New York SIU compliance: the state audits your investigation, not your fraud model

New York does not examine your fraud model. It examines your investigation. Article 4 of the New York Insurance Law (Insurance Frauds Prevention) and 11 NYCRR 86, known as Regulation 95, put three obligations on a covered carrier: a Fraud Prevention Plan filed with the Department of Financial Services, a full-time Special Investigations Unit separate from claims and underwriting, and a report to the superintendent within 30 days of determining that a transaction appears fraudulent. None of the three is satisfied by a detection score.

That distinction is not academic. Read Regulation 95 and DFS's 17-section plan filing guidelines end to end and you will not find one question about model performance, hit rate, or false-positive rate. You will find questions about investigator caseload, case management systems, referral evaluation, and the timing of reports. New York audits the layer most carriers have automated least.

The state is also adding pressure on its own side of the funnel. On April 8, 2026, Governor Hochul announced a partnership between the State Police and DFS under the banner "Stop the Scams," including a July 2026 symposium at the State Police Academy for 250 law enforcement personnel. Enforcement capacity is growing on the criminal side while the carrier-facing funnel narrows. For the national scaffolding New York builds on, read the NAIC Model Act 680 implementation guide.

New York SIU compliance is the set of duties created by Insurance Law Article 4 and 11 NYCRR 86: file a Fraud Prevention Plan with DFS, run a full-time SIU separate from claims and underwriting, report a suspected fraudulent transaction within 30 days of determination, and file an Annual SIU Report by March 15. Each one is an investigation obligation.

Start with the citation, because most content in this area gets it wrong. There is no New York statute short-titled the "Insurance Fraud Prevention Act." The operative authority is Article 4 of the New York Insurance Law, headed "Insurance Frauds Prevention," plural. It contains seven sections, and two of them do nearly all the work a carrier feels: § 405, which sets the reporting duty, and § 409, which sets the plan and SIU mandate.

The regulation layered on top is 11 NYCRR 86, titled "Reports of Suspected Insurance Frauds to Criminal Investigations Unit; Required Warning Statements." DFS's own index of insurance regulations by part number maps 11 NYCRR 86 to Regulation 95 and 11 NYCRR 6 to Regulation 195, "Electronic Filings and Submissions." Those two get swapped constantly in secondary sources. Regulation 95 is the SIU and warning-statement rule. Regulation 195 is the electronic-filing rule DFS cites, at § 6.2(a)(1), as part of the basis for submitting fraud reports through the portal.

One naming quirk to keep straight in your filings. Regulation 95 still refers to the Criminal Investigations Unit. DFS's current organization places insurance fraud work in the Insurance Frauds Bureau, inside the Investigations and Intelligence Division of the Consumer Protection and Financial Enforcement Division. Both names appear in live DFS documents, so follow whichever name the specific instruction uses rather than assuming one is obsolete.

There is a logic to that design. A score is a prediction, and a regulator cannot audit a prediction without adopting the carrier's own model as the benchmark. An investigation leaves artifacts: a file, a date, a named investigator, a referral. Regulation 95 asks only for things that exist on paper afterward, which is why every duty it creates is a duty to document or to act within a deadline. Detection is upstream and unregulated here. Investigation is downstream and is the whole of what New York inspects.

Section 409's plan mandate is line-scoped. It applies to insurers writing personal and commercial automobile, workers' compensation, and individual, group or blanket accident and health policies issued or issued for delivery in New York, except insurers writing fewer than 3,000 such policies annually, plus HMOs licensed under Article 44 of the Public Health Law with 60,000 or more enrollees.

The exception language in § 409(a) is written as a carve-out, not a threshold: the mandate reaches those lines "except for insurers that write less than three thousand of such policies... annually," and reaches Article 44 entities "except those entities with an enrolled population of less than sixty thousand persons in the aggregate." Section 409(f) adds a counting rule that surprises health writers: for accident and health business, "policies" refers to individuals covered, not certificates issued. A group book clears 3,000 faster than a policy count suggests.

Here is the scoping error that shows up in most state-by-state SIU summaries. Homeowners, property, and general liability carriers are not inside the § 409 plan mandate at all. But the § 405 reporting duty is universal. The plan mandate is narrow; the reporting duty is not. A property-only carrier with no filed plan and no § 409 SIU still owes a report inside 30 days every time it determines a transaction appears fraudulent.

Per § 405(a), the reporting duty binds:

• Any person licensed or registered under the Insurance Law
• Any person engaged in the business of insurance in New York, including persons exempted from licensing
• The New York State Insurance Fund
• Self-insurers, including those providing health coverage and those defined in section 50 of the Workers' Compensation Law, per DFS's plan filing guidelines quoting § 405(a)

For scale, Appendix 3 of the DFS CPFED Annual Report lists 106 approved insurer Fraud Prevention Plans on file as of December 31, 2025, against 103 a year earlier. That is a count of plans, not of legal entities, because a single plan can cover multiple affiliated insurers under one group code. Separately, the department's 2025 health insurance fraud report counts 59 insurer SIUs, a figure scoped specifically to accident and health insurers, HMOs, life insurers, nonprofit medical insurers, and dental indemnity and health service corporations. Neither number is the statewide SIU population, and neither should be quoted as one.

The Fraud Prevention Plan is a standing filing, not an annual one. Regulation 95 § 86.6 sets ten required elements and caps implementation at six months. DFS's Criminal Investigations Unit then publishes a 17-section filing guideline that turns those elements into specific questions, and three of those sections ask for an operating capability rather than a policy statement.

Per 11 NYCRR 86.6, the plan must describe:

• A full-time Special Investigations Unit separate from the underwriting and claims functions
• The titles and job descriptions of investigators and their supervisors
• The rationale for the level of staffing assigned to the unit
• The relationship of the SIU to the claims and underwriting departments
• The reporting of fraud data to an organization designated by the superintendent
• In-service training for investigative, underwriting and claims personnel
• Coordination with other units of the insurer to further fraud investigations and to initiate civil actions where appropriate
• A public awareness program
• A fraud detection and procedures manual
• An implementation timetable not to exceed six months

Investigator qualifications are prescribed, not left to the carrier. An SIU investigator needs an associate's or bachelor's degree in criminal justice or a related field, or five years of insurance claims investigation experience or professional investigation experience with law enforcement agencies, or seven years of professional investigation experience involving economic or insurance-related matters, or authorization as a medical professional to evaluate medical-related claims. Those are personnel-record facts an examiner can verify line by line.

Section 9: the caseload number you have to defend

The DFS guidelines for insurers' submission of Fraud Prevention Plans (Rev. 11/15/22) devote Section 9 to SIU staffing. For each unit, the plan must state the number of investigators conducting New York fraud investigations with names, titles and resumes, "the percentage of New York insurance fraud investigations as a percentage of total investigations," "an assessment of optimal caseload per investigator or other metric to assess investigator productivity," and a "justification for the number of investigators, preferably via metrics such as optimal caseload," alongside an org chart, job descriptions, geographic territories, and a training program listing course titles and hours.

New York sets no investigator-to-claims ratio. Its SIU FAQ says each company has broad latitude in deciding how much of its resources will be dedicated to fraud prevention. That latitude is harder to satisfy than a ratio would be, because the carrier has to publish its own standard and then live inside it. On Hesper internal benchmarks, a manual investigator carries 200+ cases and a full investigation takes 14+ days, which is why manual SIUs across US P&C carriers fully investigate roughly 25% of the claims they flag. A plan that files an optimal-caseload figure well below the caseload the unit actually carries has written its own examination finding.

Section 13: case management, referral evaluation, investigation procedures

Section 13 of the filing guidelines is where the regulator states its actual object of interest. The plan must "describe the SIU's case management system," "describe the process for review and evaluation of referrals," and "describe the procedures for case investigations." It must say whether the investigator manual is kept electronically, in hard copy, or both. It must "provide a list of databases used by investigators (e.g.: ISO, DMV)." It must name the individual authorized to refer cases to the Insurance Frauds Bureau and describe the policy for avoiding duplicate concurrent referrals to multiple law enforcement agencies. And it must "indicate the SIU's compliance with NYIL §405(a)," with the 30-day language reproduced and the deadline underlined.

Nothing in Section 13 asks about model performance. The questions are about machinery: how referrals get evaluated, how investigations get run, what the file looks like, and whether the report went out on time. That is a working definition of the investigation layer, written by a regulator rather than a vendor.

Section 12: outsourcing puts the contract in the filing

Outsourcing is permitted. DFS states plainly that New York Insurance Law allows insurers to use an outside contractor to perform SIU functions, and Regulation 95 contemplates contracting for all or part of the function. The insurer remains primarily responsible for developing and implementing the plan. Section 12 of the guidelines requires executed vendor contracts to be filed with the plan, and requires the agreement to state that the SIU will provide any and all assistance requested by the Insurance Frauds Bureau and any other law enforcement agency, and will cooperate with DFS in any examination of the plan's implementation.

State the implication for any automated investigation layer, Hesper included, rather than hiding it. If a system performs SIU functions, its contract becomes a filed document and its output has to survive a DFS field examination. That is a reasonable bar, and it is why an audit-trail-native design is a compliance feature rather than a convenience.

Two filing mechanics catch carriers out. First, cadence: DFS says it is not necessary to submit a new plan annually, but plans should be updated to reflect material changes, and insurers "should revise Plans approximately every 5 years, if not sooner." Its enumerated material-change triggers are a change of SIU vendor, a change from in-house to vendor, a change of vendor, significant changes in the number of SIU personnel, new SIU management or investigators, changes to lines of business written, and significant holding company changes. Second, format: plans received as a filled-in template based on the guidelines, rather than as an organized plan document, are not acceptable. There is also a quiet dead letter in the rule: for the § 409(c)(2) fraud-data collection organization, DFS notes that currently no organization has been established, yet the plan must still contain a statement committing to comply.

Section 405(a) requires a report to the superintendent within thirty days after determination by the reporting person that the transaction appears to be fraudulent, on a form prescribed by the superintendent. Insurers submit through the Frauds Case Management System on the DFS Portal. The clock does not start at first notice of loss and does not start at the detection flag. It starts when you determine.

DFS's fraud reporting page cites Insurance Law § 405(a) together with Regulation 195 § 6.2(a)(1) as the basis for electronic submission, and an FCMS registration form is required to get access. Consumers and non-licensees use a separate path: the hotline at (888) 372-8369 or the department's online form. No public form number for the insurer report was located, so if a checklist in your compliance manual names one, verify it before relying on it.

Now the structural problem. Because the deadline runs from the carrier's own determination, the safest way to never file a late report is to never reach a determination. A flag that sits in a queue has not been determined. A referral closed for capacity rather than on the evidence has not been determined either. The regulation sets the clock; the carrier sets the start time by deciding when it has enough to decide. That is not a loophole anyone is exploiting deliberately. It is what a capacity-constrained SIU produces by default.

This is where the operational numbers bite. A manual investigation takes 14+ days per case, and a manual investigator completes roughly 10 investigations per month while carrying 200+ open cases. Against a 30-day post-determination window, the binding constraint is not the filing step. It is the time to a defensible determination on every referred claim. Running 15+ investigation phases in parallel compresses that to 2-4 hours per case and lifts coverage from ~25% of flagged claims toward 100%, which is the difference between reporting on the claims you got to and reporting on the claims you flagged. We walk through that arithmetic in how AI agents compress the SIU reporting timeline.

The other clock is the calendar. Section 409(g) requires every insurer that must file a Fraud Prevention Plan to report to the superintendent annually, no later than March 15. The Annual SIU Report covers New York business only for the previous calendar year, is filed through the DFS Portal, and hard copies are not accepted. DFS applies a hard back stop: no submissions or resubmissions are permitted after May 1. The report captures policy counts and premiums written, claims processed and dollars paid, suspicious claims detected by count and dollar value, investigated claims denied or partially paid, SIU referrals and cases opened and closed, savings and recoveries, referrals to law enforcement, SIU costs and investigator resources, civil actions initiated, and public awareness spending. A Rate Evasion Form sits inside the same application.

New York's own numbers show a funnel widening at the top and narrowing at the point of investigation. The Insurance Frauds Bureau received 51,419 reports of suspected insurance fraud in 2025 and opened 243 new investigations. Against 2020, reports are up 70.8% and investigations opened are down 25.0%. That is the state-side view of the same squeeze carriers feel internally.

2023 is omitted deliberately. In both the 2024 and 2025 CPFED reports, the new-investigations-by-category table totals 341 for that year while the summary arrests table shows 387. DFS's own tables disagree, so the trend above is built on the years where they do not.

Two derived figures make the shape concrete. In 2025, 0.47% of suspected-fraud reports became a new IFB investigation, and the state received roughly 141 reports per calendar day. Of the 51,419 reports, about 1,400 came from consumers, businesses, non-profits and anonymous tips; the rest were statutorily required licensee filings. From that volume the bureau made 169 arrests and referred 95 cases to prosecutorial agencies.

None of that means the bureau is failing. It means a funnel behaves like a funnel when the top grows faster than the middle. Part of the mechanical explanation sits upstream: rules-based detection runs a 60-85% false-positive rate, so volume and conversion move independently. A flag is a question, not a finding, which is why the same coverage problem persists at the carrier level - we unpack it in why most flagged insurance claims are never investigated.

Hold the carrier-side counterweight from the same report next to it. For 2024, the most recent year with electronically filed Annual SIU Report data, insurers self-reported roughly $3.5 billion in savings from SIU investigations against roughly $40.3 million in recoveries. Savings in that framing are avoided payments that a documented investigation supported. It is the number the Annual SIU Report exists to collect, and investigation work produces it, not scoring.

Roughly 72% of everything reported to New York's Insurance Frauds Bureau is no-fault automobile fraud: 36,835 reports out of 51,419 in 2025. An antifraud program that is not built for medical-provider billing patterns and staged-collision networks is not built for New York, regardless of how it performs in other states.

The health-lines view sharpens it. DFS's 2025 health insurance fraud report counts 39,676 healthcare-fraud reports, about 77% of all reports received, of which about 93% are no-fault. Accident and health reports total 2,651 and disability reports 190. New York's healthcare-fraud problem is overwhelmingly an auto medical problem wearing a health-lines label.

The April 8, 2026 DFS announcement puts the auto trend on the record: 43,811 motor vehicle insurance fraud incidents reported in 2025 against 24,238 in 2020, an increase of roughly 80% in five years. Acting Superintendent Kaitlin Asrow said combating insurance fraud "takes the full force of state government," and State Police Superintendent Steven G. James said the July 2026 symposium "will serve to enhance our statewide investigatory capacity." The investigatory capacity being enhanced is the state's. The carrier side of the funnel is not on that agenda.

Category-level conversion tells a carrier where its reports actually go. In 2025 the bureau opened 57 no-fault cases against 36,835 no-fault reports, which is 0.15% by derivation. Auto collision damage produced 3,401 reports and 26 cases opened. Workers' compensation produced 541 reports and 20 cases opened. Filing the report discharges the § 405 duty, but it does not produce an investigation. The investigation that matters for the carrier's own loss cost, reserve accuracy and denial defensibility is the one the carrier runs.

There is also a premium-side line item most SIU programs underweight. Appendix 2 of the CPFED report identifies 17,441 New York insureds who misrepresented their vehicle garaging location in 2025, with $50,158,934 in reported premium lost, and 86% of those involved a location within New York. That is rate evasion, filed on the same form as everything else. For the claim-side patterns behind the no-fault volume, see our breakdown of medical mill fraud investigation and our auto claims investigation use case.

Section 409(d)(3) authorizes the superintendent to impose a fine of not more than $2,000 per day for an insurer's failure, running until the superintendent deems the insurer to be in compliance. It accrues daily rather than landing as a single assessment, which means a gap left open across a quarter costs considerably more than the headline number reads.

Keep § 403(c) in its own lane. It provides a civil penalty of up to $5,000 plus the amount of the claim per violation, and it runs against the person who commits the fraudulent insurance act, not against a carrier with a thin plan. Conflating the two overstates carrier exposure and understates the real mechanism, which is examination.

DFS states that it may perform field examinations of insurer SIUs to assess compliance with § 409, other sections of Article 4, and Regulation 95. Examinations sample files. A published example shows how specific the findings get: a DFS targeted market conduct examination of National Income Life Insurance Company, covering the period ending December 31, 2023, cited a Regulation 95 § 86.4(e) violation after sampling 79 claims and finding unapproved fraud-warning language on claim forms - 12% of paid claims, 16% of pending claims, and 48% of resisted claims in the sample.

Section 86.4(e) is a small clause with an outsized citation rate: insurers may use substantially similar warning statements only if those statements are submitted to the Criminal Investigations Unit for prior approval. If your claim forms carry lightly edited wording that was never submitted, that is a finding waiting to be written. The broader lesson is that examinations test artifacts. What survives is a file, not a score, which is why we treat the artifact itself as the deliverable in generating an audit-ready fraud investigation report at speed.

Downstream of the report sits the criminal code, and New York's thresholds are low enough to change how a carrier should think about a padded no-fault claim. Penal Law Article 176 grades insurance fraud by the value wrongfully taken, obtained or withheld.

The $1,000 felony floor is the line to internalize. In New York a padded no-fault claim above $1,000 is already a class E felony. The distance between that legal reality and a funnel where 0.47% of reports become an investigation is not a statement about prosecutors. It is a statement about how much investigative work sits between a filed report and a case anyone can act on.

New York is not an NAIC Model Act 680 clone. The model builds a state fraud bureau and asks insurers for antifraud initiatives; New York prescribes a separate full-time unit, qualification tiers, a filed plan reviewed against 17 sections, a 30-day reporting clock, and a fixed annual report. California prescribes heavily too, but on a different axis and a slower clock.

The headline contrast is the clock. New York gives 30 days from determination; California Insurance Code § 1872.4 gives 60. New York's window is half of California's, and New York's per-carrier volume is more concentrated because of no-fault. The documentation emphasis differs too: California's 10 CCR 2698.36 demands a written investigation summary and a documented reason on every decline, while New York demands a filed description of the machinery plus a timely report. A multi-state carrier owes both. For the section-by-section walkthrough of the California side, read the California 10 CCR 2698 SIU compliance guide, and for the national frame both sit inside, the NAIC Model Act 680 implementation guide.

The compliance floor for automation in New York is set by what DFS asks a carrier to describe: caseload justification in Section 9, vendor contract terms in Section 12, case management, referral evaluation and investigation procedures in Section 13, and § 405 timing throughout. Clear those and an automated investigation layer is describable in a filed plan. Miss them and it is an undocumented dependency.

There is no New York rule specific to AI in claims investigation. Insurance Circular Letter No. 7 (2024), issued July 11, 2024, is expressly scoped to the use of artificial intelligence in underwriting and pricing. It does not reach claims handling or fraud investigation. So an investigation layer in New York is governed by § 409, Regulation 95 and § 405 plus general governance expectations. Even so, the circular letter's third-party framing - audit rights, vendor cooperation with regulatory inquiries, documentation available to the department on request - is a sensible template to hold a vendor to even where it does not bind, and it lines up with what Section 12 already requires of a filed SIU contract.

State the anti-positioning plainly, because New York does. The law requires a real, staffed, full-time SIU separate from underwriting and claims, with investigators who meet the qualification tiers. No software satisfies that requirement, and no vendor should claim it does. An AI investigation layer amplifies that unit: it runs the phases, builds the file, and produces the record. The investigator's role shifts from execution to decision-making, and capacity gets re-aimed at judgment work rather than reduced.

What changes is coverage and cycle time. Hesper runs 15+ investigation phases in parallel on every flagged claim - document forensics, OSINT, statement cross-reference, timeline reconstruction, financial pattern analysis - returning a complete, timestamped file in 2-4 hours instead of 14+ days, at roughly $150 per case against roughly $2,500 manual. Coverage moves from ~25% of flagged claims to 100%, which is what makes a determination on every referral operationally possible rather than aspirational. Every decision is logged with sources, reasoning and timestamps, so the Annual SIU Report statistics on cases opened, closed, denied and referred fall out of the record instead of being reconstructed each February. That is the move from fraud detection to fraud resolution, and in New York it is also the move from a plan that describes a process to a plan whose process leaves evidence.

The layering has to stay honest. FRISS, Shift Technology and Verisk operate upstream, at detection and scoring, and they do that well. Section 13 of the New York filing guidelines even names ISO and DMV as examples of the databases an investigator should be querying, which makes the complementarity concrete: a cross-carrier data source is a listed input to the plan, and the plan still has to describe the investigation performed on top of it. Hesper AI sits downstream of detection and is complementary to FRISS, Shift Technology, and Verisk - not a replacement. New York does not regulate the score. It regulates what happened after the score. Make every flagged claim investigable, and the filing describes work that actually occurred.

For the operating model this fits into, start with how Special Investigation Units run in 2026. For the national picture the New York numbers sit inside - the Coalition Against Insurance Fraud puts US insurance fraud at $308 billion a year, with fraud in roughly 10% of property-casualty losses - see the State of Insurance Fraud 2026 report.