Regulation Automated Trading

Federal RegisterNov 25, 2016

Ask Donna

What actually matters in this document.

Text

COMMODITY FUTURES TRADING COMMISSION

17 CFR Parts 1, 38, 40, and 170

RIN 3038-AD52

Regulation Automated Trading

AGENCY:

Commodity Futures Trading Commission.

ACTION:

Supplemental notice of proposed rulemaking.

SUMMARY:

On December 17, 2015, the Commodity Futures Trading Commission (“CFTC” or “Commission”) published in the

Federal Register

a notice of proposed rulemaking (“NPRM”) proposing a series of risk controls, transparency measures, and other safeguards to enhance the safety and soundness of automated trading on all designated contract markets (“DCMs”) (collectively, “Regulation Automated Trading” or “Regulation AT”). Through this supplemental notice of proposed rulemaking for Regulation AT (“Supplemental NPRM”), the Commission is proposing to modify certain rules set forth in the NPRM. Any new or amended rules proposed in this Supplemental NPRM reflect only those areas where the Commission believes that additional notice and comment may be appropriate before enacting final rules. Procedurally, this Supplemental NPRM is

not

a replacement or withdrawal of rules proposed in the NPRM. Unless specifically amended herein, all regulatory text proposed in the NPRM remains under active consideration for adoption as final rules. The Commission welcomes public comment on all aspects of the Supplemental NPRM.

DATES:

Comments must be received on or before January 24, 2017.

ADDRESSES:

You may submit comments, identified by RIN 3038-AD52, by any of the following methods:

•

CFTC Web site: http://comments.cftc.gov

. Follow the instructions for submitting comments through the Comments Online process on the Web site.

•

Mail:

Send to Christopher Kirkpatrick, Secretary of the Commission, Commodity Futures Trading Commission, Three Lafayette Centre, 1155 21st Street NW., Washington, DC 20581.

•

Hand Delivery/Courier:

Same as Mail, above.

•

Federal eRulemaking Portal: http://www.regulations.gov

. Follow the instructions for submitting comments.

Please submit comments by only one method. All comments should be submitted in English or accompanied by an English translation. Comments will be posted as received to

http://www.cftc.gov

. You should submit only information that you wish to make available publicly. If you wish the Commission to consider information that may be exempt from disclosure under the Freedom of Information Act (“FOIA”), a petition for confidential treatment of the exempt information may be submitted according to the procedures established in 17 CFR 145.9. The Commission reserves the right, but shall have no obligation, to review, prescreen, filter, redact, refuse, or remove any or all of your submission from

http://www.cftc.gov

that it may deem to be inappropriate for publication, such as obscene language. All submissions that have been so treated that contain comments on the merits of the rulemaking will be retained in the public comment file and will be considered as required under the Administrative Procedure Act and other applicable laws, and may be accessible under FOIA.

FOR FURTHER INFORMATION CONTACT:

Sebastian Pujol Schott, Associate Director, Division of Market Oversight,

sps@cftc.gov

or 202-418-5641; Marilee Dahlman, Special Counsel, Division of Market Oversight,

mdahlman@cftc.gov

or 202-418-5264; Joseph Otchin, Special Counsel, Division of Market Oversight,

jotchin@cftc.gov

or 202-418-5623; Andrew Ridenour, Special Counsel, Division of Market Oversight,

aridenour@cftc.gov

or 202-418-5438; Brian Robinson, Special Counsel, Division of Market Oversight,

brobinson@CFTC.gov

or 202-418-5385; Michael Penick, Economist, Office of the Chief Economist,

mpenick@cftc.gov

or 202-418-5279; Richard Haynes, Economist, Office of the Chief Economist,

rhaynes@cftc.gov

or 202-418-5063; Carlin Metzger, Trial Attorney, Division of Enforcement,

cmetzger@cftc.gov

or 312-596-0536; or John Dunfee, Assistant General Counsel, Office of General Counsel,

jdunfee@cftc.gov

or 202-418-5396.

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Introduction: The NPRM and Supplemental NPRM for Regulation AT

A. Basic Structure of Regulation AT: The NPRM and the Supplemental NPRM

B. Opportunities for Public Comment on NPRM Proposals During Two Public Comment Periods and Public Staff Roundtable

C. Overview of Comments Received

II. AT Person Status and Requirements for AT Persons

A. Overview and Policy Rationale for New Proposal

B. NPRM Proposal and Comments

C. Substance of New Proposal

1. Volume Threshold Test for AT Persons

2. Registration as a Floor Trader

3. Anti-Evasion

4. Registration for Membership With a Registered Futures Association

D. Commission Questions

III. Proposed Definition of DEA

A. Overview and Policy Rationale for New Proposal

B. NPRM Proposal and Comments

C. Substance of New Proposal

D. Commission Questions

IV. Algorithmic Trading Source Code Retention and Inspection Requirements

A. Overview and Policy Rationale for New Proposal

B. NPRM Proposal and Comments

C. Substance of New Proposal

D. Commission Questions

V. Testing, Monitoring and Recordkeeping Requirements in the Context of Third-Party Providers

A. Overview and Policy Rationale for New Proposal

B. NPRM Proposal and Comments

C. Substance of New Proposal

D. Commission Questions

VI. Changes to Overall Risk Control Framework

A. Change From Three Level to Two Level Risk Control Framework

1. Overview and Policy Rationale for Proposal

2. NPRM Proposal and Comments

3. Substance of New Proposal

4. Commission Questions

B. Electronic Trading at the AT Person, FCM, and DCM Levels

1. Overview and Policy Rationale for New Proposal

2. NPRM Proposal and Comments

3. Substance of New Proposal

4. Commission Questions

C. New and Revised Definitions; Change from “Clearing Member” to “Executing” FCMs

1. Overview and Policy Rationale for New Proposal

2. NPRM Proposal and Comments

3. Substance of New Proposal

4. Commission Questions

D. AT Person Delegation to FCM

1. Overview and Policy Rationale for New Proposal

2. NPRM Proposal and Comments

3. Substance of New Proposal

4. Commission Questions

VII. Reporting and Recordkeeping Obligations

A. Overview and Policy Rationale for New Proposal

B. NPRM Proposal and Comments

C. Substance of New Proposal

D. Commission Questions

VIII. Additional Changes to NPRM Proposed Rules Under Consideration

A. Commission Questions

IX. Related Matters

A. Cost-Benefit Considerations

1. The Statutory Requirement for the Commission To Consider the Costs and Benefits of Its Actions

2. Comments Regarding Costs and Benefits of Regulation AT

3. The Commission's Cost-Benefit Consideration of Regulation AT—Baseline Point

4. The Commission's Cost-Benefit Consideration of Regulation AT—Cross-Border Effects

5. Introduction: The NPRM and Supplemental NPRM for Regulation AT

6. Proposed New Definitions and Changes to NPRM Proposed Definitions

7. Requirements for AT Persons

8. Source Code Retention and Inspection Requirements

9. Testing, Monitoring and Recordkeeping Requirements in the Context of Third-Party Providers

10. Changes to Overall Risk Control Framework

11. Reporting, Testing and Recordkeeping Requirements

12. Section 15(a) Factors

B. Regulatory Flexibility Act

1. A Description, and, Where Feasible, an Estimate of the Number of Small Entities to Which the Proposed Rules Will Apply.

2. A Description of the Projected Reporting, Recordkeeping, and Other Compliance Requirements of the Rules, Including an Estimate of the Classes of Small Entities Which Will Be Subject to the Requirements and the Type of Professional Skills Necessary for Preparation of the Report or Record.

C. Paperwork Reduction Act

1. § 1.3(x)(1)(iii)—Submissions by Newly Registered Floor Traders

2. § 1.80(d) Pre-Trade Risk Controls for AT Persons—Delegation

3. § 1.83(a)—AT Person Retention and Production of Books and Records

4. § 1.83(b)—Executing FCM Retention and Production of Books and Records

5. § 1.84—Retention, Production and Confidentiality of Algorithmic Trading Records

6. § 1.85—Third-Party Algorithmic Trading Systems or Components

7. § 38.255(c) Risk Controls for Trading—FCM Certification to DCM

8. § 40.22(a)-(c)—Compliance With DCM Reviews

9. § 40.22(d) Certification Requirement

10. Commission Questions

I. Introduction: The NPRM and Supplemental NPRM for Regulation AT

Regulation Automated Trading is a comprehensive Commission effort to reduce risk and increase transparency in algorithmic order origination and electronic trade execution on all U.S. futures exchanges. The proposed rules, both in the NPRM and the Supplemental NPRM, modernize the Commission's regulatory regime, promote the safety and soundness of trading on all contract markets, and seek to keep pace with evolving technologies. This Supplemental NPRM builds on the Commission's December 2015 NPRM for Regulation AT,

and is a continuation of the underlying policies and objectives reflected therein. The Supplemental NPRM responds to persuasive public comments to help ensure appropriate final rules for Regulation AT.

Regulation Automated Trading, Proposed Rule, 80 FR 78824 (Dec. 17, 2015) (hereinafter “NPRM”).

Sections I-III of the NPRM provided a fulsome discussion of the policy considerations, market events, existing best practices, and procedural history that informed the Commission's development of Regulation AT. The Commission explained that “the basic structure of [open-outcry trading] remained constant for decades, and produced a parallel regulatory framework also premised on natural persons and human decision-making speeds.”

See

NPRM at 78825. It contrasted now-obsolete manual processes against the “wide array of electronic systems for the generation, transmission, management, and execution of orders” used today by DCMs and DCM market participants, including high-speed communication networks to confirm transactions, communicate market data, and link markets and market participants.

See id.

The Commission provided information indicating that over 95% of all on-exchange futures trading was electronic by 2014, with many exchanges having closed their open-outcry trading pits well before then. It also indicated that by 2014, ATSs were present on at least one side of almost 80% of trading volume in some asset classes. The Commission noted that “[t]he largely complete transition of DCMs to electronic trade matching platforms has occurred alongside an equally important shift in the technologies used by market participants to place and manage orders.” These include ATSs, high-speed communication networks, and the use of direct access and colocation services to “minimize latencies between ATS, market data systems, and DCMs' electronic trading platform[s].”

See

NPRM at 78826.

The Commission explained that “an overarching goal” of Regulation AT is to update its rules in response to the evolution from pit to electronic trading, including by focusing on “algorithmic order origination or routing by market participants, and electronic trade execution by DCMs.” It also observed that “[m]arket participants using automated trading include an important population of proprietary traders that, while responsible for significant volume and liquidity in key futures products, are not registered with the Commission.” The Commission emphasized that Regulation AT is focused on the “automation of order generation, transmission, and execution, and the risks that may arise from such activity.” It identified “appropriate pre-trade and other risk controls” as an important element in “ensur[ing] the integrity of Commission-regulated markets” and fostering market participants' confidence in the transactions being executed.

See

NPRM at 78827-78828.

The Commission also summarized the broad array of resources that it consulted in preparing the NPRM for Regulation AT, including “industry practices, measures taken by other U.S. and foreign regulators, and best practices or guidance set forth by other informed parties.” It noted the “emerging consensus around pre-trade risk controls for automated trading and supervision standards for ATSs.” Finally, the Commission emphasized that “Regulation AT attempts to balance flexibility in a rapidly changing technological landscape with the need for a regulatory baseline that provides a robust and sufficiently clear standard for pre-trade risk controls, supervision standards, and other safeguards for automated trading environments.”

See

NPRM at 78828. This Supplemental NPRM continues to build on the policy determinations and regulatory objectives set forth in the NPRM for Regulation AT.

Procedurally, the Supplemental NPRM is a continuation of the NPRM. All rules in the NPRM remain under consideration as originally proposed unless specifically modified in the proposed rule text in this Supplemental NPRM.

Accordingly, this Supplemental NPRM begins with an overview of Regulation AT across the NPRM and the Supplemental NPRM (Section I(A)). It continues with a summary of the opportunities for public comment provided by the Commission (Section I(B)), and an overview of the comments received (Section I(C)). Sections II through VII discuss specific proposed rules in the Supplemental NPRM that add to, remove, or otherwise amend the Commission's original proposals in the NPRM. Sections II through VII also provide a summary of the comments and policy considerations that led to the Commission's new or amended proposals. Section VIII provides preamble discussion and seeks comment regarding additional areas where the Commission's final rules for Regulation AT may amend the NPRM. However, such potential amendments are not included as proposed regulatory text in this Supplemental NPRM. The Commission believes that the further amendments under consideration do not impact new parties, create new obligations, or otherwise increase burdens. Section IX includes the Commission's Paperwork Reduction Act, Regulatory Flexibility Act, and Cost-Benefit discussions for the regulatory text proposed herein. Finally, the Commission presents the proposed new or modified regulatory text following the end of the preamble. Any sections or paragraphs marked as “Reserved” are not addressed in this Supplemental NPRM. The provisions proposed for such sections or paragraphs in the NPRM are unchanged from that document and remain under active consideration by the Commission. (Note, however, that proposed reserved § 1.3(aaaaa) is not the subject of either this Supplemental NPRM or the NPRM. That definitions paragraph is the subject of another pending unrelated Commission rulemaking proposal.) Please note also that the provisions proposed in the NPRM for §§ 38.401 and 40.1(i), and for Appendix B to part 38, are not shown as reserved in this Supplemental NPRM for technical reasons. Nonetheless, the provisions proposed in the NPRM for those two sections and that appendix are unchanged and remain under active consideration by the Commission.

The Commission's new proposed regulatory text is presented in this document following the end of the preamble.

A. Basic Structure of Regulation AT: The NPRM and the Supplemental NPRM

The basic structure of Regulation Automated Trading is set forth in the NPRM, and remains largely intact. However, through this Supplemental NPRM, the Commission is proposing certain changes to Regulation AT to address comments received in response to the NPRM and during a day-long staff roundtable on Regulation AT held in June 2016. This Section I(A) provides an overview of Regulation AT by summarizing several of the principal changes that the Supplemental NPRM proposes to make to the NPRM.

First, Regulation AT would require pre-trade risk controls and other measures for the Algorithmic Trading of AT Person customers in order to promote the continued safety and soundness of Commission-regulated markets. In the NPRM, the Commission proposed placing such risk controls at three levels: The AT Person, the FCM and the DCM. Many commenters asserted that a three-layer structure could be redundant and costly, and some indicated that a two-level structure would be preferable. After careful consideration, the Commission is proposing to move Regulation AT from a three-level risk control structure to a modified two-level structure, with risk controls set at the levels of (1) the AT Person

its FCM; and (2) the DCM. Under the two-level structure proposed in the Supplemental NPRM, an AT Person would have the option of delegating its pre-trade risk control requirements to an FCM rather than implementing its own controls.

“AT Person” is defined in proposed § 1.3(xxxx) of the NPRM, and includes existing Commission registrants engaged in “Algorithmic Trading” on a DCM, as well as market participants required to register as floor traders pursuant to proposed § 1.3(x)(3) of the NPRM. Algorithmic Trading is defined in proposed § 1.3(zzzz) of the NPRM. Electronic Trading is defined in Supplemental NPRM in proposed § 1.3(ddddd).

Second, the NPRM proposed requiring risk controls only with respect to the Algorithmic Trading of AT Persons. In contrast, the Supplemental NPRM addresses not only Algorithmic Trading, but also Electronic Trading at the AT Person, FCM, and DCM levels. The Commission's amended proposal is consistent with comments stating that all electronic trading—not just the narrower set of Algorithmic Trading—should pass through pre-trade risk controls.

Third, in the NPRM, the Commission proposed requiring that pre-trade risk controls be set at the level of each AT Person or market participant, or other more granular levels as the AT Person, FCM or DCM determined appropriate. The Supplemental NPRM responds to comments that it may not be efficient or possible for DCMs and FCMs to set controls at the level of individual market participants. Accordingly, in the Supplemental NPRM, the Commission revises the risk control provisions to provide AT Persons, FCMs and DCMs greater flexibility regarding the level at which pre-trade controls must be set.

Fourth, Regulation AT would require the registration of certain market participants who are not already registered with the Commission. Such market participants would be required to register as “floor traders,” as defined in the Supplemental NPRM in proposed § 1.3(x)(1)(iii) (“New Floor Traders”), and would also be required to become members of a registered futures association (“RFA”). Together with certain existing registrants, New Floor Traders would be considered AT Persons and be subject to all relevant requirements of Regulation AT. Pursuant to the NPRM, the proposed registration criteria for New Floor Traders

were that such persons be engaged in (1) proprietary, (2) Algorithmic Trading (3) through Direct Electronic Access (“DEA”) on a DCM. The Supplemental NPRM retains these requirements but also incorporates a volume-based quantitative test for registration as a New Floor Trader. This amendment responds to concerns that the NPRM would have imposed registration and its consequent obligations on too large a population of market participants. The Commission also proposes to apply this same volume-based quantitative test to existing registrants and persons otherwise required to register with the Commission to determine whether they are AT Persons.

For purposes of this Supplemental NPRM, registrants under Supplemental proposed § 1.3(x)(1)(iii) are deemed “New Floor Traders.”

To be considered AT Persons, existing registrants and persons otherwise required to register with the Commission must be engaged in Algorithmic Trading on our subject to the rules of a DCM. Unlike for New Floor Traders, however, direct electronic access is not a relevant consideration for existing registrants and persons otherwise required to register with the Commission (

e.g.,

FCMs, floor brokers, swap dealers, major swap participants, commodity pool operators, commodity trading advisors, and introducing brokers).

The Commission estimates that its proposed volume-based criteria would result in approximately 120 AT Persons, including some of who are already registered with the Commission in some capacity. This stands in contrast to some commenters' estimates that the NPRM could have required thousands of persons to register. While any volume-based metric has limitations, the Commission believes that this is the best way to focus the registration-related obligations on the appropriate class of persons. This approach, coupled with other changes in the Supplemental NPRM regarding the obligations of AT Persons as discussed below, also addresses many of the concerns expressed about the NPRM registration requirement.

Fifth, in the NPRM, the Commission proposed requiring that AT Persons provide the DCMs on which they operate with annual reports containing information on the AT Persons' compliance with requirements concerning risk controls. The NPRM further would have required DCMs to establish a program for effective review and evaluation of the reports. The Commission received comments that the proposed reporting requirements were overly burdensome and would provide little benefit in mitigating the risks of Algorithmic Trading. In the Supplemental NPRM, the Commission proposes replacing the annual compliance report requirement for AT Persons with a streamlined annual certification requirement. The Commission also proposes to retain certain recordkeeping requirements, as well as the requirement that DCMs establish a program for effective periodic review and evaluation of AT Persons' compliance with elements of Regulation AT. Similarly, the NPRM imposed annual reporting requirements on FCMs and required DCMs to review these reports. The Supplemental NPRM also replaces the annual reporting obligations for FCMs with a certification requirement, and also retains the requirement that FCMs maintain certain records. As with AT Persons, the Supplemental NPRM requires DCMs to establish a program for effective periodic review and evaluation of FCMs' compliance with Regulation AT.

Sixth, Regulation AT requires that algorithmic trading source code be preserved and made available to the Commission when necessary.

The NPRM required that AT Persons maintain a “source code repository” and make it available for inspection in accordance with the Commission's general recordkeeping requirements. These provisions provoked extensive

comments. Notably, commenters may have misunderstood the Commission's intent, which was never to require that all source code to be provided routinely to a Commission or third-party repository. The Supplemental NPRM acknowledges the concerns regarding the confidentiality and proprietary value of Algorithmic Trading Source Code and revises these provisions extensively. While Algorithmic Trading Source Code and related records are still required to be preserved, they are not subject to the Commission's general recordkeeping provisions. Instead, preservation and access obligations are set forth in new provisions in the Supplemental NPRM that reflect market participants' concerns. The Supplemental NPRM provides that the Commission would have access to Algorithmic Trading Source Code and related records only via a subpoena or a special call approved by the Commission itself, not by staff, and that any such access would be subject to policies and procedures to protect confidentiality.

“Algorithmic Trading Source Code” is defined in Supplemental proposed § 1.3(ccccc). The Commission notes that source code was not defined in the NPRM. In this Supplemental NPRM, the Commission uses “source code” in connection with its proposal in the NPRM, and uses the term “Algorithmic Trading Source Code” when referring to Supplemental proposed § 1.3(ccccc).

Seventh, the Supplemental NPRM discusses a number of changes to certain defined terms proposed in the NPRM, as well as other provisions that the Commission is considering in response to comments from market participants. These include limiting the scope of “Algorithmic Trading Compliance Issue,” “Algorithmic Trading Disruption,” and “Algorithmic Trading Event.”

Eighth, Regulation AT includes a number of additional rules focused specifically on DCMs. As reflected in the NPRM, these proposals include: (1) Greater transparency around DCMs' electronic trade matching platforms and (2) promoting the use of self-trade prevention tools.

The Commission is contemplating deferring further consideration of such provisions to a second phase of rules to be finalized at a later date. The Commission seeks comments regarding deferral of these two provisions to a later date.

The NPRM proposed amendments to existing § 38.255, to require DCMs to have in place systems reasonably designed to facilitate the FCM's management of the risks that may arise from their customers' Algorithmic Trading using DEA. Regulation AT would also amend existing § 38.401(a) to require DCMs to provide additional public disclosure regarding their electronic matching platforms. In part 40, the NPRM proposed the following new regulations: § 40.20—requiring DCMs to implement pre-trade risk controls and other related measures; § 40.21—requiring DCMs to provide a test environment to AT Persons; § 40.22—requiring DCMs to implement a review program for compliance reports regarding Algorithmic Trading submitted by AT Persons and clearing member FCMs, require that certain books and records be maintained by such persons, and review such books and records as necessary; § 40.23—requiring DCMs to implement self-trade prevention tools, mandate their use, and publish statistics concerning self-trading; and §§ 40.25-40.28—requiring DCMs to provide disclosure and implement other controls regarding their market maker and trading incentive programs. Regulation AT would amend the definition of “rule” in § 40.1(i) in response to certain of the changes proposed above.

Finally, specific regulatory provisions addressed in the Supplemental NPRM include a number of new or revised defined terms, such as revised § 1.3(x)—Floor trader; revised § 1.3(wwww)—AT Order Message; revised § 1.3(xxxx)—AT Person; revised § 1.3(yyyy)—Direct Electronic Access; new § 1.3(ddddd)—Electronic Trading; new § 1.3(bbbbb)—Electronic Trading Order Message; and new § 1.3(ccccc)—Algorithmic Trading Source Code. Other new or revised regulatory provisions include: (1) New § 1.80(d)—Delegation of pre-trade risk controls by AT Persons; (2) new § 1.80(g) —AT Persons' pre-trade risk controls for Electronic Trading; (3) revised § 1.81—Standards for the development, monitoring, and compliance of Algorithmic Trading systems; (4) revised § 1.82—FCM pre-trade risk controls and other related measures for orders from their AT Person customers; (5) revised § 1.83—AT Person and executing FCM recordkeeping; (6) new § 1.84—Maintenance of Algorithmic Trading Source Code and related records; (7) new § 1.85—Use of third-party Algorithmic Trading systems or components;

(8) revised §§ 38.255 and 40.20—Risk controls for trading; (9) revised § 40.22—DCM requirements for AT Persons and executing FCMs, and DCM review program; and (10) revised § 170.18—AT Person registration for membership in at least one “RFA”.

Including, for example, options for complying with elements of NPRM § 1.81—“Standards for the development, monitoring, and compliance of Algorithmic Trading systems.”

See

Section V below.

This Supplemental NPRM modifies some, but not all, of the NPRM. Where this Supplemental NPRM proposes rule text in full, such text replaces what was proposed in the NPRM. With the exceptions noted in this paragraph, where this Supplemental NPRM reserves a section or paragraph for which provisions were proposed in the NPRM, the previously proposed provisions of such section or paragraph remain unchanged from the NPRM and continue to be under active consideration by the Commission. For technical reasons, §§ 38.401 and 40.1(i), and Appendix B to part 38, are not shown as reserved in this Supplemental NPRM; however, the amended provisions proposed for those sections and that appendix in the NPRM also remain unchanged and under active consideration. (Please note that proposed reserved § 1.3(aaaaa) is not the subject of either this Supplemental NPRM or the NPRM. That definitions paragraph is the subject of another pending unrelated Commission rulemaking proposal.)

B. Opportunities for Public Comment on NPRM Proposals During Two Public Comment Periods and Public Staff Roundtable

In response to the NPRM, the Commission received 54 comment letters from an array of market participants, exchanges, industry trade associations, public interest organizations, and others.

During the initial comment period, Commission staff also met in person and via telephone with interested parties who requested meetings. Market participants and other interested parties were also provided extensive opportunities to comment on the Commission's 2013 Concept Release on Risk Controls and

System Safeguards for Automated Trading Environments (“Concept Release”), which included an initial 90-day comment period and a subsequent three-week comment period in conjunction with a public meeting of the Commission's Technology Advisory Committee.

The Concept Release and comments thereto helped inform a number of the proposals reflected in Regulation AT.

During the 90-day comment period following the Commission's issuance of the NPRM, the Commission received comment letters from: Aesthetic Integration Ltd. (“AI”); Allen, Theo (“Allen”); Alternative Investment Management Association (“AIMA”); American Gas Association (“AGA”); Americans for Financial Reform (“AFR”); Anonymous (non-responsive comment); Asset Management Group of the Securities Industry and Financial Markets Association (“SIFMA”); National Introducing Broker Association (“NIBA”); Barnard, Chris (“Barnard”); Better Markets Inc. (“Better Markets”); Bloomberg Tradebook LLC (“Bloomberg”); CBOE Futures Exchange, LLC (“CBOE”); Citadel LLC (“Citadel”); CME Group Inc. (“CME”); Commercial Energy Working Group and Commodity Markets Council (collectively, the “Commercial Alliance”); Committee on Capital Markets Regulation (“CCMR”); Cordova, Alex (“Cordova”); CTC Trading Group, L.L.C. (“CTC”); Futures Industry Association (“FIA”); Hudson River Trading LLC (“Hudson Trading”); Information Technology Industry Council and U.S. Chamber of Commerce (“ITI and Commerce”); Institute for Agriculture and Trade Policy (“IATP”); Intercontinental Exchange, Inc. (“ICE”); International Energy Credit Association (“IECA”); International Swaps and Derivatives Association, Inc. (“ISDA”); Investment Adviser Association (“IAA”); LCHF Capital Management, Inc. (“LCHF”); Lelli, Carmen (“Lelli”); Leuchtkafer, RT (“Leuchtkafer”); Managed Funds Association (“MFA”); Mercatus Center at George Mason University (“Mercatus”); Minneapolis Grain Exchange, Inc. (“MGEX”); Modern Markets Initiative (“MMI”); NASDAQ Futures, Inc. (“NASDAQ”); National Grain and Feed Association (“NGFA”); Nodal Exchange, LLC (“Nodal”); North American Derivatives Exchange, Inc. (“Nadex”); Olam International Limited (“Olam”); OneChicago, LLC (“OneChicago”); Quantitative Investment Management, LLC (“QIM”); Schwartz, Peter (“Schwartz”); Shatto, Suzanne (“Shatto”); Summers, Neil (“Summers”); TraderServe Limited (“TraderServe”); Trading Technologies International, Inc. (“TT”); trueEX LLC (“trueEX”); Two Sigma Investments, LP (“Two Sigma”); Virtu Financial, Inc. (“Virtu”); Weaver, Jack (“Weaver”); and XTX Markets Limited (“XTX”).

Concept Release on Risk Controls and System Safeguards for Automated Trading Environments, 78 FR 56542 (Sept. 12, 2013); Reopening of Comment Period, 79 FR 4104 (Jan. 24, 2014).

Comments received during the initial comment period described above helped to identify areas that warranted further consideration by staff. Accordingly, on June 10, 2016, Commission staff held a public roundtable (“Roundtable”) to discuss certain elements of the NPRM. The topics discussed at the Roundtable included (1) the definition of DEA; (2) quantitative measures to establish the population of AT Persons; (3) alternatives to imposing pre-trade risk controls and development, testing, and monitoring standards on AT Persons; (4) AT Persons' compliance with elements of the proposed rules when using third-party algorithms or systems; and (5) Algorithmic Trading Source Code access and retention. The Roundtable included representatives from a broad cross-section of entities potentially impacted by Regulation AT.

A transcript of the Roundtable proceedings is available on the Commission's Web site at

CFTC.gov

In connection with the staff Roundtable, the Commission reopened the comment period for elements of Regulation AT for an additional two weeks. The Commission received an additional 19 comment letters during the reopened comment period.

The participants at the Roundtable included CME; Deutsche Bank; ICE; QIM; Tethys Technology (“Tethys”); Virtu; OneChicago; European Securities and Markets Authority (“ESMA”); ABN AMRO Clearing Chicago LLC (“ABN AMRO”); AFR; Shell Energy North America (U.S.), L.P. (“Shell”); Hartree Partners (“Hartree”); J.P. Morgan; KCG Holdings (“KCG”); AQR Capital Management (“AQR”); TT; Optiver US LLC (“Optiver”); and Hudson Trading.

See http://www.cftc.gov/PressRoom/Events/opaevent_cftcstaff061016

In response to the NPRM, the Commission received: (i) Written comments submitted during the initial 90 day comment period (“Initial Comment Period”); comments by Roundtable participants; and (iii) written comments submitted during the reopened comment period (“Second Comment Period”). Some commenters submitted multiple comments. Accordingly, this Supplemental NPRM identifies Roundtable comments with a Roman numeral “II” and Second Comment Period comments with a Roman numeral “III.” For example, CME's comments are identified as CME (its Initial Comment Period comment letter); CME II (its Roundtable comments); and CME III (its Second Comment Period comment letter). During the Second Comment Period, the Commission received comment letters from: AIMA; Chilton, Bart; Better Markets; the Chamber of Commerce (together with ISDA, FIA and others); CME; Commercial Alliance; an industry group consisting of FIA, FIA Principal Traders Group, MFA, ISDA, and SIFMA Asset Management Group (collectively, the “Industry Group”); Hartree; Hudson Trading; ICE; KCG; MFA; MGEX; Milliman Financial Risk Management LLC (“Milliman”); MMI; Nadex; QIM, Schwartz; and TT.

C. Overview of Comments Received

The comments that the Commission received in written letters and at the Roundtable addressed a range of matters in Regulation AT. For purposes of this Supplemental NPRM, the Commission is focusing solely on comments related to new or amended rules proposed herein.

For example, several commenters suggested that the proposed rules could impact a larger number of market participants (including new and existing Commission registrants) than would be appropriate or than the Commission estimated in the NPRM.

The Commission found these comments persuasive, as a result of which it developed the volume-based quantitative test for AT Persons described in Section II below and reflected in Supplemental proposed § 1.3(x)(2) (the “volume threshold test”). Some commenters also expressed concern regarding the NPRM's proposal to require risk controls for Algorithmic Trading at three levels (

i.e.,

at the DCM, FCM and AT Person levels).

Although most saw value in pre-trade risk controls administered by DCMs, some commenters encouraged the Commission to limit any further risk control requirements to either AT Persons or FCMs, but not both. After careful consideration, the Commission is proposing the hybrid two-level risk control structure in which the first level would be at the level of the AT Person or FCM, as reflected in Supplemental proposed §§ 1.80(d) and (g), 1.82, and 1.3(xxxx)(2).

The preamble to any final rules that the Commission may adopt for Regulation AT would provide a more complete summary of all comments received, including in response to the NPRM.

E.g.,

CME A-7; ICE 6; MFA 34; Nadex 1-2.

FIA 5; CME 6, A-14; ICE 5; MFA 4-5; Nadex 3; SIFMA 20; NIBA 1-2.

As explained in Sections II and VI below, these provisions would establish a framework where FCMs act as one of two pre-trade risk control layers for all electronic trading

not

originating with an AT Person (

see

Supplemental proposed § 1.82). AT Persons would remain responsible for their own pre-trade risk controls in lieu of any FCM (

see

NPRM proposed § 1.80). However, the Supplemental NPRM provides additional flexibility by permitting AT Persons to delegate their pre-trade risk control functions to an FCM, while retaining legal responsibility for such controls (

see

Supplemental proposed § 1.80(d) and (g)). The Supplemental NPRM would also permit a non-AT Person to administer its own pre-trade risk controls if it so desired by voluntarily assuming AT Person status pursuant to Supplemental proposed § 1.3(xxxx)(2).

A significant source of discussion in response to the NPRM focused on the source code provisions in NPRM proposed § 1.81(a)(vi). Commenters raised confidentiality, intellectual property, and information security as primary concerns. Many recommended that registrants' source code should be available to the Commission only through subpoena.

Some commenters also noted that source code by itself may be of limited value to the Commission, and noted the importance of records such as log files in understanding the market behavior of an ATS.

E.g.,

AIMA 10-11; Barnard 2; Citadel 2; FIA 48; Hudson Trading 3; ICE 7; ISDA 6; MFA 23; MGEX 24-25; MMI 5; Commercial Alliance 12; QIM 5; TraderServe 1; TT 7; Two Sigma 4-5.

The Commission is sensitive to commenters' confidentiality and information security concerns as summarized above and in Section IV of this Supplemental NPRM. As explained above, the Commission believes that its intent with respect to source code was misunderstood. Specifically, the Commission did not intend for a source code repository be maintained at the Commission or with third-parties. However, the Commission also emphasizes that preservation of source code, and Commission access to such source code, is vital. Recordkeeping and access to records are and have always been central to the Commodity Exchange Act's (“Act” or “CEA”) statutory framework for regulated derivatives markets. Further, as a civil law enforcement agency, the Commission already handles sensitive, proprietary and trade secret information on a daily basis under strict retention and use requirements. Cybersecurity and the protection of confidential information are a top priority for the Commission, and all current and former CFTC employees are prohibited by 17 CFR 140.735-5 from disclosing confidential or non-public commercial, economic or official information.

Through this Supplemental NPRM, the Commission seeks to balance commenters' concerns against its legitimate regulatory interest in ensuring that the Algorithmic Trading Source Code that is often essential for transacting in modern electronic markets is preserved and is available to the Commission when necessary. Source code related provisions are now reflected in a new Supplemental proposed § 1.84, which provides that any CFTC access to Algorithmic Trading Source Code must be authorized by the Commission itself through either the part 11 subpoena process or through a

new “special call” process set forth in the proposal. Supplemental proposed § 1.84 also addresses records required to be maintained, confidentiality protections, and the time period for which records must be maintained. Supplemental proposed § 1.84 would replace NPRM proposed § 1.81(a)(vi) in its entirety.

Other amendments in the Supplemental NPRM address commenters' concerns regarding the proposed definition of DEA, AT Persons' compliance with rules when using third-party providers for their Algorithmic Trading technology, and other areas. With respect to third-party providers, for example, the Commission is adding Supplemental proposed § 1.85, which would permit AT Persons to rely on certifications from their third-party providers to meet certain requirements in Regulation AT. Such certifications would be permitted primarily with respect to NPRM proposed § 1.81(a), which requires AT Persons to follow certain standards in the development and testing of their ATSs.

Comments received in response to specific proposals in the NPRM are discussed in greater detail below.

II. AT Person Status and Requirements for AT Persons

A. Overview and Policy Rationale for New Proposal

The proposed rules in Regulation AT apply in large part to market participants who meet the requirements to be an “AT Person” as defined in NPRM proposed § 1.3(xxxx).

AT Persons include existing Commission registrants engaged in Algorithmic Trading,

as well as certain unregistered market participants who would be required to register as New Floor Traders pursuant to NPRM proposed § 1.3(x)(1)(iii). Registration criteria proposed in NPRM § 1.3(x)(1)(iii) for currently unregistered market participants include that such market participant be engaged in: (1) Proprietary (2) Algorithmic Trading (3) through DEA on a DCM. In the NPRM, the Commission preliminarily determined that these criteria could function as “filters” on the population of AT Persons, and therefore on the overall scope of the proposed rules. The Commission estimated that this definition would result in a total of 420 potential AT Persons, and believed that this would represent the top end of the range of AT Persons. The Commission based its proposal, in part, on the view that proprietary trading, DEA, and Algorithmic Trading together could appropriately identify those market participants, including new and existing registrants, that any rulemaking should encompass to effectively address risks associated with Algorithmic Trading.

In addition to AT Persons, Regulation AT also includes requirements for FCMs, DCMs, and RFAs.

Algorithmic Trading is defined in NPRM proposed § 1.3(zzzz) to mean trading in any commodity interest as defined in paragraph (yy) of this section on or subject to the rules of a designated contract market, where: (1) One or more computer algorithms or systems determines whether to initiate, modify, or cancel an order, or otherwise makes determinations with respect to an order, including but not limited to: The product to be traded; the venue where the order will be placed; the type of order to be placed; the timing of the order; whether to place the order; the sequencing of the order in relation to other orders; the price of the order; the quantity of the order; the partition of the order into smaller components for submission; the number of orders to be placed; or how to manage the order after submission; and (2) Such order, modification or order cancellation is electronically submitted for processing on or subject to the rules of a designated contract market; provided, however, that Algorithmic Trading does not include an order, modification, or order cancellation whose every parameter or attribute is manually entered into a front-end system by a natural person, with no further discretion by any computer system or algorithm, prior to its electronic submission for processing on or subject to the rules of a designated contract market.

The Commission's estimates notwithstanding, a number of commenters have opined that the NPRM would capture substantially more than 420 AT Persons. Commenters indicated that DEA is a widespread practice, including potentially among proprietary retail market participants. Some commenters also suggested that the Commission's proposed definition of Algorithmic Trading may be of limited value in filtering the number of AT Persons because, for example, it incorporates certain automated order routing systems (“AORSs”). At one end of the comment spectrum, several commenters stated that AT Persons could number in the thousands.

See, e.g.,

MFA 6, 12-13 (indicating that potentially thousands of market participants would be subject to Regulation AT); Nadex 1-2 (indicating that estimated number of affected participants would be significantly higher than 100, potentially in the thousands); FIA 91 (stating that “DCMs will be flooded by hundreds, if not thousands, of annual reports” pursuant to NPRM proposed §§ 1.83 and 40.22); CME A-7 (indicating that the DEA definition would capture trading activity of thousands of firms).

The Commission has carefully considered all comments regarding the number of potential AT Persons pursuant to the proposed rules, particularly those comments indicating that the NPRM's defined terms and other elements may not successfully filter the scope of the rules. The Commission is therefore proposing in this Supplemental NPRM the addition of a volume threshold test to the definition of AT Person. In doing so, the Commission has also considered comments that any volume of trading potentially could pose risks. However, status as an AT Person involves compliance costs due to Regulation AT risk control, testing, recordkeeping and other requirements, and accordingly the Commission has determined that, at this time, it is appropriate to limit the population of AT Persons to larger market participants, including those responsible for significant trading volumes and liquidity in CFTC-regulated markets. The Commission emphasizes that its proposed framework requires FCMs to act as one of two pre-trade risk control layers for all Electronic Trading not originating with an AT Person (

see

Supplemental proposed § 1.82). Accordingly, the proposed risk control framework is not limited to the trading of AT Persons who satisfy a quantitative threshold (

i.e.,

the volume threshold test described in Section II below).

The Commission emphasizes, as stated above, that Regulation AT is not intended to capture large swaths of new or existing registrants. The focus on Algorithmic Trading and DEA, among other criteria, reflects the Commission's interest in sophisticated market participants that can bring significant human capital, information technology, or other resources to bear on trading in modern markets. The definition of AT Person in Regulation AT is centered on larger market participants, including, those “responsible for significant trading volumes and liquidity.”

Such market participants include existing Commission registrants, and an important population of proprietary traders who heretofore have remained outside of the Commission's registration regime. The Commission has determined to address both sets of market participants through a straightforward test for potential AT Persons that measures all market participants' presence on DCMs: Total trading volume for all products across all DCMs, as described below.

See

NPRM at 78827.

Taking these considerations into account, the Commission has determined that a quantitative volume threshold test is best suited to identifying larger market participants who should be brought within the Commission's regulatory purview. To that end, the Commission is proposing a new approach that includes quantitative metrics based on a market participant's average daily trading volume across all products. Specifically,

the Commission is proposing a volume threshold of 20,000 contracts traded on average per day, including for a firm's own account, the accounts of customers, or both, over a six month period. The Commission believes that this approach will facilitate the identification of AT Persons through the use of clear, numerical standards that can be calculated easily by market participants and are verifiable in the Commission's data. The Commission further believes that the proposed volume threshold test is an appropriate vehicle to define the scope of AT Persons, in combination with the proposed definition of Algorithmic Trading and the proposed amended definition of DEA.

As discussed below, the Commission also considered a variety of quantitative thresholds in formulating the Supplemental NPRM proposal, including order related measurements and frequency metrics.

The Commission also considered alternatives based on defined terms such as “DEA” and “Algorithmic Trading” that also serve to define the scope of AT Persons. The Supplemental NPRM proposes revisions to the definition of DEA based on public comments that the NPRM proposed definition was ambiguous, but does not propose amendments to the definition of Algorithmic Trading. The Commission believes the volume-based approach proposed herein is a better option as it is based on verifiable and easily observed data regarding the trading volumes of all market participants on DCMs.

B. NPRM Proposal and Comments

The term “AT Person,” as defined in the NPRM, involves several interrelated terms, including AT Person, floor trader, DEA, and Algorithmic Trading. The definitions proposed in the NPRM for each of those terms are discussed below, and changes thereto are noted where applicable.

AT Person.

The NPRM proposed to define AT Person as an existing Commission registrant that engages in Algorithmic Trading on or subject to the rules of a DCM, or a New Floor Trader. In this Supplemental NPRM, the Commission is proposing an additional requirement for AT Person status: A volume threshold test, as described in Section II(C) below. In addition, as discussed below in Section VI(D)(3)(c), the Commission is also proposing to permit market participants to voluntarily elect AT Person status.

See

Supplemental proposed § 1.3(xxxx)(2). The Commission is providing flexibility so that non-AT Person market participants can administer their own pre-trade risk controls in lieu of controls that its FCM must otherwise impose. Such market participants must register as New Floor Traders and comply with obligations imposed on AT Persons.

The defined term “AT Person” remains central to the structure of the proposed rules. Regulation AT defines the term “AT Person” in order to identify which entities are subject to the proposed regulations addressing trading firms' management of the risks associated with automated trading. These regulations include, for example, pre-trade and other risk controls on the orders initiated by the trading firm, and standards for the development, testing and supervision of ATSs. The definition of AT Person under NPRM proposed § 1.3(xxxx) lists those persons or entities that may be considered an AT Person, namely (1) persons registered or required to be registered as FCMs, floor brokers, swap dealers (“SDs”), major swap participants (“MSPs”), commodity pool operators (“CPOs”), commodity trading advisors (“CTAs”), or introducing brokers (“IBs”) that engage in Algorithmic Trading on or subject to the rules of a DCM; or (2) persons registered or required to be registered as floor traders as defined in § 1.3(1)(iii).

In the NPRM, the Commission proposed amending the definition of “floor trader” in existing § 1.3(x) to facilitate the registration of proprietary traders using DEA for Algorithmic Trading on a DCM. The NPRM proposed requiring such persons (

i.e.,

New Floor Traders) to register as floor traders, assuming they were not already registered or required to register with the Commission in another capacity.

Direct Electronic Access.

Through this Supplemental NPRM, the Commission is proposing to amend the definition of DEA originally proposed in the NPRM. In the NPRM, the Commission proposed a new § 1.3(yyyy) that defined DEA as an arrangement where a person electronically transmits an order to a DCM, without the order first being routed through a separate person who is a member of a DCO to which the DCM submits transactions for clearing. By using the word “routed,” the Commission indicated that it means the process by which an order physically goes from a customer to a DCM. Section III below discusses the Commission's revisions to the proposed definition of DEA as part of this Supplemental.

Algorithmic Trading.

The Commission is not proposing to amend the definition of Algorithmic Trading originally proposed in the NPRM.

In the NPRM, the Commission proposed a new § 1.3(zzzz) that defines Algorithmic Trading as trading in any commodity interest as defined in Regulation 1.3(yy) on or subject to the rules of a DCM, where: (1) One or more computer algorithms or systems determines whether to initiate, modify, or cancel an order, or otherwise makes determinations with respect to an order, including but not limited to: the product to be traded; the venue where the order will be placed; the type of order to be placed; the timing of the order; whether to place the order; the sequencing of the order in relation to other orders; the price of the order; the quantity of the order; the partition of the order into smaller components for submission; the number of orders to be placed; or how to manage the order after submission; and (2) such order, modification or order cancellation is electronically submitted for processing on or subject to the rules of a DCM; provided, however, that Algorithmic Trading does not include an order, modification, or order cancellation whose every parameter or attribute is manually entered into a front-end system by a natural person, with no further discretion by any computer system or algorithm, prior to its electronic submission for processing on or subject to the rules of a DCM.

As the Commission explained in the NPRM, “[t]he term `Algorithmic Trading' is a critical underpinning” of Regulation AT.

It noted that the proposed definition of Algorithmic Trading is similar to that which was adopted by the European Commission under MiFID II, except that it also includes AORSs.

It observed that “automated order routers have the potential to disrupt the market to a similar extent as other types of automated systems, and therefore should not be treated differently” under Regulation AT. It also explained that “given the interconnectedness of trading firm systems, carving out a particular subset of automated systems from the definition of Algorithmic Trading,

e.g.,

order routing systems, would introduce unnecessary complexity and reduce the effectiveness of the safeguards provided in its proposed regulations.”

The Commission is cognizant of comments indicating some commenters' belief that the proposed definition of Algorithmic Trading should be revised to exclude certain systems such as AORSs. However, the Commission has thus far been presented with no persuasive evidence establishing that the operation of AORSs presents less risk to the market than other types of automated or algorithmic systems.

See

NPRM at 78840.

See id.

Comments Received.

As discussed above, the NPRM proposed to define AT Person as an existing Commission registrant that engages in Algorithmic Trading on or subject to the rules of a DCM, or a New Floor Trader (

i.e.,

a market participant that engages in (1) proprietary (2) Algorithmic Trading (3) through DEA on a DCM). In addition to receiving comments on the substance of NPRM proposed terms such as “Algorithmic Trading” and “DEA,”

the Commission also received comments concerning the number of market participants that would qualify as AT Persons under the proposed rules, particularly as a function of the defined terms discussed above. Several

commenters asserted that the number of persons or entities that would come within the NPRM proposed definition of AT Person is higher than the Commission's estimate of 420 AT Persons. ICE commented that “[i]f read broadly (

i.e.

orders routed through an FCM's risk management controls located at the exchange but not physically routed . . . through the FCM are considered DEA), the Commission's estimated 100 market participants that would be impacted by Regulation AT would increase to include the vast majority of all market participants.”

The Commercial Alliance stated that Regulation AT could apply to “a large segment of commercial energy and agricultural firms,” contrary to the Commission's intent to limit its scope to one hundred new registrants.

MFA commented that “the breadth of the Regulation AT definitions are [sic] likely to capture many more market participants as AT Persons than the 420 persons that the Commission estimates.”

MFA estimated that if even half of the CTAs and CPOs registered with the Commission used an algorithmic trading execution system, there would be at least 1,270 CTAs and CPOs that would be AT Persons, exclusive of other registrant categories.

The comments received regarding the NPRM proposed definition of DEA are discussed in Section III(B) below. The Commission is proposing a revised definition of DEA, as set forth in Section III(C) below. The Commission is not proposing to amend the NPRM proposed definition of Algorithmic Trading.

ICE 6.

Commercial Alliance 2;

see also

FIA 6, 13, 21; ICE 4; and MGEX 20-21 (commenting that all market participants trading electronically should use pre-trade and other risk controls appropriate to their trading).

Hudson Trading, Roundtable Tr. 95:10-97:8, 135:12-136:19; Optiver, Roundtable Tr. 119:11-19; KCG, Roundtable Tr. 120:21-121:8.

Hartree, Roundtable Tr. 100:7-101:7; AQR, Roundtable Tr. 106:5-107:17, 109:9-110:13.

Milliman III 3; Hudson Trading, Roundtable Tr. 97:15-98:4; AQR, Roundtable Tr. 107:18-108:7; QIM, Roundtable Tr. 117:13-114:10.

Specifically, the Commission is proposing to establish a framework where FCMs act as one of two pre-trade risk control layers for all Electronic Trading

not

originating with an AT Person (

see

Supplemental proposed § 1.82). The volume threshold test would identify those market participants with the most significant presence in CFTC-regulated markets. The Commission is also proposing an anti-evasion provision in Supplemental proposed § 1.3(xxxx)(4) to address commenters' concerns that a quantitative measure could be “gamed” by market participants.

As discussed in Section II(C) below, the proposed anti-evasion provision states that no person shall trade contracts or cause contracts to be traded through multiple entities for the purpose of evading the floor trader registration requirements under Supplemental proposed § 1.3(x)(3), or to avoid meeting the definition of AT Person under Supplemental proposed § 1.3(xxxx).

See

AQR, Roundtable Tr. 107:18-108:7; Hudson River Trading, Roundtable Tr. 97:19-21.

C. Substance of New Proposal

In light of comments received, the Commission is proposing an additional requirement for AT Person status: A volume threshold test. Pursuant to Supplemental proposed § 1.3(xxxx), a market participant may fall under the definition of AT Person in one of three ways. First, the category of AT Persons includes persons registered or required to be registered as an FCM, floor broker, SD, MSP, CPO, CTA, or IB that (1) engages in Algorithmic Trading and (2) satisfies the volume threshold test under Supplemental proposed § 1.3(x)(2) (as discussed in greater detail below).

Second, AT Persons include New Floor Traders under Supplemental proposed § 1.3(x)(1)(iii).

Such New Floor Traders must engage in Algorithmic Trading, utilize DEA, and satisfy the volume threshold test under Supplemental proposed § 1.3(x)(2). Third, a person who does not satisfy either of the other two prongs of the AT Person definition may nevertheless elect to become an AT Person, provided that such person registers as a floor trader and complies with all requirements of AT Persons pursuant to Commission regulations.

In addition, each AT Person who is not already a member of an RFA must submit an application for

membership to at least one RFA, as discussed below.

See

Supplemental proposed § 1.3(xxxx)(1)(i).

See

Supplemental proposed § 1.3(xxxx)(1)(ii).

See

Supplemental proposed § 1.3(xxxx)(2).

1. Volume Threshold Test for AT Persons

In light of commenter views that the Commission has underestimated the number of AT Persons that would fall within the scope of Regulation AT, the Commission proposes modifying the proposed definition of AT Person to incorporate a volume threshold test. Specifically, Supplemental proposed § 1.3(x)(2) would require potential AT Persons to determine whether they trade an aggregate average daily volume of at least 20,000 contracts for their own account, the accounts of customers, or both. The Commission notes that while many Commission registration categories (

e.g.,

FCM, CPO, floor broker, etc.) may trade both their proprietary and customer accounts, New Floor Traders are likely to trade solely for themselves. Accordingly currently unregistered market participants would likely look to their proprietary trading volume when determining whether they satisfy the volume threshold test.

For purposes of the volume threshold test, potential AT Persons would be required to calculate their aggregate average daily volume across all products on the electronic trading facilities

of all DCMs on which they trade.

Aggregate average daily volume would be calculated in six-month periods, from each January 1 through June 30 and each July 1 through December 31, based on all trading days in the respective period.

For purposes of calculating the aggregate average daily volume, AT Persons would also be required to aggregate their own trading volume and that of any other persons controlling, controlled by or under common control with the potential AT Person.

However, if a currently unregistered market participant is in fact trading the accounts of customers consistent with the Act and Commission regulations, such market participant should include their customer trading volume, in addition to their proprietary volume, when determining whether it satisfies the volume threshold test.

“Electronic trading facility” is defined in section 1a(16) of the CEA. The aggregate average daily volume would not include block trades, exchange for related positions, pit trades, or other transactions outside a DCM's electronic trading platform.

See

Supplemental proposed § 1.3(x)(2)(i).

See

Supplemental proposed § 1.3(x)(2)(ii).

See

Supplemental proposed § 1.3(x)(2)(iii).

The Commission believes that a volume threshold test based on total trading volume across the electronic trading facilities of all DCMs best matches the goals of AT Person regulation, including risk controls, recordkeeping and testing and monitoring of automated systems requirements that will prevent and reduce the potential risk of market disruption caused by technological malfunction or other error. This volume threshold test would apply to both current and new Commission registrants to help define whether they are AT Persons.

In making this determination, the Commission reviewed other quantitative thresholds proposed, or finalized, for regulatory purposes similar to those in Regulation AT. These other quantitative thresholds include, for example, tests proposed by ESMA for identifying high-frequency traders in European markets,

i.e.,

average resting order times and daily number of messages sent by a trading entity. The Commission's purpose in creating the new AT Person category is to ensure that risk management, testing and monitoring standards are sufficiently high for larger market participants in futures markets, regardless of strategy or firm type. The Commission believes that, out of all actions taking place on an electronic platform, consummated transactions are the key element of market processes such as price discovery and risk transfer. For this reason, larger entities, across products taken as a whole, should be held to standards sufficient to mitigate the risks of general market disruptions or degradations in the quality of trading.

The Commission proposes setting a six-month window for calculating average daily trading volume. The Commission's intent is that a longer window will smooth out episodic volume fluctuations experienced by a firm through the year for a variety of reasons, including, for example, hedging practices, roll activity, or other seasonal reasons. By doing this, the set of AT Persons should be restricted to entities that are larger, sufficiently high-volume traders. The averaging window also should moderate the effect of market events where there is unusually high volume relative to historical levels.

The volume threshold test definition does not make a distinction between futures products or between futures and options contracts for the purposes of aggregation. The Commission believes this is appropriate to help facilitate the volume calculation for potential AT Persons. Accordingly, the proposed volume threshold test instead results in an averaging across markets and products.

Using the proposed definition, and a trading volume threshold of 20,000 contracts traded per day on DCM electronic trading facilities—including for a firm's own account, the accounts of customers, or both, over a six month period—the Commission estimates that there would be approximately 120 AT Persons, a portion of which would be newly registered under the amended definition of floor trader.

In order to derive this estimate, the Commission made use of daily trading audit trail data, for futures and options on futures, received from a number of DCMs. This audit trail data included information about the trading activity of market participants on the electronic trading facility of each DCM, coinciding with the order and trade activity associated with electronic trading, the focus of many other elements of this Supplemental NPRM. Because the volume threshold test is based on activity within a semi-annual period, the Commission calculated the average activity of individual firms during the first half of 2016 and used these aggregate numbers as an activity benchmark. Aggregating this activity across the DCMs for which the Commission had firm identification provided a basis for estimating the number of potential AT Persons. The Commission notes that its data provides a significantly comprehensive, but not a full, identification of the firms associated with each trade; in other cases, the firm associated with a trade may be the broker rather than the principal. For these reasons, the Commission estimates for the number of AT Persons may omit some firms that would meet the volume threshold requirements.

The Commission notes that over time it may amend the volume threshold it adopts in any final rules for Regulation AT. Such amendments would be an outgrowth of the Commission's experience with the volume threshold it adopts in final rules. As the Commission is proposing to codify the volume threshold in its rules, any future changes would necessarily be pursued through further notice and comment rulemaking.

Because trading patterns for a given entity or firm may change over time, the Commission acknowledges that traders who are active enough to fall above the AT Person volume threshold test during a given semi-annual period may, over time, reduce their activity levels. To accommodate changes in strategy and in the use of futures markets, the AT Person definition allows for current AT Persons to drop their designation as an AT Person if they fall below the volume threshold for two consecutive six-month periods.

The Commission's proposed volume threshold test helps determine, together with other factors, a market participant's obligation to register as a New Floor Trader. As described above, any Commission registrant who is also an AT Person, including a floor trader, may cease to be bound by the requirements applicable to AT Persons if such registrant falls below the volume threshold test for

two consecutive six-month periods. The Commission notes, however, that a floor trader who ceases to be an AT Person shall still be registered as a floor trader unless it formally applies for withdrawal from registration as described in Commission § 3.33.

2. Registration as a Floor Trader

Supplemental proposed § 1.3(x) modifies the new definition of floor trader, which also make up the group of AT Persons under Supplemental proposed § 1.3(xxxx)(1)(ii). Under the Supplemental proposed definition, a floor trader must, in addition to using DEA to conduct Algorithmic Trading (as proposed in the NPRM), also satisfy the volume threshold test set forth in Supplemental proposed § 1.3(x)(2). This proposal will help to address concerns that too many market participants would be captured by the new definition of floor trader proposed in the NPRM.

Supplemental proposed § 1.3(x)(3) specifies the period of time provided to an entity meeting these conditions to register as a floor trader and come into compliance with the requirements for AT Persons. Specifically, Supplemental proposed § 1.3(x)(3) provides that an unregistered person who satisfies Supplemental proposed §§ 1.3(x)(1)(iii)(A), (x)(1)(iii)(B) and (x)(1)(iii)(C), and who meets the volume threshold test in Supplemental § 1.3(x)(2) in any January 1 through June 30 or July 1 through December 31 period, shall register as a floor trader within 30 days after the end of such period and shall comply with all requirements of AT Persons pursuant to Commission regulations within 90 days after the end of such period.

Supplemental proposed § 1.3(x)(3)(ii) describes which person or persons must register if there is an “affiliate group,” under common control, that meets the volume threshold test in the aggregate. Supplemental proposed § 1.3(x)(3)(ii) states that for any group consisting of a person and any other persons controlling, controlled by or under common control of such person, if such group of persons in the aggregate satisfies the volume threshold test set forth in Supplemental proposed § 1.3(x)(2), then one or more persons in such group must register as floor traders. These registrations would need to continue across affiliated entities until the aggregate average daily volume of the unregistered persons in the group trade an aggregate average daily volume below the volume threshold test set forth in § 1.3(x)(2).

The Commission's proposal for aggregating the trading volume of affiliated entities under common control is modeled on analogous provisions in the Commission's swap dealer registration requirements.

See

existing § 1.3(ggg)(4) and Interpretative Guidance and Policy Statement Regarding Compliance With Certain Swap Regulations, 78 FR 45292 (July 26, 2013).

3. Anti-Evasion

Supplemental proposed § 1.3(x)(4) provides that no person shall trade contracts or cause contracts to be traded through multiple entities for the purpose of evading the registration requirements imposed on New Floor Traders under § 1.3(x)(3), or to avoid meeting the definition of AT Person under § 1.3(xxxx). The purpose of this provision is to prevent market participants whose trading volume would otherwise cause them to fall within the definition of New Floor Trader (and, therefore, AT Person), but who trade through multiple entities for the purpose of falling below the volume threshold test, from avoiding registration. By including such anti-evasion provision, the Commission seeks to prevent market participants from structuring transactions and legal entities in order to avoid the requirements of Regulation AT. Examples of these structures might include trading through multiple “shell” companies that individually trade below the threshold, or trading through one entity for part of the year, then ceasing all trading activity for that entity and trading instead through a newly formed entity, similarly leaving average daily volume under the threshold.

4. Registration for Membership With a Registered Futures Association

In addition to being registered with the Commission in some capacity, AT Persons must also submit applications for membership in at least one RFA.

In particular, Supplemental proposed § 170.18 requires that an AT Person not yet a member of an RFA must submit an application for membership in at least one RFA within 30 days of such AT Person satisfying the volume threshold test set forth in Supplemental proposed § 1.3(x)(2).

In addition, Supplemental proposed § 1.3(xxxx) provides that any person that elects to become an AT Person must submit an application for membership to at least one RFA pursuant to Supplemental proposed § 170.18 within 30 days of such person choosing to become an AT Person.

The Commission is cognizant that upon the adoption of final rules for Regulation AT, an RFA may need additional time to prepare its governance structure, membership categories, application materials, and other internal processes to accommodate New Floor Traders. Accordingly, the Commission may determine to delay the compliance date for Supplemental proposed § 170.18 for a short period of time so that an RFA may complete such processes prior to receiving its first application for membership from a New Floor Trader.

Any unregistered person who meets the requirements to register as a New Floor Trader would have identical 30-day periods in which to both register with the Commission and apply for membership in an RFA.

The Commission does not require such membership to be in a specific membership category. An RFA may register such AT Persons as “floor traders,” or choose to create a subset or other category of Regulation AT floor traders for membership purposes.

D. Commission Questions

1. The Commission invites comment on the proposed volume threshold test set forth in Supplemental proposed § 1.3(x)(2). In particular, the Commission specifically invites comment on whether the volume threshold test is an appropriate means of identifying those market participants who should qualify as AT Persons and therefore be subject to the proposed risk control, recordkeeping testing and monitoring and other requirements in Regulation AT.

2. If you believe that AT Persons should be identified by a quantitative measure other than the proposed volume threshold test, please identify and describe such alternative measure, including the number and types of market participants that would qualify as AT Persons.

3. The proposed volume threshold test would require a potential AT Person to determine whether it trades an aggregate average daily volume of at least 20,000 contracts over a six month period. Do you believe that a potential AT Person's average daily volume for purposes of the volume threshold test should instead be calculated only over the days in which the potential AT Person trades during the six month period? Would such alternative better address potential AT Persons who may trade infrequently over the course of a six month period, but in large quantities when they do trade?

4. The Commission estimates that its proposed volume threshold of 20,000 contracts traded per day, including for a firm's own account, the accounts of customers, or both, across all products and DCMs, would capture approximately 120 market participants, including new and existing registrants. Please comment on the Commission's estimate. Do you believe that the number of market participants captured by this volume threshold test would be greater or fewer than 120? Please indicate how many of these market participants are currently registered with the Commission and how many are not.

5. With the addition of the proposed volume threshold test, do you believe that any AT Person will be a natural person or a sole proprietorship with no employees other than the sole proprietor?

6. For the proposed volume threshold test, please explain any challenges that could arise with respect to implementation. For example, what difficulties might an entity potentially subject to Regulation AT encounter in calculating whether it meets the volume threshold? Will the entity be able to readily distinguish between trades executed on a DCM's electronic trading facility and other trades executed on or pursuant to the rules of the DCM? Does the volume threshold test potentially capture a set of entities that should not be subject to Regulation AT?

7. For the proposed volume threshold test, please explain whether the proposed rule should specify a different aggregation level for purposes of deciding who is an AT Person (

e.g.,

individual DCMs, individual products), or whether the aggregation should be done over a time period different than the proposed semi-annual window.

8. For the proposed volume threshold test, please explain whether certain trades should be weighted differently in calculating the volume aggregation, or whether certain trades such as spread trades should be excluded from the aggregation.

9. For the proposed volume threshold test, the Commission proposes to set a single threshold incorporating trading in all products and on all DCMs in order to facilitate calculations for potential AT Persons. Please explain whether the Commission should instead set different thresholds for groups of related products, or on a per-DCM basis, or other more granular measures than the aggregation of a potential AT Person's trading across all products and DCMs. Please also discuss the added complexity of any such alternate system, and explain why such system is preferable despite such complexity.

10. Supplemental proposed § 1.3(x)(2)(ii) calls for aggregate average daily volume to be calculated in six-month periods, from each January 1 through June 30 and each July 1 through December 31. The Commission requests comment regarding when to begin the first six-month measurement period for any final rules that the Commission adopts. For example, the Commission anticipates that for any final rules with an effective date prior to July 1, 2017, the first measurement period will be July 1 through December 31, 2016. Alternatively, the Commission could delay the effective date for certain elements of the final rules to a date from July 1, 2017 onwards. In such case, the first measurement period could be January 1 to June 30, 2017.

11. The Commission invites comment on whether any future changes to the volume threshold deemed appropriate by the Commission (subsequent to a final rulemaking on Regulation AT) should be made by notice and comment rulemaking. Commenters are particularly invited to address potential alternatives to updating the volume threshold, if any.

12. The Commission invites comment as to how the proposed volume threshold test should be applied to members of an affiliated group. Commenters are particularly invited to address how the Commission should interpret common control for these purposes, and whether this interpretation should be limited to wholly-owned affiliates.

13. The Commission requests comment regarding the appropriate amount of time for an entity to register as a New Floor Trader and come into compliance with all requirements applicable to AT Persons, once such entity has triggered the criteria for registration and AT Persons status.

III. Proposed Definition of DEA

A. Overview and Policy Rationale for New Proposal

The Commission proposed in NPRM § 1.3(yyyy) to define DEA for purposes of Regulation AT as an arrangement where a person electronically transmits an order to a DCM, without the order first being routed through a separate person who is a member of a DCO to which the DCM submits transactions for clearing.

The NPRM explained that the term “routed” was intended to mean the process by which an order physically goes from a customer to a DCM. The Commission proposed this definition of DEA in the NPRM as a filter, along with Algorithmic Trading, to help define the category of proprietary traders that would be required to register as floor traders under Regulation AT. The Commission anticipated that the proposed definition of DEA could help to define the number of entities required to register as New Floor Traders, and to focus registration on larger market participants not otherwise registered with the Commission. In light of comments received on the NPRM, and in light of the proposed addition of a volume threshold test to filter out smaller market participants from floor trader registration and its attendant obligations, the Commission is proposing an amended definition of DEA, as described below.

See

NPRM at 78844.

The Supplemental proposed defined term DEA means the electronic transmission of an order for processing on or subject to the rules of a contract market, including the electronic transmission of any modification of such order. DEA would

not

include orders, or modifications or cancellations thereof, (i) electronically transmitted to a DCM (ii) by an FCM (iii) that such FCM received from an unaffiliated natural person

(iv) by means of oral or written communications.

The amended definition differs from the NPRM definition in four key areas: (a) Eliminating the term “routed through”; (b) clarifying that DEA does

not

include orders submitted to a DCM by an FCM where such FCM received the order from an unaffiliated natural person by means of written or oral communication;

(c) changing the proposed rule's reference to “clearing members” of DCOs to any FCM; and (d) expanding the term “order” to include the cancellation or modifications of such order.

The Commission notes that an “unaffiliated natural person” is one who has no affiliation with, and whose employer has no affiliation with, the FCM receiving the order. Such natural person may be communicating the order for another (unaffiliated) Commission registrant, an (unaffiliated) unregistered market participant, an (unaffiliated) end customer, etc. Examples of scenarios that are not DEA include: (1) An employee of a Commission registrant communicates an order to an unaffiliated FCM, verbally or in writing, for onward transmission by such FCM to a DCM; (2) A natural person customer communicates an order to an unaffiliated FCM, verbally or in writing, for onward transmission by such FCM to a DCM; and (3) An employee of customer that is a legal entity not registered with the Commission communicates an order to an unaffiliated FCM, verbally or in writing, for onward transmission by such FCM to a DCM. The Commission emphasizes that an unaffiliated natural person has no relationship, and their

employer

has no relationship, with the FCM receiving the order for submission to a DCM.

The Commission notes that “written communications” may include email, text messages, or instant messaging “chat” tools, in addition to communications on paper. The common denominator is that such communications are in each instance specifically written by a natural person.

The Commission notes that this exclusion addresses the “how” and “by whom” of an order's communication to the FCM. Such communication must be made by a (1) unaffiliated (2) natural person (3) verbally or in writing.

B. NPRM Proposal and Comments

In the NPRM, DEA was relevant to several of the proposed regulations. It was used as a filter to define the category of market participants required to register as floor traders and be subject to the requirements of Regulation AT

(

see

proposed § 1.3(x)(3)). In addition, DEA was relevant to revised § 38.255, which requires DCMs to have in place systems and controls reasonably designed to facilitate an FCM's management of the risks that may arise from Algorithmic Trading, and proposed § 1.82, which requires FCMs to implement such DCM-provided controls for DEA orders. This approach of enabling clearing FCMs to implement DCM-based controls is similar to how the Commission addresses financial risk management by FCMs, as reflected in existing DCM regulation § 38.607. Existing § 38.607 describes DEA as allowing customers of futures commission merchants to enter orders directly into a designated contract market's trade matching system for execution.

As discussed below, the Commission proposes to amend the definition of DEA to address various commenter concerns, and the term continues to be relevant to Supplemental proposed §§ 1.3(x)(1)(iii), 1.82 and 38.255.

In addition, in the context of foreign boards of trade, section 4(b)(1)(A) of the CEA defines “direct access” as an explicit grant of authority by a foreign board of trade to an identified member or other participant located in the United States to enter trades directly into the trade matching system of the foreign board of trade.

Comments Received.

The Commission received a range of comments concerning the scope and clarity of the definition of DEA proposed in the NPRM. Better Markets commented that the NPRM's definition of DEA encompassed all types of access commonly understood in Commission-regulated markets as “direct market access.”

Other commenters raised a number of concerns over the NPRM proposed definition of DEA and its application to various types of market participants. One commenter cautioned that the NPRM proposed definition of DEA would not capture any market participants because clearing members are required to have risk controls over automated customer orders under existing § 1.73.

Some commenters found the NPRM definition too broad, and argued that it would capture individual traders and small trading groups, as well as large corporations using futures markets to hedge risks.

CME stated that this broader reading of DEA would capture thousands of firms if the term includes orders that pass through software calibrated by clearing members but maintained and owned by a clearing member's IT provider (

e.g.,

TT or Bloomberg).

Two commenters suggested that the definition of DEA is unnecessary because any market participant trading electronically must utilize pre-trade and other risk controls appropriate to the nature of their trading.

Better Markets 3; Better Markets III 3-4.

CME, 12.

TT 3.

CME A-7.

FIA 6; ICE 4-5.

Several commenters asserted that the NPRM proposed definition of DEA lacks clarity,

and that the definition does not provide sufficient guidance as to what “being routed through a separate person” that is a member of a DCO means.

Many commenters argued that DEA should not include DCM-offered connectivity platforms such as WebICE or CME Direct.

Commenters also argued that DEA should not include platforms provided by third-party ISVs;

one commenter considered such ISVs to be an extension of the FCM's infrastructure where the FCM was able to control a risk control module on the platform.

TT 2; MFA 15; CME 11-12; ICE 4; IECA 7.

TT 2; CME 11-12; ICE 4.

FIA A-17; MFA 15; AGA 3; Commercial Alliance III 4; ICE 5; CME A-7.

FIA A-6; MFA 15; TT 3; Commercial Alliance 4.

FIA A-6.

Some commenters also suggested that the NPRM definition was too narrowly focused on the role of clearing FCMs, as opposed to executing FCMs. Several commenters argued that executing FCMs could better act as gatekeepers over customer order flow than clearing FCMs.

For example, Milliman commented that NPRM proposed § 1.3(yyyy) should be modified to refer to an order being routed through a separate person who is an “executing agent” (rather than a clearing member).

QIM raised the issue of FCM “gateways” through which customers could submit orders, and commented that only the person or agent directly placing trades on a DCM should be considered to possess DEA

Milliman III 2. One commenter also noted that there may be non-FCM clearing members of a DCM, which could create situations under the NPRM proposed rules where there would be “no second line of pre-trade risk control administered by an FCM.” Industry Group III 15 n.12. One commenter also suggested that limiting the exclusion to instances where a clearing member had risk controls in place would incentivize market participants to move away from the use of executing FCMs and give-up arrangements.

See

Bloomberg 7.

Milliman III 2.

QIM III 1.

Commenters offered a variety of alternate definitions of DEA, with the intent that DEA not capture certain types of market participants. Bloomberg and TT offered alternate definitions that would exclude market participants using third-party software platforms provided by FCMs.

CME offered an alternative definition that would exclude orders passing through risk controls administered by a clearing member.

FIA and the Commercial Alliance offered an alternative definition that would exclude orders that are first routed through an order routing system under the control of an FCM.

Better Markets proposed a definition that would take into consideration colocation and the use of FCM-provided software.

Nadex supported defining DEA, consistent with existing Commission § 38.607, as “allowing customers of FCMs to enter orders directly into a DCM's trade matching system for execution.”

Similarly, Nodal commented that the definition of DEA in § 38.607 “is an accurate definition of Direct Electronic Access that does not need revision.”

Bloomberg 8-9; TT 3.

CME 12.

FIA 6; Commercial Alliance 6.

Better Markets III 4.

Nadex III 2.

Nodal 2.

C. Substance of New Proposal

The Commission proposes to amend the definition of DEA in § 1.3(yyyy) of the NPRM to address the comments summarized above, including with respect to potential ambiguities in the NPRM's definition of DEA. At the same time, the Supplemental NPRM retains DEA as one of the criteria for defining who must register as a New Floor Trader. The addition of the volume threshold test pursuant to Supplemental proposed § 1.3(x)(2) will act as a further filter for New Floor Traders, limiting registration to large market participants. This will limit AT Person status and its attendant obligations to only those market participants who meet the volume threshold test.

The Commission intends for the amended proposed definition of DEA to cover any arrangement where a market participant electronically transmits an order, modification or cancellation to a DCM. However, the amended proposed definition

excludes

from the definition of DEA any orders submitted by an FCM where the FCM receives such order from an unaffiliated natural person by means of written or oral communication. As noted in Section III(A) above, an “unaffiliated” natural person is one who has no affiliation with the FCM receiving the order for submission to a DCM. Similarly, the natural person's employer can have no affiliation with such FCM.

The NPRM definition of DEA exempted orders that were “routed through” a clearing FCM. After receiving comments requesting clarification on this phrase, the Commission proposes changing the definition of DEA so that it does not include orders electronically submitted to a DCM by an FCM that such FCM first receives from an unaffiliated natural person by means of oral or written communications. The Commission believes that this revision clarifies which order submission methods are DEA, and which are not, for purposes of Regulation AT. The Commission expects that the language in which an FCM electronically submitting orders first received from an unaffiliated natural person by means of oral or written communications will only encompass situations where the FCM is acting in a true intermediating role:

i.e.,

where the FCM receives an order from a third-party (who may or may not be a Commission registrant) and the FCM then submits such order to a DCM for or on behalf of the third party. Each element of Supplemental proposed § 1.3(yyyy) is intended to emphasize an FCM's active, involved intermediation as a necessary condition for non-DEA order submission, modification, or cancellation. Accordingly, non-DEA orders must be received by an FCM orally or in writing, from a natural person, who is unaffiliated and whose employer is unaffiliated with the FCM.

Because technological innovations have created, and may continue to create, new methods for market participants to connect to DCMs, the Commission has determined not to differentiate between currently existing connection types. Instead, the amended proposed definition would capture all electronic order submissions to a DCM as DEA, unless the order is first received by an FCM from an unaffiliated natural person by means of written or oral communication prior to being submitted to the DCM by the FCM.

To identify specific connection types in this definition—such as connection through a DCM's application program interface (“API”)—risks having the definition become outdated with changes in technology while simultaneously creating uncertainty over the regulatory standing of such new technology.

The Commission understands that written or oral communications are not computer-generated, and therefore such communications would come from a natural person. The Commission notes that “written communications” may include email, text messages, or instant messaging “chat” tools, in addition to communications on paper. The common denominator is that such communications are in each instance specifically written by a natural person.

Second, the exclusion would apply only where an FCM receives an oral or written communication from a natural person for a particular order or series of orders. The exclusion would not apply to orders received through electronic systems or automated means, such as through any API or graphical user interfaces (“GUIs”) provided by an FCM. The exclusion also would not apply to any third-party ISV platforms, such as those provided by Bloomberg or TT, even if the FCM were able to calibrate or implement risk controls over customer order flow submitted through those platforms. Further, the exclusion would not apply to any orders submitted through DCM-provided APIs, such as WebICE or CME Direct. In each case, current and potential technological practices may serve to reduce or eliminate the role of an FCM or other Commission registrant as a true intermediary to the transaction.

Third, the Commission's amended proposed definition also would change the entity that must be involved in an order's transmittal to the DCM for such order not to be considered DEA. The NPRM proposal would exclude orders routed through a clearing member of a DCO to which the DCM submits trades for clearing, thus applying to clearing FCMs. The amended proposal would expand the exclusion from DEA to certain types of orders submitted by any FCM, including those FCMs that a market participant may use only to execute trades as well as those used to clear trades. This change is in response to various comments suggesting that executing FCMs could better act as gatekeepers on customer order flow than clearing FCMs.

Fourth, the amended proposal differs from the NPRM proposal in that the definition of DEA proposed in this Supplemental NPRM applies explicitly to modifications and cancellations of orders, not only initial order submissions. The Commission considers this a non-substantial clarification intended to align the DEA definition with the proposed definition of Algorithmic Trading (NPRM proposed § 1.3(zzzz)).

D. Commission Questions

14. Does the amended proposed definition of DEA appropriately capture all order submission methods to which the additional filters for New Floor Trader status (

i.e.,

Algorithmic Trading and the volume threshold test) should be applied?

IV. Algorithmic Trading Source Code Retention and Inspection Requirements

A. Overview and Policy Rationale for New Proposal

The Commission proposed NPRM § 1.81(a)(vi) to ensure that source code is preserved and available to the Commission when necessary. The NPRM required that AT Persons maintain a “source code repository” and make it available for inspection in accordance with existing § 1.31. The requirements proposed in the NPRM were intended to be consistent with the Commission's traditional statutory and regulatory authorities governing recordkeeping and access to records; however, as explained below, some commenters misconstrued the proposal as requiring more than the Commission intended. Specifically, NPRM proposed § 1.81(a)(vi) did

not

require the transfer of all source code to the Commission or other third party for centralized storage. It also did not require that AT Persons provide their Algorithmic Trading Source Code to the Commission on a regular basis.

Comments received in response to NPRM proposed § 1.81(a)(vi) expressed intellectual property and information security concerns among numerous market participants and other observers. The Commission appreciates these concerns, including the commercial and enterprise value of market participants' Algorithmic Trading Source Code. The Commission is proposing to revise NPRM proposed §§ 1.81(a)(1)(v) and (vi) as reflected in Supplemental proposed § 1.84. This new proposal directly addresses commenters' concerns regarding Commission access to source code in several respects. Most importantly, access to Algorithmic Trading Source Code would not be governed by § 1.31. Instead, access to Algorithmic Trading Source Code and related records described in the proposed rule would require a subpoena approved by the Commission pursuant to part 11 or a “special call” which must also be approved by the Commission itself, a heightened procedural step that responds to concerns raised by market participants.

Through Supplemental proposed § 1.84, the Commission is endeavoring to balance its responsibility to oversee markets and market participants—including the operation of ATSs which have become highly pervasive in modern electronic markets—with market participants' strongly-held privacy and confidentiality concerns. Ultimately, it is imperative that the Commission have access to all information necessary for effective

regulatory oversight, including market surveillance and maintaining the safety and soundness of markets. The Commission believes that Supplemental proposed § 1.84 strikes an appropriate balance between regulatory needs and privacy concerns.

The Commission emphasizes that recordkeeping and Commission access to books and records are central to the Act's statutory framework for the oversight of regulated derivatives markets. Sections 4g, 4n(3)(A), 4r(c), and 4s(f)(1)(C) of the Act require all registrants and registered entities to maintain books and records, and provide for prompt access by the Commission and its staff. They include nearly identical language stating that registrants and registered entities shall keep books and records in such form and manner and for such period as may be required by the Commission; and shall keep such books and records open to inspection by any representative of the Commission.

These core statutory provisions recognize that the Commission must have adequate information to oversee markets and market participants subject to its jurisdiction.

Required books and records include not only those that must be reported to the Commission on a routine basis, but also books and records that registrants must maintain in their own possession and make available upon request by the Commission or its staff. The Act and Commission rules contemplate a range of mechanisms to obtain books and records, from prompt production to Commission staff through on-site inspection,

to subpoenas in investigative proceedings pursuant to part 11 of the Commission's regulations.

17 CFR 1.31.

See

Section 4g(a) of the Act, 7 U.S.C. 6g(a); Section 4n(3)(A) of the Act, 7 U.S.C. 6n(3)(A); Section 4r(c) of the Act, 7 U.S.C. 4r(c); and Section 4s(f)(1)(C) of the Act, 7 U.S.C. 6s(f)(1)(C). Sections 1.31 and 1.35 of the Commission's rules build on these statutory provisions by requiring registrants to keep full, complete, and systematic records, and to produce such records as required by any representative of the Commission.

See

17 CFR 1.35; 17 CFR 1.31. Records must be kept for at least five years, and must be “readily accessible” during the first two years.

See

17 CFR 1.31(a)(1). Records must be produced to the Commission in a form specified by any representative of the Commission, and production shall be made, at the expense of the person required to keep the book or record.

See

17 CFR 1.31(a)(2).

In addition to the statutory authority cited above under Sections 4g, 4n(3)(A), 4r(c), and 4s(f)(1)(C) of the Act, the Commission notes that Section 8a(5) of the Act provides additional authority for the proposed recordkeeping and inspection rules. Section 8a(5) authorizes the Commission to make and promulgate such rules and regulations as, in the judgment of the Commission, are reasonably necessary to effectuate any of the provisions or to accomplish any of the purposes of this Act. 7 U.S.C. 12a(5).

See

17 CFR 1.31(a)(2).

As a civil law enforcement agency, the Commission handles sensitive, proprietary and trade secret information under strict retention and use requirements.

Further, cybersecurity and the protection of confidential information are a top priority for the Commission.

The Commission receives confidential information on a daily basis in a variety of contexts, and takes its legal obligation to protect such information seriously. The Commission has significant data security measures in place to protect sensitive information from internal or external threats. In addition, all current and former CFTC employees are prohibited by 17 CFR 140.735-5 from disclosing confidential or non-public commercial, economic or official information to any unauthorized person, or releasing such information in advance of authorization for its release.

See

Section 8(a) of the Act, 7 U.S.C. 12(a) (providing that except as otherwise specifically authorized in the Act, the Commission may not publish data and information that would separately disclose the business transactions or market positions of any person and trade secrets or names of customers); Section 8(e) of the Act, 7 U.S.C. 12(e) (providing that the Commission shall not furnish any information to a foreign futures authority or to a department, central bank and ministries, or agency of a foreign government or political subdivision thereof unless the Commission is satisfied that the information will not be disclosed by such foreign futures authority, department, central bank and ministries, or agency except in connection with an adjudicatory action or proceeding brought under the laws of such foreign government or political subdivision to which such foreign government or political subdivision or any department, central bank and ministries, or agency thereof, or foreign futures authority, is a party); 17 CFR 145.5 (providing that the Commission may decline to publish or make available to the public certain nonpublic records, including records specifically exempted from disclosure by statute, including data and information which would separately disclose the business transactions or market positions of any person and trade secrets or names of customers);

see also

5 U.S.C. 552(b)(4) (providing exemption from FOIA for trade secrets and commercial or financial information obtained from a person and privileged or confidential).

See

System Safeguards Testing Requirements, Final Rule, 81 FR 64272 (Sept. 19, 2016); System Safeguards Testing Requirements for Derivatives Clearing Organizations, Final Rule, 81 FR 64322 (Sept. 19, 2016).

In sum, this Supplemental NPRM and the Algorithmic Trading Source Code amendments proposed herein achieve four important goals. First, the Commission is clarifying its intent regarding Algorithmic Trading Source Code. The Commission's interest is in ensuring that Algorithmic Trading Source Code is preserved by AT Persons and that it be available for inspection by the Commission when needed to investigate, understand, and respond, for example, to significant market events, including market disruptions and failures of the price discovery process. The Commission does not seek routine access to Algorithmic Trading Source Code, nor is it requiring that Algorithmic Trading Source Code be provided to repositories maintained by the CFTC or a third party.

Second, the Commission is proposing to codify in Supplemental proposed § 1.84(b) that any access to Algorithmic Trading Source Code must be authorized by the Commission itself. Such access could be authorized via subpoena, in an investigatory proceeding pursuant to part 11 of the Commission's regulations, or via special call authorized by the Commission and executed by the Director of the Division of Market Oversight (“DMO” or “Division”) pursuant to Supplemental proposed § 1.84(b). The Commission notes that the different methods of access to source code—subpoena or special call—depend on whether Commission staff is: (1) Formally investigating potential violations of law; or (2) carrying out its market oversight responsibilities. Subpoenas are typically issued in connection with enforcement investigations. The proposed special call authority and process is intended to require similar Commission approval, but to recognize, for example, the potential need for DMO to review source code, such as in association with unusual trading events or market disruptions. While some commenters recommended that the Commission rely on subpoenas for access to source code in all circumstances, the Commission believes it is important to distinguish investigatory proceedings from access to records by DMO in connection with market surveillance and related work.

However, both the subpoena and the special call would require approval by the Commission itself.

The Commission notes that it would continue to possess subpoena authority with respect to source code, as it does today.

The Commission notes Supplemental proposed § 1.84's emphasis on access to Algorithmic Trading Source Code and related files in support of the Commission's market and trade practice surveillance functions. In executing the special call, communications from DMO to the AT Person could specify further procedures undertaken by the Division to help ensure the security of records provided. For example, the Division could specify the means by which it will access Algorithmic Trading Source Code or other records required by the special call, including on-site inspection at the facilities of the AT Person; the provision of records to the Commission on secure storage media or on

computers lacking network connectivity; or the transfer of records to secure Commission systems with controlled access.

Third, and building on public comments regarding additional information necessary for the Commission to understand the operation of Algorithmic Trading in regulated markets, the Commission is proposing in Supplemental proposed § 1.84(a)(3) that AT Persons be required to keep records of log files generated in the ordinary course by their ATSs. Absent subpoena, access to such log files would also be limited to special call by the Commission. As with other regulatory records, both Algorithmic Trading Source Code and log files would be required to be maintained for a period of five years.

Pursuant to Supplemental proposed § 1.84(b)(2), AT Persons would be required to maintain records “in a form and manner that ensures the authenticity and reliability of the information in such records,” and would also be required to have available “systems to promptly retrieve and display” records required to be maintained under Supplemental proposed § 1.84.

See

Supplemental proposed § 1.84(a).

In this regard, Supplemental proposed § 1.84(b)(2) is modeled on existing Commission recordkeeping rules in § 1.31, which also call for persons subject to recordkeeping to maintain capabilities by which the Commission can view required records.

Finally, consistent with section 8(a) of the CEA, the Commission is emphasizing in Supplemental proposed § 1.84(b)(3) that key confidentiality protections would apply to any records provided to the Commission pursuant to § 1.84. The Commission notes that section 8 of the Act and other Commission rules governing confidential information would apply to Algorithmic Trading Source Code and related files even in the absence of Supplemental proposed § 1.84(b)(3).

In this regard, Supplemental proposed § 1.84(b)(3) is intended to emphasize the confidential nature of any Algorithmic Trading Source Code provided to the Commission. The protections of section 8 would apply even absent codification by the Commission in Supplemental proposed § 1.84(b)(3). Section 8 provides, among other things, that except as otherwise specifically authorized the Commission may not publish data and information that would separately disclose the business transactions or market positions of any person and trade secrets or names of customers.

See

7 U.S.C. 8(a)(1).

B. NPRM Proposal and Comments

The NPRM proposed that each AT Person maintain a “source code repository” to manage source code access, persistence, copies of all code used in the production environment, and changes to such code. The NPRM further required that such source code repository would include an audit trail of material changes to source code that would allow AT Persons to determine, for each such material change: Who made it; when they made it; and the coding purpose of the change. The NPRM also required that AT Persons maintain source code in accordance with § 1.31.

Several commenters expressed support for the proposal that source code should be a required record under Commission rules.

Better Markets called the source code provisions “the most important and effective provision in the proposed rule” and noted “the clear and many benefits arising from the Commission's ability to perform post-mortems after disruptive market events.”

Better Markets pointed out that “it is crucial that regulators have access to HFT algorithm source code, rather than facing the impossible task of reconstructing manipulative algorithms from market data alone.”

Another commenter stated that if an algorithm or source code has caused, or has the potential to cause, damage to the U.S. financial markets, regulators have not only a right, but a duty to inspect source code.

MFA supported a source code and audit trail record retention requirement, but objected to a source code “repository.”

MFA stated that it understands the Commission's need “to be able to obtain and review confidential, proprietary material that trading firms and other businesses maintain. We also understand the need for a preservation requirement that will ensure that the source code and any audit trails that are relevant to a given investigation be preserved and be made available to the Commission . . . when appropriate.”

100

MFA recommended that the Commission adopt a principles-based rule requiring that market participants adopt a mechanism to preserve source code, produce current and prior versions of such source code, and track material change to the source code.

101

AIMA commented that it is “supportive of an obligation for AT Persons to maintain internal source code repositories.”

102

AFR 3; Better Markets 2; Better Markets III 2-3; Shatto 1; Summers 1.

Better Markets 2.

Better Markets 2-3.

Summers 1.

MFA 3, 21.

100

MFA 21.

101

MFA III 3.

102

AIMA III 4.

Many commenters expressed concerns about the confidentiality of source code, and in particular making source code subject to § 1.31.

103

Several stated that source code should only be available pursuant to a subpoena,

104

which some described as a procedural safeguard.

105

Others, such as FIA and Mercatus, noted the potential impracticality of certain requirements of § 1.31 in the context of source code, such as duplicate storage, indexes of stored records, and the potential retention of a third-party technical consultant with access to the records.

106

103

MFA 29; ISDA 6; NASDAQ 2; Two Sigma 4; CCMR 5; FIA A-49, 54; Mercatus 6.

104

AIMA 10-11; AIMA III 5; Barnard 2; Citadel 2; FIA A-48; Hudson Trading 3; KCG III 4-5; ICE 7; ICE III 4; ISDA 6; MFA 23; MFA III 3; MGEX 24-25; MMI 5; Commercial Alliance 12; QIM 5; TraderServe 1; TT 7; Two Sigma 4-5.

105

Industry Group 6.

106

FIA A-54; Mercatus 6.

Numerous commenters described source code as valuable intellectual property and raised concerns about information security if source code were to be provided to regulators.

107

Some raised the possibility that source code stored on government servers or government-mandated repositories could be vulnerable to cyberattack and other system breaches or misappropriation.

108

Some commenters took the position that making source code subject to § 1.31 would violate Constitutional protections.

109

107

Hudson Trading 1-2; IAA 10; ICE 7; ISDA 6; ITI 2, 4; MMI 3; Commercial Alliance 12; Nadex 7; Two Sigma 2; Virtu 3; TT 4, 3 n.2; QIM 2.

108

LCHF 3; Mercatus 6; MFA 22, 24, 25; CTC 9-10; IAA 10; CCMR 4-5; MMI 3-4; MMI III 2; Commercial Alliance 12; Chamber of Commerce III 2, 4-5; NIBA 2; QIM 5; TT 4; Two Sigma 2, 3, 6; Mercatus 6; AIMA 10; FIA A-52; Bloomberg 2-3; Citadel 2; SIFMA 16.

109

ITI 2; FIA A-46; MMI 4; MMI III 1-2; TT 4.

Several commenters questioned the scope of the records to be retained as source code.

110

MMI stated that “source code” should be defined to avoid confusion.

111

FIA stated that “it is not clear under § 1.81(a)(vi) whether the referenced source code refers to Algorithmic Trading code only, or includes the code of `related systems' or separate `software' as well.”

112

One commenter even speculated that the rule might be broad enough to require Microsoft to permit inspection of the code underlying its Excel program if a trader developed an algorithm using an Excel spreadsheet.

113

110

FIA A-47; MMI 2; TT 3-4.

111

MMI 2.

112

FIA A-47.

113

TT 4.

Several commenters and Roundtable participants noted that a review of source code alone without additional context would be insufficient to identify the cause of a trading discrepancy.

114

Several commenters also posited that source code would be unintelligible to regulators,

115

or that the CFTC lacked the resources to understand it.

116

Several participants at the Roundtable suggested that it may be necessary to review log files in order to gain further context regarding trading activity under review.

117

Participants indicated that a review of log files might assist in identifying a trigger for specific trading behavior such as market data, a change in parameters, or a component of source code.

118

114

ITI 6; MMI 2; TT 5.

115

Hudson Trading 1-2; MMI 2; TraderServe 2; ITI 6; MMI 2; TT 5-6.

116

ITI 5; Weaver 2.

117

KCG Holdings II, Roundtable Tr. 263:2-13 (one of the first items to look at when addressing a trading discrepancy would be “log files to see was it a data issue, incoming data issue, was it something that was part of the algorithm, was it a control that misfired. You'd look at the log data to see if there's anything in there that would start to point you in a direction of where the issue might become. At that point in time you might bring in a developer to help walk through the code.”); TT II, Roundtable Tr. 264:9-11 (noting that a developer would “probably comb through log files” to narrow down where a discrepancy occurred).

118

Optiver II, Roundtable Tr. 267:18-268:21 (describing “looking in the log file . . . to figure out . . . the trigger for . . . [an] order,” including whether it was “human interaction, . . . market data, a “change in parameters,” or “source code.”).

C. Substance of New Proposal

Through this Supplemental NPRM, the Commission is proposing to replace NPRM § 1.81(a)(1)(vi) with Supplemental proposed § 1.84, entitled “Maintenance of records of Algorithmic Trading Source Code and related records.”

119

Supplemental proposed § 1.84 requires AT Persons to retain three categories of records for a period of five years: (1) Algorithmic Trading Source Code; (2) records that track changes to Algorithmic Trading Source Code; and (3) log files that record the activity of the AT Person's Algorithmic Trading system.

120

These records would be required to be maintained in their native format. Supplemental proposed § 1.84 does not require that records be generated; rather, it only requires the retention of such records to the extent they are generated by an AT Person (or by a third-party on behalf of the AT Person) in the ordinary course of their business. It also requires that these records be kept in a form and manner that ensures the authenticity and reliability of the information contained in the records, and that AT Persons have systems available to promptly retrieve and display the records.

121

119

The Commission notes that in addition to proposing new § 1.84 (addressing Algorithmic Trading Source Code) and § 1.85 (addressing use of third party systems or components), it has made several changes to proposed § 1.81. The Supplemental NPRM withdraws §§ 1.81(a)(1)(v) and (vi). Provisions relating to documenting the strategy and design of Algorithmic Trading software and maintenance of Algorithmic Trading Source Code are now contained in Supplemental proposed §§ 1.84 and 1.85.

In addition, NPRM proposed § 1.81(a)(1)(ii) required testing of all Algorithmic Trading code and any changes to such systems. This language has been modified so that it is consistent with the Commission's intent that the AT Person be required to test systems, not merely the source code related to such systems. The changes to the second sentence, resulting in the language in Supplemental proposed § 1.81(a)(1)(ii) that such testing shall be reasonably designed to effectively identify circumstances that may contribute to future Algorithmic Trading Events, are intended to improve clarity. The Commission deleted the provision's final sentence, “Such testing must be conducted both internally within the AT Person and on each designated contract market on which Algorithmic Trading will occur.” The Commission has also withdrawn corresponding NPRM proposed § 40.21, which had required DCMs to provide test environments to AT Persons. Supplemental proposed § 1.81(a)(1)(ii) now provides discretion to the AT Person as to where testing should occur.

120

Commenters at the Roundtable recognized that in order to assess a trading discrepancy they would need to review their own log files and potentially the source code for their trading algorithms. KCG II, Roundtable Tr. 262:17-263:10; 267:18-268:21; TT II, Roundtable Tr. 264:3-20.

121

The Commission notes that Supplemental proposed § 1.84's requirement that records be maintained in their “native format” is distinct from the proposed requirement that such records be maintained in a manner that ensures the “authenticity and reliability” of information contained in such records. The retention of a record in “native format” equates to a requirement that such record be retained in the same format as it was originally created. Authenticity and reliability, in contrast, address the accuracy of a record as genuine, unchanged iteration of the original.

Algorithmic Trading Source Code is defined broadly in Supplemental proposed § 1.3(ccccc), and is intended to capture the various types of code and related components used in connection with Algorithmic Trading. It includes computer code, hardware description language, scripts and formulas, as well as the configuration files and parameters used to carry out the trading.

122

The term Algorithmic Trading Source Code should be construed broadly to encompass field-programmable gate array (“FPGA”) technology including the logic built onto chips or embedded in electronic circuits. Logic embedded in electronic circuits is sometimes referred to as “hardware description language (“HDL”). On the other hand, Algorithmic Trading Source Code does not include the underlying code to a program used to develop a formula or algorithm (

i.e.,

Microsoft Excel).

122

Parameters include settings or variables that are relied on by an algorithm to make determinations in a system's Algorithmic Trading. For example, parameters may include settings or variables impacting order type, order quantity, order price, order side, position size, number of orders, and duration of orders.

The Commission recognizes the confidentiality and value of Algorithmic Trading Source Code. Accordingly, the Commission has endeavored in this Supplemental NPRM to enhance the procedural protections afforded to Algorithmic Trading Source Code in the rule text and to expressly reference the statutory and regulatory provisions that protect all confidential information to which the Commission has access. As a threshold matter, the Commission emphasizes that Supplemental proposed § 1.84 makes Algorithmic Trading Source Code, change logs, and log files subject to recordkeeping requirements that are

separate

from the general recordkeeping provisions under § 1.31 of the Commission's rules. Supplemental proposed § 1.84 also makes clear that these records are subject to section 8(a) of the Act.

123

Section 8(a) prohibits the release of data or information that would disclose business transactions or market positions of any person and trade secrets or names of customers, and any data or information concerning or obtained in connection with any pending investigation of any person. Separately, confidential information received by Commission employees is also subject to § 140.735-5 of the Commission's rules, which prohibits a Commission employee or former employee from disclosing, or causing or allowing to be disclosed, confidential or non-public commercial, economic or official information to any unauthorized person.

124

The Commission also notes that Section 1905 of Title 18 specifically prohibits the disclosure of confidential information, including trade secrets, by all officers or employees of the United States and any department or agency thereof, including the CFTC. Violations of this statutory provision carry significant penalties, including fines, loss of employment, and imprisonment.

125

Commission staff are

annually trained on the prohibitions against disclosing confidential or non-public commercial, economic or official information, and specifically are provided with post-employment guidance regarding these prohibitions, in addition to other applicable ethics restrictions, prior to their departure from the Commission.

123

Section 8(a) of the Act, 7 U.S.C. 12(a).

124

17 CFR 140.735-5.

125

See

18 U.S.C. 1905, which provides that whoever, being an officer or employee of the United States or of any department or agency thereof, publishes, divulges, discloses, or makes known in any manner or to any extent not authorized by law any information coming to him in the course of his employment or official duties or by reason of any examination or investigation made by, or return, report or record made to or filed with, such department or agency or officer or employee thereof, which information concerns or relates to the trade secrets, processes, operations, style of work, or apparatus, or to the identity, confidential statistical data, amount or source of any income, profits, losses, or expenditures of any person, firm, partnership, corporation, or association; or permits any income return or copy thereof or any book containing any abstract or particulars thereof to be seen or examined by any person except as provided by law; shall be fined under Title 18 of the United States Code, or imprisoned not more than one year,

or both; and shall be removed from office or employment.

Supplemental proposed § 1.84 sets out a procedure for requests for production or inspection of these records that requires Commission approval by means of a special call for the records. The Commission would also retain its existing authority to seek access to such records through a subpoena, which would typically be used in an enforcement matter. If the Commission approves a special call, it may authorize the Director of the Division of Market Oversight to execute the special call, and may also authorize the Director to specify the form and manner in which the required records must be produced. The Commission notes that Supplemental proposed § 1.84 does not alter any aspect of part 11 of the Commission's rules relating to investigations. For clarity, Supplemental proposed § 1.84 provides that the records required by the section must also be available by subpoena issued pursuant to part 11 of the Commission's regulations.

Supplemental proposed § 1.84(a)(2) requires that AT Persons retain records tracking material changes to Algorithmic Trading Source Code, including a record of when and by whom such changes were made, when such records are generated in the ordinary course of business. The Commission notes that this new proposed rule does not require that such records be generated, but does require that they be maintained if they are generated in the ordinary course of business.

Supplemental proposed § 1.84(a)(3) requires that AT Persons retain any logs or log files generated by the AT Person in the ordinary course of business that record the activity of the AT Person's ATS, including a chronological record of such system's actions. As noted above, this provision was added to address the concerns of some commenters that source code alone is insufficient to review trading activity of an AT Person, and the suggestion that log files may provide important context to a review of source code. The new proposal does not mandate the retention of specific log files or even the form or specific content of log files. The new proposal simply requires that log files be retained to the extent such files are generated in the ordinary course of business. The Commission recognizes that various exchanges require persons with direct access to maintain audit trails with detailed information about trading activity.

126

The Commission expects that log files will contain a similar level of detail and in some cases a greater level of detail than the electronic audit trails required by these exchanges. To the extent log files are generated, they must be maintained in a form and manner that ensures the authenticity and reliability of the information contained in the records. In addition, AT Persons must have systems available to promptly retrieve and display these records to the Commission in the event of a special call.

126

For example, ICE Futures U.S. Rule 27.12A requires certain clearing members and direct access members to maintain electronic audit trials of electronic orders submitted through direct access connections. CME Rule 536.B.2. also requires an electronic audit trail for systems accessing the CME Globex platform through the CME iLink gateway. Both CME and ICE require the retention of these electronic audit trails for five years.

D. Commission Questions

15. Please comment on whether, through Supplemental proposed § 1.84, the Commission has appropriately balanced its responsibility to oversee markets and market participants with the privacy and confidentiality concerns that market participants have raised with respect to access to Algorithmic Trading Source Code.

16. Please comment on the Commission's determination to obtain access to Algorithmic Trading Source Code via special call, rather than have such access be governed by § 1.31.

17. Is the definition of “Algorithmic Trading Source Code” sufficiently clear to allow AT Persons to comply with the recordkeeping requirements in Supplemental proposed § 1.84? Which, if any, components of Algorithmic Trading systems should be added to the definition of Algorithmic Trading Source Code? Which, if any, should be excluded?

18. Are log files described in sufficient detail in the Supplemental NPRM? Please explain why or why not.

19. The NPRM's Question 131 (NPRM at 78913) sought comment on NPRM proposed § 1.81(a)'s standards for the development and testing of Algorithmic Trading systems and procedures, including requirements for AT Persons to test all Algorithmic Trading code and related systems and any changes to such code and systems prior to their implementation. The Commission renews that question here as to Supplemental proposed § 1.84(a). Are any of the requirements of Supplemental proposed § 1.84(a) not already followed by the majority of market participants that would be subject to § 1.84(a) (or some particular segment of market participants), and if so, how much will it cost for a market participant to comply with such requirement(s).

20. If a firm uses FPGA or a similar technology, how would it record the design of the programming?

21. How do firms store or record configurations and parameters that impact their trading system? For example, are these components stored or recorded in their Algorithmic Trading Source Code or log files?

22. If a firm uses a chip or FPGA as a part of its ATS, how does it describe the records?

V. Testing, Monitoring and Recordkeeping Requirements in the Context of Third-Party Providers

A. Overview and Policy Rationale for New Proposal

Regulation AT, as proposed in the NPRM, required AT Persons to comply with a number of standards regarding pre-trade risk controls and other measures; the development, testing and supervision of ATSs; and the retention and potential production of source code. In order to be effective, Regulation AT should be uniformly applied across the breadth of business arrangements that AT Persons may elect to pursue. As detailed below, commenters to the NPRM's proposed rules noted that AT Persons whose ATSs are sourced in whole or in part from third parties face challenges in complying with certain elements of NPRM proposed §§ 1.80 and 1.81. The Commission has considered these comments and is sensitive to the concerns raised. However, the use of third-party systems should not exempt market participants from compliance with regulatory standards designed to increase the safety and soundness of Algorithmic Trading. The rules set forth in Supplemental proposed § 1.85 seek to strike an appropriate balance by permitting AT Persons to comply with certain elements of §§ 1.81 and 1.84 through a combination of certifications from their service providers, due diligence by the AT Persons and, in most cases,

127

a retention of legal

responsibility for compliance with the rules by the AT Person.

128

127

As discussed below, Supplemental proposed § 1.85(d) requires that an AT Person is responsible for ensuring that records are retained and produced as required pursuant to Supplemental proposed § 1.84. A certification and due diligence alone will not satisfy an AT Person's obligation to ensure that

Algorithmic Trading Source Code is retained as required by Supplemental proposed § 1.84.

128

In the context of the Securities and Exchange Commission's (“SEC”) Market Access Rule, 75 FR 69792 (Nov. 15, 2010), the SEC allows a broker-dealer relying on third-party technology or software to perform appropriate due diligence to assure that its controls and procedures are consistent with the rule.

See

SEC, Responses to Frequently Asked Questions Concerning Risk Management Controls for Brokers and Dealers with Market Access (Apr. 15, 2014) (Question 14), available at

https://www.sec.gov/divisions/marketreg/faq-15c-5-risk-management-controls-bd.htm

B. NPRM Proposal and Comments

NPRM proposed § 1.81(a) required AT Persons to implement written policies and procedures for the development and testing of ATSs. Among other things, such policies and procedures must at a minimum include documenting the strategy and design of proprietary Algorithmic Trading software, as well as any changes to software that are implemented in a production environment, pursuant to NPRM proposed § 1.81(a)(v). NPRM proposed § 1.81(a)(vi) required an AT Person to maintain a source code repository, which included an audit trail of material changes to source code that would allow AT Persons to determine, for each such material change: Who made it; when they made it; and the coding purpose of the change. The source code was also required to be maintained in accordance with § 1.31.

Comments received.

Several commenters noted that AT Persons using third-party systems licensed or purchased from vendors or DCMs do not have access to the systems' algorithmic code, and therefore would be unable to comply with the source code provisions.

129

IAA identified this as an issue for registered CPOs and CTAs using an ISV's or other third-party's system,

130

SIFMA identified it as an issue for asset managers,

131

and AIMA identified it as an issue for buy-side participants. AIMA stated that requiring access and disclosure of third-party code, particularly best-execution algorithms, as provided in the NPRM, would cause third parties to stop providing software services to AT Persons.

132

The Commercial Alliance also confirmed that the vast majority of its members use third-party source code provided by ISVs or DCMs.

133

TT commented that the testing requirements under NPRM proposed § 1.81(a) should focus on the

output

of an ATS or software, rather than the underlying source code.

134

129

FIA A-53; ISDA 5; CME 38; AIMA 11; AIMA III 5-6; IAA 11; Commercial Alliance 12; SIFMA 15; TT III 2.

130

IAA 11.

131

SIFMA 15.

132

AIMA 11.

133

Commercial Alliance 12.

134

TT III 1.

At the Roundtable, Commission staff asked for industry comment regarding how such issues involving third-party providers should be addressed. Generally, industry participants stated that AT Persons lacked access to source code of third parties.

135

Tethys commented that AT Persons exhibit a range of control over source code;

136

while some AT Persons may write their own code, others use off-the-shelf third-party software, and others may add additional controls to third-party software as necessary.

137

TT stated that as a third-party provider, it did not provide its customers with access to its source code.

138

135

Tethys II, Roundtable Tr. 236:2-14; TT II, Roundtable Tr. 216:22-217:1-3, 250:9-13; ABN AMRO, Roundtable Tr. 249:4-10.

136

Tethys II, Roundtable Tr. 236:2-14.

137

Tethys II, Roundtable Tr. 236:2-14.

138

TT II, Roundtable Tr. 216:22-217:1-3.

Commission staff also asked for comment at the Roundtable on a potential approach where AT Persons would obtain certifications from third parties regarding development requirements and would conduct due diligence. TT said that because it provides customers with the opportunities to test algorithms built using its software,

139

it would be unnecessary and burdensome to require AT Persons to obtain certifications from third-party providers.

140

AQR, Tethys, and TT argued that it would be difficult to fairly impose a certification requirement.

141

ABN AMRO and Tethys commented that AT Persons may not have the necessary expertise to perform extensive due diligence regarding software code.

142

ABN AMRO said that customers would not want to have access to source code.

143

In addition, TT stated that the Commission can understand how technology functions without seeing source code.

144

139

TT II, Roundtable Tr. 237:17-238:6.

140

TT II, Roundtable Tr. 238:7-239:3.

141

AQR, Roundtable Tr. 240: 15-2, 242:17-243:19; Tethys II, Roundtable Tr. 240:4-14; TT II, Roundtable Tr. 239:4-15.

142

ABN AMRO, Roundtable Tr. 245:12-246:14; Tethys II, Roundtable Tr. 247:18-249:3.

143

ABN AMRO, Roundtable Tr. 249:4-10.

144

See

TT II, Roundtable Tr. 250:14-252:7; TT III 2-3.

C. Substance of New Proposal

The NPRM comments discussed above cite potential compliance challenges when AT Persons obtain their ATSs, in whole or in part, from third-party providers. Accordingly, this Supplemental NPRM proposes an alternative framework for AT Persons to comply with their obligations related to the development and testing of ATSs, and for the retention and production of Algorithmic Trading Source Code and related records.

Specifically, Supplemental proposed § 1.85 allows AT Persons who, due solely to their use of third-party system or components, are unable to comply with a particular development or testing requirement (NPRM proposed §§ 1.81(a)(1)(i), 1.81(a)(1)(iii), 1.81(a)(1)(iv), 1.81(a)(2), or Supplemental proposed §§ 1.81(a)(1)(ii) or 1.84)

145

or a particular maintenance or production requirement related to Algorithmic Trading Source Code and related records (Supplemental proposed § 1.84), to comply with such proposed regulatory obligations by satisfying two requirements: (i) Obtaining a certification that the third party is complying with the obligation; and (ii) conducting due diligence regarding the accuracy of the certification.

146

While obtaining such certifications and conducting due diligence as to their accuracy may still be challenging for some AT Persons, the Commission has determined that such requirements, at this stage, appear more practical compared to the NPRM's proposal that AT Persons themselves comply with all NPRM § 1.81 requirements. The Commission believes that the certification and due diligence requirements present a workable alternative that will ensure that all AT Persons—regardless of whether they develop their own ATSs, or use the systems of a third party—are subject to the same standards.

145

These subsections were also proposed in the NPRM, although this Supplemental NPRM proposes several changes to the text of § 1.81(a)(1)(ii).

146

The Supplemental NPRM provides flexibility and does not set forth the means by which due diligence must be conducted. The Commission expects that due diligence may take a variety of forms, all of which can potentially be effective in helping AT Persons fulfill their regulatory obligations pursuant to Supplemental proposed § 1.85. Due diligence may include, for example, a combination of (1) information gathering, including with respect to prevailing best practices and a third party's own practices; (2) on-site inspection; (3) communications between the AT Person and its third-party provider, including in writing, in person, via email, and telephone or video; and (4) review and evaluation of files, documents, and other information gathered. The Commission offers this list by way of example only, and notes that each AT Person should arrive at its own determination regarding an appropriate due diligence process. The Commission encourages each AT Person making use of Supplemental proposed § 1.85 to perform such diligence as is necessary for the AT Person to have comfort that the underlying substantive regulatory requirements are being met.

Supplemental proposed § 1.85(d) requires that, in all cases, an AT Person is responsible for ensuring that records are retained and produced as required pursuant to Supplemental proposed § 1.84.

147

In other words, an AT Person's certification and due diligence will establish that it has complied with testing obligations pursuant to NPRM proposed §§ 1.81(a)(1)(i), 1.81(a)(1)(iii), 1.81(a)(1)(iv), 1.81(a)(2), or Supplemental proposed § 1.81(a)(1)(ii), but certification and due diligence alone will not satisfy an AT Person's obligation to ensure that Algorithmic Trading Source Code is retained and produced as required by Supplemental proposed § 1.84. Even where an AT Person obtains a certification and conducts due diligence with respect to a third party's obligations, the AT Person will remain responsible for ensuring that Algorithmic Trading Source Code retention and production requirements are met. For example, if the Commission were to issue a special call or a subpoena to an AT Person for the production of Algorithmic Trading Source Code maintained by a third party, the AT Person would be responsible for complying with the Commission request, regardless of the certification or the due diligence performed by the AT Person. Such compliance could be achieved by making sure that the third party produced the required records, but a failure by the third party to produce such records would not relieve the AT Person of its own obligations.

147

The proposed rules do not require that the certifications be filed with the Commission. However, the certifications would be subject to § 1.31 recordkeeping requirements.

Pursuant to the Commission's Supplemental proposal, AT Persons may not rely on § 1.85 for any element of §§ 1.81(a)(1) and 1.84 with which they have the ability to comply. For example, an AT Person who uses a combination of third-party and internally developed ATS components would be expected to comply with NPRM proposed §§ 1.81(a)(1)(i), 1.81(a)(1)(iii), 1.81(a)(1)(iv), 1.81(a)(2), and Supplemental proposed §§ 1.81(a)(1)(ii) and 1.84 for all such components that the AT Person itself develops or modifies. The Commission also notes that Supplemental proposed § 1.85 provides an alternative means of compliance in circumstances where the use of a third-party system or component is the

sole

reason why an AT Person cannot otherwise comply with its obligations. Although an AT Person may be motivated to make use of Supplemental proposed § 1.85 for reasons of potential costs or administrative ease, such considerations are not permissible rationales for use of Supplemental proposed § 1.85.

In many cases, the Commission expects that AT Persons and third parties will each have developed different portions of an ATS. If an AT Person develops an algorithm using third-party software, the AT Person would remain responsible for development and testing requirements with respect to the algorithm, and for the retention and production of Algorithmic Trading Source Code and related records requirements for that algorithm. Further, whether a third-party certification is appropriate under Supplemental proposed § 1.85 may depend on the amount of control the AT Person has over the development of algorithms it employs. If the AT Person, for example, has a limited ability to affect or modify an algorithm, then the Commission expects that the AT Person would comply with NPRM proposed §§ 1.81(a)(1)(i), 1.81(a)(1)(iii), 1.81(a)(1)(iv), 1.81(a)(2), and Supplemental proposed §§ 1.81(a)(1)(ii) and 1.84 by obtaining a certification and conducting due diligence pursuant to Supplemental proposed § 1.85. However, the Commission notes that as to Supplemental proposed § 1.84 requirements, the AT Person remains responsible for compliance with Algorithmic Trading Source Code retention and production requirements are met.

The Commission expects that the certifications required by Supplemental proposed § 1.85 would, at a minimum, list the specific regulatory obligations that the third party is certifying compliance with, describe the component of the ATS at issue (or the whole system, if applicable), and explain how such component or system complies with the regulatory obligation. The Commission recognizes that some system components may be standard products offered to multiple customer trading firms, and others may be custom-designed for one customer trading firm. With respect to standard products, the third party's certification may take the same form for multiple customers.

Supplemental proposed § 1.85(b) requires that the AT Person must obtain a certification each time there has been a material change to such third-party provided systems or components. Accordingly, there is no specific periodic deadline for certification; rather, the third party must only re-certify when there has been a material change. The Commission intends that the due diligence requirement imposed by Supplemental proposed § 1.85(c) includes an obligation on AT Persons to determine whether a material change to third-party provided systems or components has occurred.

The Commission understands that AT Persons who use third-party system components or Algorithmic Trading Source Code may not have the same level of development and testing expertise as third-party providers who routinely develop such systems or code. Accordingly, the due diligence required to be performed by the AT Person under Supplemental proposed § 1.85(c) is limited to the accuracy of the certification. Due diligence may require the involvement of technology support staff from the AT Person, but detailed technical audits are not required on behalf of the AT Person with respect to Supplemental proposed § 1.85(c).

D. Commission Questions

23. The Commission invites comment on all aspects of Supplemental proposed § 1.85.

24. Should the requirements for AT Persons who develop their own systems and code differ from requirements imposed on AT Persons that use systems or components provided by a third party? If so, how should the requirements be different, while continuing to ensure a consistent baseline of effectiveness in the development and testing of ATSs?

25. What specific steps should AT Persons take when conducting due diligence of the accuracy of a certification from a third party, as required by Supplemental proposed § 1.85? Should proposed § 1.85(c) provide greater detail with respect to such due diligence? For example, should due diligence be required to specifically include review of technical design information, testing protocols and test results, documented dialogue between staff of the AT Person and the third party, or other measures?

26. Supplemental proposed § 1.85(b) requires that the AT Person must obtain a certification each time there has been a material change to third-party provided systems or components. What is a reasonable estimate as to the average frequency of such material changes? Should the Commission base the certification requirement on another timing metric?

VI. Changes to Overall Risk Control Framework

A. Change From Three Level to Two Level Risk Control Framework

1. Overview and Policy Rationale for Proposal

In the NPRM, the Commission sought to take a principles-based approach to addressing the potential risks associated with Algorithmic Trading.

148

NPRM proposed §§ 1.80, 1.82, 38.255 and 40.20 imposed pre-trade risk control and other requirements, such as order cancellation systems, at three points in the order submission and execution chain: AT Persons, FCMs and DCMs. The NPRM approach proposed to allow the relevant entity—AT Person, FCM, or DCM—discretion in the design and parameters of such controls. In general, while some commenters supported the multi-layered approach described above, numerous commenters viewed the framework as unnecessarily redundant and prescriptive. Accordingly, the Commission in this Supplemental NPRM proposes a risk control framework with controls at two, rather than three, levels: (i) AT Person or FCM; and (ii) DCM. The Commission believes that this structure still achieves the goal of protecting market integrity, while simultaneously reducing the complexity of the risk controls and overall costs of compliance.

148

See

NPRM at 78837-78839.

By requiring two levels of risk controls, mistakes or omissions made at one level will have a backstop, potentially mitigating the possibility of a trading disruption. Because the unexpected or disruptive behavior of an algorithm would affect other market participants at the DCM level, thus leading to potential system risk, the Commission is requiring DCM controls for all electronic orders, regardless of source. The second set of controls may be implemented at either the AT Person or the FCM level, depending on whether an order is originated by AT Person or non-AT Person market participant. In addition, under specific circumstances, AT Persons will have discretion to delegate certain of their pre-trade risk control functions to an FCM, if they so choose. The Supplemental proposed rules continue to provide discretion in how entities design and calibrate the controls. Further, as discussed below, the Commission has revised the rules to allow greater flexibility for AT Persons, FCMs and DCMs to determine the level of granularity at which controls are set.

2. NPRM Proposal and Comments

As discussed above, NPRM proposed §§ 1.80, 1.82, 38.255 and 40.20 imposed risk control and similar requirements, such as order cancellation systems, at three levels: the AT Person, FCM and DCM.

Comments Received.

The Commission received numerous comments on the proposed risk control structure during the Initial Comment Period, the Second Comment Period, and at the Roundtable. As discussed in more detail below, some commenters during the Second Comment Period and at the Roundtable suggested a two-level structure instead of the three level structure proposed in the NPRM. For example, the Industry Group suggested a framework in which responsibility for implementing appropriate pre-trade risk controls lies either (i) with the FCM registrant that is facilitating access to the DCM, or (ii) in the case of a market participant that is not trading through the risk controls of an FCM, with that participant. Industry Group further stated that in both cases, the pre-trade risk controls must be supplemented by DCM-provided risk controls configured by the member of the DCO that grants access to the DCM.

149

CME suggested a similar approach, commenting that: “Two layers of market risk controls would apply to all Algorithmic Trading orders. The first layer would be administered by either an AT Person or the gatekeeper clearing member, and could be developed internally or obtained from an independent third-party source (such as the DCM or a software provider). The second layer would be developed and administered by the DCM.”

150

The framework proposed in this Supplemental NPRM involves a similar two-level approach, which is intended to address the complexity and cost concerns expressed by Industry Group, CME and other commenters.

149

Industry Group 8.

150

CME III 9-10.

Further, some commenters supported expanding risk controls requirements to all electronic orders, rather than applying controls to only algorithmic trading orders. For example, the Industry Group stated that “all electronic trading must be subject to pre-trade and other risk controls administered by a CFTC registrant that are appropriate to the nature of the activity.”

151

ICE stated that “all market participants that engage in electronic trading on a DCM should maintain . . . risk controls, regardless of how market participants access a DCM or whether the market participants engage in algorithmic trading.”

152

The Commission has addressed such comments by expanding the scope of the risk control requirements to include Electronic Trading. Further detail on the addition of Electronic Trading to Regulation AT's risk control framework is discussed below in Section VI(B), and discussion of the relevant new definitions related to such changes is provided in Section VI(C).

151

Industry Group 8.

152

ICE III 2.

Numerous commenters opposed the NPRM's proposed three-level approach to risk controls or otherwise characterized it as a “one size fits all” model. Specifically, FIA, CME, ICE, MFA, Nadex, NIBA, SIFMA and Mercatus indicated that the multiple layers of risk controls across the market—at the AT Person, clearing member FCM, and DCM levels—are too prescriptive, duplicative, costly and inefficient.

153

FIA, CME, OneChicago, LCHF and QIM commented that Regulation AT's required duplication of risk controls across the lifecycle of a trade actually introduces risk.

154

CME, MFA, SIFMA and NIBA characterized the proposed rules as a “one size fits all” model that doesn't appropriately take into account the different types of automated systems, business, or operational size of market participants.

155

FIA did not support requiring every market participant to implement its own risk controls; rather, such controls could be provided by FCMs or DCMs.

156

153

FIA 5; CME 6, A-14; ICE 8; Mercatus 4-5; MFA 4-5; Nadex 3; SIFMA 20; NIBA 1.

154

FIA 7, A-25; CME A-11; OneChicago 3; LCHF 2-3; QIM 2.

155

CME A-11; MFA 2, 4; SIFMA 20; NIBA 1.

156

FIA 4, A-24.

In contrast, other commenters supported the multi-layered approach (either fully or with reservations that the approach could create some risks), or supported more centralized controls at the FCM and DCM levels. Specifically, IATP supported a multi-layered approach to risk controls and believed it will mitigate the risks of algorithmic trading.

157

In addition, AIMA supported the principle that risk controls are to be maintained at three levels—the exchange, the clearing member and the trading firm.

158

LCHF also recommended a three-level structure for risk controls.

159

Virtu generally

supported a multi-layered approach to risk controls as well, but warned of potential risks if the multiple controls are applied or calibrated independently, since market participants may not be able to predict which orders will reach the order book and which may be screened by a “downstream” risk layer.

160

Similarly, MFA and LCHF acknowledged that multiple risk filters across different entities may reduce the probability that a wrong message reaches the market, but stated that such redundancy may be inefficient or increase complexity and possible errors if the risk parameters are not coordinated properly.

161

157

IATP 7.

158

AIMA 7.

159

LCHF 2-3. LCHF recommended a structure with risk controls at (1) the tradi

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.