer information. Overlap: yes. AI reading: agent-to-tool permissions and credential scoping are the natural anchor.
• Multi-factor authentication: Part 500: amended text requires MFA for any individual accessing any information systems, with narrower requirements for entities holding a 500.19(a) limited exemption. Reg S-P: addressed through safeguards rather than a stated MFA mandate here. Treat as Part 500-led. AI reading: how service accounts and agent credentials are authenticated needs a documented position.
• Service provider oversight: Part 500: written policies covering risk-based assessment, minimum cybersecurity practices, due diligence and periodic reassessment. Reg S-P: incident response program with oversight of service providers, including due diligence and monitoring. Overlap: yes. AI reading: model providers, tool vendors and MCP server operators are candidate providers, classified case by case.
• Incident reporting: Part 500: 72-hour report to DFS after a determination that an incident has occurred at the covered entity, its affiliates or a third-party service provider. Reg S-P: incident response program, with providers notifying the institution within 72 hours of becoming aware of a breach. Different recipients and triggers.
• Customer notification: Reg S-P: notice as soon as reasonably practicable, and not later than 30 days, after the institution becomes aware that unauthorized access to or use of customer information has, or is reasonably likely to have, occurred. Reg S-P-led. Both clocks can start from a third-party event.
• Recordkeeping and evidence: Reg S-P: covered institutions other than funding portals must make and maintain written records documenting compliance with the safeguards and disposal rules. Part 500: access reviews and provider assessments imply supporting records. AI reading: evidence of what data and tools agents could reach and actually used.

Where multi-agent execution creates evidence gaps

Examiner questions will likely center on who or what can access protected information, and on proof of that access. Policy documents alone will not answer them. In a multi-agent system, access decisions happen at runtime: an agent selects a tool, the tool reaches a data store or MCP server, and the result moves to another agent as context.

Three behaviors are the most likely to leave gaps. First, tool calls: an annual access review can confirm what an agent was permitted to call, but not what it called last Tuesday. Second, data access: if protected information enters a prompt or tool response, the firm needs a record of whether it was passed, redacted or blocked. Third, inter-agent context passing: context can carry nonpublic or customer information across boundaries, and neither regime states a specific rule for this. Treat it as an open examiner question and decide your position in advance.

These gaps matter under both regimes for the same reason. Each requires the firm to show that safeguards operated, and the records that demonstrate it must come from the systems where the activity occurred.

Where Trussed fits

Trussed enforces policy in the execution path across models, agents, tools and MCP servers, at the level of individual interactions and tool calls: allow, redact, block, rate limit, or escalate for human approval. Enforcement produces continuous audit-ready evidence, mapped to NYDFS among other frameworks, and deployment is self-managed in the customer cloud with configurable retention and data residency.

Trussed's depth is in insurance, a regulated financial sector. Its approved proof is general: 18+ months of continuous production in a regulated enterprise, 99.95% uptime on live production traffic, and 30+ GB of audit evidence generated per day. This page does not claim deployments with broker-dealers, investment advisers or other Reg S-P covered institutions, and the Reg S-P mapping above is a framework for your own analysis. The comparison stands on its own whichever tooling you use.