The New York State Department of Financial Services (DFS) has issued new guidance emphasizing the importance of multi-factor authentication (MFA) and biometric authentication in mitigating cybersecurity risks posed by artificial intelligence (AI). This guidance comes amid growing concerns about AI-enabled fraud, following recent warnings from FinCEN about the rising threat of deepfake media fraud. Covered Entities, including financial institutions regulated under DFS’s Cybersecurity Regulation (23 NYCRR Part 500), must ensure MFA implementation for all authorized users accessing sensitive systems or non-public information (NPI) by November 2025. This requirement mandates the use of two or more authentication factors, such as passwords, biometric traits, or possession-based tokens, and encourages defenses against AI-manipulated deepfakes, including digital certificates and physical security keys. The move aligns with broader industry trends, as exemplified by Mastercard’s recent commitment to replace passwords with biometric authentication by 2030.