New York Security Deposit Law 2026 — Beyond the NYC Rules

The biggest misconception about New York security deposit law is that it's an NYC rule that varies upstate. It isn't. The 2019 Housing Stability and Tenant Protection Act (HSTPA) capped deposits statewide at one month's rent, set a 14-day return + itemization requirement, and added the interest-bearing account rule for buildings of 6+ units. The rules apply equally in Buffalo, Syracuse, Rochester, the Hudson Valley, and the five boroughs. Here's what actually changed and where landlords keep getting tripped.

One month's rent. Statewide. No exceptions.

NY GOL § 7-103, as amended by HSTPA, caps the security deposit at one month's rent for all residential tenancies in New York State. There is no exception for:

• Furnished units (formerly allowed up to two months).
• Short-term tenancies (formerly negotiable).
• First-time renters or applicants with thin credit history.
• Higher-rent units.
• Co-op or condo rentals.

A pre-HSTPA lease that collects two months' rent as a deposit has been operating in violation since 2019. Tenants can pursue recovery of the excess plus interest. Lease renewals are an opportunity to correct the deposit downward to the statutory cap.

The 14-day return + itemization rule

NY GOL § 7-108 requires the landlord to return the deposit, plus any required interest, within 14 days after the tenant vacates the premises. The return must be accompanied by an itemized statement of any deductions.

Failure to provide the itemized statement within 14 days forfeits the right to retain any portion of the deposit. The tenant is entitled to the full deposit back — even if the apartment was damaged. This is the rule that catches operators who think "we have a year to deal with this." The 14-day clock is strict.

Where the interest rule kicks in

For buildings of six or more units, NY GOL § 7-103 requires the deposit to be held in an interest-bearing account in a New York banking institution. The interest accrues for the tenant and must be paid annually or at the end of the tenancy, less an administrative fee of up to 1% of the deposit annually.

For buildings of five or fewer units, there is no statutory interest requirement, though many co-op and condo agreements include one contractually.

The bank account information — name of the institution, address, and account number — must be disclosed to the tenant in writing. Failure to disclose does not void the right to deduct (a common misconception), but it can support a bad-faith finding in a deposit dispute.

Bad-faith withholding and the doubled-deposit remedy

NY GOL § 7-108 provides that a landlord who wrongfully retains a deposit is liable for up to twice the amount of the deposit. Combined with the 14-day forfeiture rule for missing itemizations, this means a $2,400 wrongfully withheld deposit can become a $4,800 exposure plus attorney's fees.

"Bad faith" in New York courts includes:

• Failing to send the itemized statement at all.
• Itemizing damages without supporting documentation when challenged.
• Deducting for items the lease did not authorize.
• Holding the deposit past the 14-day window without explanation.

What about the "last month's rent" charge?

A long-standing operator workaround was to collect a separate "last month's rent" payment at move-in alongside the security deposit. HSTPA closed this loophole in many configurations: a landlord cannot collect more than the equivalent of one month's rent + one month's rent advance as a deposit. The "advance rent" must be applied to the actual final month, not retained as a deposit substitute.

Practical implication: a one-month deposit + one month's advance rent at move-in is the upper limit. Any combination that effectively exceeds two months' rent at move-in violates the cap.

The "trust account" question

Outside of the 6+ unit interest-bearing rule, New York does not require deposits to be held in a designated trust account. They can be commingled with operating funds — though Massachusetts-style trust account rules are increasingly common as best practice and some local ordinances (NYC for stabilized units, Co-op City, certain other configurations) add additional rules.

For most New York operators, the practical compliance path is:

1. Open a separate "deposits" account at any bank — interest-bearing for 6+ unit buildings, non-interest-bearing acceptable for smaller buildings.
2. Disclose the account in writing to the tenant within a reasonable time of collecting the deposit.
3. Use the same account for every tenant's deposit, separated by ledger entries.
4. Pay any accrued interest annually for 6+ unit buildings.

Upstate exemptions and special configurations

HSTPA did not create exemptions for upstate or rural rentals. The same one-month cap, 14-day return, and itemization rule applies in Albany, Plattsburgh, and Watertown as in Brooklyn.

Where you find variation:

• Rent-stabilized units (NYC and ETPA-opted-in towns: Newburgh, Kingston, Poughkeepsie, etc.) follow rent-stabilization deposit rules, which mirror but slightly differ from the general HSTPA framework. The DHCR is the authority for stabilized units.
• Co-op rentals governed by board approval often have separate "move-in fees" charged by the co-op board — these are not the security deposit and are not subject to GOL § 7-103.
• Public housing has separate federal rules.

The general rule for non-stabilized, market-rate rentals across New York State is the one-month cap, 14-day return, and itemization requirement, regardless of geography.

Compliance checklist

For every New York rental:

1. Cap the deposit at one month's rent, period. Re-check on renewal.
2. Interest-bearing account if the building has 6+ units. Disclose the bank to the tenant in writing.
3. Move-in inspection with photographs and a signed condition report. Same at move-out.
4. Written itemized statement of any deductions, mailed within 14 days of the tenant vacating.
5. Documented mailing to the forwarding address (or last known address if no forwarding was provided).
6. Annual interest payment (or credit to rent) for 6+ unit buildings.

How Proprietio handles New York deposits

Proprietio's New York-tier lease template caps the deposit at the statutory one month and prompts for the 6+ unit interest-bearing disclosure when applicable. The 14-day return clock is tracked from move-out and the itemized statement template prompts for the specific deduction categories that survive HSTPA scrutiny. For rent-stabilized units, the workflow distinguishes between free-market and stabilized rules and pulls the current DHCR guidance into the renewal flow.

HSTPA didn't make New York deposit law easier — it made it more consistent. The same rules now apply whether you're operating one unit in Watertown or thirty in Brooklyn. The compliance discipline is the same; the geography excuse is gone.