CFTC Staff Issues Request for Comment on Artificial Intelligence Uses and Risks in Derivatives Markets

The Commodity Futures Trading Commission (CFTC) staff has published a Request for Comment (RFC) on the current and potential uses and risks of artificial intelligence (AI) in CFTC-regulated derivatives markets. In a recent speech, Chair Behnam explained that the RFC will help the CFTC evaluate "the need for future regulation, guidance or other Commission action" while aligning its approach with other financial markets regulators.

Chair Behnam identified the RFC as originating with the new AI task force, which was created last summer for purposes of "exploring the role that emerging technologies such as artificial intelligence and machine learning may play in violations of the Commodity Exchange Act and CFTC regulations; and ensuring that registrants adequately supervise their use of emerging technologies."  This was confirmed at Chair Behnam's January 26 keynote at the ABA Derivatives Law committee, where he further stated that the RFC was "part of a greater vision" to advance the CFTC's analytical capabilities and, importantly, to "identify the highest priorities and return-on-investment projects to pursue." The RFC continues the CFTC's trend of information-gathering on emerging market issues and follows three Technology Advisory Committee meetings focused on AI use in financial markets, cybersecurity threats of AI, and possible AI biases.

Notably, the RFC considers the extent to which AI support and compliance services are performed by a third-party service provider, potentially impacting FCM and SD registrants under existing third-party oversight requirements, as well as third-party relationship monitoring requirements proposed under the Operational Resilience Framework NPRM. The Commission recently extended that rule’s comment deadline to April 1, 2024.

In the RFC, CFTC staff continue to focus on the impact of AI on consumer and data protection, as well as its potential impact on, or contribution to, broader financial and systemic risks of derivative markets. Registrants will note the RFC's focus on AI's impact on existing futures and swaps intermediary compliance programs, such as business conduct and trading, margin/capital, and third-party service providers. And not limited to CFTC registrants alone, the RFC also seeks information on potential uses of AI in facilitating market misconduct, such as fraud and manipulation.  

The comment deadline is April 24, 2024.

RFC Questions

The RFC first seeks to define the proper scope of AI technology before asking questions geared toward understanding its usage. As a starting point, CFTC staff use the same definition of AI contained in the recent Biden Administration Executive Order on AI: "a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations or decisions influencing real or virtual environments." But CFTC staff acknowledge that the RFC, which solicits comments to well over 20 questions, many with multiple additional subparts, is interested in "similar technologies beyond the scope of this definition of AI."

In general, the RFC asks a series of wide-ranging questions focusing on AI usage and concerns in derivatives markets in order to enable it "to assess the benefits and risks associated with the use of AI in CFTC-regulated markets" and "inform staff’s supervisory oversight and to evaluate the need for any future guidance and rulemakings." The CFTC took a similar approach when it published its pioneering Request for Information on Climate-Related Financial Risk (Climate RFI) and, a year and a half later, issued its Proposed Guidance Regarding the Listing of Voluntary Carbon Credit Derivative Contracts.

In seeking to better understand current and potential usages of AI technology by derivatives market participants, the RFC focuses on how AI technology is currently used by firms, who is using it, and what the technology may be used for in the future.

• How firms deploy AI technologies:
  • The RFC acknowledges or anticipates the usage of AI technologies in the following areas:
    • derivatives trading programs
    • compliance programs
    • customer contact and interaction to solicit or facilitate relationships and trading
    • risk management framework (to monitor or evaluate margin, capital, risk tolerances, credit and position limits)
    • recordkeeping retention and the identification of gaps or vulnerabilities
    • cybersecurity and resilience, and
    • data processing and analytics (e.g., to monitor for and identify analytical errors or quality issues).

• • Questions regarding potential additional usage of AI technologies include:
    • How does the use of AI in trading differ from traditional trading algorithms?
    • Is AI used for risk management or compliance purposes, such as to monitor or evaluate margin, capital, risk tolerances, credit, or position limits, or to satisfy business conduct standards?
    • Are customers informed when AI has been used to generate answers, advice, or other communications? Does AI serve as the basis for customer engagement or interactions?
    • Are “preprogrammed automated advisors” being used? And can there by market-wide trading behavior prompted by such AI?

• Who uses or provides the AI technologies:
  • The RFC wants to identify whether third-party service providers are providing AI services that support its usage in derivatives trading markets and for compliance purposes.
  • Importantly, CFTC staff ask whether AI technologies are being developed within registrants as “proprietary technology” and used for trading purposes, including for discretionary trading absent human supervision.
  • The request is notable given the Commission’s since-withdrawn Regulation Automated Trading (Reg. AT) proposal, which would have required registration for market participants using algorithmic trading systems (ATSs) or engaging in proprietary algorithmic trading.
  • CFTC registrants should also note that third-party service providers of AI services for compliance purposes will likely need to adhere to NFA’s existing third-party service provider requirements.

In addition to understanding the current usage and potential functionality of AI technologies in derivatives markets, the RFC seeks information related to its perceived concerns with AI’s usage. Separately, the CFTC seeks to better understand the risks AI technology could present to derivative markets.  For example, the RFC solicits comments on the following:

• Does the adoption of AI impede enforcement of antifraud and market manipulation regulations?
• Does the proliferation of AI present increased risks of manipulation, fraud, or other illicit activity in the derivatives market?
• What disclosures should be required regarding a firm’s use of third-party providers for AI services?

Most importantly for market participants, CFTC staff is implicitly communicating its expectation that AI technologies used in an existing derivatives business are incorporated into compliance frameworks to manage and mitigate AI technology risks.  For example, question 9 asks whether and in what way CFTC registrants have modified governance structures to address AI.

Similarly, another question requests that firms (including non-registrants) integrating AI into trading decision-making “describe the policies and practices adopted to prevent the use of AI-driven strategies in schemes designed to manipulate the market.”

Other examples of questions gauging firms’ management of AI-related risks include:

• Do market participants consider AI to be a source of cybersecurity vulnerability? Have firms implemented measures to defend against these threats?
• For firms that integrate AI into trading decision-making, describe the policies and practices adopted to prevent the use of AI-driven strategies in schemes designed to manipulate the market.
• What protections are CFTC-regulated entities adopting to ensure the confidentiality of proprietary data used in AI?
• What due diligence procedures are in place to evaluate the risks posed by third-party providers before adopting third-party AI technologies?

Takeaways and Possible CFTC Action

We expect the CFTC to act largely by integrating AI-related requirements into existing rules on a registrant basis. The RFC asks all commenters to identify their registrant status and references derivatives clearing organizations (DCO), futures commission merchants (FCM), swap dealers (SD), swap execution facilities (SEF), and designated contract markets (DCM) as well as non-registrant market participants. Comments will also be used to inform open rulemakings. For example, the CFTC’s recent advanced notice of proposed rulemaking on the Risk Management Program (RMP) regulations included AI and machine learning risks factors in existing RMP requirements for swap dealers and futures commission merchants.  Given the RFC’s focus on systemic market risk and individual risk to firms using AI, the CFTC may also incorporate staff’s findings into the Operational Resilience Framework, recently proposed on December 18, 2023.

Firms considering the RFC’s implications should note that the release was made by CFTC division staff and not the Commission itself, suggesting that finalizing a rulemaking or guidance is not an imminent priority or one that practically may be accomplished in short order. By way of comparison, the aforementioned Climate RFI was formally issued by the Commission. Nevertheless, the RFC represents an important step toward any formal Commission action, and submitted comments help shape the Commission’s knowledge of not only AI’s usage and risks, but also its approach regarding how the technology is addressed and incorporated into its regulatory regime. Lost in the shuffle of the CFTC’s efforts to better understand the usage of AI and its risks presented to derivatives markets is the RFC’s subtle message to registrants: firms using the technology should already be incorporating any usage into existing risk management frameworks and compliance programs.

Although the RFC solicits information relating to AI technology’s usage, market participants should know that the CFTC has already demonstrated an awareness of its capabilities in an impactful way. Internally, the agency has taken steps to incorporate its usage with a focus on developing efficiencies (e.g., by moving regulatory databases to the AWS cloud) and enhancing its investigatory prowess. For example, the CFTC is augmenting existing algorithms with AI to more efficiently surveil and identify unlawful trading activities, such as spoofing. We expect the CFTC to further advance these efforts with insights provided by market participants in response to the RFC.