1 | Page

 

U.S. Commodity Futures Trading Commission

The Inspector General’s Statement on the 

CFTC’s Management and Performance 

Challenges Office of the Inspector General

Fiscal Year 2023

Management and Performance Challenges

November 13, 2023
2 | Page

August 2023

Contents

Commodity Futures and Trading Commission ................................................................ 3

OIG Mission and Authority .............................................................................................. 3

CFTC Management and Performance Challenges for FY 2023...................................... 4

Challenge 1: Maturing Enterprise Risk Management Practices ...................................... 5

Challenge 2: The Customer Protection Fund .................................................................. 6

Challenge 3: Leased Space Savings............................................................................... 7

Challenge 4: Maintaining Cyber Security Effectiveness .................................................. 8

Challenge 5: Preparing for its Role for Regulating Digital Assets.................................... 9

To Report Fraud, Waste, or Abuse, Please Contact:................................................ 11

Comments and Suggestions...................................................................................... 11
3 | Page

Commodity Futures and Trading Commission

The mission of the Commodity Futures Trading Commission (CFTC) is to promote the 

integrity, resilience, and vibrancy of the U.S. derivatives markets through sound 

regulation. In the aftermath of the 2008 financial crisis, the Dodd-Frank Wall Street 

Reform and Consumer Protection Act of 2010 (Dodd-Frank Act) expanded the CFTC’s 

regulatory authority to oversee the more than $400 trillion swaps market.

The CFTC organization consists of the offices of the Chairman and Commissioners as 

well as the agency's 13 operating divisions and offices. The CFTC’s Executive 

Leadership Team consists of the heads of each operating division and office, the 

agency’s Chief of Staff/Chief Operating Officer, and the CFTC Chairman in his or her 

capacity as the agency’s Chief Executive. These individuals are responsible for carrying 

out the CFTC’s administrative, regulatory, and enforcement agenda.

OIG Mission and Authority

The Office of the Inspector General (OIG) mission is to detect waste, fraud, and abuse 

and to promote integrity, economy, efficiency, and effectiveness in the CFTC’s 

programs and operations. As such it has the ability to review all of the Commission’s 

programs, activities, and records. OIG was established as an independent unit to:

• Promote economy, efficiency, and effectiveness in the administration of CFTC 

programs and operations, and detect and prevent fraud, waste, and abuse in such 

programs and operations;

• Conduct and supervise audits and, where necessary, investigations relating to 

the administration of CFTC programs and operations; 

• Review existing and proposed legislation and regulations, and make 

recommendations concerning their impact on the economy and efficiency of CFTC 

programs and operations or the prevention and detection of fraud and abuse; 

• Recommend policies for, and conduct, supervise, or coordinate other activities 

carried out or financed by such establishment for the purpose of promoting economy 

and efficiency in the administration of, or preventing and detecting fraud and abuse in, 

its programs and operations; and
4 | Page

• Keep the Commission and Congress fully informed about any problems or 

deficiencies in the administration of CFTC programs and operations and provide 

recommendations for correction of these problems or deficiencies.

The Reports Consolidation Act of 2000 (RCA) requires the Inspector General to 

summarize the “most serious management and performance challenges facing the 

agency” and briefly assess the Agency’s progress in addressing those challenges. 

Management challenges are “programs or management functions, within or across 

agencies, that have greater vulnerability to waste, fraud, abuse, and mismanagement 

(such as issues identified by the Government Accountability Office as high risk or issues 

identified by an Inspector General) where failure to perform well could seriously affect 

the ability of an agency to achieve its mission or goals. This memorandum fulfills our 

duties under the RCA.

To complete our assessment, we relied on data contained in the CFTC financial 

statement audit and Agency Financial Report, representations by agency management, 

and our knowledge of industry trends and CFTC operations.

CFTC Management and Performance Challenges for FY 2023

The CFTC faces several management challenges that potentially hinder its ability to 

fulfill its mission effectively. For FY 2023, we have identified five challenges; three with

opportunities for improvement. Recognizing CFTC’s leadership initiatives for data 

harmonization completed and underway, for FY 2023 we focused on areas where the 

CFTC must adapt its regulatory framework to keep pace with technological 

advancements for risk intelligence and capitalizing on existing resources. In particular:

1. Maturing Enterprise Risk Management Practices

2. The Customer Protection Fund

3. Lease Space Savings

4. Maintaining Cyber Security Successes

5. Preparing for its Role for Regulating Digital Assets 

Mastering these opportunities can further transform the CFTC to anticipate and mitigate 

risks impacting the fulfillment of its mission. 
5 | Page

Challenge 1: Maturing Enterprise Risk Management Practices 

Enterprise risk governance is a shared responsibility at the highest levels of executive 

leadership. Applied to CFTC, Enterprise Risk Management (ERM) is a Commissionwide strategy to identify and prepare for risks to business objectives. More specifically, 

ERM provides a framework for risk management, which typically involves identifying 

particular events or circumstances relevant to the CFTC objectives (threats and 

opportunities), assessing them in terms of likelihood and magnitude of impact, 

determining a response strategy, and monitoring process.

CFTC’s current Strategic Plan recognizes that “[a] robust and mature ERM program is 

central to achieving the CFTC mission.” CFTC’s ERM program vision “integrates risk 

identification, risk management, strategic planning, and performance monitoring so that 

risks that potentially threaten achievement of the CFTC mission are anticipated, 

analyzed, and systematically addressed.” However, CFTC’s Chief Risk Officer departed 

in March 2023; currently one CFTC employee is tasked with risk management 

oversight. Therefore, in the short-term the Commission has opportunities to mature its 

ERM program through skilled staff acquisition, developing policies and procedures,

employing data-driven metrics, and integrating risk management practices CFTC-wide. 

During FY 2023, CFTC responded to several unexpected risks impacting markets and 

operation such as crypto currency failures1 and malware impacting registrant reporting.2

A robust ERM program enhances CFTC’s posture to better anticipate, prioritize, and 

respond to risk. 

Management conveyed they:

 

1 See, e.g., CFTC Customer Advisory: Use Caution When Buying Digital Coins or Tokens; Keynote 

Address of Commissioner Kristin Johnson at UC Berkeley Law Crypto Regulation Virtual Conference, 

Post Crypto-Crises: Pathways for Protecting Customers and Preserving Market Integrity, Feb 8, 2023. 

2 See, Reuters, U.S. CFTC traders report delayed by ransomware attack on data firm ION, Feb. 2, 2023. 

Completed Actions Ongoing Actions

• Conducted interviews with multiple Financial Institutions 

Reform, Recovery, and Enforcement (FIRREA) and 

Financial Services agencies as part of a benchmarking 

exercise to help assess CFTC’s current level of maturity 

and consider best practices moving forward. 

• Based on the interviews, the CFTC planned a strategic 

pragmatic approach to develop an ERM program that is 

effective and sustainable by focusing on one division at 

a time. 

• Established an informal ERM Committee to provide 

guidance and feedback on the implementation strategy 

of the ERM program.

• Establish a formal ERM 

Committee building from 

the informal committee.

• Develop a mature ERM 

program to identify and 

respond to enterprise 

risks.
6 | Page

Challenge 2: The Customer Protection Fund

Currently, the CPF is available to CFTC for the payment of awards to whistleblowers 

and the funding of customer education initiatives designed to help customers protect 

themselves against fraud or other violations of the Commodity Exchange Act. The 

CFTC could assert its use of the CPF for increased educational initiatives, such as 

education of registrants and market professionals, and could interpret existing 

legislation to permit the CPF to fund education activities beyond fraud avoidance for 

customers. Customer education regarding registration and customer disclosure 

requirements, for instance, could protect customers from violations in addition to the 

fraud prohibitions under the Commodity Exchange Act and regulations. Risk 

management and cyber security training could benefit customers, registrants and 

market participants, while strengthening measures against fraud or other violations of 

the Commodity Exchange Act. In short, expanded use of CPF funds to finance 

additional education initiatives could benefit the CFTC ecosystem as a whole. 

Management stated:

 

3 See, e.g., Rostin Behnam, Chairman, CFTC, Testimony of Rostin Behnam, Chairman, Commodity 

Futures Trading Commission “Oversight of the Commodity Futures Trading Commission,” U.S. Senate 

Committee on Agriculture, Nutrition, & Forestry (Mar. 8, 2023), Testimony of Chairman Rostin Behnam 

Before the U.S. Senate Committee on Agriculture, Nutrition, & Forestry | CFTC. 

Completed Actions Ongoing Actions

• The CFTC has identified the CEA provisions 

relevant to education. The CEA allows use of 

the CPF for the funding of “customer 

education initiatives designed to help 

customers protect themselves against fraud 

or other [CEA] violations . . . or . . . [related] 

rules and regulations. . . . .” 7 U.S.C. 

§ 26(g)(2)(B). The CEA also calls for other 

educational expenses to be carried out 

through appropriations. 7 U.S.C. § 22(a). 

• The CFTC has sought two opinions from GAO 

as to the use of the CPF for customer 

education and market participant education, 

and one opinion from the CFTC’s General 

Counsel. (GAO, B-321788, at 4; GAO, B324469, at 6). 

• The Whistleblower Office (WBO) is also 

funded by the CPF and is part of the Division 

of Enforcement (Division). The WBO works 

with the Director of the Division and relevant 

Division Task Forces to publish whistleblower 

alerts, and to conduct outreach efforts to 

potential whistleblowers. Whistleblower Alerts 

| Whistleblower.gov

• The WBO will continue to work with 

the Division and its Task Forces to 

educate potential whistleblowers 

about Division priorities, which 

include cyber security. 

• OCEO will explore within the CFTC 

the use of CPF funds to expand the 

remit of its educational efforts.

• The Chairman will continue to 

advocate for amendments to the 

CEA to expand the permitted uses of 

the CPF in support of implementing a 

host of new investor protection 

programs and systems and 

information aimed at ensuring 

Americans not only protect 

themselves from fraud and 

manipulation, but may more fully 

engage with the Commission and the 

markets it oversees.3 
7 | Page

Challenge 3: Leased Space Savings 

During Fiscal Years (FY) 2020-22 CFTC completed the relocation of its three 

regional offices to facilities managed by the General Services Administration 

(GSA). During that period, and in response to observed declines in employee office 

attendance due to the novel COVID-19 (coronavirus) pandemic, CFTC has 

maintained its four (total) leased facilities with low occupancy levels since March 

2020. When CFTC determines its post-pandemic return to work policy and updates 

office space requirements accordingly, significant cost savings may become 

available to support operational needs through right-sizing leased space. 

Specifically, opportunities exists to re-evaluate its current space needs and inform

GSA of unused space at its Kansas City, Chicago, and New York offices. In 

addition, because its Washington D.C. headquarters lease expires in 2025, CFTC 

also has the opportunity to right-size headquarters space requirements. Through 

CFTC action, GSA may facilitate amended leases in the regions and a new 

headquarters lease that serves the CFTC’s prospective space needs. The 

opportunity to re-evaluate leased space remains throughout a GSA lease, but 

CFTC should seize the opportunity as soon as feasible.4 

Management expressed:

 

4 See Occupancy Agreement between Commodity Futures Trading Commission and General Services 

Administration Financial Terms clause “[The] tenant agency may relinquish space upon four (4) months’ 

notice at any point after the first twelve (12) months of occupancy”. Identical clause is found in KCRO, 

NYRO, and CHRO Occupancy Agreements.

Completed Actions Ongoing Actions

• During Fiscal Years (FY) 2020-22, CFTC completed the 

relocation of its three regional offices to facilities 

managed by the General Services Administration 

(GSA). 

• CFTC proposed a space reduction of 49% from current 

levels in the future lease for DC office space.

• Currently in negotiations with 

the union to determine the 

CFTC’s future work posture 

(e.g., telework). 

• Work with GSA to evaluate 

proposals on the DC office 

space plan and design.
8 | Page

Challenge 4: Maintaining Cyber Security Effectiveness 

A technological area of success for CFTC has been the growth and effectiveness of 

cyber security operations. At present security operations are able to monitor and 

respond to threats in real-time. In addition, CFTC has successfully migrated to a cloud 

environment and its security posture is effective. However, CFTC must devote vigilance 

and resources to maintaining talent and leading-edge tools to remain effective in its 

cloud environments. Cloud-conscious adversaries, which abuse cloud-specific features 

to achieve their goals, pose significant risk to cloud environments. They have a deep 

understanding of cloud infrastructure and continue to refine their tactics, including 

artificial intelligence, to abuse cloud services and exploit cloud vulnerabilities and 

misconfigurations. We noted during FY 2023 that while CFTC cyber controls were 

effective and in line with the organization's established policy and procedures, an 

improvement opportunity existed to mitigate or accept the risk of aging critical and high 

vulnerabilities associated with its network servers and workstations. 

Management communicated they:

Completed Actions Ongoing Actions

• Updated CFTC’s vulnerability management 

processes and procedures to establish a more 

aggressive patching timeframe to protect the 

network against urgent and active threats.

• Conducted 12 phishing exercises to reduce the 

risk posed by phishing attacks by increasing 

user awareness through continuous exercises 

and detailed debriefs. 

• Implemented several 3rd party patch 

management tools to deploy security updates.

• Explore additional alternatives to 

improve patching timeframe for the 

aging critical and high 

vulnerabilities identified in CFTC 

information systems.

• Explore modifications to the 

network architecture (e.g., network 

segmentation) to reduce the attack 

surface and limit lateral movement 

to better safeguard CFTC 

information and information 

systems.
9 | Page

Challenge 5: Preparing for its Role for Regulating Digital Assets

Digital Assets include cryptocurrency, virtual currency, digital currency, crypto tokens, 

virtual tokens, digital tokens, utility tokens, crypto assets, stablecoins, central bank 

digital currency, non-fungible tokens, and many other possible terms referring to “assets 

on the blockchain.”

Over the past decade, digital assets have gone from an obscurity to a generally 

unregulated medium of finance. As with any new technology, there is great potential for 

society, but there are also significant risks. As society awaits Congressional action for 

clear regulatory jurisdictions, many federal agencies have begun acting within their 

powers. The President has ordered5 federal agencies to begin coordinating and refining 

their responses with the hopes that the U.S. will not miss the opportunity to be a leading 

jurisdiction for digital assets, and equally to ensure that the U.S. remains at the forefront 

of responsible development and design of digital assets and the technology that 

underpins new forms of payments and capital flows in the international financial system. 

We recognize the collective attention to digital assets and jurisdiction, and the 

distinction between securities and commodities in particular. Whether certain digital 

assets are securities or commodities remains unclear, as various subcomponents of the 

ecosystem challenge existing regulatory divisions. The Government Accountability 

Office recently issued a report recognizing that “gaps in regulators’ authority” exist in 

this area, and summarizing the risks of unclear regulation of digital assets: 

As markets for crypto assets and other blockchain-related products and services 

have grown, so has the need for federal financial regulators to address the risks 

they pose to consumers, investors, and financial stability. Recent market turmoil 

and instances of fraud related to crypto assets, stablecoins, and trading platforms 

illustrate the significant risks to consumers and investors. [The] potential for risks 

to financial stability will increase as blockchain products and services continue to 

grow and integrate into the mainstream financial system.6

 

5 See, Executive Order 14067 of March 9, 2022, “Ensuring Responsible Development of Digital Assets” 

(https://www.whitehouse.gov/briefing-room/presidential-actions/2022/03/09/executive-order-on-ensuringresponsible-development-of-digital-assets/); Fact Sheet: White House Releases First-Ever 

Comprehensive Framework for Responsible Development of Digital Assets 

(https://www.whitehouse.gov/briefing-room/statements-releases/2022/09/16/fact-sheet-white-housereleases-first-ever-comprehensive-framework-for-responsible-development-of-digitalassets/#:~:text=President%20Biden's%20March%209%20Executive,assets%20and%20their%20underlyi

ng%20technology). 

6 GAO-23-105346, Blockchain in Finance – Legislative and Regulatory Actions Are Needed to Ensure 

Comprehensive Oversight of Crypto Assets, page 55-56, June 2023.
10 | Page

GAO also recognized that “gaps in regulators’ authority” limit their ability to effectively 

mitigate these risks.7 CFTC participates in the Financial Stability Oversight Council, 

which is designed to monitor and address such risks. CFTC may be uniquely positioned 

to analyze risks posed by digital asset markets and to contribute to the work of the 

FSOC regarding risks posed by such markets. This presents a significant opportunity to 

coordinate responsibilities for spot markets, for example, as well as a significant 

management challenge to bolster capacity for data capture, analysis, monitoring, 

supervision, and regulation of crypto-asset activities.8 

Management shared:

 

7 Id., page 56.

8 See, FSOC, Report on Digital Asset Financial Stability Risks and Regulation, 2022 

(https://home.treasury.gov/system/files/261/FSOC-Digital-Assets-Report-2022.pdf). 

Completed Actions Ongoing Actions

• Enforcement actions related to digital assets to 

ensure compliance with existing laws (47 actions 

filed in FY 2023) 

• Helped draft FSOC report on digital assets

• Participated in drafting reports on digital assets 

by international bodies, including IOSCO and 

FSB

• Provided technical assistance to Congress on 

proposed digital asset legislation

• Drafted preliminary plan of action if legislation is 

enacted that would give the CFTC jurisdiction 

over spot trading in digital assets that are not 

securities 

• Numerous ongoing enforcement 

matters related to digital assets 

• Ongoing participation in FSOC digital 

asset working group

• Ongoing technical assistance to 

Congress for possible legislation

• Coordinate directly with other 

governmental bodies, including the 

SEC, Treasury and California state 

regulators, on digital asset policy
 

11 | Page

To Report Fraud, Waste, or Abuse, Please Contact: 

The Office of Inspector General (OIG) conducts and supervises audits and 

investigations of programs and operations of the CFTC and recommends policies to 

promote economy, efficiency and effectiveness in CFTC programs and operations in 

order to prevent and detect fraud, waste or abuse. 

Employees, contractors and members of the public may report any instance of fraud, 

waste, or abuse at CFTC by contacting: 

• OIG Hotline at 202.418.5510 

• Email to OIGComplaint@cftc.gov (you do not need to identify yourself) 

• Sending a letter to: 

Commodity Futures Trading Commission 

Office of the Inspector General Three Lafayette Centre 

1155 21st Street, NW 

Washington, DC 20581 

• Fax to the CFTC OIG at 202.418.5522 

Comments and Suggestions 

Comments can be mailed to the attention of the Assistant Inspector General for Audits 

at the address listed above. 

Suggestions for the CFTC FY24 workplan may be emailed to OIGWorkplan@cftc.gov. 

Please send general comments or questions to OIG@cftc.gov.