Privacy Impact Assessment 

for 

Filings and Actions (FILAC) 

6/11/2020

System/Business Owner

Howard Rosen

Associate Director

Market and Financial Systems

Reviewing Official 

Charles Cutshall

Chief Privacy Officer

Commodity Futures Trading Commission 
Page 1 of 10

I. SYSTEM OVERVIEW

1) Describe the purpose of the system/collection: 

Filings and Actions (FILAC) is used by Commodity Futures Trading Commission (“CFTC” or 

“Commission”) staff to: 

1. Collect and process documentation from organizations that wish to register as a 

Designated Contract Market (DCM), Swap Execution Facility (SEF), Derivatives 

Clearing Organization (DCO), Swap Data Repository (SDR) or Foreign Board of Trade 

(FBOT). This function is the responsibility of the Division of Clearing and Risk (DCR) 

and Division of Market Oversight (DMO).

2. Collect and process filings submitted by registered organizations (i.e., DCMs, SEFs, 

DCOs, and SDRs) regarding new products, new rules, and rule changes as required by 

CFTC regulations. 

3. Publish basic information about organizations and their products, rules, and changes 

on the Industry Filings page on CFTC.gov. 

4. Serve as a reference tool for other CFTC divisions (such as the Division of Swap 

Dealer and Intermediary Oversight (DSIO), the Office of General Counsel (OGC), 

Office of Executive Director (OED), Chairman and Commissioners (COM), Office of 

Data and Technology (ODT), Office of International Affairs (OIA), Enforcement 

Division (ENF), and Office of the Chief Economist (OCE)) in the context of their 

research and enforcement functions. 
Page 2 of 10

2) Provide a data map or model illustrating how information is structured or is processed by 

the system throughout its life cycle. Include a brief description of the data flows. 

1a. Organizations seeking to register as a DCM, DCO, SEF, SDR, or FBOT send required 

documentation to one of four inboxes (submissions@cftc.gov, 

DMOSubmissions@cftc.gov, secretary@cftc.gov, and FBOTapplications@cftc.gov) 

managed by the CFTC Secretariat and DMO. The Secretariat forwards documents to 

the relevant CFTC division. 

1b. Organizations seeking to register as an SEF or SDR have the option to submit 

registration documents via the CFTC Portal. Once registered, all organizations enter 

information and submit documents relating to new products and rules through the 

CFTC Portal. 

2a. DCR and DMO staff manually enters information relating to new registrations into 

FILAC and save the associated documentation in shared folders on a shared server. 

2b. Documents relating to SEF or SDR registration submitted through CFTC Portal are 

transferred to and saved in a SharePoint site. Relevant division staff manually enters 

pertinent information into FILAC. Information relating to new products and rules from 

all registered organizations is automatically transferred from CFTC Portal and stored in 

the FILAC database upon submission, while the supporting documentation is 

automatically stored in the OPERA (Organizations, Products, Events, Rules and 

Actions) SharePoint site.

3. Basic information about organizations and their products, rules, and changes is 

published on the Industry Filings page on CFTC.gov. 
Page 3 of 10

4. Staff from various CFTC divisions including DSIO, OGC, OED, COM, ODT, OIA, ENF, and 

OCE access FILAC records in the context of their research and enforcement functions. 

II. AUTHORITY AND PURPOSE

1) What is the legal authority to collect, use, maintain, and share information in the system?

The authority to collect and use information in FILAC varies depending on the type of 

organization and the purpose of its filing: 

CFTC Regulation Organization Type

17 CFR § 37.3 Swap Execution Facility (SEF) Registration

17 CFR § 38.3

Designated Contract Market (DCM) 

Designation

17 CFR § 39.3

Derivatives Clearing Organization (DCO) 

Registration

17 CFR § 48.5 Foreign Board of Trade (FBOT) Registration

17 CFR § 49.3 Swap Data Repository (SDR) Registration

17 CFR § 37.3 Swap Execution Facility (SEF) Registration

17 CFR § 38.3

Designated Contract Market (DCM) 

Designation

CFTC Regulation Product Type

17 CFR § 30.13 Product Certification Foreign Security Index

17 CFR § 39.5(a) Swap Clearing Eligibility Determination

17 CFR § 39.5(b) S Swap Clearing Requirement Determination

17 CFR § 40.2(a) Product Certification

17 CFR § 40.2(d) Product Certification Swaps Class

17 CFR § 40.3(a) Product Approval

17 CFR § 41.23(a) Product Certification Security Future

CFTC Regulation Organization Rules

17 CFR § 40.5(a) Rule Approval

17 CFR § 40.5(g) Expedited Rule Approval

17 CFR § 40.6(a) Rule Certification

17 CFR § 40.6(a)(6) Emergency Rule Certification

17 CFR § 40.6(d) Notification of Rule Amendments

17 CFR § 40.10(a) SIDCO Advance Notice of Rule Certification

17 CFR § 40.10(h) SIDCO Emergency Rule Certification

CFTC Regulation Product Rules

17 CFR § 40.4(b)(5) 

Amendments to Enumerated Agricultural 

Products - Non-Material

17 CFR § 40.5(a) Rule Approval
Page 4 of 10

17 CFR § 40.5(g) Expedited Rule Approval

17 CFR § 40.6(a) Rule Certification

17 CFR § 40.6(a)(6) Emergency Rule Certification

17 CFR § 40.6(d) Notification of Rule Amendments

17 CFR § 41.24(a) Rule Certification Security Futures Product

III. INFORMATION TYPES 

1) What information relating to individuals affiliated with regulated entities will be collected, 

maintained, used, and/or disseminated? 

Information in FILAC is contextual and the data elements and types of information received 

will vary depending on the nature and purpose of each individual filing. As such, while the 

table below attempts to identify all of the data elements and information types that FILAC 

routinely processes, the system may collect and process data elements and information 

types that are not specifically identified below. 

Identifying Numbers

☐ Social Security Number ☐ Truncated or Partial Social Security Number

☐ Driver’s License Number ☐ License Plate Number

☐ Patient ID Number ☒ File/Case ID Number

☐ Student ID Number ☐ Health Plan Beneficiary Number

☐ Passport Number ☐ Federal Student Aid Number

☐ Employee Identification Number ☐ Taxpayer Identification Number

☐ Professional License Number ☒ Legal Entity Identifier

☐ Credit/Debit Card Number ☒ National Futures Association ID

☐ Personal Bank Account Number ☐ Other ID if it can be traced back to an 

individual

☐ Personal Device Identifiers or Serial 

Numbers

Contact Information

☐ Personal Mobile Number ☒ Business Phone Number

☐ Personal E-mail Address ☒ Business E-mail Address

☐ Home Phone Number ☒ Business Mobile Number

☐ Home Mailing Address ☒ Business Mailing Address

Sole Proprietors

☐ Business Taxpayer Identification Number ☐ Business Mailing Address

☐ Business Credit Card Number ☐ Business Phone or Fax Number

☐ Business Bank Account Number ☐ Business Mobile Numbers

☐ Business Device identifiers or Serial 

Numbers

Biographical Information

☒ Name ☐ Gender

☐ Date of Birth ☐ City or County of Birth
Page 5 of 10

☐ Country of Birth ☒ Zip Code

☐ Citizenship ☐ Military Service Information

☐ Spouse Information ☐ Academic Transcript

☒ Group/Org. Membership ☒ Resume or Curriculum Vitae

☐ Location Data (e.g., GPS) ☐ Nationality

☒ Employment Information ☐ Marital Status

☐ Mother’s Maiden Name ☐ Children Information

Biometrics/Distinguishing Features/Characteristics

☐ Fingerprints ☐ Height

☐ Retina/Iris Scans ☐ Voice/Audio Recording

☐ Hair Color ☐ Eye Color

☐ Video Recording ☐ Photos

☐ Weight ☒ Signatures

2) What information relating to FILAC users will be collected, maintained, used, and/or 

disseminated? 

Active Directory/Device Information

☐ IP Address ☐ MAC Address

☐ CFTC Asset Number ☐ Device Identifiers or Serial Numbers

☒ User Name ☒ Log data

IV. COLLECTING INFORMATION 

1) How is the information in this system collected? 

Email: Organizations that wish to register as a DCM, SEF, DCO, SDR or FBOT submit the 

required documentation to one or more of four possible email addresses, three of which 

are managed by the CFTC Secretariat and the other by DMO (submissions@cftc.gov, 

DMOSubmissions@cftc.gov, secretary@cftc.gov, and FBOTapplications@cftc.gov). Access 

to these inboxes is determined by the Secretariat and DMO, respectively. The Secretariat 

forwards documents it receives to the appropriate division and that division’s staff enters 

relevant information from the documents into the FILAC software. Copies of the original 

documents themselves are stored in shared folders on a shared server; accompanying 

emails from entities submitting registration documentation are not entered into FILAC. 

Portal: Organizations may also submit SEF and SDR-related registration documentation 

through the CFTC Portal. Portal is a separate external-facing system used by CFTC to 

simplify document submissions for different purposes by regulated entities. Registration 

documents submitted through Portal are saved in the “General Form Upload” SharePoint 

site. Relevant information from the documents is then manually entered into FILAC. 

Once registered, organizations periodically submit documentation related to new products, 

new rules, and rule changes as required by CFTC regulations using the CFTC Portal. 
Page 6 of 10

Information about the requested change is provided by the organization itself in Portal, and 

is transferred to and stored in the FILAC database upon submission. The associated 

documentation is stored in the OPERA SharePoint site. 

Internal Collection: Each new registration or filing which enters FILAC, whether via email or 

Portal, is assigned to one or more CFTC staff using their username, meaning that 

information about staff is generated as they use FILAC. 

2) If any forms are used to collect information that resides in the system, please include the 

name of such form(s) and any applicable control number.

Form Control No. (If applicable)

Form SEF

Form DCM

Form DCO OMB No. 3038-0076

Form FBOT and Form Supplement S-1

Form SDR

V. INFORMATION USE 

1) Will information in the system be retrieved using one or more of the data elements listed in 

Section III? 

Information in FILAC is retrieved by name and filtered by assigned CFTC staff. 

While Data relating to organizations in FILAC is retrieved by elements such as organization 

name, organization type, filing status, and status date, it cannot be retrieved using the 

personal information of the person submitting the documentation or any of the other 

personal identifiers listed in Section III. 

2) If the information in the system is retrieved using one or more of the identifiers, what CFTC 

System of Records Notice (SORN) covers the information? 

Retrieval of information relating to CFTC staff is covered by CFTC-35, General Information 

Technology Records. 

VI. ACCESS AND SHARING

1) With which internal CFTC Offices or Divisions is the information shared? For each Office or 

Division, what information is shared and for what purpose? 

Staff across 11 divisions have some form of access to the FILAC software (DCR, DMO, DSIO, 

ODT, OED, OGC, COM, ENF, OIA, OCE, and Office of Public Affairs (OPA)). 
Page 7 of 10

Increasing levels of permissions (read, contribute, manage) are applied to individual 

categories of organizations, rules, and products. Permissions are granted to staff with a 

business need to review and approve submissions according to their particular role. 

Permission levels are assigned by the directors or deputy directors of the business units 

from within the FILAC software. Access to the FILAC software and SharePoint sites is 

managed by ODT. 

2) How is the information shared internally? 

Filing data and submissions, including the underlying documents, are accessible by CFTC 

staff with “read” privileges in the FILAC software. 

3) With which external organization(s) is the information shared? 

Information is not shared directly with other federal, state, or local government agencies, 

law enforcement, international regulator or agency, self-regulatory organizations, or private 

entities. Basic information is published on CFTC.gov and available to the public. 

4) How is the information shared externally? 

Basic information relating to registered organizations, their products, rules, and changes is 

published to the CFTC.gov Industry Filing page, along with links to certain underlying 

documents that are required by CFTC regulation to be made public. Personal information 

pertaining to the organization or its employees does not appear on the Industry Filing page 

or the linked documents; the name and signature of the incumbent Secretary of the 

Commission appears on CFTC-issued orders. 

VII. TRANSPARENCY

1) How are individuals notified as to how their information will be collected, used, and/or 

shared within this system? 

Individuals are provided with a Privacy Act statement and a website privacy notice when 

creating an account on Portal. Individuals signing and submitting documents by email as 

part of the registration process for their organization understand that they are providing 

personal information to the CFTC. In addition, to ensure individuals understand how the 

CFTC uses and protects their personal information, CFTC has conducted and published this 

PIA on the CFTC.gov privacy program page. 

2) Is a SORN required? If so, explain how the use of the information in this system is limited to 

the use specified in the SORN? 

Yes, CFTC-35, General Information Technology Records covers creation of logs relating to 

activity by CFTC staff on CFTC IT systems. 
Page 8 of 10

VIII. INDIVIDUAL PARTICIPATION 

1) Is the information collected directly from the individual? 

Yes, information maintained and processed by FILAC is collected directly form the 

individual. However, in many cases, the documentation received from the individual 

contains information about other individuals, such as shareholders, officers, directors, 

brokers, and traders who are not directly involved in the preparation or submission of the 

filing. 

2) Is the collection mandatory or voluntary? If voluntary, what opportunities do the 

individuals have to decline to provide information? 

Organizations registering to operate as a DCM, SEF, DCO, SDR or FBOT are required to 

provide this information to the CFTC. Once registered, to the extent organizations choose 

to adopt new rules and products they are obligated to file the appropriate documentation 

with the CFTC. 

3) Do individuals have an opportunity to consent to a particular use of the information? If so, 

how do they provide consent for a particular use?

No.

IX. DATA MINIMIZATION 

1) What steps were taken to minimize the collection of PII in the system?

CFTC only requires individuals to provide the minimum amount of personal information 

necessary when submitting documents as part of an organization’s registration process and 

periodic filings. 

X. DATA QUALITY AND INTEGRITY 

1) How is data quality ensured throughout the information lifecycle and business processes 

associated with the use of the information?

☐ Cross referencing data entries with other systems 

☐ Third party data verification 

☐ Data taken directly from individuals 

☒ Character limits on text submissions 

☒ Numerical restrictions in text boxes 

☒ Other: Restrictions on entering duplicate names and acronyms. 
Page 9 of 10

XI. RETENTION 

1) What are the retention periods for the information? 

The NARA-approved retention schedule title for FILAC data is “Continued Financial and 

Compliance Oversight” and the retention period is “Cut off upon completion of action or 

contract, whichever is appropriate. Destroy 5 years after cut off.” 

XII. SECURITY

1) What types of administrative safeguards protect the information? 

☒ Contingency Plan 

☐ User manuals for the system 

☒ Rules of Behavior 

☒ Non-Disclosure or other contractual agreement 

☐ Other: 

2) What types of physical safeguards protect the information? 

☐ Guards 

☒ Identification Badges 

☐ Biometric 

☐ Cameras 

☐ Physically secured space with need to know access 

☐ Other: 
Page 10 of 10

3) What types of technical safeguards protect the information? 

☒ User Identification 

☒ Firewall 

☒ Virtual Private Network (VPN) 

☒ Multi-factor Authentication (MFA) 

☒ Passwords 

☐ Encryption 

☐ De-Identification 

☐ Anonymization 

☐ Other: 

4) What monitoring, recording, and auditing safeguards are in place to prevent or detect 

unauthorized access or inappropriate use of the information?

Scans of the machines housing the database and the software are performed on a regular 

basis. Each case file is assigned in the FILAC application to one or more CFTC staff. Logs are 

created recording the sign-in and sign-off times of CFTC staff. 

XIII. TRAINING

1) What privacy training is provided to users of the system? 

CFTC staff receive training before gaining access to FILAC for the first time. In addition, 

annual privacy and cybersecurity training is mandatory for all CFTC staff.