The April 15 Part 500 Filing Is Stuck: Repair These Five Records
How a New York cybersecurity consultancy can route an unfinished NYDFS Part 500 annual filing through entity, exemption, compliance, remediation and receipt evidence before April 15.
Signals to watch
- An April 15 annual-notification deadline is approaching while the legal entity, license or claimed exemption remains unresolved
- The group says the entity cannot certify material compliance, but does not identify every applicable section, the nature and extent of noncompliance or the remediation date
- Executive or CISO signature, five-year support records, portal access or the emailed receipt number is still missing
An unfinished NYDFS Part 500 annual filing should be repaired in this order: confirm the exact Covered Entity and exemption, choose the filing route for the prior calendar year, map every applicable section to evidence, document every material gap and remediation date, then preserve the signatures and emailed DFS receipt. Do not begin by editing a portal answer. A wrong entity or exemption can change which sections must be assessed; a missing support record can make a confident certification indefensible.
This is the direct answer for a business-development lead at a New York cybersecurity compliance consultancy who follows financial-services, CISO and regulatory-operations Telegram groups the firm is authorised to access. The commercial moment may last only until an executive review or filing adviser is chosen. But “cert is stuck” is not evidence that the poster is a Covered Entity, lacks compliance or has authority to engage a consultant.
The request usually arrives as fragments
Consider an illustrative composite thread. It is not a customer conversation, enforcement record or claim of commercial results:
“April filing still not cleared. Two controls are red.”
A reply appears later:
“We used an exemption last year I think. Headcount changed.”
Then another participant asks:
“Can someone fix the cert in the portal before exec sign-off?”
The thread contains a deadline, unresolved controls, a possible exemption change and an executive approval step. It does not identify the licensed person, the relevant calendar year, the exemption subsection, the two controls, whether the gaps are material, the CISO, the portal filer, remediation dates or purchasing authority.
That is enough to raise the discussion for review, not enough to promise a Certification of Material Compliance. The useful opening question is: which DFS-regulated legal entity is filing, and which Part 500 sections applied to it during the prior calendar year?
Before starting: assemble the five-record worksheet
Prepare one worksheet with five rows: entity and exemption, filing route, section evidence, remediation status, and submission proof. The legal or compliance owner should approve regulatory conclusions; the BD lead uses the worksheet to identify a bounded workstream and the right specialist.
You will need:
- the entity’s exact licensed name and DFS identifier;
- its Part 500 exemption notices and any change in qualifying facts;
- the prior-year control and governance evidence;
- the highest-ranking executive and CISO or responsible senior officer;
- DFS Portal access through DFS ID and multi-factor authentication; and
- enough time for qualified review before April 15, not merely enough time to enter the form.
Step 1: Resolve the legal entity and exemption first
By the end of this step, the worksheet should identify one filer and the set of Part 500 sections that applied to it during the year being reported.
The current official regulation defines a Covered Entity as a person operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation or similar authorisation under New York’s Banking Law, Insurance Law or Financial Services Law. Being part of a financial group, serving a regulated client or being supervised by another agency does not answer this definition by itself.
Record:
- the exact legal entity and DFS authorisation;
- every Part 500 exemption claimed for the reporting year;
- the dated facts supporting each exemption; and
- any headcount, revenue, asset, information-system, nonpublic-information, affiliation or license change that could alter the result.
NYDFS’s official exemptions resource separates limited exemptions under Sections 500.19(a), (c) and (d) from full exemptions under Sections 500.19(b), (e) and (g). Limited exemption does not mean “no annual filing”: those entities still notify NYDFS about compliance with the sections that apply to them. The full-exemption routes are different; entities under (b) and (e) file a Notice of Exemption, while NYDFS says the status-based (g) exemption does not require that notice.
Verify this step by writing an applicable-section list with a cited exemption subsection. “Small company” or “exempt last year” is not a sufficient result. If exemption status ended, Section 500.19(h) gives 180 days from the loss of qualification to comply with applicable requirements; NYDFS also instructs entities to terminate a prior exemption as soon as reasonably possible.
Step 2: Choose certification or acknowledgment from the evidence
By the end of this step, the team should have a defensible route for the prior calendar year—not the route that sounds better in a board update.
Section 500.17(b) requires the annual electronic submission by April 15. The two routes are:
- Certification of Material Compliance: the entity certifies that it materially complied with Part 500 requirements applicable to it during the prior year. The regulation says this must rest on data and documentation sufficient to accurately determine and demonstrate material compliance.
- Acknowledgment of Noncompliance: the entity acknowledges it did not materially comply with all applicable requirements, identifies every section not materially complied with, describes the nature and extent of noncompliance, and provides a remediation timeline or confirms completion.
Do not convert “the control was remediated in February” into a certification for the prior year without analysis. The filing addresses the prior calendar year; later remediation is relevant evidence, but it does not erase the earlier state. Conversely, one open ticket does not automatically prove material noncompliance. Qualified reviewers must assess the applicable provision, facts and materiality.
Verify the route with a short signed decision record listing the applicable sections, evidence period, known exceptions, materiality owner and chosen filing. If any of those fields remains unresolved, the portal answer is not ready.
Step 3: Connect each filing claim to a dated evidence owner
By the end of this step, every applicable section should point to evidence that existed for the reporting year and to a person who can explain it.
Use a claim-to-evidence register with these columns:
| Filing state | Evidence needed | Owner question | Route if missing |
|---|---|---|---|
| Materially compliant | Policy, test, report, approval, configuration or other dated support for the applicable section | Who can attest that this evidence covers the filer and reporting period? | Evidence repair or reassessment |
| Not materially compliant | Applicable section, affected area or system, nature and extent, start/end dates | Who owns the factual description and materiality decision? | Acknowledgment drafting |
| Remediation open | Approved action, owner, milestones, expected completion date and residual exposure | Is the date supported by a delivery plan rather than an estimate in chat? | Remediation evidence package |
| Remediation complete | Change and test records, approval, completion date and remaining limitations | What proves completion and scope? | Completion confirmation |
This is where an apparently simple filing request often separates into evidence collection, control testing, exemption analysis or remediation governance. A portal form does not supply the missing proof.
For a reusable way to rank regulatory claims by authority, read how to build an official-source ladder. To keep a fragment’s uncertainty visible during commercial review, use the business-signal confidence scoring model.
Step 4: Build the five-year support and signature package
By the end of this step, the decision should survive a later NYDFS request without relying on one employee’s inbox or memory.
Section 500.17(b)(3) requires the filer to maintain supporting records, schedules, documentation and data for five years. The provision expressly includes areas, systems and processes that require or required material improvement, updating or redesign; remedial efforts; and remediation plans and implementation timelines.
The package should therefore contain:
- the entity-and-exemption determination;
- the applicable-section register and supporting evidence index;
- the certification or acknowledgment decision record;
- noncompliance descriptions and remediation evidence, where relevant;
- the final submitted representation and version history; and
- the approval record for both required signatories.
The annual certification or acknowledgment is signed by the Covered Entity’s highest-ranking executive and CISO. If it has no CISO, the second signer is the senior officer responsible for its cybersecurity program. A consultant may organise evidence and advise; it cannot quietly replace those signatories or their judgment.
Verify that names, roles, entity and filing year match across the package. A group-level CISO slide or an affiliate’s report should not be assumed to cover the filer without evidence of scope.
Step 5: Submit through the right portal record and retain the receipt
By the end of this step, the team should possess the actual NYDFS confirmation evidence.
The NYDFS submission instructions say cybersecurity filings are made through the DFS Portal using DFS ID and multi-factor authentication. Confirm the filer and annual-notification type before data entry, enter the approved facts, complete the required signatures and preserve the final filed copy.
NYDFS says the email containing a receipt number is the only confirmation of submission. Retain the email and receipt number with the five-year support package. If the email does not arrive, follow the Department’s “Confirm My Submission” instructions rather than treating a browser screenshot as final proof.
Verify success with four matching items: legal entity, reporting year, filing type and receipt number. A draft marked complete in an internal tracker is not the same as a filed annual notification.
Where early group discovery fits—and stops
For the composite thread, a consultancy BD lead can save a matching target around events such as “April filing,” “cannot certify,” “exemption changed,” “CISO sign-off” and “remediation date” in selected Telegram groups the firm is authorised to access. In the current TOP Prospect version, saving that matching target stores the configuration; it does not automatically produce a candidate Signal. The lead must still review available source material and verify the entity, year and filing state with the poster or another authorised source.
TOP Prospect does not determine Covered Entity status, test controls, decide materiality, sign a filing, enter the DFS Portal, read private or unselected groups, or confirm that a submission occurred. The Telegram business-signal workflow shows where product records end and human qualification begins.
Key Facts
- The annual Part 500 compliance notification is due electronically by April 15 and concerns the prior calendar year.
- The two routes are Certification of Material Compliance and Acknowledgment of Noncompliance.
- An acknowledgment identifies all applicable sections not materially complied with, describes the nature and extent, and gives a remediation timeline or completion confirmation.
- Limited exemptions under Sections 500.19(a), (c) and (d) still leave applicable requirements and an annual notification; full exemptions under (b), (e) and (g) are different.
- Both annual filing types require the highest-ranking executive and the CISO, or the responsible senior officer when there is no CISO, to sign.
- Supporting documentation for either filing must be retained for five years.
- NYDFS identifies the emailed receipt number as the only confirmation of portal submission.
Questions that surface before sign-off
What must a Covered Entity file by April 15?
For the prior calendar year, a Covered Entity subject to the annual-notification requirement submits either a Certification of Material Compliance or an Acknowledgment of Noncompliance. The route depends on material compliance with the Part 500 sections applicable to that filer.
Can a limited-exemption entity skip the annual notification?
No. NYDFS says entities under Sections 500.19(a), (c) or (d) submit the annual notification for the provisions that apply to them. Do not confuse that limited relief with full exemptions under Sections 500.19(b), (e) or (g).
What belongs in an Acknowledgment of Noncompliance?
It identifies every applicable section not materially complied with, describes the nature and extent of each gap, and provides a remediation timeline or confirms remediation is complete. A list of red controls without Part 500 section mapping is not enough.
Does fixing the gap after year-end make certification available?
Not automatically. The filing concerns material compliance during the prior calendar year. Later remediation belongs in the evidence and may support completion status, but qualified reviewers still need to determine the correct filing route for that year.
How is portal submission proven?
Retain the NYDFS email and receipt number. NYDFS calls that email the only submission confirmation; a draft, screenshot or internal approval does not replace it.
Return to the opening thread: before anyone “fixes the cert,” the team needs the exact filer, exemption, applicable-section evidence, remediation record, signatories and receipt path. If those five records exist, portal work is the last step. If they do not, the missing record—not the form—is the real consulting scope.
Reviewed by TOP Prospect Editorial Team on 18 August 2026. Regulatory facts were checked against the current official 23 NYCRR Part 500 text and NYDFS Cybersecurity Resource Center pages listed above. Entity, exemption, materiality and filing decisions require qualified review of the actual facts.
Frequently asked questions
What must a Covered Entity file by April 15 under Part 500?
For the prior calendar year, a Covered Entity subject to the annual-notification requirement files either a Certification of Material Compliance or an Acknowledgment of Noncompliance. The filing route depends on material compliance with the sections applicable to that entity.
Can a limited-exemption entity skip the annual compliance notification?
No. NYDFS says entities with limited exemptions under Sections 500.19(a), (c) or (d) still submit an annual notification, but only regarding the sections that apply to them. Full exemptions under Sections 500.19(b), (e) or (g) are treated differently.
What must an Acknowledgment of Noncompliance contain?
It must acknowledge that the entity did not materially comply with all applicable requirements for the prior year, identify every section not materially complied with, describe the nature and extent of the noncompliance, and give a remediation timeline or confirm completion.
How long must supporting records be retained?
Section 500.17(b)(3) requires records, schedules, documentation and data supporting either annual filing to be retained for five years and produced to NYDFS on request.
What proves the portal filing was submitted?
NYDFS says the email containing the receipt number is the only submission confirmation. The filing package should retain that email and receipt number; an internal screenshot or draft status is not the same evidence.
Sources and further reading
How a Signal worth attention is found
See how Top Prospect finds and organizes Signals worth checking, keeps the original Telegram context, removes duplicates, and helps you decide what to review first. You decide whether to follow up and what to do next.
