CFTC Withdraws Proposed "Operational Resilience Framework"

The CFTC withdrew a proposed rule to establish an Operational Resilience Framework ("ORF") for futures commission merchants ("FCMs"), swap dealers, and major swap participants. 

The proposal would have introduced new CFTC Rule 1.13 and amended CFTC Rule 23.603 ("Business continuity and disaster recovery") to establish the ORF framework. The proposed framework would have required firms to implement information security, third-party oversight, and business continuity programs, supported by governance, testing, training, and recordkeeping. It also would have required timely reporting of significant disruptions to the CFTC and stakeholders, while allowing reliance on group-wide or third-party programs if risks were properly managed. (See related coverage.) 

The CFTC explained its decision to withdraw the proposed rule saying there was substantial overlap with existing operational resilience requirements issued by other domestic and international regulators. The CFTC stated that many FCMs and swap dealers are already subject to enterprise-wide standards as part of larger banking organizations. The CFTC concluded that finalizing the rule would create duplicative obligations and instead signaled that it may revisit the issue through future rulemaking.