Operational Resilience / Outsourcing in United States

Key dates

2026-11-05

CFTC Division of Clearing and Risk issued the no-action letter and accompanying public release addressing trust companies used for daily settlements.

Suggested considerations

• Compliance teams may wish to identify any existing or proposed trust-company settlement arrangements and determine whether each arrangement is being governed under the DCO’s settlement-bank policies and procedures.
• DCOs should consider documenting that each trust company satisfies the applicable 17 CFR 39.14 settlement-bank criteria, including capitalization, creditworthiness, liquidity access, operational reliability, and regulatory status.
• Firms should consider reviewing account structures, settlement agreements, payment workflows, and legal opinions to confirm that transfers are irrevocable and unconditional no later than the time the relevant DCO or clearing-member account is debited or credited.
• DCOs may wish to assess credit, liquidity, concentration, and intraday settlement exposures arising from the use of each trust company and confirm that monitoring, escalation, collateral, and contingency arrangements remain adequate.
• Operations and resilience teams may wish to test the trust company’s connectivity, payment-failure procedures, recovery arrangements, and coordination with the DCO’s business-continuity and disaster-recovery plans.
• Legal and compliance teams should consider recording the no-action letter’s conditions and limits in the DCO’s regulatory inventory, noting that the relief is staff relief rather than a binding amendment to Part 39 and may not extend to materially different structures or facts.
• Clearing members may wish to confirm that their agreements with the DCO and trust company allocate settlement, segregation, insolvency, operational, and account-control risks consistently with the DCO’s approved procedures.

What changed

The letter provides staff no-action relief for a DCO that uses a trust company to conduct daily settlement, notwithstanding the distinction between a trust company and a settlement bank under the CFTC framework. It does not create a generally applicable exemption or amend 17 CFR Part 39; instead, it allows the arrangement provided the trust company is managed and controlled as a settlement bank.

Key dates

2026-11-04

The OCC issued Bulletin 2026-54 and the Supervisory Framework on Bank Use of Super Intelligence for examiner use.

Suggested considerations

• Compliance teams may wish to inventory current and planned SI and agentic-SI use cases, including embedded functionality supplied by vendors, and map each use case to its business owner, permitted actions, autonomy level, human oversight, data sources, and potential consequences of failure or misuse.
• Banks should consider documenting a risk-based classification methodology focused on potential consequences, transfer of agency, and degree of human oversight rather than technical sophistication alone.
• Risk and control owners may wish to assess whether existing model-risk, governance, data-governance, privacy, cybersecurity, compliance, operational-resilience, vendor-management, testing, monitoring, documentation, auditability, and independent-challenge controls adequately address SI-enabled activities.
• Higher-consequence or more autonomous use cases should be considered for stronger restrictions on permitted actions, more direct human oversight, independent validation or challenge, enhanced performance monitoring, audit trails, testing, fallback procedures, and resilience measures.
• Boards and senior management may wish to clarify accountability for SI deployments without creating a separate SI risk appetite unless the bank determines that one is useful internally; the OCC framework does not require one.
• Internal audit and compliance teams may wish to retain evidence showing how SI risks are identified, measured, monitored, controlled, and escalated within existing risk-management frameworks, particularly because examiners may use the framework during ordinary examinations despite its nonbinding status.
• Banks should consider reviewing contracts and oversight arrangements for SI vendors, including access to data, model changes, incident notification, testing rights, service continuity, explainability or transparency, subcontracting, and termination or fallback arrangements.
• Compliance teams may wish to monitor future OCC revisions and stakeholder feedback because the framework is expressly intended to be a living document.

What changed

The OCC provided examiners with a risk-based, proportionate framework covering SI used in activities including credit decisioning, payments, fraud detection, customer service, operations, risk management, and market activities. Examiners are instructed to consider the bank’s size, complexity, risk profile, and the nature, consequences, autonomy, and complexity of each SI use case; banks are not required to create a separate SI risk category or SI-specific risk appetite. The framework identifies 16 components across six pillars: purpose, risk, control, oversight, resilience, and assurance.

Key dates

2026-11-04

The OCC issued Bulletin 2026-54 and the accompanying supervisory framework for examiner use.

2026-10-02

Executive Order 14434 was published in the Federal Register and is cited by the OCC as the source for the “super intelligence” terminology and broader definition.

Suggested considerations

• Firms should consider maintaining an inventory of SI and agentic use cases, documenting each system’s purpose, permitted actions, accessible data and systems, prohibited uses, degree of autonomy, human-oversight model, and business owner.
• Compliance teams may wish to prioritize review of use cases according to potential consequences of failure or misuse, transfer of decision-making agency, reversibility, customer or market impact, data sensitivity, and the practical ability of personnel to intervene.
• Banks should consider testing whether human reviewers can meaningfully understand, reject, pause, or stop system outputs and actions, rather than relying solely on nominal approval checkpoints or high-volume bulk approvals.
• Risk functions may wish to map SI-enabled activities to existing model risk management, operational-risk, cybersecurity, privacy, consumer-protection, compliance, and business-continuity controls instead of creating a standalone SI risk category.
• Governance teams should consider assigning accountable owners across the system lifecycle, including approval, deployment, change management, incident response, suspension, retirement, and post-incident remediation.
• Banks should consider establishing monitoring capable of detecting model drift, erroneous or harmful actions, unauthorized activity, control exceptions, low-frequency high-impact events, and customer harm, with defined escalation and containment procedures.
• Third-party risk teams may wish to review contracts for vendor notification of model changes and new SI functionality, incident and notification timelines, audit and testing rights, data-use restrictions, responsibility for model errors, service suspension rights, and operational-resilience obligations.
• Internal audit and independent validation functions should consider whether they can reconstruct material outputs and actions, assess control effectiveness, and provide effective challenge to developers, business owners, and validation teams.

What changed

The OCC provided examiners with a framework that supplements existing model risk management, governance, technology, compliance, cybersecurity, and operational-risk practices. It covers 16 components organized around purpose, risk, control, oversight, resilience, and assurance, including permitted use and authority, criticality assessment, human-in-the-loop and human-on-the-loop controls, governance and accountability, performance monitoring, operational resilience, documentation and auditability, vendor risk, testing, and independent challenge.

Key dates

2026-11-04

The proposed rule was published in the Federal Register at 91 FR 69642.

2027-01-04 Deadline

Comments on RIN 3064-AG35 must be received by the FDIC.

2029-10-01

First proposed inflation-based adjustment to the section 360.9 covered-institution and larger-covered-institution thresholds.

Suggested considerations

• Affected banks should assess whether they meet the proposed covered-institution or larger-covered-institution thresholds using Call Report definitions and current deposit-account and asset data.
• Current part 370 institutions should map existing output files and deposit-account records against the 26 proposed mandatory fields in 12 CFR part 360 appendices C through G, identifying gaps in account title, ownership, relationship, beneficiary, domestic-versus-foreign, and other required data.
• Part 370 institutions should evaluate the effect of replacing their own deposit-insurance calculation systems with FDIC-calculation reliance, while preserving or redeveloping the provisional-hold capabilities required by proposed section 360.9.
• Larger covered institutions should inventory transactional accounts subject to the proposed account-holder contractual or disclosure requirement and determine which mortgage-servicer, fiduciary, real-estate, IOLTA, employee-benefit-plan, and trust-related accounts may be excluded.
• Compliance, operations, legal, and technology teams should review the proposed six-month implementation period for general requirements and 18-month period for provisional-hold requirements for institutions that are larger covered institutions on the final rule's effective date.
• Banks approaching the thresholds should establish monitoring for two consecutive quarters, the proposed 12-month implementation period after becoming a larger covered institution, and the proposed release mechanism after three consecutive quarters below the relevant threshold.
• Institutions should consider whether to submit comments by January 4, 2027, particularly on field-level data requirements, provisional-hold redevelopment, account-holder disclosures, transition timing, exemptions, and the CPI-W indexing methodology.
• Industry commentary indicates that the proposal is being read primarily as a burden-reduction measure for large banks, with estimated annual savings of approximately $33 million offset by approximately $14 million in transition costs; firms should nevertheless account for operational work associated with standardized data and provisional holds.

What changed

Proposed revised 12 CFR 360.9 would apply to insured depository institutions with at least $2 billion in deposits and either at least 250,000 deposit accounts or at least $20 billion in total assets, regardless of deposit-account count. A new category of larger covered institution would include institutions with at least $2 billion in deposits and two million or more deposit accounts. Part 370 institutions would generally become larger covered institutions under section 360.9, and would no longer need to operate systems capable of calculating deposit-insurance coverage themselves.

Key dates

2026-10-30

FDIC Board unanimously approved the Notice of Proposed Rulemaking by notational vote.

Suggested considerations

• Compliance teams should obtain and review the complete NPRM, including proposed amendments, definitions, scope thresholds, transition provisions, and the Federal Register comment deadline, because the bulletin itself contains only a high-level announcement.
• Firms should map each insured depository institution against the current applicability criteria in 12 CFR part 370 and 12 CFR 360.9, documenting deposit-account counts, domestic deposits, total assets, existing exemptions, certifications, and any voluntary compliance elections.
• Affected institutions should inventory overlapping deposit-insurance determination, depositor-record, provisional-hold, data-format, and reporting capabilities to identify systems that could potentially be consolidated if the proposal is finalized.
• Technology, operations, deposit administration, legal, resolution-planning, and third-party-risk teams should assess whether current data lineage, account ownership and capacity coding, reconciliation, testing, and FDIC access processes would satisfy a revised standardized-record framework.
• Firms should consider submitting comments on the operational feasibility, treatment of affiliates and mergers, transition periods, testing expectations, treatment of custodial and pass-through accounts, and whether any proposed relief would create gaps in failure-day data availability.
• Institutions should continue complying with currently effective 12 CFR part 370 and 12 CFR 360.9 requirements until a final rule becomes effective and any applicable transition period expires.

What changed

The FDIC has proposed amendments concerning the framework used by large insured depository institutions to maintain depositor records and support rapid deposit-insurance determinations. Based on the FDIC’s accompanying policy direction and independent industry commentary, the proposal would likely preserve standardized depositor-record and data-access requirements while reducing or eliminating the need for institutions subject to 12 CFR part 370 to maintain separate, independent deposit-insurance determination systems.

Key dates

2026-10-15

The proposed rule is published in the Federal Register.

2026-12-14 Deadline

Public comments on the proposed amendments to 12 CFR parts 704 and 713 are due.

Suggested considerations

• Compliance teams may wish to review the proposal against existing policies and procedures under 12 CFR 704.18, 12 CFR 713, and 12 CFR 741.201, distinguishing provisions that would be removed from obligations that would remain.
• Credit unions should continue to maintain existing fidelity-bond coverage, deductibles, renewal processes, and NCUA-related approvals unless and until a final rule becomes effective.
• Boards and management may wish to assess whether current coverage remains adequate for fraud, dishonesty, theft, burglary, robbery, and other covered losses, and preserve documentation supporting the required board review.
• Credit unions and insurers may wish to evaluate whether the proposed flexibility in coverage amounts and deductibles affects policy terms, underwriting, renewal timing, or internal risk assessments.
• Interested parties may wish to submit comments by December 14, 2026, addressing the proposed treatment of coverage calculations, deductibles, bond forms, purchase and renewal procedures, and any transition or implementation concerns.

What changed

The proposal would amend 12 CFR part 713 and related corporate-credit-union requirements in 12 CFR 704.18 by eliminating or modifying prescriptive procedural requirements concerning fidelity-bond purchases and renewals, simplifying the rules governing coverage amounts and deductibles, and removing outdated requirements. The proposal would preserve the requirement that a federally insured credit union maintain adequate fidelity-bond coverage against losses involving fraud, dishonesty, theft, and other covered risks.

Key dates

2026-10-13

Federal Register publication date for the ANPRM, published as 91 FR 64811 and document number 2026-20888.

2026-12-14 Deadline

Deadline for submitting comments to the CFTC on Regulation CTX, Regulation CAM, and the interpretation and implementation of CEA section 2(c)(2)(D).

Suggested considerations

• Compliance teams may wish to determine whether current or planned retail crypto products could constitute transactions covered by CEA section 2(c)(2)(D), including products described as spot, margin, leveraged, financed, perpetual, or otherwise structured to defer delivery.
• Firms should consider mapping current customer agreements, funding arrangements, custody models, delivery controls, and liquidation processes against the CFTC's preliminary positions on offers and actual delivery.
• Prospective venues may wish to assess the potential CAM operating model, including registration perimeter, governance, listing standards, market surveillance, position controls, execution, recordkeeping, cyber and system safeguards, proof-of-reserves, and customer-asset arrangements.
• FCMs, IBs, DCOs, custodians, and leverage providers should consider identifying the registrations, permissions, capital, segregation, margin, clearing, insolvency, and operational dependencies that a CAM structure could create.
• Crypto businesses may wish to prepare comments addressing the scope of section 2(c)(2)(D), the definition and practical test for actual delivery, treatment of fully paid open transactions, permissible crypto assets, and the allocation of responsibilities among CAMs, FCMs, DCOs, and leverage providers.
• Firms should monitor whether the CFTC follows the ANPRM with a formal proposed rule and should not treat the ANPRM as creating immediate registration, margin, reporting, or conduct obligations.
• Affected firms may wish to preserve evidence of product design, delivery capability, customer disclosures, surveillance controls, and legal analysis in anticipation of supervisory or enforcement scrutiny under the CFTC's stated interpretation of section 2(c)(2)(D).

What changed

The CFTC has published ANPRM RIN 3038-AF80, 91 FR 64811, concerning proposed Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets. Regulation CTX would seek to clarify when section 2(c)(2)(D) applies to crypto asset transactions, including the meaning of covered offers, actual delivery, and actual delivery of fully paid open transactions. Regulation CAM would create a crypto asset market subcategory of designated contract market registration under 17 CFR part 38, supported by related amendments or requirements under 17 CFR parts 1, 38, and 39.

Key dates

2026-10-06

The proposed rule was published in the Federal Register as 91 FR 63870, covering pages 63870-64103.

2026-12-07 Deadline

Public comments must be received by the SEC on or before this date.

Suggested considerations

• Compliance teams may wish to determine whether client or fund crypto assets are currently held through arrangements that would constitute adviser or regulated-fund self-custody under the proposal, including arrangements involving service providers, private keys, wallets, or decentralized finance protocols.
• Firms should consider mapping proposed requirements for key management, joint authorization, asset segregation, safeguarding expertise, cybersecurity, incident response, annual review, internal control reporting, and client or investor account statements against existing custody, information-security, and operational-resilience controls.
• Advisers and regulated funds may wish to assess whether existing custodians, including state trust companies, could satisfy the proposed authorization, policy, audit, internal-control, and segregation conditions.
• Compliance teams should consider preparing comments for File No. S7-2026-35 by December 7, 2026, particularly on the proposed scope of self-custody, the qualified-custodian determination, treatment of airdropped crypto assets, decentralized finance activity, and the interaction with existing custody arrangements.
• Firms should assess potential changes to Form ADV, Form ADV-E, Form N-CEN, custody records, crypto-network records, audited financial statements, and accountant reports if the proposal is adopted.
• Investment advisers and regulated funds may wish to inventory tokenized private funds and tokenized regulated-fund shares in anticipation of the proposed additional Form ADV and Form N-CEN questions.
• Firms should distinguish proposal-stage planning from current legal obligations because the publication does not itself impose the proposed requirements and does not establish a final compliance date.

What changed

The proposal would add an adviser self-custody framework under proposed Advisers Act rule 223-1(b)(7), allowing an adviser to self-custody client crypto assets only in specified circumstances and subject to conditions addressing safeguarding expertise, documented safeguarding systems, key management, joint authorization, segregation, cybersecurity risk assessment, threat and vulnerability management, incident response and recovery, annual review, an internal control report, and client account statements.

Key dates

2026-03-25

NCUA issued the proposed rule to remove the prescriptive requirements

2026-05-26 Deadline

Public comment period closed

2026-08-06

Final rule was published in the Federal Register at 91 FR 50677

2026-09-08 Deadline

Final rule becomes effective

Suggested considerations

• Compliance teams may wish to review current indirect vehicle lending policies to confirm they no longer reference the removed 50% and 100% net-worth limits.
• Boards may wish to document a board-approved risk appetite and concentration framework for third-party serviced indirect vehicle loans.
• Credit unions may wish to align vendor oversight, due diligence, and servicing controls with their internal policies since the prior waiver pathway is no longer the operative framework.
• State-chartered federally insured credit unions may wish to verify any conforming updates needed to insurance-related procedures and governance materials.
• Compliance functions may wish to update training, policy manuals, and examination binders to reflect that supervision will now focus on principles-based oversight rather than the deleted rule text.

What changed

The final rule removes 12 CFR 701.21(h) in full, eliminating the existing concentration limits, the 30-month step-up to a higher limit, the waiver process to a Regional Director, the related response timeline, and the embedded definition framework tied to that paragraph. NCUA also states that it removed the parallel requirement in 12 CFR 741.203(c) and the related citation in 12 CFR 746.201(c), as part of the same deregulatory package.

Key dates

2026-02-25

NCUA issued the proposed rule removing 12 CFR 701.26; public comments were invited through April 27, 2026

2026-04-27 Deadline

Public comment deadline on the proposal

2026-08-06

Final rule published in the Federal Register at 91 FR 50674

2026-09-08 Deadline

Final rule becomes effective

Suggested considerations

• Compliance teams may wish to remove references to 12 CFR 701.26 from policies, procedures, and training materials once the rule is effective.
• Firms should consider confirming that contract templates still include written terms addressing audit rights, information security, business continuity, indemnification, performance metrics, data ownership and return, termination, and dispute resolution.
• Credit unions involved in shared operational arrangements may wish to review whether documentation now reflects the updated clarification in 12 CFR 721.3.
• Firms may wish to confirm that third-party risk management, vendor oversight, and due diligence controls remain aligned with existing supervisory expectations despite the regulatory deletion.

What changed

The final rule rescinds 12 CFR 701.26, which had addressed FCU authority to enter written contracts for assets or services relating to daily operations and required those agreements to be in writing. NCUA states that the contractual authority already exists under the FCU Act and incidental powers authority, so the regulation was redundant. The Board also amended 12 CFR 721.3 to formally clarify that credit unions may act as representatives in shared operational arrangements with other credit unions or organizations, and that fixed assets may be shared.

Key dates

2026-06-25

CFTC published the original request for comment in the Federal Register at 91 FR 38334

2026-07-08

CME NYMEX self-certified a 24/7 oil contract

2026-07-09

CFTC stayed the self-certified 24/7 oil contract

2026-07-28

CFTC published the extension of the comment period at 91 FR 47158

2026-08-26 Deadline

Extended comment deadline for the request for comment

Suggested considerations

• Compliance teams may wish to assess whether existing trading, clearing, settlement, surveillance, and customer-protection controls would function on a 24/7 basis.
• Firms may wish to review the CFTC’s additional questions on the stayed CME NYMEX crude oil contract and consider whether their comments should address execution, settlement, market integrity, and operational resilience issues.
• Market participants may wish to prepare data-driven comments, because the CFTC’s consultation is focused on factual and empirical input rather than conclusory policy statements.
• Firms considering perpetual or around-the-clock products may wish to map any dependencies on payment systems, margin processes, and holiday/weekend operational support before submitting comments.

What changed

This publication does not impose a new binding rule; it extends the comment deadline for an existing request for comment by 30 days. The underlying consultation covers two issues: whether standard futures contracts, including energy futures, can trade on a 24/7 basis without changing expiration, delivery, or settlement terms, and whether perpetual contracts referencing physically delivered or storable energy commodities should be permitted.

Key dates

22 June 2026

- CFTC issues the targeted request for comment on extending standard energy futures to 24/7 trading and on the listing of perpetual contracts referencing physically delivered or storable energy commodities

26 July 2026 Deadline

- Original 30‑day comment deadline for the RFC on 24/7 trading and energy perpetual contracts (now superseded by the extension)

26 August 2026 Deadline

- Extended deadline for submission of public comments on the RFC regarding 24/7 trading of standard energy futures and perpetual contracts referencing physically delivered or storable energy commodities

Suggested considerations

• Identify and convene an internal cross‑functional working group (trading, risk, operations, compliance, legal, and IT) to assess potential impacts of 24/7 trading and energy perpetual contracts on your firm’s business model and control environment.
• Perform a gap analysis of current trading, clearing, surveillance, margin, and risk management frameworks against the operational and risk expectations articulated in recent CFTC staff advisories and policy statements on 24/7 markets and perpetual contracts.
• Draft and submit a data‑driven comment to the CFTC by 26 August 2026 addressing the RFC questions most relevant to your activities, including empirical analysis of liquidity, price formation, manipulation risk, funding rate behavior, and customer protection in energy derivatives.
• Review and update internal policies and procedures for trade surveillance, market abuse monitoring, and manipulation detection to address continuous 24/7 trading windows and any contemplated use of energy perpetual contracts.
• Assess whether current staffing models, systems support, and incident‑response processes can support 24/7 trading or clearing operations, and document enhancements or mitigations that would be needed to maintain operational resilience.

What changed

• - The CFTC has extended the comment deadline on the RFC regarding 24/7 trading of standard futures contracts and perpetual contracts in energy markets by 30 days, moving the due date to 26 August...
• The RFC focuses on the extension of standard futures contracts, including energy futures, to a 24/7 trading schedule while keeping fixed expirations but allowing potentially material economic changes...
• The RFC separately focuses on the listing and regulation of perpetual contracts that reference physically delivered or storable energy commodities, such as crude oil, and that have no fixed...
• The Commission has added additional questions to the original RFC to probe market integrity, price formation, operational resilience, customer protections, and risk management implications of 24/7...
• The RFC builds on and is informed by the CFTC’s May 29, 2026 coordinated actions on perpetual contracts and 24/7 trading in digital commodities, including the Policy Statement on perpetual contracts,...

Key dates

2026-07-16

FDIC, Federal Reserve Board, and OCC issued the joint statement on handling highly sensitive information during examinations

2026-07-16 Deadline

Affected banks must be notified of any potential or confirmed material data breach involving confidential supervisory information no later than 72 hours after discovery, unless legal restrictions apply

Suggested considerations

• Compliance teams may wish to review examination response procedures for materials that could be treated as highly sensitive, including technology diagrams, penetration test results, detailed control-weakness reports, and similar data.
• Banks may wish to establish an internal process for flagging sensitive examination materials to examiners and documenting the basis for the sensitivity designation.
• Firms may wish to confirm that exam-response playbooks address on-site review, direct-from-system access, redaction, and summarization options for especially sensitive documents.
• Compliance and information security teams may wish to ensure escalation paths are ready if examiners disagree about whether information should receive enhanced handling.
• Firms may wish to verify incident-response and supervisory-notification procedures can support rapid engagement if a material supervisory-information breach is suspected.

What changed

The agencies said they will use a coordinated approach to identify highly sensitive data and documents during examinations and will apply enhanced handling procedures to reduce cybersecurity risk while preserving examiner access. The statement says review may occur on-site rather than by transferring materials onto agency systems, and the agencies may use other protective methods such as direct digital review from the bank's own systems or review of redacted or summarized materials where appropriate.

Key dates

March 17, 2026

SEC-CFTC Joint Interpretation Effective; The foundational joint interpretation establishing crypto asset taxonomy and digital commodity classification became effective upon Federal Register publication

March 20, 2026

FAQs Published; CFTC Market Participants Division and Division of Clearing and Risk issue clarifying FAQs effective immediately

January 18, 2027 (Estimated)

GENIUS Act Stablecoin Exclusion; Final implementing rules for payment stablecoins issued by permitted issuers; interim staff position applies now

Within 30–60 Days Deadline

Disclosure & Program Updates; Firms must revise Form ADV, disclosure documents, offering materials, and custodial arrangements to reflect the new regulatory framework

Immediate Deadline

Compliance Review Required; Asset classification audits, staking arrangement reviews, and investment contract assessments must begin now; enforcement posture is live

Suggested considerations

• *Immediate (0–30 days):
• *Asset Classification Audit: Map every crypto asset in your portfolios, products, or platforms against the five-category framework (digital commodities, digital collectibles, digital tools, stablecoins, digital securities) established in the March 17 joint interpretation.
• *Investment Contract Review: Identify any assets subject to active issuer promises of essential managerial effort—those remain securities regardless of category and cannot be treated as digital commodities.
• *FAQ Implementation Review: Obtain and review the full CFTC FAQs (available at https://www.cftc.gov/PressRoom/PressReleases/9200-26) to identify specific operational questions relevant to your entity type.
• *Notification Protocol Establishment: If relying on the no-action relief for tokenized collateral, establish procedures to notify the CFTC of significant operational, system, or cybersecurity issues affecting digital asset collateral use (required for first three months of relief).

What changed

• The CFTC FAQs address implementation questions arising from two prior staff positions:
• Tokenized Collateral Guidance (CFTC Staff Letter 25-39): Established the framework allowing futures commission merchants (FCMs) and designated contract markets (DCMs) to accept digital assets as...
• No-Action Position (CFTC Staff Letter 26-05): Provided temporary relief permitting FCMs to accept payment stablecoins, Bitcoin, and Ether as customer margin collateral, subject to specific...
• How registered entities should operationalize tokenized collateral acceptance
• Compliance with notification and operational risk management requirements

Key dates

April 4, 2025

- CFTC Staff Letter 25-09 issued, establishing no-action position on PTMMM requirement

September 12, 2025

- CFTC issued further amended exemptive order permitting JSCC to clear interest rate swaps

September 24, 2025

- CFTC issued Notice of Proposed Rulemaking (comment period opened)

October 24, 2025 Deadline

- Comment period deadline (ISDA and SIFMA submitted comments on this date)

December 18, 2025

- CFTC approved final rule (subject to pre-publication technical corrections)

Suggested considerations

• *Immediate Actions (Pre-Implementation)
• *Implementation Actions (Upon Effective Date)
• trade disclosure systems to remove PTMMM generation and delivery requirements
• based operations, review implications of superseded Staff Letter No. 23-01
• *Ongoing Compliance

What changed

The final rule introduces the following substantive amendments: Exceptions for Swaps Intended to be Cleared (ITBC Swaps) Swap dealers and major swap participants are exempted from certain External Business Conduct Standards and swap trading relationship documentation requirements when executing swaps that are intended by the parties to be cleared contemporaneously with execution.