The New York State Department of Financial Services announced that licensed money transmitter Order Express will pay a USD 250,000 penalty for violating the department’s cybersecurity regulation, 23 NYCRR Part 500. An investigation found deficiencies in the company’s cybersecurity program and required controls that exposed it to vulnerabilities potentially exploitable by threat actors. The deficiencies included inadequate cybersecurity policies for system updates and insufficient risk assessments. Order Express has remediated the identified issues. Although the company is exempt from many Part 500 requirements because of its limited revenue, it remained subject to the provisions underlying the enforcement action.
New York State Department of Financial Services2026-08-05
New York State Department of Financial Services fines Order Express USD 250,000 for cybersecurity control failures
The New York State Department of Financial Services fined Order Express USD 250,000 for deficiencies in its cybersecurity program, including inadequate system-update policies and risk assessments. The licensed money transmitter has remediated the issues and is exempt from many other requirements under 23 NYCRR Part 500 because of its limited revenue.