NYDFS Part 504 is a New York state regulation, codified at 3 NYCRR Part 504, that requires financial institutions supervised by the Department of Financial Services to maintain a transaction monitoring program for Bank Secrecy Act and anti-money laundering purposes and a filtering program for OFAC sanctions compliance, and to file an annual certification by April 15 attesting that both programs meet the regulation’s requirements. The certification is signed either by the board or by a senior officer, and that individual carries personal civil and criminal exposure if the filing turns out to be false.
Who the Rule Covers
Part 504 applies to every “Regulated Institution” under New York Banking Law. That category includes banks, trust companies, private bankers, savings banks, safe deposit companies, savings and loan associations, credit unions, and investment companies.1New York State Senate. New York Code BNK – Definitions It also reaches non-bank financial service providers licensed in New York, including check cashers and money transmitters.
New York branches and agencies of foreign banking organizations are covered as well. The trigger is location: if the branch operates in New York, Part 504 applies regardless of where the parent sits.
What the Transaction Monitoring Program Must Do
Section 504.3(a) requires every regulated institution to maintain a program that reviews completed transactions for potential BSA and anti-money laundering violations. The program can be manual or automated, but either way it has to satisfy eight attributes.2Cornell Law Institute. New York Code Title 3 Section 504.3 – Transaction Monitoring and Filtering Program Requirements
- Built on the institution’s own risk assessment, not a generic template.
- Reviewed and updated at risk-based intervals to reflect changes in federal AML law, regulatory warnings, and the institution’s own business.
- Matched to the institution’s specific products, services, customer types, and counterparties.
- Supported by specific detection scenarios with dollar thresholds and activity patterns calibrated to catch suspicious or illegal activity.
- Subjected to end-to-end pre- and post-implementation testing covering governance, data mapping, transaction coding, detection scenario logic, model validation, and data flow in and out of the system.
- Documented in writing, with the current detection scenarios and the assumptions, parameters, and thresholds behind each one on file.
- Supported by clear protocols for investigating alerts, deciding when a suspicious activity report or other action is warranted, assigning responsibility, and documenting the decision.
- Continuously evaluated so that scenarios, rules, thresholds, parameters, and assumptions keep up as criminal tactics change.
The regulation also requires qualified staff or outside consultants to handle design, implementation, testing, validation, and ongoing analysis. Staffing is where many institutions fall short: sophisticated monitoring software is of little use if there are not enough analysts to work the alerts it produces.
What the Filtering Program Must Do
Section 504.3(b) separately requires a Filtering Program designed to stop transactions that would violate sanctions administered by the Office of Foreign Assets Control. Where the monitoring program looks at transactions after they settle, the filtering program is meant to intercept prohibited transactions before they go through.2Cornell Law Institute. New York Code Title 3 Section 504.3 – Transaction Monitoring and Filtering Program Requirements
OFAC publishes multiple sanctions lists, including the Specially Designated Nationals and Blocked Persons list and consolidated lists covering foreign sanctions evaders, sectoral sanctions targets, and other restricted parties.3U.S. Department of the Treasury. Sanctions List Search Tool The Filtering Program has to screen against these lists and meet five attributes:
- Grounded in the institution’s risk assessment.
- Equipped with technology, processes, or tools that match names and accounts, calibrated to the institution’s risk profile and transaction patterns.
- Tested end to end, both before and after implementation, for data matching, OFAC list coverage, threshold settings, matching logic, model validation, and data flow.
- Continuously reviewed to confirm the matching logic, OFAC list coverage, and thresholds still fit the institution’s risk exposure.
- Documented in writing, with the intent and design of the filtering tools and processes on file.
A filtering program may be manual or automated, but the method has to match volume and complexity. A manual process is difficult to defend at an institution running tens of thousands of international wires a day.
The Annual Certification and Who Signs It
The enforcement hook sits in Section 504.4. Each regulated institution must adopt and submit either a Board Resolution or a Senior Officer Compliance Finding, using the form the Department prescribes, by April 15 of each year, covering the prior calendar year.4Cornell Law Institute. New York Code Title 3 Section 504.4 – Certifications The filing goes through the DFS Portal, which is the only accepted submission method.5Department of Financial Services. Transaction Monitoring
The person signing is making a binding statement that the institution’s monitoring and filtering programs comply with the regulation and that they have taken the steps needed to reach that conclusion. If the board is the certifying body, the certification takes the form of a board resolution. If a senior officer signs instead, that individual’s name and title appear on the filing. Either way, the signer needs to actually understand what the programs do, what gaps exist, and what remediation is underway. This is not a document to delegate to the compliance team and sign without review.
Do not attach supporting documentation to the certification itself.5Department of Financial Services. Transaction Monitoring The underlying records stay internal, organized, and ready for inspection if the Department asks for them.
Records You Must Keep
Section 504.4 requires each regulated institution to maintain all records, schedules, and data supporting its certification for five years, available for examination by the Department at any point during that window.4Cornell Law Institute. New York Code Title 3 Section 504.4 – Certifications
In practice that means retaining the internal analyses, testing results, risk assessments, alert investigation records, remediation documentation, and anything else the certifying officer relied on. If a 2026 certification gets questioned during a 2030 examination, the institution has to produce the underlying evidence. Institutions that migrate systems or change vendors in the interim need a plan for keeping the older records accessible.
When Your Program Has Gaps
Part 504 assumes institutions will find problems. Section 504.3(d) requires that when an institution identifies areas, systems, or processes needing material improvement, updating, or redesign, it must document both the finding and the remedial steps planned or underway.2Cornell Law Institute. New York Code Title 3 Section 504.3 – Transaction Monitoring and Filtering Program Requirements That documentation must be available for the Superintendent of Financial Services at any time.
Identifying a deficiency does not by itself block an institution from filing its annual certification. What the regulation expects is a credible remediation plan with documented timelines and progress, and a certifying officer who has reviewed and understood those gaps before signing. The failure mode to avoid is a signer who learns only after the fact that compliance staff had flagged serious problems months earlier.
Penalties and Enforcement
Section 504.5 warns that a certifying individual who files an incorrect or false certification may face both criminal and civil penalties. That personal exposure is what distinguishes Part 504 from most other compliance frameworks and what forces accountability up to the board or senior officer level.
At the institutional level, NYDFS has imposed substantial fines for Part 504 violations. In one enforcement action, the Department fined Robinhood Crypto $30 million after finding its anti-money laundering program inadequately staffed and reliant on a manual transaction monitoring system that was not sufficient for its volume, which averaged 106,000 daily transactions totaling $5.3 million. The Department noted that a manual system is not inherently a violation but was unacceptable at that scale. Late certifications, incomplete documentation, and thin staffing are the kinds of findings that escalate from an examination into formal enforcement.