New York Department of Financial Services Superintendent Adrienne Harris leaves office emphasizing the state’s leadership in shaping modern financial regulation. She tells PYMNTS CEO Karen Webster that her successor, Kaitlyn Asrow, will continue advancing the “department of YES” approach that balances innovation with consumer protection.
Transcript
This is Monday Conversation, a PYMNTS podcast. Karen Webster sits down with the visionaries behind the trends for the stories shaping what's next in payments and commerce. In this episode, New York Department of Financial Services Superintendent Adrienne Harris leaves office, emphasizing the state's leadership in shaping modern financial regulation.
Karen Webster:If you've spent any time in financial services over the past few years, especially in payments, fintech, or crypto, you felt the ripple effects of one regulator more than any other. Under Superintendent Adrienne Harris, the New York Department of Financial Services didn't just supervise, it often set the standard from rewriting the state's cybersecurity rule book to modernizing crypto oversight, expanding into AI, BNPL, and fairness and insurance. Superintendent Harris has treated regulation as an instrument of progress, not paralysis. And having known and worked with her over the years, I can say that she measures success, not just in enforcement actions, but in the durable systems and mindsets that she has helped to shape. So today she prepares to leave the role of superintendent. We get to pause and look back with her at what it took to modernize one of the nation's most complex regulators, what she learned along the way, and what will still bear her fingerprints years from now. Hi, Superintendent Harris. This must be a pretty bittersweet time for you as you look to say goodbye and look forward to what's next. Thanks for making the time for a conversation about all of that and more.
Adrienne Harris:Yeah, happy to be here. Thanks for having me.
Karen Webster:So let's start with, I guess, the foundational question. You made a deliberate choice to make New York the leader in regulating financial innovation from crypto, AI, cybersecurity. The landscape is broad. Why did you decide to do that? Were you trying to fill a national gap, set the starting point for others to sort of follow, or simply make sure that New York didn't get left behind?
Adrienne Harris:I think it was really a combination of those things. I have always believed that too often we set up a false choice in financial regulation that we think you can be good for consumers or good for business, but you can't do both. I've always believed you can do both. You can protect consumers and markets and be good for business at the same time. It was part of the reason I took this job when I first met Governor Hokel, I thought what a great place to prove out this thesis in the financial capital that includes, of course, around innovative financial products. So I wanted to make sure New York was the leader. I wanted to try and set an example for globally how you could accomplish these objectives together. And I think the team has done a really good job over the past four plus years.
Karen Webster:Four plus years. That's been that's a long time.
Adrienne Harris:It is a long time.
Karen Webster:But it's been it's been it's been wonderful. I agree with that. But I mean, you do make a good point that I think most people think of regulators and agencies as the department of no. And you really try to create the department of yes with the appropriate guardrails. But but doing that also is a mindset shift inside the department, inside the agency. How did you manage to do that?
Adrienne Harris:Yeah, I think the team that was here and has been here, and it's an incredible, professional, dedicated staff that's been here for years and years and years. I think they wanted that themselves, right? I think they were all very aligned in saying, we want to help businesses succeed, but within our risk tolerance for what we know needs to happen for safety and soundness and consumer protection. So I think it was just giving them the resources, both human, capital, and technological, uh, and the license to do that. And I think to your point, yes, it is a change, and change management is hard in any large organization. I think that we still have room for improvement there. Um, but the team was was all for it, and I think our stakeholders have really embraced it as well.
Karen Webster:How long did it take for the industry and innovators to recognize that you were approachable and interested in understanding how to move innovation forward rather than kind of be the shackles that hold it, that hold it back?
Adrienne Harris:Yeah, I mean, I think, you know, sometimes people will still say that about us if we're not letting them do something we'd like to do. So fair enough. Um, but I think it was pretty quickly. I mean, we tackled some really tough things early on, things that had been thorns in everybody's side for decades. And I think those early moves sent a very strong signal to our stakeholders. And the same was true, frankly, for the state legislature, which I think had always had a tough relationship with the agency. Very early, I spent time working with legislators on bills or ideas that they had, giving them access to the team, really talking about tough issues. And I think that made a huge difference for us.
Karen Webster:Well, I think being able to look at the issue in a 360-degree fashion, as opposed to assuming that everything is wrong and assuming that things have the potential to be quite strong and quite important for the consumer and innovators, I think is it's a mindset shift. I mean, it isn't necessarily something that regulators think about in the first instance. At least that's not what people think.
Adrienne Harris:Yeah, no, I think that's right. But I think people will be surprised. I mean, we always encourage our stakeholders, regulated entities, legislators, others, come in and talk to us. I think people would be surprised how aligned they are with their regulators, but it's just people don't have the honest conversations.
Karen Webster:Right. Well, what is the one thing that is not something that you think a successor would unwind? Because every successor wants to put their fingerprints on their new role, right? And and I think you've made a a great effort to put the guardrails in place and put the foundation in place. But but are there things that just aren't breakable that you think are durable regardless of what tweaks and and and and change may happen after you after you leave?
Adrienne Harris:Yeah, well, for now, you know, Caitlin Azra, my executive deputy superintendent for research and innovation, will take over as acting. I think that's continuity that the department has never had in its transitions in the past. So I think that was really meaningful for the staff, and it will be meaningful for our stakeholders as they see that continuity. She's been a big part of what we've built over the past four years. Um, and then, you know, then we'll see in the years to come how things how things change. But my hope is any and all successors going forward um feel like we've put an in place a good foundation and want to build on that.
Karen Webster:I I want to switch to the conversation to crypto, stable coin. You've been very influential, not only on a state level, but on a federal level as well. And it's such a dynamic part of the market right now where we see a lot of innovation, we see a lot of activity. Um, but I'm curious, you know, if you could rewind the clock, would you change anything about the bit license? And is there a control that you've put in place that you'd require on a national level if you could influence? I mean, the Genius Act is really the cut and paste of what you've done in in New York. But if you could put something in place nationally that you've done at the state level with respect to those two areas of innovation, what would that be?
Adrienne Harris:Yeah, I mean, I don't think there's really much I would change about the bit license, the limited purpose trust charter. I think what we've learned over time is that often people think of the rule as the end, right? And we think of it as the beginning. And I think that's why over four years we've done now 11 pieces of guidance, right? The rule was done at a period in time, but the space, as you indicate, has changed dramatically. Uh, and so that guidance around market manipulation, around stable coins, around blockchain analytics adds that meat on the bones that keeps us abreast of developments in the space. Um, but then the most important thing is really that supervision, that day-to-day supervision examination of companies. That's where the rubber really meets the road. And I think any regulator more or less effective as they oversee the space.
Karen Webster:How do you think that's going to change the composition of the team at the department once you leave? Because that has taken so much energy now in the market, and it seems to overshadow a lot of other financial services and payments practices that uh have you know sort of been the bread and butter of what of what agencies think about.
Adrienne Harris:Yeah, I mean, I think, as you know, we've grown the virtual currency team from a few folks to now 60 team members. Um, I I still think it is the perhaps the largest uh virtual currency regulatory group uh anywhere in the world. Uh but we have incredibly strong teams on our money transmission side and our licensed lending side, obviously, and our traditional banking and insurance supervision. But I think for us, what we've found the key to be across all of our teams is we've done so much hiring and promoting. We hired or promoted more than 1,200 people in my time here, is having diverse teams. So we've got people that have been at DFS forever. We've got folks from federal and international regulators, we have people that came in from the private sector, from companies, from law firms. And having that diversity of perspectives, I think really, really makes the teams effective.
Karen Webster:Let's talk about something that has been a topic of conversation in payments and financial services for a while, and that's Bine LP later, um, that will come under the department oversight, although rulemaking is not something that is in place and will take some time to develop. What are some of the things that you're most concerned about that you want to see addressed?
Adrienne Harris:Yeah. Yeah, the team is already hard at work putting together our proposed rules. So hopefully it won't take uh very long before those rules are in place. You know, we're of course uh looking at fees in all shapes and forms, whether it's sort of the financing fee, late fees, initiation fees, subscriptions, how those things come together in aggregate. New York has very strict usury laws that we need to make sure we're keeping in mind. Disclosures and marketing, I think, are things that are that are top of mind. But we want to make sure we write a rule that accounts for models that exist today and then may come into existence in the future as well. So we did this RFI uh a few weeks ago that's now done, and we'll incorporate a lot of that data and input into the proposed rule and then go through the rulemaking process. Um, credit reporting is a really important issue that we're looking at. Um, so we have to cover a lot of ground in this. And then, of course, there's there's overlap, as you know, buy now pay later providers don't just do buy now pay later. They do other types of lending, they do money transmission. So we want to make sure our um our supervision framework is efficient that way and takes account of that.
Karen Webster:And and do you think it will be different than what exists in other states? I mean, the CFPB, it looks like there'll be a vacuum there, certainly at the federal level, um, for some time to come. Um, you know, one of the one of the challenges is for these providers is to be compliant with rules that are so different from state to state.
Adrienne Harris:Yeah, I mean, we always work very hard to harmonize with existing uh frameworks and to make sure we're we're having conversations with other regulators. We've done so with other states. Uh, we've had lots of conversations with the FCA, for instance, right? Because they've been working on this issue for for quite some time. Uh, so we do everything we can to harmonize to streamline even within our own requirements. Um, but then you know, there are going to be issues, I'm sure, where we feel differently than others. And so we'll have some different requirements there.
Karen Webster:You've so many things to talk about because you've done so many things. Yeah. I want to I want to switch to cybersecurity and AI, two big, giant topics of conversation, certainly cyber, where you have completely overhauled the regulation in the state and put some real teeth into what businesses have to do. You know, AI guidance, similarly, and that's an area that's moving so quickly, innovating so rapidly. Where do you think firms are still underinvesting as you look across the landscape of the rules that are in place now and the activity and the innovation that's certainly happening on the AI side and the threats and vulnerability on the other side with respect to cyber and bad guys using tools to try to compromise existing data and businesses?
Adrienne Harris:Yeah, I think you know it's still such a hard thing for the smaller firms to tackle. So one of the things we did in the amended regulation was really to revisit our tailoring to make sure things that weren't originally required of the smaller firms, multi-factor authentication, for instance, now can be required by smaller firms because that technology is more accessible, it's cheaper, more easy to implement. Um, so I think people invest quite a lot in this. I think there's still a lot of work to be done around reporting, threat detection, right? As you know, you can have a cyber incident, and quite a bit of time can pass before before you know as an entity that you've had a breach. Um, so I think that detection and reporting still has some work to do. I think all regulators are working on what do we do with the data we get from individual companies? How do we think about pattern detection and working with other regulators and law enforcement to make sure we're sharing data in real time? I think that works pretty well, but always room for for improvement there. Um, but I think those, you know, making sure the small firms have the toolkit that they need to be as advanced as as possible, given their resources, is something that everybody should be collaborating on.
Karen Webster:When you talk to businesses on these two topics, I mean, obviously quite, I mean these are board-level discussions. Um, what do they ask you and and what do you tell them that they need to make sure is a high priority?
Adrienne Harris:Yeah, I mean, the the AI is a big topic of conversation. That's why we did the guidance when we did. And we like to use this guidance tool when we start to get a critical mass of questions from our stakeholders who say, okay, it's time for us to say something about this, and then try to strike that balance between being principles-based and rules-based when we do speak up about an issue. Um, so people really are coming a lot and saying, well, how do I defend against threats that are augmented or perpetrated by AI? How do I use AI, right, as part of the defenses? I think that's really been the biggest topic of conversation that we've we've had. And of course, you know, the ransomware topic is not new, um, but I think the firms continue to evolve in how they think about whether or not to pay ransoms when they get them. Um, so I think that's a discussion that's not going anywhere anytime soon.
Karen Webster:You're such a proponent of stablecoin. Um, why do you think this is such a transformative technology?
Adrienne Harris:Yeah, I, you know, I think this idea about the internet of money, right? I mean, I don't have new things to say necessarily about this. There are there are lots of smart people out there that do this every day, all the time. But um thinking about how we might make especially wholesale payments, treasury functions more efficient for businesses, and I think for small businesses, I think that could really be a game changer. Um, there are certainly risks, and we've been chatting with lots of international regulators. We convened a round table several months ago to talk about reserves and rebalancing and harmonizing requirements. Um, but it's still such early days. Um crypto even, but especially for stablecoin. Uh, we were very excited to see Genius get across the finish line. As you noted, it really is a copy and paste of our stablecoin framework from a few years ago. Eager to see the implementation, and and Treasury's been moving very quickly on the things that it's been required to do from the act. Um, but I think there's lots of exciting things to come from this technology. I will say sometimes when we engage with stakeholders around this topic, I hear discussions about things uh that make me a little bit nervous that are akin to products and discussions that were happening in the lead up to and during the financial crisis. And I always remind people, right, this movie is not that old. Um so we should not forget that that history. Um, so everybody, I think, should really continue to be mindful of the risks while thinking about some of the benefits the technology will bring.
Karen Webster:I mean, and you and you were in your post during some of the nasty, you know, the crypto winter and Silicon Valley Bank collapse. And, you know, you you were there in the room when this was happening all around us. I mean, take us inside some of those conversations and discussions. What was your reaction and what were you asked to do?
Adrienne Harris:Yeah, so we, of course, were the supervisors of Signature Bank.
Karen Webster:Yep.
Adrienne Harris:And you know, Signature sort of got tagged with being this crypto bank and it failed because of crypto, which actually wasn't the case. I think it was a very technology-friendly bank. They did have crypto companies as depositors. And so I think between Silvergate and SVB, there was a theme there. But to say that Signature failed because of crypto, I don't think is right. Because as we looked at the depositors that were fleeing over that weekend, the crypto company depositors sort of fled the bank in almost direct proportion to their presence in the overall deposit base, right? We saw lots of other depositors fleeing as well. And I do think, you know, one of my big takeaways from that crisis is how we think about a couple of things. One, regulation, right? If you think about liquidity rules, they're not written for a time, even though they're not that old. They're not written for a time when you can move lots of money really quickly from a mobile device. And because we're in New York, right between subway stops, no less, move a lot of money from a mobile device. So I think making sure we have the tools to keep rules up to date as technology in the broader world around financial services is changing, but it also caused us to revisit a lot of our internal processes and procedures. So we changed our escalation procedure. We saw institutions like signature, and we wrote about this in our report, that we're getting threes on their Camel scores, cycle after cycle after cycle, that needs to be escalated. So we changed our internal procedures around that. But I also think the feedback loop in examinations is too long. So if you're, you know, covering in your exam year one, you're writing the exam in year two, you're looking at remediation steps in year three, that's too long a feedback loop. And so we went through and really mapped our processes. How long does it take us to write a report? How do we better hold institutions' feet to the fire on remediation? How do we tighten that feedback loop to something that's more fit for a 21st century economy?
Karen Webster:There are a lot of new players looking for banking licenses because they see the opportunity. You know, that that's a conversation for another day, perhaps. But I think your point about, you know, look at history because the idea that this can't possibly happen again, um, you know, that's not always necessarily the past can be prologue.
Adrienne Harris:Absolutely.
Karen Webster:Um thinking about what's next from the regulatory landscape in in New York and and even more broadly than that, if you had one more opportunity to say, here's an area where I think a product or a business model needs a different or a clearer rule of the road in New York, what would that be?
Adrienne Harris:Yeah, it's hard to pick one, um, certainly. Um, you know, one thing that we've started work on, but I think is gonna require more legislation and then rulemaking and work to develop is around the prescription drug supply chain. So two years ago, we got authority to oversee pharmacy benefit managers, PBMs. There are so many other intermediaries in the prescription drug supply chain. And it's complicated supply chain, yeah. And so that I think we have a lot more work to do here on in New York and around the country.
Karen Webster:Yeah, that is a that is a big and complex area, but certainly an important area to to look at. Um, how do you know when you've gotten it right? Because there are so many different points of view. When you are balancing innovation, regulation, consumer businesses with the ability to make a margin from the services that they're putting into market. What's your litmus test for knowing whether or not you've struck the right balance? Is it that everyone is complaining for about something?
Adrienne Harris:Or is there something that's more scientific? You know, I think that is certainly part of it, right? If everybody's a little unhappy, you know, you sort of got to the right place. Um, you know, I think the other thing that we look for is we subject a lot of things to comment, even when the law doesn't require us to do so. Um and when everybody comes back and they say, maybe we don't agree with this, but we see how you got there. We understand why you made this decision, right? There's there's transparency there, there's rationality there, there's um something for us, right? We look to be data driven and transparent in the data we're using to make decisions. So everybody's a little unhappy, and but for the things that they're unhappy about, they go, but I understand. Yeah.
Karen Webster:That's um that's a good litmus test. I think I think people respect something when they actually understand why a rule is being made, why guardrails are being put in place, and then they can adapt accordingly. Final question. Um, we talked about, you know, some of the things that you could change if you if you could, would change if you could, but but what is the one thing five years from now, when you're at dinner and people are like, wow, so many things that you did while you were superintendent in New York at the Department of Financial Services. What's the one thing that will stand out and have you say the one thing that I really am proud of is so hard to pick one thing.
Adrienne Harris:Um, I think the one thing that always stands out in my mind is we over the past four years have gotten over $725 million in restitution. That's a lot. It's a lot of money, and that's not penalties, that really is money back in New Yorkers' pockets. Um I said it was hard to pick just one. Um we also made it so that there's no cost sharing for insulin in New York. It's a big, big health equity um initiative that we led there. So there are lots of things, but I think those are two of the top ones for sure.
Karen Webster:Well, Superintendent Harris. This is the last time I'll be able to call you Superintendent Harris. We'll figure out what we call you next when when uh when the time is right. But I really enjoyed the conversation. Appreciate that you took the time. I mean, for me, what has really stood out is that you didn't just regulate innovation, you kind of redefined how regulation needs to support innovation in a way that is sustainable and durable for all of the stakeholders, turning the department of NO into the department of K NOW. Get it? No, KNOW. That was one of my better things. Yeah. Um, but but I think, I mean, I think you've obviously shown that regulation doesn't have to slow things down. It can actually improve the process for everyone and really create better outcomes for everyone who is participating in the financial services arena, whether in New York State or on a much broader scale, uh, nationally and even internationally, it sounds like. So thank you so much for your time. Thanks for your service to the state of New York and to other jurisdictions. We can't wait to see what's next.
Adrienne Harris:Thank you, Karen.
Narrator:That's it for this episode of the PYMNTS Podcast, the thinking behind the doing. Conversations with the leaders transforming payments, commerce, and the digital economy. Be sure to follow us on Spotify and Apple Podcasts. You can also catch every episode at pymnts.com/ podcasts. Thanks for listening.