UNITED STATES OF AMERICA

 COMMODITY FUTURES TRADING COMMISSION

 OPEN MEETING OF THE COMMISSION

 Washington, D.C.

 Thursday, September 8, 2016
 2 

 1 PARTICIPANTS:

 2 Commissioners:

 3 CHAIRMAN TIMOTHY G. MASSAD

 4 COMMISSIONER SHARON Y. BOWEN

 5 COMMISSIONER J. CHRISTOPHER GIANCARLO

 6 CFTC Staff:

 7 

 

CHRISTOPHER KIRKPATRICK

 Secretary of the Commission

 8

 Staff Presentation: Final Rule - System

 9 Safeguards Testing Requirements

 10 VINCE McGONAGLE

 Division of Market Oversight

 11

 RACHEL BERDANSKY

 12 Division of Market Oversight

 13 DAVID STEINBERG

 Division of Market Oversight

 14

 DAVID TAYLOR

 15 Division of Market Oversight

 16 SUSAN STEWART

 Division of Market Oversight

 17

 Staff Presentation: Final Rule - System

Safeguards Testing Requirements for Derivatives

Clearing Organizations

 18 

 

 19

 EILEEN DONOVAN

 20 Division of Clearing and Risk

 21 JULIE MOHR

 Division of Clearing and Risk

 22
 3 

 1 PARTICIPANTS (CONT'D):

 2 JAMES ORTLIEB

 Division of Clearing and Risk

 3 

 Staff Presentation: Comparability

Determination for Japan Uncleared Swap Margin

Rules for Substituted Compliance Purposes

 4 

 

 5 

 FRANK FISANICH

Division of Swap Dealer and Intermediary

Oversight

 6 

 

 7 

 KATHERINE S. DRISCOLL

Division of Swap Dealer and Intermediary

Oversight

 8 

 

 9 

 10

 11 * * * * *

 12

 13

 14

 15

 16

 17

 18

 19

 20

 21

 22
 4 

 1 P R O C E E D I N G S

 2 (10:06 a.m.)

 3 CHAIRMAN MASSAD: Okay, good morning.

This meeting will come to order. It's after Labor

Day, the kids are back in school, so we thought

we'd kick off the fall with an open meeting this

morning. This is a public meeting of the

Commodity Futures Trading Commission. I'd like to

welcome members of the public, market

participants, and members of the media, as well as

those taking part on the phone or via webcast.

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 Today we gather to consider three

important measures. The first two are final rules

that will enhance cybersecurity and operational

safeguards in our markets. In addition, we will

consider a determination of comparability with

respect to Japan's margin requirements for

uncleared swaps.

 13 

 14 

 15 

 16 

 17 

 18 

 19 The risk of cyberattack probably

represents the single greatest threat to the

stability and integrity of our markets today.

Instances of cyberattacks are all too familiar

 20 

 21 

 22 
 5 

 1 both inside and outside the financial sector.

Today they are often motivated not just by those

with a desire for profit but by those with a

desire deliberately to disrupt or to destabilize

orderly operations. And that is why the system

safeguard rules are so important. They will apply

to the core infrastructure in our markets, the

exchanges, clearing houses, trading platforms, and

trade repositories. They will ensure that those

private companies are adequately evaluating cyber

risks and testing their cybersecurity and

operational risk defenses. And while our rules

already require this generally, the measures we

will consider today add greater definition, not by

being overly prescriptive, but by setting some

principles-based standards rooted in industry best

practices.

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 I've said many times that as regulators

we must not just look backwards to address the

causes of past failures or crises. We must also

look ahead, ahead to the new opportunities and

challenges facing our markets. Financial markets

 19 

 20 

 21 

 22 
 6 

 1 constantly evolve, and we must ensure our

regulatory framework is adapting to those changes.

These rules are one good example of how we are

looking ahead and addressing these new challenges.

 2 

 3 

 4 

 5 I want to thank all those who provided

feedback on the proposed rules the Commission

approved last December. We received a number of

thoughtful comments from market participants, most

of which expressed broad support for the

proposals. Commenters also highlighted some areas

of concern; and as you will hear, we've made

adjustments based on that feedback.

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 For example, we have reduced the

frequency of controls testing and narrowed the

instances where independent contractor testing is

required. We have also clarified definitions of

key terms and made clear that the scope of

required testing will be based on appropriate risk

and threat analysis.

 14 

 15 

 16 

 17 

 18 

 19 

 20 If approved, these new rules will serve

as a strong and important complement to the many

other steps being taken by regulators and market

 21 

 22 
 7 

 1 participants to address cybersecurity. For

example, government agencies and market

participants are already working together to share

information about potential threats and risks and

learn from one another.

 2 

 3 

 4 

 5 

 6 Today we will also consider a measure

that will further our commitment to international

cooperation and harmonization: The comparability

determination with respect to Japan's rules on

margin for uncleared swaps. This will provide

that a Japanese swap dealer registered with the

CFTC can comply with many aspects of our margin

rules by meeting Japan's corresponding

requirements. Comparability determinations like

this are critical to building a strong and

sensible international regulatory framework.

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 As always, let me thank the hardworking

CFTC staff for their work on today's rules and for

what I'm sure will be instructive presentations.

And I also want to thank my fellow Commissioners

-- Commissioner Bowen and Commissioner Giancarlo

-- for their commitment to these issues and their

 18 

 19 

 20 

 21 

 22 
 8 

 1 involvement. Let me first recognize Commissioner

 2 Bowen for any opening remarks.

 3 COMMISSIONER BOWEN: Thank you, and good

morning. I will be voting yes on both of these

system safeguards rules today. There's really not

much more to say than I said about these rules

when they were proposed in December 2015.

Cybersecurity is a top concern for American

companies, especially financial firms. These

rules are a good step forward in addressing those

concerns. I want to thank the staff for their

hard work on this, and I'd like to give my remarks

later on the other rules.

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 CHAIRMAN MASSAD: Commissioner

 15 Giancarlo.

 16 COMMISSIONER GIANCARLO: Thank you.

This morning I issued two written statements

concerning the rulemakings before the Commission.

Thus, my oral remarks will be brief.

 17 

 18 

 19 

 20 As for system safeguards, I and my

fellow Commissioners are united in the recognition

that cyber and system security is of the utmost

 21 

 22 
 9 

 1 importance to the integrity and durability of

financial markets. When I voted in favor of these

rule proposals last December, I said they were a

constructive step in better defending markets and

participants from cyberattack.

 2 

 3 

 4 

 5 

 6 I believe that the final rules before us

are better balanced than the original proposals.

They provide greater flexibility to market

operators, and they address my concern that simply

being hacked cannot be considered a rule violation

subject to enforcement and that market operators

should not be held strictly liable for cyber

breaches.

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 I commend CFTC staff for their good work

and often thoughtful responses to the

commentators. I draw their attention to my

written statement that does raise some concerns

about some costs in the rule that will be imposed

on smaller DCOs and offer some practical

suggestions.

 15 

 16 

 17 

 18 

 19 

 20 

 21 As for the comparability determination

 22 for Japan, I harken back to my dissent to the rule
 10

 1 on cross-border application of margin requirements

for uncleared swaps. I said then that the

comparability framework was overly complex and

unduly narrow. I said the element-by-element

methodology for permitting substituted compliance

was contrary to the principles-based holistic

analysis that the Commission has used in the past.

And I said that it could result in an impractical

patchwork of U.S. and foreign regulations for

cross-border transactions. I worried that it

would make it harder for American financial firms

to serve their customers around the world.

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 Last Wednesday, I warned of a liquidity

crunch that could occur if the CFTC and U.S. bank

regulators barreled ahead with the September 1

implementation of cross-border margin despite the

delay of the rule by 21 out of 24 overseas

regulators. I said imposing the rule would put

U.S. industrial and other companies needing to

hedge risks using uncleared swaps at a competitive

disadvantage to their overseas competitors. I

advised instead that U.S. Regulators announce an

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 
 11

 1 immediate pause long enough to reach a new

agreement with their overseas counterparts on a

final deadline for joint implementation. My

advice went unheeded.

 2 

 3 

 4 

 5 Sure enough, one day later, Asian swaps

markets almost ground to a halt amid chaos and

confusion over the application of the new margin

rules. I received reports of counterparties

avoiding trading with U.S. persons. Many trades

were rejected.

 6 

 7 

 8 

 9 

 10 

 11 This disruption was totally avoidable

had the CFTC and its fellow U.S. regulators been

less concerned with sticking to an arbitrary

deadline and more concerned with the impact of a

self-induced market shock on the welfare of

American business.

 12 

 13 

 14 

 15 

 16 

 17 I take the opportunity now to reiterate

my warning that the cross-border margin rule's

subjectivity and complexity will continue to be a

source of regulatory uncertainty at the expense of

U.S. financial firms, their employees, and the

American businesses that they serve.

 18 

 19 

 20 

 21 

 22 
 12

 1 But turning to the issue before us,

despite an analytical process that is overly

complex and unduly narrow, the determination does

appropriately recognize that certain differences

between the U.S. and Japanese margin regimes

achieve comparable outcomes. Wrong approach,

right result. Therefore, I will support the

determination.

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 Thank you.

 10 CHAIRMAN MASSAD: For each of the items

on today's agenda, the staff will make

presentations to the Commission. After each

presentation, the floor will be open for questions

and comments from each of the Commissioners.

Following the close of discussion on each matter,

the Commission expects to vote on the staff

recommendation as presented. All final votes

conducted in this public meeting shall be recorded

votes. The results of votes approving the

issuance of rulemaking documents will be included

with those documents in the Federal Register. At

this point, I ask unanimous consent to allow staff

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 
 13

 1 to make technical corrections to the documents

voted on today, assuming they are approved, prior

to sending them to the Federal Register.

 2 

 3 

 4 Without objection, so ordered. At this

time, I would like to welcome the following staff

for their presentations on two rules related to

system safeguards. First, from the Division of

Market Oversight to my right, Vince McGonagle, the

director; Rachel Berdansky, deputy director; Susan

Stewart, systems risk analyst; David Steinberg,

associate director; and David Taylor, associate

director. And from the Division of Clearing and

Risk, Julie Mohr, deputy director; James Ortlieb,

associate director; and Eileen Donovan, deputy

director.

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 I will now allow the staff to make their

presentations, so I will turn to DMO, and I think

Susan and David will make the presentations.

 17 

 18 

 19 Okay, thank you.

 20 MR. MCGONAGLE: Yes. Thanks, Chairman.

 21 MR. TAYLOR: Good morning, Mr. Chairman

 22 and Commissioners.
 14

 1 Before I begin, I would like to thank my

fellow Division of Market Oversight team members,

including Rachel Berdansky, David Steinberg,

Shifra Katz, Susan Stewart, Chris Russell-Wood,

Michael Bartlett, and Kyle Miller, and my system

safeguards colleagues in the Division of Clearing

and Risk, as well as Dave Reiffen from the Office

of the Chief Economist and Dhaval Patel and Susan

Nathan from the Office of the General Counsel for

their hard work in preparing the final rules that

we are presenting to the Commission today.

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 Today, staff is recommending that the

Commission approve two parallel final rulemakings

addressing cybersecurity and system safeguards

requirements for designated contract markets, or

DCMs; swap execution facilities, or S-E-Fs or

SEFs; swap data repositories, or SDRs; and

derivatives clearing organizations, or DCOs. My 

DCR colleague, Julie Mohr, and I will share the

task of making the presentation.

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 The final rules would enhance and

 22 clarify existing Commission rule provisions
 15

 1 related to cybersecurity testing and system

safeguards risk analysis and oversight, and add

new provisions concerning certain aspects of

cybersecurity testing. Most importantly, the

final rules would clarify the existing rules by

specifying and defining the types of cybersecurity

testing that DCMs, SEFs, SDRs, and DCOs must

conduct in order to fulfill their regulatory

system safeguards testing obligations.

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 Cybersecurity testing by DCMs, SEFs,

SDRs, and DCOs can harden their cyber defenses, 

mitigate their operations reputation and financial

risk, and maintain and increase their cyber

resilience and their ability to detect, contain,

respond to, and recover from cyberattack. As set

out in detail in both rulemakings, cybersecurity

testing is a well-established best practice both

generally and for financial sector entities.

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 As we will outline for you, the central

point of the final rules would be the requirement

for all DCOs, all DCMs, all SEFs, and all SDRs

regulated by the Commission to conduct five

 20 

 21 

 22 
 16

 1 important types of cybersecurity testing that are

essential to an effective program of system

safeguards risk analysis and oversight: One,

vulnerability testing; two, penetration testing;

three, controls testing; four, security incident

response plan testing; and five, enterprise

technology risk assessment.

 2 

 3 

 4 

 5 

 6 

 7 

 8 The Commission's existing system

safeguards rules require these entities to conduct

testing to ensure the reliability, security, and

capacity of their systems. Best practices

establish that it would be impossible to fulfill

the purposes of that requirement without

conducting these five types of testing. In this

respect, therefore, the final rules would clarify

what is already required of these entities.

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 As we will note in presenting each of

the five types of testing, the final rules would

also establish minimum testing frequency and

independent contractor testing requirements for

all DCOs and all SDRs and for covered DCMs. These

requirements are also generally consonant with

 18 

 19 

 20 

 21 

 22 
 17

 1 best practices. As defined, covered DCMs would be

those whose total annual trading volume is 5

percent or more of the total annual trading volume

of all DCMs regulated by the Commission.

 2 

 3 

 4 

 5 The proposed rule for DCMs, SEFs, and

SDRs included an Advance Notice of Proposed

Rulemaking, or ANPRM, which noted that the

Commission plans to consider whether in a future

Notice of Proposed Rulemaking, or NPRM, it should

define the most systemically important SEFs as

covered SEFs and make them subject to the minimum

testing frequency and independent contractor

testing requirements. In the ANPRM, the

Commission noted that the SEF market is still in

the early stages of development. The Commission

received several comments concerning the ANPRM.

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 Staff recommends that further

consideration and consultation with both the

industry and other relevant regulators and

stakeholders would be appropriate and helpful

before issuance of any future NPRM regarding

covered SEFs. Accordingly, staff plans to hold a

 18 

 19 

 20 

 21 

 22 
 18

 1 public roundtable later this fall regarding SEFs,

to gather additional information that will assist

the Commission in determining whether to issue a

future NPRM regarding covered SEFs.

 2 

 3 

 4 

 5 MS. MOHR: As I begin the next section

of our presentation, I would also like to thank my

fellow DCR team members, including Jim Ortlieb,

Tammy Roust, Eileen Donovan, Tad Polley, and Scott

Sloan, as well as Carlene Kim and Brian Trackman

of OGC for their hard work in preparing the final

rules that we are presenting to the Commission

today. We will briefly describe for you this

morning each of the five types of cybersecurity

testing that would be required by the final rules,

beginning with vulnerability testing.

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 Vulnerability testing is the process of

scanning your systems for weaknesses. As software

is developed and deployed, new weaknesses called

"vulnerabilities" can be created for various

reasons. For example, adding new features to

existing software generates transaction paths and

logic that creates future opportunities for

 17 

 18 

 19 

 20 

 21 

 22 
 19

 1 unwanted users to exploit these features in

 2 unintended ways.

 3 Moving software or hardware around

within existing environments can create

interconnections between systems and paths through

existing systems that offer fresh opportunities

for intruders to enter and exploit. In addition,

existing software is constantly being tested and

probed in ways by existing deployments, including

both research efforts and real-world attacks. As

a DCM, SEF, SDR, or DCO deploys, modifies, and

runs its systems, it must remain cognizant of the

fact that external entities are constantly probing

its defenses looking for these vulnerabilities.

If the organization can discover its

vulnerabilities before the attackers do, it can

attempt to fix them before they are exploited.

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 Vulnerability testing is covered by

generally accepted standards and best practices,

such as those published in the National Institute

of Standards and Technology, or NIST, and the

Federal Financial Institution Examinations

 19 

 20 

 21 

 22 
 20

 1 Council, or FFIEC, and others. Such generally

accepted best practices call for vulnerability

testing at a frequency determined by an

appropriate risk analysis and in some cases also

provide that the frequency for such testing should

be no less than quarterly.

 2 

 3 

 4 

 5 

 6 

 7 The final rules would address the

frequency at which vulnerability testing should be

conducted. As a fundamental principle, we would

call for all DCMs, SEFs, SDRs, and DCOs to conduct

vulnerability testing at a frequency determined by

an appropriate risk analysis. For all DCOs, all

SDRs, and covered DCMs the rule would also include

a minimum vulnerability testing frequency

requirement calling for testing to be conducted no

less than quarterly. In addition, the final rules

would call for vulnerability testing by all DCOs,

all SDRs, and covered DCMs to be performed by

independent contractors or employees who are not

responsible for the development or operation of

the systems or capabilities being tested.

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 In the NPRM, the Commission proposed
 21

 1 requiring all DCOs, all SDRs, and covered DCMs to

engage an independent contractor to conduct two of

their required quarterly vulnerability tests each

year. Commenters noted the potential security

risks, as well as the cost, of hiring an

independent contractor to conduct the

vulnerability testing. Therefore, the final rule

will require all DCOs, all SDRs, and covered DCMs

to engage an independent contractor or employees

who are not responsible for the development or

operation of the systems or capabilities of the

systems being tested to conduct the required

vulnerability tests.

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 The second type of cybersecurity testing

that the final rules would require is penetration

testing. Penetration testing is the process of

simulating an attack on a system in order to

discover and exploit its weaknesses.

 15 

 16 

 17 

 18 

 19 There are two main forms of penetration

testing: External and internal. The final rules

would define external penetration testing as

attempts to penetrate the entity's automated

 20 

 21 

 22 
 22

 1 systems from outside the systems' boundaries to

identify and exploit vulnerabilities. The final

rules would define internal penetration testing as

attempts to penetrate the entity's automated

systems from inside the systems' boundaries for

the same purpose. Generally accepted practices

such as NIST standards, FFIEC standards, and the

Payment Card Industry Data Security Standards call

for organizations to conduct both internal and

external penetration testing and to conduct such

tests annually.

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 The final rules would also call for all

DCOs, DCMs, SEFs, and SDRs to conduct both

internal and external penetration testing at a

frequency determined by an appropriate risk

analysis. In addition, the rules would require

internal and external penetration testing at least

annually by all DCOs, all SDRs, and covered DCMs.

 13 

 14 

 15 

 16 

 17 

 18 

 19 The final rules would also provide that

the annual external penetration test required of

all DCOs, all SDRs, and covered DCMs must be

performed by an external independent contractor.

 20 

 21 

 22 
 23

 1 MR. TAYLOR: The final rules would also

call for all DCMs, SEFs, SDRs, and DCOs to conduct

controls testing, including testing of each

control included in their programs of systems

safeguards risk analysis and oversight. Controls

are the safeguards or countermeasures used by an

entity to protect the reliability, security, or

capacity of its automated systems or the

confidentiality, integrity, and availability of

its data and information. Some controls provide

safeguards against automated system failures or

deficiencies while others guard against human

error deficiencies or malicious action. Controls

testing assesses each control to determine whether

it is implemented correctly, is operating as

intended, and is enabling the organization to meet

system safeguards requirements. Such testing is

called for by generally accepted best practices

and standards.

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 The final rules would address the

frequency at which controls testing should be

conducted. As a fundamental principle, they would

 21 

 22 
 24

 1 call for all DCMs, SEFs, SDRs, and DCOs to conduct

controls testing at a frequency determined by an

appropriate risk analysis. For all DCOs, all

SDRs, and covered DCMs, the rules would also

include a minimum controls testing frequency

requirement calling for testing of each key

control no less frequently than every three years.

 2 

 3 

 4 

 5 

 6 

 7 

 8 Key controls are those controls that a

risk analysis determines to be either critically

important for effective systems safeguards or

intended to address risks that evolve or change

more frequently, and therefore require more

frequent review to ensure continuing control

effectiveness. Since systems safeguards involve

large numbers of controls, the final rules would

permit the controls testing to be done on a

rolling basis over the course of the required

period.

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 In the NPRM, the Commission proposed a

minimum testing frequency of no less frequently

than every two years for all controls. Based on

the comments received, staff believes that a

 20 

 21 

 22 
 25

 1 three-year rather than two-year minimum controls

testing frequency requirement for the key controls

is appropriate. Staff further agrees with

commenters that registered entities should

determine the testing frequency for non-key

controls based on appropriate risk analysis.

Therefore, the final rules would require

registered entities to test each control at a

frequency determined by an appropriate risk

analysis and each key control no less frequently

than every three years.

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 The final rules would also call for all

DCOs, all SDRs, and covered DCMs to have

independent contractors test each of the

registered entities' key controls no less

frequently than every three years. Such

independent assessments are consonant with best

practices.

 13 

 14 

 15 

 16 

 17 

 18 

 19 The fourth type of testing that the

final rules would require is security incident

response plan testing. Best practices call for

financial sector entities to maintain and test a

 20 

 21 

 22 
 26

 1 security incident response plan, or S-I-R-P,

doubtless to be pronounced SERP. Such plans are

crucial to cyber resilience.

 2 

 3 

 4 The final rules would require each DCM,

SEF, SDR, or DCO to maintain and test a SIRP,

defined as a written plan documenting the

entities' policies, controls, procedures, and

resources for identifying, responding to,

mitigating, and recovering from security incidents

and the roles and responsibilities of its

management, staff, and independent contractors in

responding to security incidents. The rules would

note that SIRP testing can take a number of

possible forms from checklists and tabletop

exercises to simulations and comprehensive

exercises.

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 The final rules would also address the

frequency at which SIRP testing should be

conducted. As a fundamental principle, they would

call for all DCMs, SEFs, SDRs, and DCOs to conduct

SIRP testing at a frequency determined by an

appropriate risk analysis. At a minimum, the

 18 

 19 

 20 

 21 

 22 
 27

 1 final rules would call for all DCOs, all SDRs, and

covered DCMs to have SIRP testing performed no

less frequently than annually. SIRP testing could

be done either by independent contractors or

employees of the entity.

 2 

 3 

 4 

 5 

 6 The proposed rules called for SIRP

testing to be conducted by either independent

contractors or employees who are not responsible

for development or operation of the systems or

capabilities tests. Based on a comment, staff

believes that allowing the employees who designed

a SIRP to test the plan could provide useful

benefits and flexibility to all DCOs, DCMs, SEFs,

and SDRs without impairing the purposes of the CEA

and Commission's regulations. Therefore, the

final rules would require SIRP testing to be

conducted by either independent contractors or

employees without restricting which employees may

lead or conduct the testing.

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 Finally, the final rules would require

each DCM, SEF, SDR, or DCO to conduct enterprise

technology risk assessments, or ETRAs.

 21 

 22 
 28

 1 An ETRA is a written assessment

including identification and analysis of threats

and vulnerabilities and the harm they could cause,

in the context of mitigating controls. In an

ETRA, a DCM, SEF, SDR, or DCO may draw together

and use the results of the other types of

cybersecurity testing in order to identify and

mitigate its cybersecurity risks. Conducting

ETRAs is consistent with best practices regarding

system safeguards. As a fundamental principle,

the final rules would call for all DCMs, SEFs,

SDRs, and DCOs to conduct an ETRA as often as

indicated by appropriate risk analysis.

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 At a minimum, the final rules would

require DCOs, covered DCMs, and SDRs to have ETRAs

performed no less frequently than annually. The

ETRAs may be conducted using either independent

contractors or employees not responsible for

development or operation of the systems or

capabilities being assessed.

 15 

 16 

 17 

 18 

 19 

 20 

 21 MS. MOHR: The Commission's current

 22 regulations specify various elements, standards,
 29

 1 and resources to be included in a registered

entity's program of risk analysis and oversight

with respect to its operations and its automated

systems. The final rules would clarify the

existing rule provisions for all DCOs, DCMs, SEFs,

and SDRs concerning (1) the categories of risk

analysis and oversight that must be addressed; (2)

the books and records obligations; (3) the scope

of system safeguards testing; (4) internal

reporting and review of testing results; and (5)

remediation of vulnerabilities and deficiencies

disclosed by testing.

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 The final rule provision that would

address the required scope of cybersecurity

testing is especially important, because adequate

testing depends on identification of an

appropriate scope. The final rules would require

that the scope of all testing assessments required

by Commission regulations be broad enough to

include the testing of automated systems and

controls that a registered entity's required

program of risk analysis and oversight and its

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 
 30

 1 current cybersecurity threat analysis indicate is

necessary in order to identify risks and

vulnerabilities that could enable an intruder or

an unauthorized user or insider to (a) interfere

with the registered entity's operations or with

fulfillment of its statutory and regulatory

responsibilities; (b) impair or degrade the

reliability, security, or capacity of a registered

entity's automated systems; (c) add to, delete,

modify, exfiltrate, or compromise the integrity of

any data related to the registered entity's

regulated activities; or (d) undertake any

unauthorized action affecting the registered

entity's regulated activities or hardware or

software used in connection with those activities.

The NPRM required the scope of testing to be broad

enough to include testing of all automated systems

necessary to identify any vulnerability which

could allow an unauthorized user access to the

entity's systems. Based on the comments received,

staff believes that a risk-based approach to

determining the scope of testing is more

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 
 31

 1 appropriate. Therefore, the final rules would

base the scope of testing on a registered entity's

program of risk analysis and oversight and its

current cybersecurity threat analysis.

 2 

 3 

 4 

 5 Another important clarifying provision

relates to the governance of cybersecurity and

system safeguards by requiring that the reports on

the testing protocols and results be communicated

to and reviewed by both the entity's senior

management and its board of directors. Registered

entities would also be required to establish and

follow appropriate procedures for remediation of

issues identified and for evaluation of the

effectiveness of testing and assessment protocols.

Each entity would be required to identify and

document the vulnerabilities and deficiencies in

its systems revealed by the testing and

assessments required by the section. Each entity

would also be required to conduct and document an

appropriate analysis of the risks presented by 

such vulnerabilities and deficiencies to determine

and document whether to remediate or accept each

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 
 32

 1 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

risk.

 2 In addition, the final rules would

provide that required remediation must be timely

with respect to the risk presented by the

identified vulnerabilities and deficiencies. The

NPRM required a registered entity to analyze the

results of the required testing to identify all

vulnerabilities in a system. Based on the

comments, staff recommends removing a suggestion

that all vulnerabilities will be revealed through

testing.

 3 

 4 

 5 

 6

 7 

 8 

 9 

 10 

 11 

 12 The final rules would thus require a

registered entity to identify and document those

vulnerabilities that were revealed through the

required testing. The NPRM also required entities

to remediate the vulnerabilities to the extent

necessary to enable the entity to fulfill the

requirements of this chapter and meet its

statutory and regulatory obligations.

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 Staff recognizes that some of the

vulnerabilities may be properly accepted by the

entity but believes that documentation is

 21 

 22 
 33

 1 necessary to ensure the entity is appropriately

 2 considering and responding to the risks.

 3 The final rules would thus require a

registered entity to conduct and document an

appropriate analysis of the risk presented by such

vulnerabilities and deficiencies to determine and

document whether to remediate or accept each risk.

 4 

 5 

 6 

 7 

 8 The divisions also recommend the final

rules become effective after publication in the

Federal Register but with a compliance date of 180

days after the effective date for vulnerability

testing and security incident response plan

testing and one year after the effective date for

external penetration testing, internal penetration

testing, controls testing, and enterprise

technology risk assessment. The compliance dates

were determined on a provision-by-provision basis

to allow all DCOs, DCMs, SEFs, and SDRs --

regardless of their size, complexity, or resources

-- to be able to meet the requirements of the

final rules.

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 This concludes our joint presentation of
 34

 1 the final rules. We will be happy to address any

 2 questions.

 3 CHAIRMAN MASSAD: Well, thank you to our

 4 staff for those excellent presentations.

 5 To begin the Commission's discussion and

consideration of these rulemakings, I will now

entertain a motion to adopt the Division of Market

Oversight's final rule - we'll take them one at a

time - related to systems safeguards as presented

by the staff. So, is there a motion to consider

the DMO final rule?

 6 

 7 

 8 

 9 

 10 

 11 

 12 COMMISSIONER BOWEN: So moved.

 13 COMMISSIONER GIANCARLO: Second.

 14 CHAIRMAN MASSAD: All right, so I'd now

like to open the floor to allow the Commissioners

to make any statements and ask any questions they

may have about them.

 15 

 16 

 17 

 18 COMMISSIONER GIANCARLO: I have no

 19 questions.

 20 CHAIRMAN MASSAD: Neither do I. Okay.

So, let us then proceed to a vote. Let me just

say for both presentations and for our staff, from

 21 

 22 
 35

 1 DMO and DCR, again thank you for the incredible

amount of work that went into this. And also it's

not just DMO and DCR staff that are here. There

are obviously others in those divisions and others

in other divisions - such as the Office of General

Counsel, Office of the Chief Economist. As I have

learned, there is an enormous amount of work that

goes into this behind the scenes, and everyone

involved in these rules is also doing a number of

other things.

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 And, in particular, I want to thank the

staff for listening to the input of market

participants. I want to thank again market

participants for giving us their input. I think

it was very constructive. We did make a number of

adjustments, as the staff has outlined, to make

sure that these rules can work effectively.

 12 

 13 

 14 

 15 

 16 

 17 

 18 So, with that, are we prepared to vote

on the first rule? Okay, Mr. Kirkpatrick, will

you call the roll.

 19 

 20 

 21 MR. KIRKPATRICK: The motion now before

 22 the Commission is on the adoption of the Division
 36

 1 of Market Oversight Final Rule on System

 2 Safeguards Testing Requirements.

 3 Commissioner Giancarlo.

 4 COMMISSIONER GIANCARLO: Aye.

 5 MR. KIRKPATRICK: Commissioner

 6 Giancarlo, aye. Commissioner Bowen.

 7 COMMISSIONER BOWEN: Aye.

 8 MR. KIRKPATRICK: Commissioner Bowen,

 9 aye. Chairman Massad.

 10 CHAIRMAN MASSAD: Aye.

 11 MR. KIRKPATRICK: Chairman Massad, aye.

Mr. Chairman, on this matter the ayes have 3; the

no's have zero.

 12 

 13 

 14 CHAIRMAN MASSAD: Okay, thank you. At

this point, I will now entertain a motion to adopt

the Division of Clearing and Risk's Final Rule

related to System Safeguards, as presented by the

staff.

 15 

 16 

 17 

 18 

 19 COMMISSIONER BOWEN: So moved.

 20 COMMISSIONER GIANCARLO: Second.

 21 CHAIRMAN MASSAD: Okay, any questions or

 22 comments on that rule?
 37

 1 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

COMMISSIONER GIANCARLO: No questions.

 2 CHAIRMAN MASSAD: All right, Mr.

 3 Kirkpatrick, could you call the roll.

 4 MR. KIRKPATRICK: The motion now before

the Commission is on the adoption of the Division

of Clearing and Risk Final Rule on System

Safeguards Testing Requirements for Derivatives

Clearing Organizations.

 5

 6

 7

 8

 9 Commissioner Giancarlo.

 10 COMMISSIONER GIANCARLO: Aye.

 11 MR. KIRKPATRICK: Commissioner

 12 Giancarlo, aye. Commissioner Bowen.

 13 COMMISSIONER BOWEN: Aye.

 14 MR. KIRKPATRICK: Commissioner Bowen,

 15 aye. Chairman Massad.

 16 CHAIRMAN MASSAD: Aye.

 17 MR. KIRKPATRICK: Chairman Massad, aye.

Mr. Chairman, on this matter the ayes have 3; the

no's have zero.

 18

 19

 20 CHAIRMAN MASSAD: Okay, so the ayes have

it, and the motion to adopt that final rule is

approved as well. So, both rules are adopted.

 21

 22
 38

 1 Once again, thank you to the staff and

 2 to market participants for your input.

 3 We will now have a shift in the seating

 4 and welcome the members of our staff from DSIO.

 5 (Pause)

 6 CHAIRMAN MASSAD: Okay, at this time I

would like to welcome Frank Fisanich, deputy

director, and Katherine Driscoll, associate chief

counsel, from the Division of Swap Dealer and

Intermediary Oversight for their presentation on a

Comparability Determination for Japan's Uncleared

Swap Margin Rules.

 7 

 8 

 9 

 10 

 11 

 12 

 13 MR. FISANICH: Good morning. At the

start, I'd like to thank my colleagues in DSIO and

OGC and OIA for their valuable contributions to

getting this done in a short amount of time.

 14 

 15 

 16 

 17 Pursuant to the cross-border margin rule

adopted by the Commission in May of this year and

an application from the Japan Financial Services

Agency, the JFSA, staff is presenting a

recommendation that the Commission adopt a

comparability determination for Japan with regard

 18 

 19 

 20 

 21 

 22 
 39

 1 to its margin requirements for uncleared swaps.

Where the recommended determination has found the

laws of Japan and the rules of the JFSA comparable

to the Commission's uncleared swap margin rules,

swap dealers who do not have a prudential

regulator would be permitted to comply with the

Commission's rules by complying with the JFSA's

rules to the extent such substituted compliance is

available under the Commission's cross-border

margin rule.

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 Over the past three months, staff has

consulted with the JFSA in the development of this

determination. In addition, staff has consulted

with the U.S. Prudential regulatory authorities,

including the Federal Reserve Board of Governors,

the Office of the Comptroller of the Currency, and

the Federal Deposit Insurance Corporation. Staff

notes that both Japan and the United States

participated in the BCBS-IOSCO working group on

margin requirements, and work undertaken by that

group led to a broad international consensus on

the substantive framework for global margin

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 
 40

 1 requirements for uncleared swaps back in 2013.

Both the CFTC and Japan promulgated margin rules

meeting the principles of that framework, and such

rules therefore have a very similar scope and

objective.

 2 

 3 

 4 

 5 

 6 The comparability determination staff is

recommending today follows the standard of review

mandated by the cross-border margin rule, which

required the Commission to determine whether

Japan's uncleared swap margin regime achieves

outcomes comparable to those of the Commission's

corresponding uncleared swap margin rules. Under

the Commission's standard of review, a foreign

margin regime must be comparable to the

Commission's in purpose and effect but need not be

identical or comparable in every aspect. The

Commission also committed to evaluating outcomes

in light of a foreign regulator's supervisory and

enforcement authority. In other words, the

Commission recognized that a foreign regime could

achieve comparable outcomes through the exercise

of supervisory authority.

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 
 41

 1 The outcomes-based approach taken by

this comparability determination is consistent

with the approach taken by the Commission when it

adopted the comparability determination for DCOs

under E.U. law earlier this year and with the

approach taken by the Commission in 2013 when it

adopted eight comparability determinations for six

jurisdictions with regard to certain other

requirements under Part 23, including risk

management program and recordkeeping requirements.

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 Adhering to the standard of review

announced by the Commission, staff is recommending

that the Commission find the laws of Japan

comparable to the Commission's uncleared swap

margin rules except in one area. Staff notes that

with respect to many core requirements of the

uncleared swap margin rules, the JFSA's rules are

either essentially identical or substantially

similar in all material respects. This includes

required methodologies for calculating the amounts

of margin, the process and standards for approving

margin models, permitted margin thresholds, risk

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 
 42

 1 management controls, and required documentation.

 2 For example, with respect to the

methodologies for calculating the amounts of

margin, the comparability determination finds that

the definitions of initial and variation margin

are similar, including the description of

potential future exposure agreed under the

BCBS-IOSCO framework. Margin models or a

standardized margin schedule may be used to

calculate initial margin. Criteria for historical

data to be used in initial margin models is

similar. Initial margin models must be submitted

for review by a regulator prior to use.

Eligibility for netting is similar. Correlations

may be recognized within broad risk categories but

not across such risk categories. The required

method of calculating initial margin using

standardized margin rates is essentially

identical, as is the prescribed standard margin

rates themselves.

 3 

 

 

 

 

 

 

 

 

 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 

 

 

 

 

 

 15 

 16 

 17 

 18 

 19 

 20 

 21 Where staff noted differences in other

 22 JFSA margin requirements, it also kept in mind
 43

 1 that the Commission's standard of review does not

require identical or comparable requirements in

every aspect. In these instances, staff discussed

with the JFSA its supervisory position and then

evaluated the purpose and effect of the particular

JFSA margin requirements in light of the JFSA's

supervisory authority.

 2 

 3 

 4 

 5 

 6 

 7 

 8 Following this procedure, staff

recommends that the Commission should find the

JFSA's rules comparable in outcome. These rules

include timing for collection of margin, the list

of eligible collateral, requirements for custodial

arrangements, and the cross-border aspects of the

JFSA's rules.

 9 

 10 

 11 

 12 

 13 

 14 

 15 Staff is not recommending that the

Commission find comparability only in relation to

margin requirements for inter-affiliate swaps. In

this one instance, the JFSA's rules have no

corollary to the Commission's rules, and pursuant

to the cross-border margin rule, the Commission

determined this rule to be of high importance for

the purpose of preventing the evasion of initial

 16 

 17 

 18 

 19 

 20 

 21 

 22 
 44

 1 margin collection requirements through the use of

 2 affiliates.

 3 Staff notes that we have a broad scope

MOU in place with the JFSA and have established a

close working relationship with the JFSA over many

years. Commission staff believe that the JFSA has

all the necessary powers to supervise,

investigate, and discipline entities under their

margin rules.

 4 

 5 

 6 

 7 

 8 

 9 

 10 Finally, staff notes that under

Commission regulations, all books and records

required to be kept under Part 23 must be open to

inspection by Commission staff and the Department

of Justice. This comparability determination does

not change these requirements. These requirements

were explicitly retained under the 2013

comparability determination for Japan regarding

recordkeeping requirements. Thus, the Commission

will continue to be able to examine the books and

records of Commission registrants to monitor for

compliance with the CEA, CFTC regulations, and the

terms of this determination.

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 
 45

 1 I thank you for your attention. I would

 2 be happy to address any questions you have.

 3 CHAIRMAN MASSAD: Thank you for that

 4 very excellent and informative presentation.

 5 I will now entertain a motion to approve

the comparability determination so that we may

begin our discussion and consideration of this

matter. Is there such a motion?

 6 

 7 

 8 

 9 COMMISSIONER BOWEN: (off mic)

 10 CHAIRMAN MASSAD: Yes, you will. We

 11 just need a motion first to begin the discussion.

 12 COMMISSIONER BOWEN: Yes, okay.

 13 CHAIRMAN MASSAD: Yes?

 14 COMMISSIONER GIANCARLO: Second.

 15 CHAIRMAN MASSAD: Okay. All right, I

will now open the floor to allow the Commissioners

to make any statements or ask any questions they

may have. Commissioner Bowen?

 16 

 17 

 18 

 19 COMMISSIONER BOWEN: Yes. Thank you.

I, too, would like to thank the staff for all of

its hard work in this matter. However, I cannot

support it today. I will be voting no, as I think

 20 

 21 

 22 
 46

 1 it will introduce greater risk into the

derivatives market, the very thing that we were

sent here by the American people to prevent.

 2 

 3 

 4 There are three questions I will answer

in my remarks today: (1) What is a margin

comparability determination, and why does it

matter? (2) What are the problems with this

particular determination? (3) How can we fix it?

 5 

 6 

 7 

 8 

 9 For many Americans a margin

comparability determination is truly a foreign

concept, but actually has great significance to

our economy. Margin is collateral. The 2008

derivatives market was under-collateralized, and

that is what caused it to explode and take our

economy with it. The American people expected us,

as regulators, to fix that by requiring sufficient

collateral to address the risk. We've done that

with our margin rule.

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 In a margin comparability determination,

we're defining when our U.S. Dealers that are

operating in the other jurisdiction can ignore our

margin rule and follow the other rules in that

 20 

 21 

 22 
 47

 1 jurisdiction. Allowing American companies to

follow just one set of rules, that of the

jurisdiction they're in, makes sense when the

rules are basically accomplishing the same thing

I'm in favor of that.

 2 

 3 

 4 .

 5 

 6 International comity, harmonization

across jurisdictions, and having an outcomes-based

approach to comparability all makes sense.

Unfortunately, that is not the scenario that we

have here today.

 7 

 8 

 9 

 10 

 11 While Japanese law has some strong

similarities to our own, there are some areas of

divergence that are significant and would allow

American companies to do overseas what they would

never be allowed to do here. And make no mistake,

though these companies are physically located in

Japan, their cash line runs right back to the

United States. That risk could be borne again by

American households.

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 A comparability determination should not

be a backdoor way of undoing or weakening our

regulations and thereby incentivizing our

 21 

 22 
 48

 1 companies to send their risky business to their

affiliates located in Japan. That would not be

good for our economy, for Japan's economy, or for

the global financial stability overall.

 2 

 3 

 4 

 5 This determination is doubly important,

because it's the first one, and thus it sets the

stage for others. By adopting a weak standard

today, we pave the way for even weaker

determinations in the future. Moreover, we're not

establishing this determination in conjunction

with the prudential regulators who oversee roughly

half of U.S. swap dealers and are our counterparts

on these issues.

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 We've worked effectively with our

prudential counterparts thus far. Making this

determination without harmonization amongst U.S.

Regulators is ill-advised. Differences in

requirements would only open the door to

regulatory arbitrage domestically.

 15 

 16 

 17 

 18 

 19 

 20 Second, what is the problem with this

particular determination? The answer:

Bankruptcy. Bankruptcy is something that we do

 21 

 22 
 49

 1 not like to think about, but in finance it's

something that we must always consider when

designing deals. We know the old adage, "Hope for

the best but plan for the worst."

 2 

 3 

 4 

 5 In my work as a law firm partner and as

acting chair for Securities Investor Protection

Corporation, I've seen too many bankruptcies. And

there are three key differences in our margin rule

and the Japanese margin rule that would leave our

American companies operating under Japanese law

vulnerable.

 6 

 7 

 8 

 9 

 10 

 11 

 12 The key differences are: Where the

customer money is kept. Our rules require

collateral to be held by a third party, not by

either one of the counterparties. This is a

safeguard for bankruptcy. If the money is held by

one of the counterparties, then a bankruptcy court

may use that money to meet that counterparty's

needs. Or in a stress scenario, the counterparty

could potentially take the customer money to meet

its obligation. If, however, the money is at a

third party, it's far more likely that it will get

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 
 50

 1 

 

 

 

 

 

 

back to the customer that provided it. Japanese

 2 law does not have a comparable rule.

 3 Thus, in a bankruptcy situation, U.S.

Companies may be unable to receive back their

customer funds. This discrepancy is noted in the

determination, but the staff states that the fact

that the funds are segregated sufficiently

mitigates this risk. I disagree.

 4 

 5 

 6 

 7 

 8 

 9 In my experiences with bankruptcies,

I've learned that access to customer funds largely

depends on the location of those funds.

Third-party custodianship is an important

safeguard.

 10 

 11 

 12 

 13 

 14 There are certain developing countries

where there is little certainty that collateral

will be there if there is a bankruptcy or where

they do not segregate customer funds from those of

the dealer. Under our rules, our U.S. dealers

have to limit the way they trade with

counterparties in bankruptcy vulnerable

jurisdictions, because we're not confident that

our American investors would get their money back

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 
 51

 1 in their bankruptcy scenario.

 2 These safeguards vary depending on the

circumstances and include limiting the amount of

business that our dealers can do with these

counterparts and limiting the type of acceptable

collateral. Japan does not have these kinds of

limits on their dealers. Thus, American companies

operating in Japan could potentially have an

unlimited amount of deals with counterparties in

these bankruptcy countries. This could put some

of our American firms at risk and thus our

economy.

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 There are significant differences in the

treatment of collateral between our rule and the

Japanese rule. First, where our rules limit daily

variation margin to cash, under Japanese law,

variation margin could be in a number of much less

liquid instruments.

 14 

 15 

 16 

 17 

 18 

 19 And, second, while we require a 25

percent haircut for certain equities, under

Japanese law equities would only be haircut by 15

percent. That means, in a crisis, American

 20 

 21 

 22 
 52

 1 companies in Japan could be exchanging instruments

that are virtually worthless since they cannot be

readily converted into cash, thereby putting them

into jeopardy.

 2 

 3 

 4 

 5 If these differences were insignificant,

I would happily brush them aside. But these

issues could mean the difference between an

orderly bankruptcy and a disaster overseas that

pulls down a significant part of the American

economy.

 6 

 7 

 8 

 9 

 10 

 11 And last, how can we fix this? Well,

actually, fixing this would have been rather

simple. We could have provided a partial

determination. Our American businesses could

follow the Japanese margin rule except in the

areas above where they would have to follow our

rule. We've already done this in the current

draft in the area of inter-affiliate margin. We

would simply extend the same treatment to these

three areas as well. A partial comparability

determination would be the best way to strike the

right balance between international harmonization

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 
 53

 1 and protection of American interests.

 2 Thank you so much for allowing me to

have my remarks today. Thank you again for the

hard work.

 3 

 4 

 5 CHAIRMAN MASSAD: Commissioner

 6 Giancarlo.

 7 COMMISSIONER GIANCARLO: I have no

 8 statement.

 9 CHAIRMAN MASSAD: Well, let me again

 10 thank the staff for the excellent work.

 11 I support the determination of

comparability with respect to Japan's rules. It's

an important and necessary step toward building a

strong international regulatory framework for

over-the-counter swaps markets, and that's

critical to ensuring the safety and soundness of

our own financial markets. And I think we must

keep in mind here that our laws and the laws of

other jurisdictions will never be identical, and I

think the comparability determination reflects

that understanding. In this instance, as in other

decisions, the Commission compared our margin rule

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 
 54

 1 to each element of Japan's rules, carefully

considering the objectives and outcomes overall.

And we also, as the staff noted, considered

another jurisdiction's supervisory and enforcement

authority.

 2 

 3 

 4 

 5 

 6 And there, you know, I want to note that

we have a very strong and good relationship with

JFSA. In fact, I met with Commissioner Mori and

members of his staff just a few months ago, and

there is I think a great amount of mutual respect,

good communication, and cooperation. We've worked

together very well on a number of issues,

including the formulation of margin requirements.

And I think this determination will strengthen

that relationship. And I think it's important to

step back because, really, the question here is,

how do we get to a strong and sensible, and

reasonably consistent international framework for

the regulation of the derivatives market? And the

margin rule is a key component of that, but it's

only one component.

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 And first to the timing of the
 55

 1 implementation concerns, I have respect for

Commissioner Giancarlo's comments on that point,

but we chose to go forward with the timing,

because the schedule was agreed to 18 months ago.

This first phase only applies to a very small

number of very large firms -- 20 firms. Several

of them are European firms, and in their

transactions with U.S. firms, they are subject to

our rules. They are collecting and posting

margin. And I think it's precisely for that

reason that when the E.U. announced their delay,

they actually told their firms to continue

preparing to comply, because they were subject to

the U.S. rules.

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 The E.U. leaders -- I met with several

of them on this subject. They're also very

committed to getting their rules in place.

Hopefully, this delay will only be a couple of

months. And I think the fact that we went forward

has actually further incentivized them -- and

other jurisdictions -- to move forward.

 16 

 17 

 18 

 19 

 20 

 21 

 22 And as to the implementation, I would
 56

 1 simply point to the statement of the head of ISDA

today that said -- and I quote -- that the rollout

went relatively smoothly, given the scale of the

change. So, you know, there were some specific

problems that we addressed. We issued a no-action

letter last week to address an issue on custodial

arrangements, because we recognized that there are

a limited number of providers of those services,

and some firms were having trouble getting those

agreements in place.

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 So, the fact that the E.U. delayed

obviously wasn't ideal; it was a disappointment.

But I think we will get to that international

framework faster by having gone forward.

 12 

 13 

 14 

 15 The same with this determination. I

think it's important to remember that we're still

at the early stages of building this framework.

There are going to be differences. But I think

overall, again, the margin requirements achieve

comparable outcomes.

 16 

 17 

 18 

 19 

 20 

 21 Think back to where we were two years

 22 ago, shortly after I took office. There were a
 57

 1 lot of differences in our rules, Japan's rules,

E.U. rules. Other jurisdictions hadn't even begun

their rules. They were waiting to see what we

did. And this is not withstanding the fact that

there was a BIS-IOSCO process, as Frank indicated,

to arrive at a common standard. And we brought

those rules together. We made tremendous progress

in doing that.

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 And so the differences that we have, I

think -- you know, we've highlighted one that we

felt was important to take an exception to on

inter-affiliate rules. I believe that exception

is necessary to help address the risk that can

flow back into the U.S. from offshore activity,

even when the subsidiary is not explicitly

guaranteed by the U.S. parent.

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 As to the other differences, I have

great respect for Commissioner Bowen's concerns

here. I think we share the same goal in terms of

reaching a strong international framework. I'm

sure the industry would prefer it if we could

arrive at a single standard that is exactly the

 18 

 19 

 20 

 21 

 22 
 58

 1 same that everyone follows. But that is a

difficult thing. As to the specifics: On

haircuts, for example, yes, it is true that there

is a slight difference, though it is pretty

slight. We recognize a 15 percent haircut on the

S&P 500 equities. We impose a larger one on S&P

1500 equities. Japan says 15 percent on major

indices. On the other hand, Japan has a larger

discount than we do on government bonds and

corporate debt. So, in that sense, their rule is

stronger than ours.

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 On the custodial arrangements, I also

recognize the importance of protection of margin

deposits in the event of bankruptcy, and that's

why we, in our rule, require segregation, but that

means is not commonly used in Japan. And that's

why the Japan rules require the use of trust

structures, which the JFSA has advised us are

respected under their law in bankruptcy.

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 Also with respect to the non-netting

jurisdictions, our rule requires a swap dealer to

collect initial margin on a gross basis from a

 21 

 22 
 59

 1 counterparty in a jurisdiction that doesn't

clearly recognize netting. The JFSA rule says

that the dealer must establish an appropriate risk

management framework that may but is not required

to include collection of margin.

 2 

 3 

 4 

 5 

 6 It's important to remember then, in

considering outcomes, how this applies. We're not

talking about American firms, U.S. entities,

dealing with Japan counterparties being able to

follow the Japan rule. We're talking about

Japanese swap dealers who are registered with us.

If those trades are guaranteed by a U.S. person,

they must still follow our rules and collect

margin according to our rules. If it's a Japanese

swap dealer whose trades are not guaranteed by a

U.S. person and who's not a foreign consolidated

subsidiary, they are entitled to an exclusion

anyway, regardless of what we do, on this

substituted compliance determination.

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 So, it is Japanese swap dealers who are

foreign consolidated subsidiaries that would be

entitled to substituted compliance. But they

 21 

 22 
 60

 1 would still be subject, if they engage in these

trades, to the JFSA risk management requirements,

and any parent entity swap dealer would be subject

to our consolidated risk management requirements.

And here again, as I noted at the outset, I think

our review of JFSA's supervisory and enforcement

authority is relevant.

 2 

 3 

 4 

 5 

 6 

 7 

 8 So, for those reasons, I believe it's

important to grant this. And, again, I think we

have to keep in mind that our goal is to build an

international framework that is strong, that is

sensible, and that is as consistent as possible.

There are going to be differences. It is going to

take time. But I think today's decision will

contribute significantly to doing that and will

help make sure the global derivatives markets

continue to be dynamic and competitive.

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 Let me again thank our staff. Let me

 19 now ask if the Commissioners are prepared to vote?

 20 

1 

COMMISSIONER GIANCARLO: Yes.

 2 COMMISSIONER BOWEN: I'd like to just

 22 raise a couple of questions as well. I do want to
 61

 1 just stress: I, too fully support harmonization

and working with Japan on this. But it makes a

good difference to me where my customer funds are.

As you guys know, I'm very much focused on that.

 2 

 3 

 4 

 5 Because Japan has a system where IM does

not have to be cash, you know, we run the risk

that we may never get to that money. So, I just

want to ask a question of the staff.

 6 

 7 

 8 

 9 So, under our rules, initial margin must

be with an unaffiliated third party, and any cash 

collateral must be reinvested by the counterparty

in another eligible instrument. How do we reach

the determination that that's comparable under

Japanese law?

 10 

 11 

 12 

 13 

 14 

 15 MR. FISANICH: Again, I would point to

the fact that the standard of review doesn't

require identical -- it's a -- as Chairman Massad

was saying, you know, we're not going to get to

the same place on everything, and in this case if

the overriding purpose of a list of eligible

collateral and the haircuts and what you can do

with those things is substantially similar.

 16 

 17 

 18 

 19 

 20 

 21 

 22 
 62

 1 COMMISSIONER BOWEN: One other question:

I assume that we decided we need to rush ahead

with this in our work with our prudential

regulators. Were there any areas of concern in

your discussions with the prudential regulators?

 2 

 3 

 4 

 5 

 6 MR. FISANICH: You know, we've had

multiple -- not just this group but others in DSIO

have had multiple conversations with the

prudential regulators. They hold weekly calls.

Any number of issues have been raised, including

some that you've raised and some that we've raised

-- inter-affiliate, custodial arrangements -- as

they look at Japan. However, they are still in

their process, and as far as we know they've not

presented anything to their principles at this

point. So, we don't know where they will come

out.

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 CHAIRMAN MASSAD: Okay, Mr.

 19 Kirkpatrick, will you call the roll?

 20 MR. KIRKPATRICK: The motion now before

the Commission is on the approval of a

comparability determination for Japan regarding

 21 

 22 
 63

 1 uncleared swap margin rules for substituted

 2 compliance purposes.

 3 Commissioner Giancarlo.

 4 COMMISSIONER GIANCARLO: Aye.

 5 MR. KIRKPATRICK: Commissioner

 6 Giancarlo, aye. Commissioner Bowen.

 7 COMMISSIONER BOWEN: No.

 8 MR. KIRKPATRICK: Commissioner Bowen,

 9 no. Chairman Massad.

 10 CHAIRMAN MASSAD: Aye.

 11 MR. KIRKPATRICK: Chairman Massad, aye.

Mr. Chairman, on this matter the ayes have 2; the

no's have 1.

 12 

 13 

 14 CHAIRMAN MASSAD: The ayes have it, and

the motion to approve the comparability

determination carries.

 15 

 16 

 17 Do the Commissioners have any other

 18 Commission business?

 19 COMMISSIONER GIANCARLO: No.

 20 COMMISSIONER BOWEN: No.

 21 CHAIRMAN MASSAD: If not, I would like

 22 to ask for the indulgence of my fellow
 64

 1 Commissioners just to say a brief word about my

 2 view of our priorities for the rest of the year.

 3 First of all, let me just note that much

of our work does not consist of writing and

adopting rules, the typical subjects of our open

meetings, such as this one. Instead, it is the

critical work of compliance and examinations, and

in particular we've had presentations from many of

our staff today involved in that work. And that

ensures that customer protection rules are

observed and that customer funds are segregated,

as Commissioner Bowen has rightly pointed out the

importance of those things. And it involves

conducting examinations of clearinghouses and

clearing members. Also it is our surveillance and

enforcement work to prevent fraud and

manipulation. And those things are obviously --

will continue to be a focal point.

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 And, finally, that ongoing work includes

the continuation of the important work we have

been doing on CCP resilience, recovery, and

resolution planning; and that will remain a key

 20 

 21 

 22 
 65

 1 priority for this fall, and you will hear more

about that in the months ahead. We will also be

continuing to make our work with international

regulators on cross-border harmonization issues a

priority.

 2 

 3 

 4 

 5 

 6 But when it comes to the typical

subjects that we bring to these open meetings, as

you probably know we've implemented almost all the

rules required by Dodd-Frank. We are now focused

on fine-tuning those rules to make sure they are 

achieving their objectives and to address any

unintended consequences. And we are focused on

responding to new challenges in our markets, and

today's action with respect to the system

safeguards rules is an illustration of that.

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 Another example of that that we are

focused on for the fall is our proposed rule on

automated trading. A very good example of how we

must address the new technological challenges in

our markets. And on the subject of AT, let me

just say that we have received a lot of feedback

from commenters. It's been very helpful, and I

 17 

 18 

 19 

 20 

 21 

 22 
 66

 1 intend to ask my fellow Commissioners to support a

supplemental proposal on certain issues related to

this rule in the near future.

 2 

 3 

 4 In addition, this fall I will ask my

fellow Commissioners to consider a re-proposal of

our rule setting capital requirements for swap

dealers and major swap participants. That is one

Dodd-Frank rule that we have not yet completed,

and it's a critical part of the regulatory

framework.

 5 

 6 

 7 

 8 

 9 

 10 

 11 I will also ask them to consider a

proposed rule addressing a number of issues

related to the cross-border application of our

swap rules that have been the subject of past

guidance. And I expect that we will soon consider

finalizing the new clearing mandates for interest

rate swaps that we proposed earlier this year.

 12 

 13 

 14 

 15 

 16 

 17 

 18 Now, further examples of fine-tuning I

think will be a focus with respect to trading and

data rules. I hope that we can consider some

changes to improve trading on swap execution

facilities that would be consistent with the

 19 

 20 

 21 

 22 
 67

 1 no-action letters we have issued on the subject.

And I expect that we will have additional

proposals to improve swap data reporting.

 2 

 3 

 4 And, finally, I hope that we can

finalize, as I've said before, our rule setting

position limits by the end of the year.

 5 

 6 

 7 Now, of course, that's an ambitious

agenda. It's only possible because of the

talented and dedicated staff at the CFTC. I want

to thank all of our employees for their hard work

on these and other important measures. And I also

want to thank again Commissioner Bowen and

Commissioner Giancarlo for their input, for their

consideration of these rules, for their very

helpful suggestions and their support of all that

we are doing.

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 With that I will entertain a motion to

 18 close the meeting.

 19 COMMISSIONER BOWEN: So moved.

 20 COMMISSIONER GIANCARLO: Second.

 21 CHAIRMAN MASSAD: All in favor?

 22 ALL: Aye.
68

 1 CHAIRMAN MASSAD: The meeting is closed.

 2 Thank you all.

 3 

 4 

 (Whereupon, at 11:16 a.m., 

the PROCEEDINGS were 

 5 adjourned.) * * * * *

 6 

 7 

 8 

 9 

10

11

12

13

14

15

16

17

18

19

20

21

22
 69

 1 CERTIFICATE OF NOTARY PUBLIC

 2 DISTRICT OF COLUMBIA

 3 I, Carleton J. Anderson, III, notary

public in and for the District of Columbia, do

hereby certify that the forgoing PROCEEDING was

duly recorded and thereafter reduced to print under

my direction; that the witnesses were sworn to tell

the truth under penalty of perjury; that said

transcript is a true record of the testimony given

by witnesses; that I am neither counsel for,

related to, nor employed by any of the parties to

the action in which this proceeding was called;

and, furthermore, that I am not a relative or

employee of any attorney or counsel employed by the

parties hereto, nor financially or otherwise

interested in the outcome of this action.

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17

 18

 19 (Signature and Seal on File)

 20 -----------------------------------

 21 Notary Public, in and for the District of Columbia

 22 My Commission Expires: March 31, 2017