April 1, 2024

Submitted via CFTC Comments Portal
Christopher Kirkpatrick
Secretary of the Commission
Commodity Futures Trading Commission
Three Lafayette Centre
1155 21st Street, N.W., Washington, D.C. 20581

Re: Operational Resilience Framework for Futures Commission Merchants, Swap Dealers and Major Swap Participants

Dear Mr. Kirkpatrick,

The Global Financial Markets Association (“GFMA”)1 supports the Commodity Futures Trading Commission’s (the “Commission”) stated aim to provide a principlesbased approach in its rule proposal for requirements for an Operational Resilience Framework (“ORF”) for Futures Commission Merchants (“FCMs”), Swap Dealers (“SDs”), and Major Swap Participants (“MSPs”) (the “Proposal”).2 GFMA believes that the Commission’s aim for a principles-based approach is consistent with other international regulatory efforts on operational resilience,3 which GFMA fully supports. GFMA welcomes the opportunity to comment on the Proposal and offer recommendations to align the Proposal with the Commission’s stated goal to develop a principles-based rule. GFMA is also aware that the Securities Industry and Financial Markets Association (“SIFMA”) and the Institute of International Bankers (“IIB”) are submitting a comment on the Proposal (the “SIFMA and IIB Letter”). GFMA fully aligns with and supports the recommendations in the SIFMA and IIB Letter.

GFMA appreciates the importance of operational resilience for the public and private sectors to maintain confidence in the financial industry and to support financial stability and economic growth. We and our members are fully committed to ensuring
robust operational resilience and already deploy a wide variety of policies, procedures, systems and controls to ensure “the ability to deliver critical operations through disruption.”4 Indeed, we are consistently and closely engaged with global standardsetters and regulators on operational resilience. As such, we are keenly aware of the depth and breadth of the work international regulators are currently doing in the operational resilience space and believe harmonization is in the interest of both regulators and firms. These pre-existing frameworks are the product of not only recognition among our members that operational resilience is good for business, but also that many entities regulated by the Commission are already, or will shortly be, subject to operational resilience requirements that would overlap with those proposed by the Commission. To that end, we have included an Appendix to this letter that highlights relevant regulations and guidance that financial firms already comply with globally and that reflect the resilience capabilities that firms have developed over time.

To ensure that the Commission’s Proposal achieves its stated aim to establish principles-based operational risk management provisions that protect derivatives markets and the institutions and customers therein, it is essential that the Commission aligns with the wider regulatory landscape. For example, it is critical that covered entities are able to communicate internally, and with their regulators, about operational resilience matters on a common linguistic and principled basis. At present, however, GFMA is concerned that the Proposal may destabilize established and developing international standards in operational resilience, as the Proposal risks creating both unnecessary regulatory overlap5 as well as divergence in terminology and substance from existing regimes. This dislocation, rather than improving operational resilience outcomes, risks increasing the compliance burden on covered entities in order to deal with disparate regimes and will instead impede operational resilience due to focusing on navigating conflicting standards instead of on the substance of resilience.

GFMA’s concern with alignment is particularly acute relative to the Proposal’s definitions. To begin, GFMA agrees with SIFMA and IIB that the Proposal would benefit from a clear definition of operational resilience that reflects the existing definition
in the Basel Committee on Banking Supervision’s Principles for Operational Resilience: “the ability of a [covered entity] to deliver critical operations through disruption.” GFMA believes the Basel Committee’s definition appropriately limits the scope of its
definition of operational resilience to “critical operations” and “critical functions,” in turn helping to define the people, processes and communication channels necessary to support effective engagement.

Next, the Proposal’s existing definitions are both overly broad and misaligned with international definitions. Specifically, GFMA is concerned with the scope of the definitions for “incident,” “covered technology,” “covered information,” the incident “notification trigger” and “critical third-party service provider.” GFMA believes that the current definitions for these terms are likely to result in undue compliance burdens, as the use of defined terms will flow through various regulatory provisions, creating asymmetry with the other regulations and guidance that firms are complying with in parallel. Therefore, GFMA strongly encourages the Commission to revise the definitions in accordance with existing, widely used terminology, as put forward by the SIFMA and IIB Letter.

Moreover, the need for broad regulatory convergence is also reflected in the significant efforts undertaken by the Financial Stability Board through its Format for Incident Reporting Exchange (“FIRE”) initiative, which aims to reduce regulatory fragmentation and achieve global standardization of cyber incident reporting requirements between regulatory authorities and financial institutions, a process being spearheaded by, among others, Andrew Bailey, Chair of the Financial Stability Board
Standing Committee on Supervisory and Regulatory Cooperation.

Finally, GFMA is concerned that the Proposal’s six-month implementation period is too short to allow covered entities to successfully obtain substituted compliance determinations and, instead, will leave entities that have submitted applications in good faith waiting for confirmation for some period of time after the implementation period has ended. For example, recent experience with capital and financial reporting requirements has shown that the timeline for substituted compliance tends to be years, not months. As such, the Proposal fails to fully reflect the wide range of obligations that covered entities are already subject to, and while GFMA’s members are confident that substituted compliance would be granted, they are concerned about the time it would take were the rule to come into effect as proposed. GFMA therefore supports the SIFMA and IIB Letter’s request for an extended and phased implementation timeframe.

***

As noted at the outset, GFMA welcomes the opportunity to comment on the Proposal. We appreciate the Commission’s consideration of our comments from a global regulatory perspective and hope that they serve as an aid to the Commission’s deliberations. GFMA would welcome the opportunity to continue to participate in this valuable process. Please feel free to contact the undersigned to discuss these issues further.

Sincerely,
Allison Parent
Executive Director
GFMA

cc: The Honorable Rostin Behnam, Chairman
The Honorable Kristin N. Johnson, Commissioner
The Honorable Christy Goldsmith Romero, Commissioner
The Honorable Summer K. Mersinger, Commissioner
The Honorable Caroline D. Pham, Commissioner
Ms. Amanda Olear, Director, Market Participants Division
Ms. Pamela Geraghty, Deputy Director

1 The GFMA represents the common interests of the world’s leading financial and capital market participants, to provide a collective voice on matters that support global capital markets. We advocate on policies to address risks that have no borders, regional market developments that impact global capital markets, and policies that promote efficient cross-border capital flows, benefiting broader global economic growth. The Global Financial Markets Association (“GFMA”) brings together three of the world’s leading financial trade associations to address the increasingly important global regulatory agenda and to promote coordinated advocacy efforts. The Association for Financial Markets in Europe (AFME) in London, Brussels and Frankfurt, the Asia Securities Industry & Financial Markets Association (ASIFMA) in Hong Kong and Singapore, and the Securities Industry
and Financial Markets Association (SIFMA) in New York and Washington are, respectively, the European, Asian and North American members of GFMA.

2 Operational Resilience Framework for Futures Commission Merchants, Swap Dealers, and Major Swap Participants, 89 Fed. Reg. 4706 (Jan. 24, 2024) [hereinafter Proposing Release].

3 See, e.g., Basel Committee on Banking Supervision, Principles for Operational Resilience, at 3 (March 2021), https://www.bis.org/bcbs/publ/d516.pdf [hereinafter Principles for Operational Resilience]; SR 20-24, Sound Practices to Strengthen Operational Resilience (Nov. 2, 2020), available at https://www.federalreserve.gov/supervisionreg/srletters/SR2024.htm.

4 Principles for Operational Resilience, supra note 2, at 3.

5 For example, covered entities under the Proposal are already subject to NFA requirements on information security, third-party risk management, and business continuity and disaster recovery. See National Futures Association, Interpretive Notice to NFA Compliance Rules 2-9, 2-36 and 2-49, available at https://www.nfa.futures.org/rulebooksql/rules.aspx?RuleID=9070&Section=9.