Advisory regarding use of AI in CFTC regulated markets.

Summary: Advisory regarding use of AI in CFTC regulated markets.

1

CFTC Letter No. 24-17 Advisories December 05, 2024

U.S. COMMODITY FUTURES TRADING COMMISSION

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

Telephone: (202) 418-5000

Facsimile: (202) 418-5521

www.cftc.gov

CFTC Staff Advisory

Division of Clearing and Risk

Division of Data

Division of Market Oversight

Market Participants Division

To:

CFTC-Registered Entities and Registrants

Subject:

Use of Artificial Intelligence in CFTC-Regulated Markets

As with other technologies before it, artificial intelligence (“AI”)1 has the potential to

transform financial services, including markets regulated by the Commodity Futures

Trading Commission (“CFTC” or “Commission”). As registered entities and registrants2

(collectively, “CFTC-regulated entities”) design, develop, use, and evaluate AI products,

services, and systems, AI may eventually touch upon all or nearly all aspects of the

lifecycle of a derivatives trade. The CFTC’s Division of Clearing and Risk (“DCR”),

Division of Data (“DOD”), Division of Market Oversight (“DMO”), and the Market

Participants Division (“MPD”) (together, the “Divisions”) are issuing this staff advisory

(“Advisory”) to remind CFTC-regulated entities of their obligations under the Commodity

Exchange Act3 (“CEA”) and the CFTC’s regulations.4

Staff of the Divisions (“Staff”) is closely tracking the development of AI technology and

AI’s potential benefits and risks. This Advisory reflects Staff’s understanding of current

1 This advisory uses the term “AI” in a manner consistent with Executive Order 14110 to mean “a machine-

based system that can, for a given set of human-defined objectives, make predictions, recommendations or

decisions influencing real or virtual environments.” Executive Office of the President, Executive Order on the

Safe, Secure and Trustworthy Development and Use of Artificial Intelligence, Sec. 3(b), Oct. 30, 2023, 88 Fed.

Reg. 75191 (Nov

istent with Executive Order 14110 to mean “a machine-

based system that can, for a given set of human-defined objectives, make predictions, recommendations or

decisions influencing real or virtual environments.” Executive Office of the President, Executive Order on the

Safe, Secure and Trustworthy Development and Use of Artificial Intelligence, Sec. 3(b), Oct. 30, 2023, 88 Fed.

Reg. 75191 (Nov. 1, 2023).

2 The term “registered entity” is used as defined in 7 U.S.C. 1a(40), which references designated contract

markets (“DCMs”), derivatives clearing organizations (“DCOs”), swap execution facilities (“SEFs”), and swap

data repositories (“SDRs”). “Registrant” is used as defined in 17 CFR 1.3 to include commodity pool operators

(“CPOs”); commodity trading advisors (“CTAs”); futures commission merchants (“FCMs”); introducing

brokers (“IBs”); leverage transaction merchants; floor brokers; floor traders; major swap participants

(“MSPs”); retail foreign exchange dealers (“RFEDs”); or swap dealers (“SDs”), or an associated person of any

of the foregoing other than an associated person of a SD or MSP.

3 7 U.S.C. 1 et seq.

4 17 CFR 1 et seq.

CFTC Logo

2

CFTC Letter No. 24-17 Advisories December 05, 2024

and potential AI use cases in the derivatives markets. This Advisory is informed by the

public comments received in response to Staff’s January 25, 2024 Request for Comment on

AI5 (“AI RFC”); engagement with market participants, industry stakeholders, and U.S.

financial regulators; 6 ongoing work by the Chairman’s AI Task Force;7 guidance issued by

the White House;8 Staff’s review of materials provided by the CFTC’s Market Risk

Advisory Committee and the Technology Advisory Committee;9 and consideration of best

practices. Staff is aware that AI technology is rapidly evolving. Such changes could lead

the Divisions to reevaluate this Advisory, develop future Staff guidance, and/or

recommend that the Commission propose new regulations.

I

the White House;8 Staff’s review of materials provided by the CFTC’s Market Risk

Advisory Committee and the Technology Advisory Committee;9 and consideration of best

practices. Staff is aware that AI technology is rapidly evolving. Such changes could lead

the Divisions to reevaluate this Advisory, develop future Staff guidance, and/or

recommend that the Commission propose new regulations.

I. AI and the CEA and CFTC Regulations

Staff sets out below certain requirements under the CEA and CFTC regulations that could be

implicated by potential AI uses and risks. Staff reiterates that the discussion of such statutory

and regulatory requirements is neither exhaustive nor definitive, and that CFTC-regulated

entities must maintain compliance with applicable requirements whether they choose to

deploy AI or any other technology, either directly or by a third-party service provider. Staff

expects that CFTC-regulated entities will assess the risks of using AI and update policies,

procedures, controls, and systems, as appropriate, under applicable CFTC statutory and

regulatory requirements. In addition, as with all material system or process changes, a

CFTC-regulated entity should ensure that its adoption of AI has been reviewed for

compliance with the CEA and CFTC regulations.

This Advisory is not a compliance checklist or substitute for appropriate risk assessments or

governance by a CFTC-regulated entity. Rather, the Advisory provides a non-exhaustive list

of existing statutory and regulatory requirements that may be potentially implicated by CFTC-

regulated entities’ use of AI.

A. DCMs, SEFs, and SDRs

DCMs, SEFs and SDRs must continue to comply with all applicable CEA and regulatory

requirements, even as these entities begin to implement AI as part of normal business

practices

ulated entity. Rather, the Advisory provides a non-exhaustive list

of existing statutory and regulatory requirements that may be potentially implicated by CFTC-

regulated entities’ use of AI.

A. DCMs, SEFs, and SDRs

DCMs, SEFs and SDRs must continue to comply with all applicable CEA and regulatory

requirements, even as these entities begin to implement AI as part of normal business

practices. Applicable requirements include, but are not limited to, requirements relating

5 Request for comment on Artificial Intelligence available at:

https://www.cftc.gov/PressRoom/PressReleases/8853-24; Comments received available at:

https://comments.cftc.gov/PublicComments/CommentList.aspx?id=7479.

6 See, e.g., Treasury Department, Request for Information on Uses, Opportunities, and Risks of Artificial

Intelligence in the Financial Services Sector, 89 Fed. Reg. 50048, (June 12, 2024).

7 See Rostin Behnam, Chairman, CFTC, Keynote Speech at 2023 U.S. Treasury Market Conference (Nov. 16,

2023), available at https://www.cftc.gov/PressRoom/SpeechesTestimony/opabehnam39 (announcing the

formation of the Chairman’s AI Task Force).

8 Executive Office of the President, Executive Order on the Safe, Secure and Trustworthy Development and

Use of Artificial Intelligence, Oct. 30, 2023, 88 Fed. Reg. 75191 (Nov. 1, 2023). See also White House Office

of Science and Technology Policy, Blueprint for an AI Bill of Rights, Oct. 2022.

9 See, e.g., Market Risk Advisory Committee, Transcript of Meeting on Apr. 9, 2024, available at

https://www.cftc.gov/PressRoom/Events/opaeventmrac040924; and Subcommittee on Emerging and Evolving

Technologies of the CFTC Technology Advisory Committee, Responsible Artificial Intelligence in Financial

Markets: Opportunities, Risks and Recommendations, available at

https://www.cftc.gov/PressRoom/PressReleases/8905-24.

Advisory Committee, Transcript of Meeting on Apr. 9, 2024, available at

https://www.cftc.gov/PressRoom/Events/opaeventmrac040924; and Subcommittee on Emerging and Evolving

Technologies of the CFTC Technology Advisory Committee, Responsible Artificial Intelligence in Financial

Markets: Opportunities, Risks and Recommendations, available at

https://www.cftc.gov/PressRoom/PressReleases/8905-24.

3

CFTC Letter No. 24-17 Advisories December 05, 2024

to:

Order Processing and Trade Matching – Staff anticipates potential use cases for AI in the

order processing and trade matching function, particularly as it relates to the preparation of

message data at the time of execution. For example, a DCM may leverage the analytic

and predictive capabilities of AI to anticipate trades before they happen, for the purposes

of allocating system resources in advance to optimize those resources and reduce post-

trade message latencies. DCMs must continue to provide competitive, open, and efficient

markets and mechanisms for executing transactions that protect the price discovery

process of trading in the centralized market of the DCM, irrespective of their use of AI,

consistent with Core Principle 9 for DCMs.10

Market Surveillance – Staff anticipates potential use cases for AI in the market regulatory

function, including detection of abusive trading practices, investigation of rule violations,

and real-time market monitoring. For example, a DCM or SEF may leverage the analytic

capabilities of AI to identify instances of abusive trading practices, including front-

running, wash trading, pre-arranged trading, fraudulent trading, money passes, and other

trading practices that the DCM or SEF deems to be abusive. A DCM or SEF may, as

appropriate, also leverage AI to improve the detecting and flagging of specific trade

execution patterns and trade anomalies, as part of its automated trade surveillance system

ces of abusive trading practices, including front-

running, wash trading, pre-arranged trading, fraudulent trading, money passes, and other

trading practices that the DCM or SEF deems to be abusive. A DCM or SEF may, as

appropriate, also leverage AI to improve the detecting and flagging of specific trade

execution patterns and trade anomalies, as part of its automated trade surveillance system.

Staff reminds DCMs and SEFs of their responsibility to maintain compliance staff and

resources sufficient to conduct effective audit trail reviews, trade practice surveillance,

market surveillance, and real-time market monitoring, consistent with Core Principles 2, 4,

and 12 for DCMs and Core Principles 2, 3, and 4 for SEFs.

System Safeguards – Staff anticipates that certain registered entities will develop AI

solutions internally, while others will procure AI-based products and services from a third

party. In both instances, Staff expects that DCMs, SEFs, and SDRs will follow generally

accepted standards and best practices with respect to the development, operation,

reliability, security, and capacity of the AI system, consistent with the requirements of

Core Principle 20 for DCMs, Core Principle 14 for SEFs, and § 49.24 for SDRs. In

particular, DCMs, SEFs, and SDRs should continue to develop and maintain appropriate

controls across all seven categories of risk, analysis and oversight that could be implicated

by the use of AI, including: enterprise risk management and governance, information

security, business continuity and disaster recovery planning and resources, capacity and

performance planning, systems operations, systems development and quality assurance,

and physical security and environmental controls.11 Additionally, Staff reminds DCMs,

SEFs, and SDRs of their responsibility to give Staff timely advance notice of all material

planned changes to automated systems that may impact the reliability, security, or

adequate scalable capacity of such systems.12

10 7 U.S.C. 7(d)(9)

, systems operations, systems development and quality assurance,

and physical security and environmental controls.11 Additionally, Staff reminds DCMs,

SEFs, and SDRs of their responsibility to give Staff timely advance notice of all material

planned changes to automated systems that may impact the reliability, security, or

adequate scalable capacity of such systems.12

10 7 U.S.C. 7(d)(9).

11 DCMs must develop and maintain a program of risk analysis and oversight with respect to their operations

and automated systems that addresses these seven categories, pursuant to § 38.1051(a); SEFs pursuant to

§ 37.1401(1); SDRs pursuant to § 49.24(b).

12 DCMs pursuant to § 38.1051(f)(1); SEFs pursuant to § 37.1401(f)(1); and SDRs pursuant to § 49.24(h)(1).

4

CFTC Letter No. 24-17 Advisories December 05, 2024

B. DCOs

DCOs that use AI must continue to comply with all applicable regulatory requirements,

including relevant provisions of the CEA and CFTC regulations. Staff anticipates that

some DCOs will develop AI solutions internally, while others will procure AI-based

products and services from a third party. In both instances, DCOs must follow generally

accepted standards and industry best practices with respect to the development, operation,

reliability, security, and capacity of the automated systems that are using AI technology,

consistent with the requirements of Core Principle I, System Safeguards. Use of AI may

implicate various scenarios, including but not limited to:

System Safeguards – Staff expects that some DCOs may use AI to support the detection

and/or response to cyber intrusions, in addition to identifying cyber vulnerabilities and

hardening defenses. Some DCOs may also use AI as a tool to evaluate and/or update

legacy and new computer code. DCOs may benefit from considering how the introduction

of AI could impact, positively or negatively, the functionality, reliability, and resilience of

computer systems relied upon by DCOs to accomplish the DCOs’ core functions

s, in addition to identifying cyber vulnerabilities and

hardening defenses. Some DCOs may also use AI as a tool to evaluate and/or update

legacy and new computer code. DCOs may benefit from considering how the introduction

of AI could impact, positively or negatively, the functionality, reliability, and resilience of

computer systems relied upon by DCOs to accomplish the DCOs’ core functions. Staff

reminds DCOs that Core Principle B, concerning the collateral that will be used to meet the

financial resource requirements, Core Principle D, concerning risk management activities,

and Core Principle I, concerning system safeguards and operational risk, continue to apply

in the event that DCOs use AI. These core principles and their related regulations apply

even if a DCO relies upon a third-party service provider for the provision of the AI.

Regulation 39.18(d)(2) makes explicit that a DCO retains responsibility in the event of

outsourcing.

Additionally, DCOs must give Staff prompt advance notice of all material planned

changes to automated systems that may impact the reliability, security, or capacity of

automated systems and all materials changes to the DCO’s program of risk analysis and

oversight.13

Member Assessment and Interaction – A DCO might utilize AI in connection with the

review of its clearing members’ compliance with DCO rules, and to support

communications with its members on any number of topics. AI chatbots may have access

to external or internal datasets, including datasets comprised of member information. In

addition, the use of AI for member assessment and interaction could become even more

prominent in the case of non-intermediated clearing. Staff reminds DCOs that Core

Principle C, concerning participant admission and continuing eligibility; and Core Principle

D, concerning monitoring credit exposure from the perspective of the DCO to its members,

continues to apply to DCOs.

Settlement – Staff also recognizes that AI might be used to support DCO settlement

d become even more

prominent in the case of non-intermediated clearing. Staff reminds DCOs that Core

Principle C, concerning participant admission and continuing eligibility; and Core Principle

D, concerning monitoring credit exposure from the perspective of the DCO to its members,

continues to apply to DCOs.

Settlement – Staff also recognizes that AI might be used to support DCO settlement.

DCOs may use AI to facilitate netting or offset of positions as the AI works to validate

data, mine data anomalies prior to settlement, or identify failed trades. Staff reminds

13 §39.18(h)(1); § 39.18(h)(2).

5

CFTC Letter No. 24-17 Advisories December 05, 2024

DCOs that Core Principle E, concerning the timely completion of settlement, the limitation

to exposure of the DCO to settlement bank risks, and the ability to permit netting or offset

arrangements, continues to apply to DCOs.

C. FCMs, SDs, CPOs, CTAs, IBs, RFEDs and Associated Persons

Although not exhaustive, Staff identifies examples in the following areas where it expects

that AI may be used and reminds registrants that the CEA and CFTC regulations continue to

apply.

Risk Assessment and Risk Management – Staff expects that registrants may utilize AI for,

among other things, the calculation and collection of initial and variation margin for

uncleared swaps. An SD that uses AI to assist in the collection of initial margin pursuant to

§ 23.152,14 for example, would still be required to confirm the adequate performance of

such a system to ensure that risk is properly managed consistent with CFTC regulations.

Compliance and Recordkeeping – Staff monitors registrants for their compliance with a

broad array of Commission regulations, including recordkeeping, disclosure, and financial

reporting, among others. Staff recognizes that AI may support the accuracy and timeliness

of financial information and risk disclosures that are provided to the Commission, National

Futures Association, and the registrant’s customers

Recordkeeping – Staff monitors registrants for their compliance with a

broad array of Commission regulations, including recordkeeping, disclosure, and financial

reporting, among others. Staff recognizes that AI may support the accuracy and timeliness

of financial information and risk disclosures that are provided to the Commission, National

Futures Association, and the registrant’s customers. Staff reminds registrants that they

remain responsible for ensuring that such information and disclosures are compliant with the

applicable statutory and regulatory requirements. For example, a CPO that used generative

AI to update a disclosure document or prepare periodic account statements for a commodity

pool would still be subject to all the requirements of Part 4 of the Commission’s

regulations.15

Customer Protection – A significant portion of CFTC regulations applicable to registrants

are related to customer protection. For example, FCMs are required, under the CEA and

CFTC regulations, to properly segregate customer funds,16 which is a fundamental

component of customer protection thereunder. Staff reminds FCMs that may consider the

use of AI to account for segregated funds would still be required to ensure that, among other

things, all of the requirements of Part 1 of the CFTC’s regulations17 are being met.

II. Staff Monitoring of AI Developments in CFTC-Regulated Markets

Staff values its ongoing dialogue with CFTC-regulated entities and encourages them to

engage with Staff when considering any changes to risks that may arise with the deployment

of AI use cases. Staff may also incorporate AI as a topic of discussion in its routine

oversight activities such as examinations. Staff will also continue to evaluate the need for

future regulation, guidance, or other Commission or Staff action.18

14 17 CFR 23.152.

15 17 CFR Part 4.

16 See, 7 U.S.C. 6d(a)(2); 17 CFR 1.20.

17 17 CFR Part 1

ges to risks that may arise with the deployment

of AI use cases. Staff may also incorporate AI as a topic of discussion in its routine

oversight activities such as examinations. Staff will also continue to evaluate the need for

future regulation, guidance, or other Commission or Staff action.18

14 17 CFR 23.152.

15 17 CFR Part 4.

16 See, 7 U.S.C. 6d(a)(2); 17 CFR 1.20.

17 17 CFR Part 1.

18 For example, such dialogue helped facilitate efforts such as this Advisory, and the Office of Customer

Education and Outreach’s (OCEO’s) Customer Advisory, which warns the public about AI-driven fraud and

6

CFTC Letter No. 24-17 Advisories December 05, 2024

*********************************************************************

This Advisory is intended to remind the affected parties of their obligations under the Act

and CFTC regulations. It is not intended to create any enforceable rights, any new binding

rules or regulations, or to amend existing rules or regulations. This Advisory represents only

the views of the Divisions and does not necessarily represent the views of the Commission

or of any other division or office of the Commission.

Any questions regarding this advisory should be directed to Clark Hutchison at 202-418-

6070; Ted Kaouk at 202-418-5747; Vincent McGonagle at 202-418-5387; or Amanda Olear

at 202-418-6700.

CLARK HUTCHISON

DIRECTOR

DIVISION OF CLEARING AND RISK

TED KAOUK

DIRECTOR

DIVISION OF DATA

VINCENT MCGONAGLE

DIRECTOR

DIVISION OF MARKET OVERSIGHT

AMANDA L. OLEAR

DIRECTOR

MARKET PARTICIPANTS DIVISION

scams. See Press Release Number 8854-24, CFTC, CFTC Customer Advisory Cautions the Public to Beware

of Artificial Intelligence Scams (Jan. 25, 2024), available

at https://www.cftc.gov/PressRoom/PressReleases/8854-24.