Are Your Trading Algorithms Ready for Scrutiny? Understanding the CFTC’s Guidance on AI

Are Your Trading Algorithms Ready for Scrutiny? Understanding the CFTC’s Guidance on AI

The Commodity Futures Trading Commission (CFTC) issued an advisory on December 5, 2024, cautioning regulated entities that the deployment of artificial intelligence (AI) in trading, risk management, and compliance functions can introduce serious regulatory and operational risks. These risks, if unmanaged, may result in violations of the Commodity Exchange Act (CEA) and CFTC regulations.

Why AI May Lead to Compliance Failures

The CFTC identified several ways in which AI can compromise regulatory compliance:

  • Opacity and Lack of Explainability
    AI models—particularly complex or “black-box” systems—often produce outputs that cannot be easily explained or audited. This undermines requirements for transparency, decision accountability, and effective recordkeeping.
  • Insufficient Supervision and Control
    Delegating critical decisions to AI without proper human oversight may violate supervisory obligations (e.g., CFTC Regulation 166.3), especially when firms cannot intervene or override model outputs.
  • Inadvertent Market Manipulation
    AI-driven trading algorithms may unintentionally engage in practices like spoofing or layering, which can distort markets and breach anti-manipulation rules, even in the absence of intent.
  • Use of Biased or Poor-Quality Data
    Training AI models on flawed or biased datasets can result in discriminatory or unfair outcomes in pricing, margin decisions, or counterparty risk assessments—potentially leading to liability under both regulatory and broader legal standards.
  • Reliance on Unvetted Third-Party Tools
    Using external AI vendors or models without sufficient validation may expose firms to unknown compliance risks. The CFTC made clear that outsourcing does not shift regulatory responsibility.
  • Automated Error Cascades and Systemic Risk
    AI systems, particularly in high-frequency trading, can propagate errors rapidly across markets, leading to violations of position limits, risk thresholds, or capital requirements.
  • Cybersecurity and Data Integrity Vulnerabilities
    AI introduces new attack surfaces (e.g., model poisoning, adversarial inputs) that can compromise the integrity of trading systems, reporting accuracy, and confidential information.

CFTC’s Key Guidance to Regulated Entities

In response to these risks, the CFTC advised all market participants subject to its oversight to:

  • Ensure full compliance with the CEA and applicable CFTC regulations, regardless of whether AI systems are developed internally or acquired from third parties.
  • Conduct robust risk assessments and update governance, internal controls, compliance procedures, and supervisory mechanisms to reflect AI-specific risks.
  • Supervise AI-enabled systems with the same rigor applied to any other critical infrastructure, ensuring transparency, auditability, and the ability to detect and correct errors.
  • Anticipate future regulatory developments: The advisory signaled the CFTC may issue further rules or guidance as the use of AI evolves and deepens across derivatives markets.

AI Compliance Checklist for CFTC-Regulated Entities

  • Document how AI systems are used in trading, compliance, and risk management.
  • Implement controls to ensure AI outputs are explainable and auditable.
  • Test AI models for accuracy, bias, and unintended consequences before deployment.
  • Establish clear human oversight and intervention protocols.
  • Validate third-party AI tools and document due diligence processes.
  • Monitor for potential market manipulation or disruptive trading behaviors.
  • Update risk management policies to address AI-specific vulnerabilities.
  • Secure AI systems against cyber threats and ensure data integrity.
  • Train staff on AI risks, governance standards, and regulatory expectations.
  • Review and update supervisory procedures regularly in light of evolving AI use.

About Kennyhertz Perry, LLC

Kennyhertz Perry, LLC is a business and litigation law firm representing clients in highly regulated industries. The firm was founded by two veteran Kansas City attorneys, John Kennyhertz and Braden Perry. To learn more about the firm, visit kennyhertzperry.com.

*The choice of a lawyer is an important decision and should not be based solely upon advertisements.