CFTC Enforcement Action: In and out-of-house perspectives (Produced in association with the Commodity Markets Council)

SPEAKER A

Communications. The CPC doesn't need to bother going to your affiliate in Europe or London. They can go directly to your US affiliate and demand the information.

SPEAKER B

The last traditional area that we're continuing to see enforcement is in disruptive trade practices, spoofing, wash trades, kind of classic exchange activities. And ask Toby to just talk a little bit about what you're seeing and what you're thinking about in that space.

SPEAKER C

Tobias? Yeah, absolutely. I mean, we still have a client interest in scoping watch trades. We see cases from the safety seat in those areas. We've also seen some position limits cases in the last year. We still see quite a bit of interest, in fact, increased interest in physical versus financial and just exposure versus exposure, perspective manipulation. I think one thing that markets might not really realize is that you can use a physical to effectuate a physical just as easily as a physical to effectuate a financial. And so we see a lot of interest and increasing interest. And I think the need for surveillance, which we can get to in a minute, is getting more complicated as a result.

SPEAKER B

Another area in connection with manipulation, the CFTC's anti-fraud rule being interpreted to apply to non-public information. And, Joseph, can you give us a little bit of background on that?

SPEAKER A

Yeah, this concept has been around for a while. I mean, most people in the room would be familiar with insider trading, right? Especially in the SEC context. So think of a publicly traded company. You have a company officer who knows about information, a potential merger deal, something like that before it was public. And the company official trades in the publicly traded stock of the company. Classic insider trading. SEC case. Well, why is the CTC going after those kinds of cases? There actually is an insider trading provision, but it applies to registered entities like Nymex. And there is a case against a couple of Nymex employees who used information that they got while working there to benefit themselves and complaints brought against them. So that was the first one that I started focusing on about insider trading, the use of non-public information for personal benefit. After Dodd Frank, we started hearing a lot from the CTC enforcement staff about the use of information in breach of a pre-existing duty. And we didn't really know what that meant, so we kept inquiring and asking that. It started coming up in all our cases, and they focused in several different ways. They said, well, it could be a limitation in your company policy, a confidentiality agreement, a non-disclosure agreement. There's any source of restrictions on the access or use of this information. Could be that breach of a pre-existing duty in the CFTC's eyes.

So now let's advance forward. The terminology breach of a pre-existing duty doesn't really appear in the most recent cases. So if you look at, like, the classic energy, you know, ring of traders, the language that's now used is misappropriation. There's misappropriation of information that is being charged. But look at the specific provision that the government is alleging they violate it. It's not that insider trading provision that was used against the NYMEX employees. They're pursuing these actions as basic fraud. So if you look at the classic energy ring of traders, they were trading away value from their companies to allow a co-conspirator to liquidate that position of profit, and they whacked up the profits in cash. That's basically what they did. So the way the government charged those cases is said, you know, the trader at company, a misappropriated his employer's information and used it in breach of that preexisting duty, the company policy, your employment agreement, whatever, was the source of that duty, and he used it to benefit himself. And not only was that a civil enforcement action, they got charged criminally. So this isn't just a little amount of money that you have to pay to get yourself out of trouble. These folks are going to jail, right? So the first person who was sentenced is going to spend three years in jail, and he was the first to be sentenced out of a whole criminal conspiracy. There's a whole group of them. So what you see is a whole series of events that turned, you know, a very familiar concept of insider trading, to breach our pre-existing duty, to misappropriation of your. Your company's information. And then in the classic energy case, they also charged the broker who was involved in brokering the block trades under the same provisions there, it's the broker's misappropriation, appropriation of their client's information. So whether you're a trader at a trading company, you're a broker employee, or your broker yourself, the same legal theory can be used against you in several different settings.

SPEAKER B

And the classic energy case is a great one, I think, to think about finding places for compliance, to have a value add for commercial, and looking at what broker usage. If you have an uptick in using a certain broker or the transactions there, you're not only looking for your own potential noncompliance, but also robbery of your company. So not trading on misappropriated information, that's prohibited. What about trading around your assets? So you have physical assets in play. Are you allowed to speculate and trade on those?

SPEAKER D

Well, it depends on where you are. We go back to the extraterritoriality. If you're in the United States, absolutely you can. You're in Canada, you're in Europe, definitely can't. So you're looking at, again where you are, where your trader is. What's the position, all of that together to see if you can use that information. Now, there's the use of your own information around your own assets, and then it's the use of information that you're gleaning from the markets and that gets a little more complicated. Right. If you have an information source, if you get information from a broker, if you get information from a person on the street or somewhere else, the question to the compliance officer is, can we use that information? And that's a facts and circumstances thing. So you do have to get into the nitty-gritty as to where you are getting it. Do you have a duty to that person, to that counterparty, to that entity? And are we able to use that information in our trading?

SPEAKER B

And I forgot to mention, Eileen had many jobs ago, was at FERC and enforcement. And so it brings, it's a great thing to have in a compliance person to be able to bring that experience when we think about trading around assets. And so you have, for example, an outage at an asset that you know and can anticipate. There's unwinding a hedge associated with that outage. There's speculating on top of that.

SPEAKER D

There's speculating on top of that. There is a difference. It's what's, what's the potential harm or benefit to the market and you. Right. So you can trade to a point where you are hedging your position, right? But if you're going beyond that and potentially doing harm with your movement of positions with your trading, that is where the line gets crossed. And that's where a lot of the regulators, CFTC, FERC, are looking at it in a much more scrutinizing way.

SPEAKER A

So there are some caveats there though, right? So can you use the information in the US? It depends. So if you go back to one of the movies that I love in the space, Trading Places, you know, stolen government reports and stolen government information.

SPEAKER D

Correct. If you're going to use the Eddie Murphy rule as a proxy, you can't do that.

SPEAKER B

So.

SPEAKER A

Can't do that, right? So Eddie Murphy rule cannot, you know, steal the information from the government and then trade based on, on that. That's illegal. And then just think about it. The old phraseology was trading on information in breach of a pre-existing duty. So if you obtain that information under contract where you agreed to maintain confidentiality over that information, and you restricted your own use of that information, but you go ahead and trade based on that anyway. Like you signed an NDA, you signed a confidentiality agreement, but you still use that information for trading. Is that the breach of a pre-existing duty? Is that misappropriation of somebody's information and are using that to benefit yourself? I mean, maybe the CFTC might look into that. Can you use the information gained through the course of your employment to trade in your own personal account for benefit? It's somebody else's information. I learned it through my job. Can I use that information to trade in my personal account to benefit? Probably not, right? It's most likely a violation of the company policy and also it could be prosecution.

SPEAKER B

And the last area of enforcement that trends that we've seen is another continuation is on record keeping. And we talked about a little bit, since 2001, there have been over a billion dollars in penalties, pretty much exclusively to banks for failing to maintain communications that were required to be maintained. And I wondered if, Joseph, you could talk a little bit about that from the registrant angle.

SPEAKER A

Well, the CFTC has strayed beyond banks. So if you are a registered entity or you otherwise have a duty under CFTC regulation to maintain records and preserve them and make them available upon request, you better be able to do so. And so the CTC has expanded that whole series of, you know, investigations beyond just banks. Some of our

clients that are handling, we're handling record keeping cases for or other types of registered entities. And, you know, the inquiries are looking for off platform, like something that's not recorded by the company. Systems off platform communications for doing business. So again, it comes back to a compliance officer's obligations to update their compliance policies, provide compliance updates. They're going to write this in the company policy that if you're going to do business on behalf of the company, you must do it, you know, on the company's platform in a medium that is recorded and is available for monitoring in the company. It's not just because they're interested in what you're doing, it's because sometimes there's a regulatory obligation. Our clients, you know, we see it when you go through interviews and you're looking at the data. You know, some people are really squeaky clean on this. Other times, you know, registered entities, if you think about their role in the industry, they're constantly talking to other people in the industry, but it could be about attending this conference, it could be about going golfing on the weekend, it could be about your kid's soccer game on Saturday where you saw that person, they're constantly communicating with others in the industry, and then quickly it strays into a business communication. And you did it on your cell phone, you did it on text message. And right there, that's something that the CTC is going to focus on. And the more instances you have, the worse it's going to get. So if you have done this for a period of years, business related communications, you know, you're a repeat offender, you've been looked at before. It's going to get more and more serious. And the fines that we're seeing, but some of the penalties that we're seeing are just astronomical.

SPEAKER B

What senior staff has said at the CFTC is you've had ten, now, twelve more years since Dodd Frank was passed to get in compliance. And so we're going to be, you're going to be having substantial penalties if you're not in compliance. And each time they've said that, that I've been there, I've reminded them that that is, most of those rules are relevant to registrants to swap dealers to FCMs and not applicable to end users. And I think staff, staff recognizes that and appreciates that. And their response each time has been, yes, but if you have a duty, we expect you to comply. And then also if you have, if you don't have a duty but you are on a recorded platform, and then we see you trying to take your communications off of the recorded platform, we're going to have a negative inference. We're going to draw a negative inference from that. We're going to assume that's because you want to conceal from us what's going on. So beware, end users. But what other, everything Joseph was talking about has really been at the registrant level. What do we think for end users? What are the takeaways?

SPEAKER D

Well, for the end user, I always look at it from a radar perspective, radar in my car. I generally want to know what the other guy knows. So if we're communicating with somebody on a broker site or some registrant site who we know is expected to retain that communication and review that communication, the concern is, from an end user perspective, while we might have a duty to preserve or retain that particular communication, is what is the best practice? Is the best practice for us to actually retain it and review it? Once we retain it, we should review it. And what does that, how does that expand our requirements from a compliance and surveillance perspective. So we do have to balance that. Right. We might not have the obligation, the same obligations that a registrant does, but we do have to look at the market in a very similar way.

SPEAKER B

Well, in one way would be having your own internal policies. Right. Beyond what's required of you.

SPEAKER D

The concern is that once we have the policies in place. Right. We understand from the CFTC's perspective and from various panels and stuff like that, even if you write it down in your policy, if you're not doing something to effectuate that policy, you can say, do not trade on unapproved points of communication. But unless you're doing something to effectuate that policy, it's simply a piece of paper.

SPEAKER B

Yeah. And we decided for time reasons, we're not going to go into it. But there's been a real focus on failure to supervise. And so if you have a policy in place that you're not actually following, that can be a huge detriment as well. Joseph, you mentioned recidivism. I think there was a policy statement last year from the CFTC laying out their policy on admissions that they were going to demand more admissions, that the default setting would be to get a settlement with the CFTC. You have to admit, no longer can you say neither admit nor deny unless there's good reason for that recidivism, that they increase penalties. They're tired of seeing the same people coming back and they're going to have higher penalties for recidivism, and then that they were going to use consultants and monitorships more regularly in their settlements and require those. I wanted to see from the panel, anybody wanted to talk about any of those three topics, about what we're seeing in enforcement cases or. I know you have personal experience with a consultant, so maybe I'll start with you.

SPEAKER D

Well, we don't have a monitor which is of public record. We were not. We were not. We maintain the consultant of our own volition. Part of our requirements within the agreement is that we do have regular meetings with the DOJ and with the CFTC for our ongoing compliance requirements. But the monitorship is something that you generally don't have control over. It is. It's approved by the CFTC or whomever the regulator is, and it's a much more formalized process for ongoing compliance within that monitorship. The consultant route is. It's a lighter touch. It's still a lot of work. Don't get me wrong, it's a lot of work, but you do have a choice in the matter more so I.

SPEAKER B

Know in the public settlement it talks about you that Freepoint had already engaged a consultant, and it seems that you can do that when the government trusts that you're actually going to implement control and when they don't trust you. We've seen the CTC in other instances require board involvement and talking about monitorships, I don't know, on recidivism or admissions. Do you want to say anything more there, Joseph?

SPEAKER A

Well, let's stick with the topic just for a second and we can talk about admissions. But when there's a CTC case that involves monitors, we see it in other government settlements as well, or consent decrees. So the Federal Reserve Board and elsewhere, and that's when you get into a government investigation and what they see is a huge number of problems. But the resolution of your case that's public is more narrow. And then sometimes, you know, our clients that have been involved in these, the government's, you know, admonition is basically get your act together right? So there can be a requirement for, in the cases that we've done, an independent consultant or independent, you know, compliance review to be performed. And when we've done those, we did it over a series of years on an annual basis for certain clients. And it would progress exactly as you would expect. The first year, you see lots of problems in reviewing their compliance with applicable law in certain areas. You know, the policies, procedures aren't matching up. They have poor controls in place. So we look at all of that, and then you're reporting that for year that the government eventually looks at your report. You can see there's a lot of things to address and the company starts to do that. And then year after year after year, it gets windowed down to a very, very small set that's not very meaningful anymore. And then the governments, you know, they're more assured that, you know, you have your house in order, you have everything done that they think you need to do, and then they'll lift those, those requirements for you. So I think what my prediction is, you're going to see those required in more and more CFTC settlements, like more CFTC cases will require that type of measure be implemented. Now on admissions, I actually question whether or not this is going to be an effective government policy of requiring a lot of companies to admit. My prediction is that a lot of companies will refuse and they will just, they would rather take their chances in litigation because of the collateral effects of that type of admission in an agreement with the government. So I don't know if it's going to be that effective for the government. If my prediction is correct, that means that the government's going to have to litigate a whole lot of cases which they simply don't have the resources to do.

SPEAKER B

And you put those two together, admissions and recidivism. You admit in one case it will be used against you in the next case. And what we've seen is the CFTC not using recidivism when that's normally used by an agency. It is the same type of violation. We're seeing different violations or small violations within the same investigation being viewed as an example of recidivism. Let's change. So that's a little bit of background of what we're seeing in enforcement. Let's talk a little bit about challenges and compliance and surveillance. And so we're having more and more market volatility in a lot of markets these days. I want to talk a little bit about what that does for surveillance. So, Toby, can you speak a little bit about how you approach volatility and extreme price movements from a surveillance perspective?

SPEAKER C

Yeah, absolutely. I mean, my view

is most volatility in the market is not caused by illegitimate factors. There's a lot of just natural volatility in the markets. And right now, we're seeing a period of increased volatility in the marketplace. I think that it oftentimes creates difficulties, though, for a compliance person. Is volatility attributable to some sort of malfeasance? And it makes the analysis that more difficult. So one weakness, I think, is inherent in a lot of compliance regimes is compliance objects being inundated by false positives. And I think that it's important such that it's important that volatility doesn't lead to a spike in false positives and overload your compliance workflow, especially because if you do get an alert out of the surveillance system, there's actually a regulatory obligation to document that have an audible alert resolution workflow. And so one approach we see in market participants take is to sort of tune their alerting system so that if there's a change in the quantity, in the quantity of whatever's triggering the alert, as opposed to just that, triggers special scrutiny. And so that they're really trying to see is there a variation in the number of flaggable events, and that generates an alert as a strategy to really try to tweak, to have the right number of alerts. So you don't want so few that you're missing critical things you should be investigating, but you don't want so many that those alerts aren't meaningful and taken seriously.

SPEAKER B

Ellen, we're shortening our session a little bit to catch up on time. So I want to make sure along the way, if there are things that you all want to hear about that we haven't gotten to yet, just raise your hand and we'll start fielding questions along the way. But staying on the topic of surveillance volatility, aside from the cases that we've been talking about and you've seen, are there new things that you're looking at or new ways to look at data in light of the trends that we're talking about?

SPEAKER C

Absolutely. I think that the complexity of what you need to surveil on the transaction side keeps going up. So in addition to kind of the issues we were talking earlier with voice surveillance, I think that the need, I kind of alluded to this earlier for cross market surveillance between physical exposures and financial exposures, but also different types of physical exposures that might effectuate each other, is more so than ever. There's also the potential for things like spoofing across markets. You might spoof one market to effectuate another market. And so I think that a challenge that market has been through at large are facing is how do you process this volume of data? Because you think when you start contemplating cross market, just the permutations of the number of contracts and instances you need to surveil exponentiates. And so I think that a major challenge that the industry is grappling with was how do we not overwhelm compliance personnel? How do they essentially have clear line of sight to all the issues that they need to have line of sight to and meaningfully digest that information?

SPEAKER B

And from an end-user perspective, we don't have any mandated surveillance, but obviously.

SPEAKER D

We don't have mandated. But if you talk to my colleagues, data is the next commodity because it's the wave of the future. It's what we're going to be. It's what we're getting. We're getting more and more data, more and more information that we have to process and review, surveil, you know, assess against policy, sense against procedure, and it's just going to, it's just more and more and more. So the automated surveillance that happens is a really good tool, but we do have to continue with that human touch, that investigation, that ad hoc review. You know, your risk assessments, all those come together as a part of your data surveillance portion.

SPEAKER B

Tom.

SPEAKER C

I don't think anybody has a.

SPEAKER E

Problem with my projection. That's all right. So when you talk about data and we talk about compliance. Let's talk about compliance. About AI, especially AI into the market. Talk about AI, Tom, just kill it all. Just kill it all. Skynet is coming. No, but I was just. Where does the challenge for end users and for everybody else? Especially not AI. So you've got two different things. AI in compliance and how badly it can go off the rail. But compliance over AI, that's in the market.

SPEAKER B

CFTC is asking these kinds of questions right now. What are you using AI for? How is it being used? I'll turn that to the panel. Can you speak to any use of AI and compliance and the surveillance you're doing?

SPEAKER D

So, sir, we don't have any. Right now that we're implementing that we know of. The concern is that not the concern? There is a review point in terms of any of the vendors that are coming through that are coming to us as marketing perspectives. Oh, we have AI as a part of this. We have AI a part of that. And as a compliance professional, you don't have that expertise to assess it. Right. It's the compliance over AI as a part of compliance with using AI within compliance. So I think it's going to be a hard topic, certainly for the next few years.

SPEAKER B

Toby, anything on AI?

SPEAKER C

Yeah, I mean, I'll just say I don't think most microchips have figured out yet how to fully use AI, either inherent in their business or on the compliance side. I think that it's definitely possible that AI-generated algorithms might cause new types of disruptive training that we might need to adapt surveillance to. We haven't seen that yet, but that's definitely a possibility in the future. I think that we know of various compliance markets that are experimenting with AI, but I don't think essentially a robust mechanism of using AI inside of surveillance has really been demonstrated, at least on a widespread basis. Yet, far as we can tell, the.

SPEAKER A

Concept that we hear, especially from the regulators, is explainability. Like, can you explain this result based on your use of AI? How did AI produce this particular result? Whether it's your traders trying to use it as part of, like, you know, their trading activities to inform what they should be doing in the markets, whether it's, you know, how did you, how did you get these alerts in your compliance system? The regulators are seeking expertise over the AI and knowledge and mastery of the AI. How does it work? And at least myself, like, I don't have that kind of expertise. And I don't think a lot of our, you know, the compliance departments and our clients have that kind of expertise to be able to explain how the AI works and how I got to this particular result. So I think a lot of trading shops will be hesitant to adopt AI either or in their compliance department for that reason.

SPEAKER C

I think to that point, if you have a methodology that is more structural, that doesn't rely on AI, you can go audit that methodology, whether it's inherent in your trading operations or whether it's something you're using just to screen surveillance alerts as an example. But you need to be able to explain what are your filtration criteria? If it's just. Well, the AI told me that these are the ideal filtration criteria. That's an answer that I think doesn't really cut it unsatisfying, even if it's theoretically true, there's no good way to validate that.

SPEAKER B

There are a couple of things from a compliance perspective with AI, and the commercial side of the business is one, AI, it seems like the solution will often be to a fraudulent outcome, is particularly in markets. Thinking about the fraud concept of gaming that the CFTC, sorry that the CFTC has, the FERC has adopted years ago. And the CFTC seems to more and more move toward, for example, in DRW and some of the cases we've seen if you have a broken market, it would seem that a logical outcome will often be fraudulent to solve for it. And so how do you program that in? How do you prevent the software from reaching that conclusion? And the regulators have set up two ways that they're really ready for this. I think one is removing the scientific standard down to a recklessness standard, interpreting away the scientific standard under fraud. And then two, we're seeing a broad application of failure to supervise the exchanges. It's just tack on. Now, at the exchange level, it's hard to not have a failure to supervise with any violation. And I can imagine failing to supervise an AI program at the CFTC. It's at least still a separate, separate count, but I think they're ready to apply that to registrants at least.

SPEAKER A

And remember, the CFTC has pursued individuals who programmed algorithms that were used in trading, not just the traders who used it, the guy who actually programmed it, because the CTC took the position that this individual knew what would be done, knew the results in the market. So even though he was just a software programmer, he was a coder, he still got charged.

SPEAKER B

Yeah, and they lost that case. But I don't think that stops them from bringing another case. Right. That will be back. And they have aiding and abetting as well. I'm going to ask you all to just talk about what we haven't talked about today, that you think if we were here next year or I looking ahead, what from an enforcement compliance perspective should be on people's minds right now. So who wants to take us, start us off with that?

SPEAKER A

Take a shot.

SPEAKER D

I'll take a shot. Okay. I think it's your time horizon of enforcement. The government has a very long look-back period. They do have a very, you know, they paper

records and all this other stuff. And we were just talking about it before. How many people in the industry today did not live through the western energy crisis, did not, do not have the experience of what, you know, major, significant, widespread industry enforcement projects look like that everyone has been affected by. So I think that, that, that collective consciousness is waning a bit as people are aging out of the industry.

SPEAKER B

Good time to refresh with your traders on these things, Joseph.

SPEAKER A

My bet is continued dramatic growth in voluntary carbon credits. I think the market will continue to grow exponentially and there maybe could be some resolution over the jurisdictional issues that are going on right now in DC politics. But even if that doesn't happen, you have two enforcers, the SEC and the CFTC, that are both pursuing cases. I think we'll see, like right now we're seeing a lot of use of resources of CFTC enforcement in digital asset cases. I actually predict we're going to start to see a shift away from that and towards environmental issues and carbon credit in particular.

SPEAKER B

We had a really good discussion before this about where does that hit? Is it the end user? Is it the registries? Is it the registrants? Maybe the answer is yes. Yeah, I think that's one. If you haven't already gotten that on your radar, Joseph. And I think both have for years been screaming to people, watch out these products. Whenever there's a product that's hard to understand why people are buying it. There's going to be enforcement there eventually, and there are going to be class actions. There's going to be activity there. So I think that's a real one to keep an eye on. Toby?

SPEAKER C

Yeah, I was kind of just reiterating what I was kind of emphasizing earlier. Just the scope of what needs to be surveilled, I think is going to keep increasing. I know this communication surveillance is a huge increase in the scope of surveillance, but on the transaction side, I think that information can be overwhelming. And I think different creative forms of manipulation will lead to increased need to surveil those new creative forms of manipulation. So I suspect just the complexity of surveillance operations will keep increasing.

SPEAKER B

Speaking about data and increased data, there's a movement to the cloud. Do you see that movement in compliance and in surveillance? Are people willing to put their data into the cloud? Can you speak to that at all?

SPEAKER C

They are now, I would say if you asked that question five years ago, the answer was pretty much no. I think that there was a worry that essentially surveillance systems and compliance officers are housing a bunch of confidential trading data they didn't want let out. There were security risks around that. But I think people have realized that Google and Amazon, for the most part, are better at cybersecurity than your company is. And so moving to cloud-hosted platforms has become the norm. And I think there's still a few firms that still prefer to host their data on their own servers. But where we've seen a broad-based shift in attitudes, and we've even had a, we've even seen a few cases where certain companies, certain traders were now aware of on-prem systems, have been hacked, but the cloud systems were intact and. Okay. And so I think one thing that our firm is recommending to almost all of our clients is to shift to the cloud, irrespective of what system that they're using, because we also just think it makes it so much easier to make your data interoperable with your other systems as well.

SPEAKER B

We have a few minutes. We're over, but we're under on our shortened time. So if you have any other questions, things we haven't talked about, you're interested in talking about. I know one thing on our agenda, or our description, was the ceph issue about CTA's registering as cefs. I don't think we have a lot of registrants in the room. Is that of interest to the end user at all the weather?

SPEAKER A

Nope.

SPEAKER B

Anybody else? Other topics we haven't covered that you'd like to hear about? Got a free shop for it? No. Well, if not, thank you all for the insights.