Jul 142023

Cybersecurity and Environmental Fraud Top Priorities of U.S. Commodity Futures Trading Commission Division of Enforcement

Paul M. Tyrrell, Jennifer Seale, Steven E. Sexton and Casey Khan
, , , ,

Just before Americans began their Fourth of July holiday, the U.S. Commodity Futures Trading Commission (CFTC) Division of Enforcement Director announced that the division has established two key task forces: the Cybersecurity and Emerging Technologies and the Environmental Fraud Task Force.1 Both task forces will be staffed with attorneys and investigators across the Division of Enforcement with the goal of serving as subject matter experts and prosecuting cases. As a result, CFTC registrants should be prepared for heightened focus on cybersecurity and environmental fraud, particularly in the derivatives and relevant spot markets.

Cybersecurity and Emerging Technologies Task Force

The release provides that the Cybersecurity and Emerging Technologies Task Force will address cybersecurity and emerging technologies issues, including artificial intelligence. Specifically, the release states that CFTC will be looking at its registrants to ensure that they have sufficient cybersecurity controls, including controls surrounding customer information and system safeguards. Notably, the release informs CFTC registrants that the task force will explore the role that emerging technologies such as artificial intelligence and machine learning may play in violations of the Commodity Exchange Act (CEA) and CFTC regulations. In addition, the task force will focus on ensuring that registrants adequately supervise their use of emerging technologies.

As a result of the Division of Enforcement’s rollout of this task force, CFTC registrants should look closely at their current state of play with respect to cybersecurity, their use and/or anticipated use of artificial intelligence, and its application toward compliance with the CEA and the CFTC regulations.

Environmental Fraud Task Force

The release notes that as more CFTC registrants tout their environmental credentials and as voluntary carbon markets grow, there is an increased risk of fraud and manipulation. As a result, the Environmental Fraud Task Force will focus on fraud and manipulation in carbon credit markets and other forms of greenwashing, including misrepresentations about environmental, social, and governmental (ESG) investment strategies. The task force will focus this effort not only in regulated derivatives markets but also relevant spot markets (e.g., voluntary carbon credit markets). The focus will be on fraud related to purported environmental benefits of purchase carbon credits and CFTC registrants’ material misrepresentations regarding ESG products and services.

As a result of this task force’s formation, it will be important for registrants and others to look closely at their practices that surround its focus, including any representations made related to ESG products or services.

Conclusion

The Division of Enforcement’s effort to stand up two new task forces will certainly have implications for CFTC registrants, including potential document and information requests for the division to begin gathering sufficient information to make assessments surrounding potential gaps and/or concerns in cybersecurity, emerging technology, and environmental programming.

1 CFTC, Release No. 8736-23 (CFTC Division of Enforcement Creates Two New Task Forces), June 29, 2023 (available here).

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.

Paul M. Tyrrell

Boston

ptyrrell@sidley.com

Jennifer Seale

Washington, D.C.

jseale@sidley.com

Steven E. Sexton

Chicago

ssexton@sidley.com

Casey Khan

Houston

ckhan@sidley.com

You might also like
Looking Ahead to 2025 in EU Cybersecurity Developments

As 2024 draws to a close, we look ahead to notable upcoming cyber developments in the new year. From the adoption of new cyber laws to the initiation of infringement proceedings by the European Commission against a number of EU Member States for alleged failures to adequately implement the EU Network and Information Systems Security 2 Directive, the EU continues to emphasize cybersecurity in a rapidly evolving legal and technological environment. There are no signs of this momentum slowing down in 2025.

Consumer Financial Protection Bureau Releases Proposed Rule on Fair Credit Reporting Act

On December 3, 2024, the U.S. Consumer Financial Protection Bureau (the CFPB) announced a notice of proposed rulemaking that seeks to significantly expand the scope of the Fair Credit Reporting Act and its implementing regulation, Regulation V (collectively, the FCRA), and to impose new requirements on covered parties, such as data brokers (the Proposed Rule).1 If implemented as currently drafted, the Proposed Rule would increase the amount of information defined as a “consumer report” and the number of persons defined as a “consumer reporting agency.” Moreover, it would create new requirements in relation to certain permissible purposes for which a consumer reporting agency may furnish a consumer report to a party.

EU AI Act: Are You Prepared for the “AI Literacy” Principle?

The EU AI Act is the world’s first horizontal and standalone law governing the commercialization and use of AI, and a landmark piece of legislation for the EU. Among the various provisions of the EU AI Act, the “AI literacy” principle is an often overlooked but key obligation which requires organizations to ensure that staff who are involved in the operation and use of AI have the necessary skills, knowledge and understanding to adequately assess AI-related risks and opportunities (e.g., through training and hiring staff with the appropriate background and skillset). This obligation – which applies from February 2, 2025 – is one of the few obligations under the EU AI Act that applies to all AI systems i.e., irrespective of the level of risk that the AI system presents. Indeed, by introducing AI literacy as one of the first provisions of the AI Act (Article 4), the EU legislators appear to underscore the significance of this requirement.