CFTC Staff Advisory on Use of AI in CFTC-Regulated Markets

2
CFTC Letter No. 24-17 Advisories December 05, 2024 and potential AI use cases in the derivatives markets. This Advisory is informed by the public comments received in response to Staff’s January 25, 2024 Request for Comment on AI 5 (“AI RFC”); engagement with market participants, industry stakeholders, and U.S. financial regulators; 6 ongoing work by the Chairman’s AI Task Force; 7 guidance issued by the White House; 8 Staff’s review of materials provided by the CFTC’s Market Risk Advisory Committee and the Technology Advisory Committee; 9 and consideration of best practices. Staff is aware that AI technology is rapidly evolving. Such changes could lead the Divisions to reevaluate this Advisory, develop future Staff guidance, and/or recommend that the Commission propose new regulations.
I. AI and the CEA and CFTC Regulations
Staff sets out below certain requirements under the CEA and CFTC regulations that could be implicated by potential AI uses and risks. Staff reiterates that the discussion of such statutory and regulatory requirements is neither exhaustive nor definitive, and that CFTC-regulated entities must maintain compliance with applicable requirements whether they choose to deploy AI or any other technology, either directly or by a third-party service provider. Staff expects that CFTC-regulated entities will assess the risks of using AI and update policies, procedures, controls, and systems, as appropriate, under applicable CFTC statutory and regulatory requirements. In addition, as with all material system or process changes, a CFTC-regulated entity should ensure that its adoption of AI has been reviewed for compliance with the CEA and CFTC regulations. This Advisory is not a compliance checklist or substitute for appropriate risk assessments or governance by a CFTC-regulated entity. Rather, the Advisory provides a non-exhaustive list of existing statutory and regulatory requirements that may be potentially implicated by CFTC￾regulated entities’ use of AI. A. DCMs, SEFs, and SDRs DCMs, SEFs and SDRs must continue to comply with all applicable CEA and regulatory requirements, even as these entities begin to implement AI as part of normal business practices. Applicable requirements include, but are not limited to, requirements relating 5 Request for comment on Artificial Intelligence available at:
https://www.cftc.gov/PressRoom/PressReleases/8853-24; Comments received available at:
https://comments.cftc.gov/PublicComments/CommentList.aspx?id=7479.
6 See, e.g., Treasury Department, Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector, 89 Fed. Reg. 50048, (June 12, 2024). 7 See Rostin Behnam, Chairman, CFTC, Keynote Speech at 2023 U.S. Treasury Market Conference (Nov. 16, 2023), available at https://www.cftc.gov/PressRoom/SpeechesTestimony/opabehnam39 (announcing the formation of the Chairman’s AI Task Force). 8 Executive Office of the President, Executive Order on the Safe, Secure and Trustworthy Development and Use of Artificial Intelligence, Oct. 30, 2023, 88 Fed. Reg. 75191 (Nov. 1, 2023). See also White House Office of Science and Technology Policy, Blueprint for an AI Bill of Rights, Oct. 2022. 9 See, e.g., Market Risk Advisory Committee, Transcript of Meeting on Apr. 9, 2024, available at https://www.cftc.gov/PressRoom/Events/opaeventmrac040924; and Subcommittee on Emerging and Evolving Technologies of the CFTC Technology Advisory Committee, Responsible Artificial Intelligence in Financial Markets: Opportunities, Risks and Recommendations, available at https://www.cftc.gov/PressRoom/PressReleases/8905-24.

3
CFTC Letter No. 24-17 Advisories December 05, 2024 to:
Order Processing and Trade Matching – Staff anticipates potential use cases for AI in the order processing and trade matching function, particularly as it relates to the preparation of message data at the time of execution. For example, a DCM may leverage the analytic and predictive capabilities of AI to anticipate trades before they happen, for the purposes of allocating system resources in advance to optimize those resources and reduce post￾trade message latencies. DCMs must continue to provide competitive, open, and efficient markets and mechanisms for executing transactions that protect the price discovery process of trading in the centralized market of the DCM, irrespective of their use of AI, consistent with Core Principle 9 for DCMs. 10 Market Surveillance – Staff anticipates potential use cases for AI in the market regulatory function, including detection of abusive trading practices, investigation of rule violations, and real-time market monitoring. For example, a DCM or SEF may leverage the analytic capabilities of AI to identify instances of abusive trading practices, including front￾running, wash trading, pre-arranged trading, fraudulent trading, money passes, and other trading practices that the DCM or SEF deems to be abusive. A DCM or SEF may, as appropriate, also leverage AI to improve the detecting and flagging of specific trade execution patterns and trade anomalies, as part of its automated trade surveillance system. Staff reminds DCMs and SEFs of their responsibility to maintain compliance staff and resources sufficient to conduct effective audit trail reviews, trade practice surveillance, market surveillance, and real-time market monitoring, consistent with Core Principles 2, 4, and 12 for DCMs and Core Principles 2, 3, and 4 for SEFs. System Safeguards – Staff anticipates that certain registered entities will develop AI solutions internally, while others will procure AI-based products and services from a third party. In both instances, Staff expects that DCMs, SEFs, and SDRs will follow generally accepted standards and best practices with respect to the development, operation, reliability, security, and capacity of the AI system, consistent with the requirements of Core Principle 20 for DCMs, Core Principle 14 for SEFs, and § 49.24 for SDRs. In particular, DCMs, SEFs, and SDRs should continue to develop and maintain appropriate controls across all seven categories of risk, analysis and oversight that could be implicated by the use of AI, including: enterprise risk management and governance, information security, business continuity and disaster recovery planning and resources, capacity and performance planning, systems operations, systems development and quality assurance, and physical security and environmental controls. 11 Additionally, Staff reminds DCMs, SEFs, and SDRs of their responsibility to give Staff timely advance notice of all material planned changes to automated systems that may impact the reliability, security,
or adequate scalable capacity of such systems. 12 10 7 U.S.C. 7(d)(9). 11 DCMs must develop and maintain a program of risk analysis and oversight with respect to their operations and automated systems that addresses these seven categories, pursuant to § 38.1051(a); SEFs pursuant to § 37.1401(1); SDRs pursuant to § 49.24(b). 12 DCMs pursuant to § 38.1051(f)(1); SEFs pursuant to § 37.1401(f)(1); and SDRs pursuant to § 49.24(h)(1).

4
CFTC Letter No. 24-17 Advisories December 05, 2024 B. DCOs DCOs that use AI must continue to comply with all applicable regulatory requirements, including relevant provisions of the CEA and CFTC regulations. Staff anticipates that some DCOs will develop AI solutions internally, while others will procure AI-based products and services from a third party. In both instances, DCOs must follow generally accepted standards and industry best practices with respect to the development, operation, reliability, security, and capacity of the automated systems that are using AI technology, consistent with the requirements of Core Principle I, System Safeguards. Use of AI may implicate various scenarios, including but not limited to:
System Safeguards – Staff expects that some DCOs may use AI to support the detection and/or response to cyber intrusions, in addition to identifying cyber vulnerabilities and hardening defenses. Some DCOs may also use AI as a tool to evaluate and/or update legacy and new computer code. DCOs may benefit from considering how the introduction of AI could impact, positively or negatively, the functionality, reliability, and resilience of computer systems relied upon by DCOs to accomplish the DCOs’ core functions. Staff reminds DCOs that Core Principle B, concerning the collateral that will be used to meet the financial resource requirements, Core Principle D, concerning risk management activities, and Core Principle I, concerning system safeguards and operational risk, continue to apply in the event that DCOs use AI. These core principles and their related regulations apply even if a DCO relies upon a third-party service provider for the provision of the AI. Regulation 39.18(d)(2) makes explicit that a DCO retains responsibility in the event of outsourcing. Additionally, DCOs must give Staff prompt advance notice of all material planned changes to automated systems that may impact the reliability, security, or capacity of automated systems and all materials changes to the DCO’s program of risk analysis and oversight. 13 Member Assessment and Interaction – A DCO might utilize AI in connection with the review of its clearing members’ compliance with DCO rules, and to support communications with its members on any number of topics. AI chatbots may have access to external or internal datasets, including datasets comprised of member information. In addition, the use of AI for member assessment and interaction could become even more prominent in the case of non-intermediated clearing. Staff reminds DCOs that Core Principle C, concerning participant admission and continuing eligibility; and Core Principle D, concerning monitoring credit exposure from the perspective of the DCO to its members, continues to apply to DCOs. Settlement – Staff also recognizes that AI might be used to support DCO settlement. DCOs may use AI to facilitate netting or offset of positions as the AI works to validate data, mine data anomalies prior to settlement, or identify failed trades. Staff reminds 13 §39.18(h)(1); § 39.18(h)(2).

5
CFTC Letter No. 24-17 Advisories December 05, 2024 DCOs that Core Principle E, concerning the timely completion of settlement, the limitation to exposure of the DCO to settlement bank risks, and the ability to permit netting or offset arrangements, continues to apply to DCOs.
C. FCMs, SDs, CPOs, CTAs, IBs, RFEDs and Associated Persons
Although not exhaustive, Staff identifies examples in the following areas where it expects that AI may be used and reminds registrants that the CEA and CFTC regulations continue to apply. Risk Assessment and Risk Management – Staff expects that registrants may utilize AI for, among other things, the calculation and collection of initial and variation margin for uncleared swaps. An SD that uses AI to assist in the collection of initial margin pursuant to § 23.152, 14 for example, would still be required to confirm the adequate performance of such a system to ensure that risk is properly managed consistent with CFTC regulations. Compliance and Recordkeeping – Staff monitors registrants for their compliance with a broad array of Commission regulations, including recordkeeping, disclosure, and financial reporting, among others. Staff recognizes that AI may support the accuracy and timeliness of financial information and risk disclosures that are provided to the Commission, National Futures Association, and the registrant’s customers. Staff reminds registrants that they remain responsible for ensuring that such information and disclosures are compliant with the applicable statutory and regulatory requirements. For example, a CPO that used generative AI to update a disclosure document or prepare periodic account statements for a commodity pool would still be subject to all the requirements of Part 4 of the Commission’s regulations. 15 Customer Protection – A significant portion of CFTC regulations applicable to registrants are related to customer protection. For example, FCMs are required, under the CEA and CFTC regulations, to properly segregate customer funds, 16 which is a fundamental component of customer protection thereunder. Staff reminds FCMs that may consider the use of AI to account for segregated funds would still be required to ensure that, among other things, all of the requirements of Part 1 of the CFTC’s regulations 17 are being met.
II. Staff Monitoring of AI Developments in CFTC-Regulated Markets
Staff values its ongoing dialogue with CFTC-regulated entities and encourages them to engage with Staff when considering any changes to risks that may arise with the deployment of AI use cases. Staff may also incorporate AI as a topic of discussion in its routine oversight activities such as examinations. Staff will also continue to evaluate the need for future regulation, guidance, or other Commission or Staff action. 18

14 17 CFR 23.152.
15 17 CFR Part 4.
16 See, 7 U.S.C. 6d(a)(2); 17 CFR 1.20.
17 17 CFR Part 1.
18 For example, such dialogue helped facilitate efforts such as this Advisory, and the Office of Customer Education and Outreach’s (OCEO’s) Customer Advisory, which warns the public about AI-driven fraud and

6
CFTC Letter No. 24-17 Advisories December 05, 2024 * This Advisory is intended to remind the affected parties of their obligations under the Act and CFTC regulations. It is not intended to create any enforceable rights, any new binding rules or regulations, or to amend existing rules or regulations. This Advisory represents only the views of the Divisions and does not necessarily represent the views of the Commission or of any other division or office of the Commission. Any questions regarding this advisory should be directed to Clark Hutchison at 202-418- 6070; Ted Kaouk at 202-418-5747; Vincent McGonagle at 202-418-5387; or Amanda Olear at 202-418-6700. CLARK HUTCHISON DIRECTOR DIVISION OF CLEARING AND RISK TED KAOUK DIRECTOR DIVISION OF DATA VINCENT MCGONAGLE DIRECTOR DIVISION OF MARKET OVERSIGHT AMANDA L. OLEAR DIRECTOR MARKET PARTICIPANTS DIVISION scams. See Press Release Number 8854-24, CFTC, CFTC Customer Advisory Cautions the Public to Beware of Artificial Intelligence Scams (Jan. 25, 2024), available at https://www.cftc.gov/PressRoom/PressReleases/8854-24.