Guide
Multi-Factor Authentication (MFA) Requirements for Financial Firms
Stolen passwords are behind many of the attacks on financial firms, and regulators and cyber insurers now expect multi-factor authentication almost everywhere. Here is what the rules require and how to roll MFA out without disrupting your staff.
Key takeaways
- The FTC Safeguards Rule requires MFA for anyone accessing systems that hold or connect to customer information, at firms of every size, unless your Qualified Individual approves an equivalent control in writing.
- Since November 1, 2025, NYDFS Part 500 requires MFA for any individual accessing any information system of a covered firm, with narrower requirements for firms with a limited exemption.
- Cyber insurers commonly expect MFA on email, remote access, cloud applications and administrator accounts.
- Not all MFA is equal: phishing-resistant methods such as security keys and passkeys are much stronger than text-message codes or simple push approvals.
The rules
Which MFA rules apply to your firm
Tax, accounting and other firms under the FTC Safeguards Rule
The Safeguards Rule requires multi-factor authentication for any individual accessing any information system that holds or connects to customer information, unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls. The exception for firms with fewer than 5,000 consumers does not remove this requirement. See our WISP guide for accounting and tax firms.
NYDFS-licensed firms: Part 500
Since November 1, 2025, Part 500 requires MFA for any individual accessing any information system of a covered firm, regardless of location or type of user, including vendors and contractors. Firms with a limited exemption must still use MFA for remote access to their systems, remote access to third-party applications such as cloud services, and all privileged accounts other than service accounts. A CISO can approve reasonably equivalent or more secure controls in writing, reviewed at least once a year.
NYDFS guidance also warns about weaker methods: push approvals should use number matching or a similar challenge, and text-message codes are exposed to SIM swapping. See our NYDFS Part 500 compliance checklist.
Advisers and broker-dealers
Regulation S-P does not name a specific sign-in method, but it requires policies and procedures that protect customer information against unauthorized access, and MFA on email, CRM and custodian platforms is one of the most effective ways to do that. Firms that are also licensed by NYDFS must meet Part 500 as well. See our Regulation S-P compliance checklist.
Cyber insurance
Most carriers ask about MFA on applications and renewals, commonly for email, remote access, cloud applications and every administrator account. An inaccurate answer can put a claim at risk, so make sure your answers match how MFA is actually set up. See our cyber insurance requirements checklist.
Methods
Which MFA methods are strongest
From strongest to weakest:
- Phishing-resistant methods: FIDO2 security keys, passkeys, Windows Hello for Business and certificate-based sign-in. A fake sign-in page cannot capture them, so they are the best choice for administrators and executives.
- Authenticator app with number matching: a good default for most staff. Number matching and sign-in details make it much harder to trick someone into approving a fraudulent request.
- One-time codes from an app or hardware token: far better than a password alone, but a fake sign-in page can still capture them.
- Text-message and phone-call codes: the weakest option because of SIM swapping. Use them only as a backup while staff move to stronger methods.
Where
Where financial firms need MFA
- Microsoft 365 and other email, including on phones
- Remote access: VPN, remote desktop and remote support tools
- Custodian, CRM, portfolio management, tax and accounting platforms
- Every administrator and privileged account, including your IT provider’s accounts
- Cloud file sharing, backup and e-signature services
- Banking and payment portals used to move money
- Password managers
Watch for the gaps attackers use to get around MFA: older email protocols that accept a password alone, shared accounts, service accounts and vendor logins. Block legacy authentication in Microsoft 365, and require MFA for vendors and contractors just as you do for staff. See our Microsoft 365 security checklist.
Rollout
How to roll out MFA without disrupting your firm
Step 1
Inventory sign-ins
List every system staff, vendors and administrators sign in to, and note which already require MFA and with which methods.
Step 2
Start with the riskiest accounts
Turn on phishing-resistant MFA for administrators and executives first, then email and remote access for everyone.
Step 3
Enroll and train staff
Help each person set up the authenticator app or security key, register a backup method and learn to deny sign-in requests they did not start.
Step 4
Enforce and document
Require MFA everywhere with Conditional Access, block legacy sign-in methods, and document any approved exceptions and review them at least once a year.
How FinFortify helps
How FinFortify helps with MFA
Multi-factor authentication is part of the security baseline every FinFortify client gets. Our Microsoft 365 managed services and managed cybersecurity services cover Conditional Access, moving staff to stronger methods such as number matching and security keys, blocking legacy sign-in, and documenting coverage and exceptions for your examiners, auditors and cyber insurer.
See also our vendor due diligence checklist and wire fraud prevention guide. To talk about MFA at your firm, request a quote.
FAQ
MFA for financial firms: frequently asked questions
Is MFA required for financial firms?
For many firms, yes. The FTC Safeguards Rule requires it for anyone accessing systems with customer information, NYDFS Part 500 requires it for any individual accessing a covered firm’s systems, and most cyber insurers expect it on email, remote access and administrator accounts. For SEC-registered firms it is the baseline safeguard for protecting customer information.
Do text-message codes count as MFA?
They are a second factor, but they are the weakest option because of SIM swapping and phishing. NYDFS guidance points firms to stronger methods, and we recommend moving staff to an authenticator app with number matching or to phishing-resistant security keys and passkeys.
Does the FTC small-firm exception cover MFA?
No. The exception for firms that hold information on fewer than 5,000 consumers removes the written risk assessment, certain testing, the written incident response plan and the annual report, but MFA is still required.
Do vendors and contractors need MFA too?
Yes. NYDFS Part 500 requires MFA for any individual accessing a covered firm’s systems, including vendors, and the FTC rule also covers any individual. Require MFA from your IT provider and other vendors in your contracts as well.
Close the gaps in your MFA
Tell us about your firm and we will help you put MFA in place on every system, with the documentation regulators and insurers ask for.
