CFTC and SEC Issue Privacy Guidance

Introduction

The Commodity Futures Trading Commission (“CFTC”) and the Securities and Exchange Commission (“SEC”) have recently issued guidance with respect to privacy notices and customer data. The CFTC also proposed a rule to improve the quality and transparency of swaps data. Taken together, this recent guidance reflects a focus on protecting the privacy interests of customers of financial services companies while also enhancing the availability of trading data. In addition, the National Futures Association (“NFA”), the self-regulatory organization for the U.S. derivatives industry, announced that it had approved an annual dues surcharge of $1,750 for swap firms.

CFTC Implements Exception for Annual Privacy Act Notice Delivery Requirement

By a final rule published in the Federal Register on April 25, 2019, the CFTC announced that it had adopted amendments to revise its regulations requiring financial institutions to provide Annual Privacy Notices to customers. [1] The Commodity Futures Modernization Act of 2000 mandates that financial institutions such as futures commission merchants (“FCMs”), commodity trading advisors (“CTAs”), commodity pool operators (“CPOs”), and introducing brokers (“IBs”) provide their customers with annual notices regarding their privacy policies and practices. If such financial institutions share nonpublic personal information with particular types of third parties, the financial institutions must also provide their customers with an opportunity to opt out of the sharing, subject to certain exceptions.

On December 4, 2015, Congress amended this statutory requirement by enacting an amendment entitled “Eliminate Privacy Notice Confusion.” [2] This amendment provides an exception to the Annual Privacy Notice delivery requirement if an FCM, CTA, CPO, or IB: (1) does not share nonpublic personal information about its customers, except for certain purposes that do not trigger the customer’s statutory right to opt out of such sharing; and (2) has not changed its policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed in its most recently distributed privacy notice. [3] (An FCM, CTA, CPO, or IB must disclose a new privacy notice if it subsequently changes those policies and practices.)

The CFTC implemented the amendment of the statute by amending CFTC Regulation 160.5. It will become effective on May 28, 2019. [4]

SEC Issues Risk Alert: Investment Adviser and Broker-Dealer Compliance with Regulation S-P, Privacy Notices, and Safeguard Policies 

On April 16, 2019, the Office of Compliance Inspections and Examinations (“OCIE”) at the SEC issued a Risk Alert for investment advisers and broker-dealers with respect to Regulation S-P, which is the primary SEC rule regarding privacy notices and safeguard policies. [5] Among other requirements, Regulation S-P requires registrants to: (1) provide a clear and conspicuous notice to customers that accurately reflects privacy policies and practices generally no later than when a customer relationship is established (“Initial Privacy Notice”), (2) provide a clear and conspicuous notice to its customers that accurately reflects its privacy policies and practices at least annually during the customer relationship (“Annual Privacy Notice”), and (3) deliver a clear and conspicuous notice to customers that accurately explains the right to opt out of some disclosures of nonpublic personal information to unaffiliated third parties (“Opt-Out Notice”). In addition, the Safeguards Rule of Regulation S-P requires registrants to adopt written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer records and information. [6]

In the Risk Alert, the SEC staff identified several common deficiencies in compliance with Regulation S-P and the Safeguards Rule. With respect to Privacy and Opt-Out Notices, the SEC staff observed certain registrants that did not provide these notices to their customers. When such notices were provided, some did not accurately reflect firms’ policies and procedures or inform customers of their right to opt out of the registrant sharing their nonpublic personal information with unaffiliated third parties. The SEC staff also observed registrants that did not have written policies and procedures as required under the Safeguards Rule. Where such policies existed, the SEC staff observed registrants with written policies and procedures that did not appear to be implemented. In addition, the SEC staff identified policies that were not reasonably designed to: (1) ensure the security and confidentiality of customer records and information, (2) protect against anticipated threats or hazards to the security or integrity of customer records and information, and (3) protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to customers. As a result of these examinations by OCIE, many registrants have modified their written policies and procedures to respond to the deficiencies identified by the SEC staff. OCIE “encourages registrants to review their written policies and procedures, including implementation of those policies and procedures, to ensure that they are compliant with Regulation S-P.” [7]

Firms that are registered as CPOs and CTAs under the Commodity Exchange Act are often also registered as investment advisers and, thus, subject to Regulation S-P. For such firms, the CFTC accepts compliance with Regulation S-P as substituted compliance with the CFTC’s privacy notice requirements. Accordingly, CPOs and CTAs should make sure that their privacy notice policies are in accordance with the Risk Alert.

Potential Impact on End-Users of CFTC Proposed Rule to Improve Data Quality and Transparency

On May 13, 2019, the CFTC published a notice of proposed rulemaking to amend the rules governing swap data repositories (“SDRs”) and reporting obligations of swap market participants. [8] The proposed rule is the first rulemaking arising out of the “Roadmap to Achieve High Quality Swaps Data,” which is a comprehensive review of swap reporting regulations that the CFTC’s Division of Market Oversight launched in July 2017. [9] The proposed rule would update reporting requirements for SDRs to verify swap data with reporting counterparties and correct swap data errors and omissions.

Although buy-side entities such as commodity pools or separately managed accounts where swap trading is directed by a CPO or CTA are generally nonreporting counterparties, the proposed rule would affect them in particular ways. The rest of this section will discuss the proposed rule with special reference to the potential impact on buy-side entities.

Under current regulations, the nonreporting counterparty is required to notify the reporting counterparty if it becomes aware of errors or omissions in swap data reported to an SDR. The current regulations require that an error or omission be reported “as soon as technologically practicable” following discovery. The proposed rule would reinforce that requirement with a mandate to make such reports no later than three business days following discovery. If a nonreporting counterparty does not know the identity of the reporting counterparty because the swap was executed on or subject to the rules of a swap execution facility (“SEF”), the nonreporting counterparty would be required to notify the SEF where the swap was executed of the error or omission.

The CFTC further stated in the preamble of the proposed amendments that it is proposing to clarify that swap data must be corrected “regardless of the state of the swap that is the subject of the swap data,” so market participants should be aware that all incorrect or omitted swap data must be corrected, even if the swap has been terminated or matured, or has otherwise ceased to be an open swap (sometimes referred to as a “dead swap”). [10] The CFTC characterizes this as a clarification rather than a new requirement because the current regulations governing correcting data do not have time restrictions. The CFTC states that failure to correct the record with respect to “dead swaps” would interfere with its ability “to generate holistic, accurate, data-driven policies, analyses, and reports.” [11]

CPOs and CTAs that may consider acting as the reporting counterparty under the CFTC’s reporting hierarchy should be aware that the proposed amendment will create objective standards for the reporting counterparty to perform certain tasks related to ongoing swap data reporting and correction of errors in reports. In order to comply with these new standards, the reporting party would have to perform periodic data reconciliations and would have to interface in specified ways with the SDR for each swap for which it is the reporting party, including understanding SDR policies, reviewing regular lists of outstanding swaps received from the SDR, and sending corrections or verification reports to the SDR within the time period of three business days as described above. The proposed amendments would likely impose new compliance burdens for non-swap dealer reporting parties. Indeed, the CFTC estimates that compliance with the proposed amendments would require end-user reporting parties to spend about 24 additional hours per year on average. On balance, the proposed amendment, if adopted, could give buy-side entities a reason to resist being the reporting party on swaps.

The proposed amendments to the swap reporting rules constitute the first of three anticipated Roadmap rulemakings. The CFTC will initially provide a comment period on these proposed amendments of 75 days, ending on July 29, 2019. When the CFTC proposes the next two rulemakings, it anticipates re-opening the comment period for this first proposal to provide market participants with an opportunity to comment collectively on the three rulemakings together, since the proposals address interconnected issues. As the Roadmap rulemakings must all work in tandem to achieve their goals, the CFTC also anticipates that key provisions of each rulemaking would have the same compliance date, regardless of when each rulemaking is adopted in final form. The CFTC intends to provide a sufficient implementation period for these various rulemakings to give SDRs and market participants enough time to implement and test the changes that would be required.

NFA Imposes Dues Surcharge for Swap Firms

By a Notice to Members dated May 20, 2019, NFA announced that it had approved an annual dues surcharge of $1,750 for IBs, CPOs, and CTAs, as well as those FCMs for which NFA is the designated self-regulatory organization, that are approved as swap firms. [12] NFA imposed this surcharge because it does not currently assess any fees related to its oversight of swaps activities. Pending approval by the CFTC, the dues surcharge will become effective on January 1, 2020, and will be included in all invoices for membership dues payable after that date. To avoid this surcharge, a current or pending swap-approved firm that is not engaged in swaps activities and is not required to be a swap-approved firm must withdraw its swap approval status by completing Form 7-W using NFA’s online registration system.

NFA also recently imposed swaps proficiency requirements for associated persons (“APs”) of swap firms, which will be effective on January 31, 2020. [13] Taken together, the assessment of dues and the new swaps proficiency mandate may increase compliance and other obligations for firms that are engaged in swaps activities. Swap firms may wish to re-evaluate their registration status along with the number of individuals at their firms who should be registered as swaps APs.

Conclusion

The guidance and proposals described above reflect the maturation of swap market regulation as the regulators address nuanced applications of the swaps regime that has been put in place under Title VII of the Dodd-Frank Act. The privacy guidance issued by the CFTC and the SEC reflects an enhanced regulatory emphasis on the privacy interests of the customers of financial services companies. At the same time, the CFTC proposal to amend the reporting obligations of swap market participants indicates an aspiration to provide greater transparency to regulators and the public and to improve the overall quality of swap market data. The new NFA fee reflects the goal of assessing the costs of the enhanced regulatory oversight of swaps activities on those firms engaging in such activities.

Notes

[1] See Commodity Futures Trading Commission, Privacy of Consumer Financial Information Amendment to Conform Regulations to the Fixing America’s Surface Transportation Act, 84 Fed. Reg. 17341 (April 25, 2019). It is available here and describes in greater detail the conditions under which there is an exception to the annual notice requirement.

[2] See Section 75001, Public Law 114-94, 129 Stat. 1312 (2015), available at https://www.govinfo.gov/content/pkg/PLAW-114publ94/html/PLAW-114publ94.htm (last accessed May 5, 2019).

[3] See supra note 1.

[4] See supra note 1.

[5] See Securities and Exchange Commission Office of Compliance Inspections and Examinations, Investment Adviser and Broker-Dealer Compliance Issues Related to Regulation S-P – Privacy Notices and Safeguard Policies, April 16, 2019, https://www.sec.gov/files/OCIE%20Risk%20Alert%20-%20Regulation%20S-P.pdf (last accessed May 6, 2019).

[6] The SEC has not yet updated the text of Regulation S-P to conform with the “Eliminate Privacy Notice Confusion Amendment,” which provides an exception to the Annual Privacy Notice delivery requirement.

[7] See supra note 5.

[8] See Commodity Futures Trading Commission, Proposed Amendments to the Commission’s Regulations Relating to Certain Swap Data Repository and Data Reporting Requirements, 84 Fed. Reg. 21044 (May 13, 2019), https://www.cftc.gov/sites/default/files/2019/05/2019-08788a.pdf?utm_source=govdelivery (last accessed May 13, 2019).

[9] See Commodity Futures Trading Commission, Division of Market Oversight Announces Review of Swaps Reporting Regulations, July 10, 2017, https://www.cftc.gov/PressRoom/PressReleases/pr7585-17 (last accessed May 6, 2019).

[10] 84 Fed. Reg. 21044, at 21069.

[11] Id.

[12] The Notice to Members, Notice I-19-13, is available here and describes in greater detail the dues surcharge and implementation timeline.

[13] See Cary J. Meer, Lawrence B. Patent, Edgar Mkrtchian. Swaps Proficiency Requirements for Associated Persons; Revised Form 7-R. April 8, 2019. Available at: http://www.klgateshub.com/details/?pub=Swaps-Proficiency-Requirements-for-Associated-Persons-Revised-Form-7-R-04-05-2019 (last accessed May 21, 2019).