MINUTES OF THE SECOND MEETING OF THE 


U.S. COMMODITY FUTURES TRADING COMMISSION'S 


MARKET RISK ADVISORY COMMITTEE 


JUNE 2, 2015 


The Market Risk Advisory Committee ("MRAC" or "Committee") convened for a public 

meeting on Tuesday, June 2, 2015, at 10:00 a.m., at the U.S. Commodity Futures Trading 

Commission's ("CFTC" or "Commission") Headquarters Conference Center, located at Three 

Lafayette Centre, 1155 21 51 St., NW, Washington, DC. The meeting consisted of two panels. 

Panel I discussed cybersecurity and the Bank of England's CBEST Program. Panel II discussed 

liquidity in the derivatives markets. 

MRAC Members in Attendance 

Dr. Anat Admati, George G.C. Parker Professor of Finance and Economics, Stanford University 

Graduate School of Business, Better Markets Representative 

Gerald Beeson, Chief Operating Officer and Chief Financial Officer, Citadel LLC 

Sunil Cutinho, President, CME Clearing, CME Group ("CME") 

Andrew Gray, Managing Director, Group Chief Risk Officer, Depository Trust & Clearing 

Corporation 

William Hale, Export Grain Manager, Cargill 

Jerry Jeske, Group Chief Compliance Officer, Mercuria Energy, Representing Commodity 

Market Council 

Sebastiaan Koeling, Chief Executive Officer, Optiver, Representing Futures Industry 

Association's Principal Traders Group 

Dr. Andrew Lo, Director, Massachusetts Institute of Technology's Laboratory for Financial 

Engineering 

Glen Mackey, Chief Risk Officer, NRG Energy 

Dennis McLaughlin, Group Chief Risk Officer, LCH.Cleamet ("LCH") 

Susan McLaughlin, Senior Vice President, Federal Reserve Bank of New York 

Richard Miller, General Counsel, Prudential Global Funding 

John Nixon, Group Executive Director, Americas for ICAP 

Susan O'Flynn, Managing Director and Global Head of CCP Strategy, Governance and 

Optimization, Morgan Stanley 

Marcus Stanley, Policy Director, Americans for Financial Reform 

Kristen Walters, Global Chief Operating Officer of Risk and Quantitative Analysis Group, 

BlackRock 

Rana Yared, Managing Director, Goldman Sachs 

Luke Zubrod, Director ofRisk and Regulatory Advisory Services, Chatham Financial 

Invited Speakers in Attendance 

Isaac Chang, Global Head of Fixed Income, Currency and Commodities, KCG Holdings, Inc. 

("KCG") 

Mahi Dontamsetti, Global Head IT Risk and Deputy Chieflnformation Security Officer, Depository 

Trust and Clearing Corporation 

David Evans, Senior Manager, Cyber Team, Bank of England 

Piers Murray, Managing Director, Global Head OTC Derivatives Clearing & Derivative Prime 

Brokerage, Deutsche Bank 
Jerry Perullo, Chieflnformation Security Officer, Intercontinental Exchange ("ICE") 

Joseph Squeri, Chief Information Officer and Chief Technology Officer, Citadel LLC 

Thomas Wipf, Managing Director and Global Head of Bank Resource Management, Morgan Stanley 

CFTC Commissioners and Staff in Attendance 

Timothy G. Massad, Chairman 

Sharon Y. Bowen, CFTC Commissioner and MRAC Sponsor 

Mark Wetjen, CFTC Commissioner 

Petal Walker, Chief Counsel, Office of Commissioner Bowen, and Designated 

Federal Officer 

David Taylor, Associate Director, Division of Market Oversight 

Robert Wasserman, Chief Counsel, Division of Clearing and Risk 

I. Opening Remarks 

Petal Walker called the MRAC meeting to order. Following welcoming remarks by 

Commissioner Bowen, she turned to Chairman Massad for his opening remarks. The Chairman 

thanked MRAC members for their participation and Mr. Gray and Ms. McLaughlin for 

facilitating the discussions. He also thanked Commissioner Bowen and CFTC staff, and noted 

the importance ofthe topics at the meeting. Commissioner Wetjen then made his opening 

remarks and echoed the Chairman in noting the importance ofthe meeting's topics. 

Commissioner Bowen thanked Kim Taylor for her service on the MRAC and welcomed Sunil 

Cutinho to the Committee. She noted that cyber-attacks on U.S. businesses have been 

alanningly increasing and it is critical that the financial industry have strong protections in place. 

She also stated that the first panel will allow the Commission to learn more about the Bank of 

England's (BoE) CBEST Program and to hear the MRAC members' thoughts. She thanked Mr. 

Evans and BoE for providing that opportunity. She then noted that the second panel will address 

an important issue that deals with market structure which is liquidity. 

II. Panel I: Cybersecurity-Considering Bank of England's CBEST Program 

Mr. Gray facilitated the discussion. 

Mr. Evans gave a presentation on the CBEST Program. In providing an overview of the 

program, he stated that in June 2013, BoE's Financial Policy Committee recommended that 

Treasury work with regulatory authorities and the core U.K. financial system and infrastructure 

to implement a program to improve and test resilience to cyber-attacks. After reviewing industry 

testing, which revealed great variation, he explained that BoE was unable to provide assurance 

that cybersecurity capabilities were adequate. He also stated that BoE wanted a means to 

measure and ensure that the core ofthe U.K. financial system has a high level of protection 

against cyber-attacks. Further, he noted that BoE recognized the need to build a repeatable and 

scalable vulnerability testing framework. 

Mr. Evans then discussed how CBEST was built on several unwritten principles and that the tests 

provide an assessment of each firm's current capability versus where it needs to be. Specifically, 

he explained that : (1) each test should include the same steps, no matter which organization was 

being tested, and be holistic in nature, ensuring people, processes, and technology were tested; 

(2) the content of each step should be tailored to each organization being tested; (3) commercial 

and government intelligence should influence the behavior of the penetration testers, who must 

2 

act as threat actors; (4) tests should provide an accurate understanding of the threats faced by 

each institution (and therefore the core as collective); (5) tests would be conducted in partnership 

with regulators; and ( 6) tests would benefit from the involvement of GCH Q, the U.K. 's signal 

intelligence. 

Because of GCCQ's involvement and the government's significant resource commitment, Mr. 

Evans noted that CBEST is only available to core institutions and that CBEST participation is 

not mandatory. He also explained that, initially, BoE needed to prove that participation is a good 

and safe thing to do, and therefore they piloted CBEST on BoE itself. A small working group, 

which included banks, infrastructure providers, penetration testers, threat intelligence providers, 

the BoE and government agencies, was then established to take development from the pilot 

phase to launch. Additionally, he stated that new accreditation standards, including 

examinations for penetration testers and threat intelligence providers, were created and 

administered by the Council of Registered Ethical Security Testers ("CREST") on behalf of BoE. 

Further, he noted that BoE liaises closely with its supervisors and with CREST and seeks 

feedback from penetration testers, threat intelligence providers, and industry to maintain the 

program. 

Next, Mr. Evans explained that CBEST testing is based on current threat intelligence and the 

scope is agreed to by the regulators and the financial institutions being tested. He also explained 

that CBEST looks broadly at functions which, if disrupted, could adversely affect U.K. financial 

stability and targets the technology systems supporting those functions. Mr. Evans then 

explained that post-test activity is analyzed at the completion of CBEST testing, which includes 

the convening of stakeholders to discuss testing activity, and subsequently, a remediation plan to 

address security gaps, which must be agreed to by both the regulators and the financial 

institution. Progress under the remediation plan is monitored via routine supervisory 

engagement, and a retest may be required. Additionally, Mr. Evans stated that each test takes 

approximately six months from start to finish (including a lengthy procurement process), while 

CBEST testing itself takes roughly four to six weeks. He then noted that next steps for firms that 

are not considered "core" are unclear, and that BoE is considering taking the CBEST principles 

and building something more manageable-smaller and less resource-intensive. 

Following the presentation, the MRAC asked Mr. Evans questions about the CBEST Program. 

Ms. Walters asked Mr. Evans to share some of the findings or performance metrics that he found 

useful when conducting the tests and analyzing results. Mr. Evans responded that he was unable 

to share specific results of tests but had received positive feedback about the test as framework. 

Mr. Miller asked how often a retest should be done to which Mr. Evans responded that definitive 

timeframes for retesting have yet to be decided, but certain triggers force a retest sooner (e.g., 

acquisitions of a business outside the U.K., undertaking new lines of business, or organizations 

targeted by new threat actors). 

Mr. Evans also addressed a question regarding the types of entities that participated in the test. 

He explained that organizations whose potential disruption would impact financial stability were 

included (e.g., investment banks, retail banks, clearing houses, wholesale banking organizations, 

exchanges, and settlement systems). Additionally, Mr. Evans was asked for his views on insider 

versus external threats to which he commented that insider threats have gained plenty of media 

attention; however, it is BoE's view that the biggest threats to organizations are external actors. 

3 

Dr. Admati asked whether testing should be mandatory or voluntary. Mr. Evans responded that 

over 90 percent ofthe organizations BoE wanted to undertake the testing, are now fully 

committed to CBEST. He also commented on the possibility of mandatory testing ifthe 

frequency of testing is increased or testing becomes intrusive. Dr. Lo then asked several 

questions, including the number of firms BoE has accredited, whether BoE tests social 

engineering as well as technology, and whether the cost oftesting will pose issues in the future, 

paiiicularly ifsmaller firms participate. Mr. Evans responded that: (1) six penetration testing 

firms and four threat intelligence providers have been accredited, and that three to five 

applications were rejected; (2) social engineering has been used in some CBEST engagements, 

but only if it is used by the threat actors identified; and (3) CBEST testing costs vary depending 

on the organization and the test's duration, but are in line with what organizations are already 

spending on penetration testing regimes. Mr. Mackey asked how dynamic CBEST testing is and 

whether it is exclusively oriented towards penetration testing to which Mr. Evans responded that 

CBEST is only penetration testing at this time. 

Mr. Perullo then commented that ICE has U .K. subsidiaries that participated in CB EST. He 

commended the program, but shared some challenges that arose from having a regulator "at the 

table." With regard to the scope oftesting, he explained that, with a vulnerability assessment, 

the targets are scoped, but with penetration testing, you just scope the types ofthreat actors. 

Additionally, he noted that if an organization is targeted, the threat may come in through a 

subsidiary in a different jurisdiction where the regulator does not have jurisdiction, which 

presents challenges. He also noted that penetration testing is not holistic because it identifies 

specific issues but is not a complete assessment of a security program. Another issue is whether 

a regulator should endorse specific private firms to perform testing and accreditation. Finally, he 

cautioned that test results create a document that lists all ofthe critical functions, and 

vulnerabilities, of any given critical infrastructure entity. He described this as a "very high risk 

asset" that he does not want regulators to have, and questioned whether the CFTC wants to be 

impregnated with that document. 

Mr. Evans agreed that these are valid challenges. He noted that BoE chose CREST after 

considering several other companies, and is open to working with other companies ifthey 

provide a better service. He also stated that CBEST does not provide a full assessment of a 

company's security capabilities; rather, it looks at the holistic nature of all processes that a threat 

actor would undergo to carry out an attack from start to finish. He agreed that many global 

organizations have a weak entry point that could be used as a back door that is not included in 

the CBEST test, and that BoE can only engage with subsidiaries in jurisdictions where it 

coordinates with other regulators. 

Chairman Massad stated that the U.S. has certain mechanisms for sharing threat intelligence 

among industry participants (e.g., FS-ISAC and a financial sector body) which are not tied to a 

specific testing regime. He asked how sharing mechanisms through CBEST differ. Evans 

replied that the U.K has similar intelligence sharing mechanisms and that CBEST is not trying to 

undermine or replace any other mechanisms. Mr. Wasserman stated that he believes CBEST is 

more tailored to the individual organization getting information while FS-ISAC is a broader 

distribution. Mr. Taylor stated that he thought the two types of intelligence involvement would 

be mutually beneficial. Mr. Wasserman added that the CFTC is well aware of the security 

concerns ofthe critical functions document and ofthe importance of keeping critical information 

secure. 

4 

(Break) 

III. Panel II: Liquidity in the Derivatives Markets 

Ms. McLaughlin facilitated the discussion. 

She noted that Panel II would focus on understanding the state of liquidity in derivatives markets 

overseen by the Commission, with a focus on commodity derivatives. Ms. McLaughlin then 

asked Mr. Murray and Mr. Chang to define market liquidity. Mr. Murray noted that liquidity can 

generally be defined as the ability to transact in an asset without affecting its price in a public 

marketplace, but that liquidity is in the eye of the beholder. He also stated that a block trader has 

a different perspective than someone trading single-size transactions. Further, different 

definitions are applicable to different markets. Therefore, he explained that it is prudent to 

define the characteristics of a liquid market instead, including: ( 1) low friction costs; (2) 

availability of risk intermediaries to smooth timing differences between buyers and sellers; (3) 

low barriers to entry; and (4) a market with few pricing constraints that distort impacts (e.g., a 

limit up or down feature, an intervention, and a zero interest rate boundary). 

Next, Mr. Chang addressed metrics that exist to measure or monitor market liquidity, which 

change based on the market structure of any particular asset class. Given the linkage between 

underlying and listed futures markets and cleared swaps markets, it is misleading to look at 

liquidity of these products in isolation. For example, while the U.S. Treasury futures market has a 

certain market structure for which there is a lot of information, it is strongly affected and 

influenced by the over-the-counter ("OTC") cash Treasury market where many participants lack 

publicly available pricing and transaction data. Therefore, he posited that it is potentially 

impossible to measure and monitor liquidity in the U.S. Treasury markets as a whole. 

Mr. Wipf next stated that liquidity as a measure should be considered in the context of 

infrastructure. Using pricing in the agency mortgage market as an example, he commented on 

upstream effects in the financing markets or securities financing transaction (SFT) markets and 

repo and securities lending. Mr. Murray agreed and noted that in the aftermath of the Swiss 

devaluation, a number of clients reduced risk across multiple assets rather than just in the FX 

space. He discussed macroeconomic versus microeconomic differences related to dislocations, 

including the broadening of the spread between CME's prices and interest rate swaps and LCH's 

prices and interest rate swaps. 

Mr. Chang then explained that market makers take the risk of holding transaction until the 

opposite side appears in the market. He stated that KCG depends on bank financing, and as the 

cost of capital increases, liquidity has to go up because the returns that a market maker has to 

generate are constant. He argued that the CME/LCH basis differential is an improvement over 

what existed pre-central clearings, when every trade was a bespoke instrument. Mr. Wipf agreed 

and said that the general nature and size and scope of the collateral mismatch have brought real 

focus to the issue, which will find its way into pricing models. 

Ms. Yared noted that liquidity in all markets is not the same. For example, liquidity in the credit 

market, based on the five year on-the-run index point, has improved over the last year, largely 

because of the structure of that particular market. However, she also noted that the interest rate 

markets have true potential for a liquidity crunch based on several factors, including the fact that 

liquidity is conditional and that executing sizeable thematic trades is a challenge. She then 

5 

commented that Goldman's view is that the capital rules-the supplemental leverage ratio and net 

stable funding ratio-are causing substantial challenges and a liquidity crunch on the executing 

broker and clearing broker side. She also stated that the treatment of cleared trades is in 

contravention of G20 clearing goals. Further, Goldman fears that if capital rules remain 

unchanged, significant hedging that should happen will remain undone, and a significant 

bifurcation in pricing in cleared and uncleared trades may occur. 

Mr. Zubrod introduced the perspective of end users, noting that regulatory issues have had an 

impact on smaller and mid-size entities. Mr. Nixon stated that banks have lessened their 

involvement significantly over the past five years, and that although some market makers are 

stepping in, the market is less liquid than before due to an absence of a major player. He further 

stated that, in the future, it will be more difficult to hedge and transact when markets move 

because less people will take the other side of the trade. Mr. Hale commented that in the 

agriculture market, liquidity is currently adequate, but he is concerned about rules that can affect 

liquidity of individual markets - i.e., issues in the Futures Commission Merchants ("FCM") 

market, which Commissioner Giancarlo covered in his June 1, 2015 Statement for MRAC, 

position limits, and capital regulation of FCMs. 

Dr. Lo commented that liquidity is difficult or impossible to measure. He believes that liquidity 

is misunderstood because it is not a single concept. From an academic perspective, there are 

three qualities of liquidity- price, time and size. He then noted that a security is liquid if it can 

be traded quickly, in large size, and without moving prices, and that different definitions of 

liquidity are required because different markets have different characteristics of price, time and 

size, but it is not hard to measure. Further, he stated that it is important to understand who 

provides liquidity and the entity's incentives for providing and withdrawing it, because 

technology enables liquidity to be moved rapidly. 

Ms. McLaughlin asked the group whether liquidity has decreased and whether they see linkages 

between different segments of markets. Mr. Cutinho noted that some clients are losing access to 

markets, and that some rules (e.g., the leverage ratio rules) have made it expensive for brokers or 

intermediaries to provide access. Ms. Walters added that capacity is more of an issue than 

liquidity, and that her firm is required to transact in smaller lot sizes and has encountered pockets 

of illiquidity. Additionally, the firm's transaction cost models do not fare well in very illiquid 

markets and, in turn, capacity is very difficult to quantitatively measure. Further, capacity is a 

major issue in regard to central counterparty risk, and there has been an impact on clearing 

members and FCMs from "the capacity perspective of increased increasing regulatory limits" on 

liquidity, leverage, and risk weighted assets. 

Dr. Admati stated that she did not favor liquidity requirements because they potentially distort 

markets. Mr. Jeske noted the important linkage between listed futures and bilateral swap 

activities. Mr. Beeson added that liquidity has been impacted by changes in business models and 

technology. Additionally, he stated that markets are more transparent and new entrants quote 

tighter spreads; however, liquidity is fragmented, with dealer-to-dealer markets split from dealerto-customer liquidity pools. 

Ms. O'Flynn discussed the CME-LCH basis imbalance in the context of liquidity and capacity. 

Ms. Y ared noted that capacity and liquidity are sisters, and that capacity is a private choiceevery bank makes important decisions about how to allocate scarce resources. She also 

commented that finding capacity has become increasingly challenging, and questioned the 

6 

feasibility of creating multiple tiers of market access and a "two-speed economy." Mr. Koelig 

stated that his firm will not be able to provide the same level of liquidity once markets move. 

Ms. McLaughlin next asked how market participants have responded to market changes and the 

implications for market functioning. Ms. Chang suggested that the CFTC focus on increasing 

pre- and post-trade data to accurately measure and monitor liquidity. He added that liquidity 

provision is a service that needs to earn an economic rate ofreturn, and the focus should be on 

increasing the number of smaller liquidity providers. Mr. Murray discussed FCM concentration 

and the ability of FCMs to support the market access that smaller pools of capital require to be 

effective. Mr. Wipf then discussed the current impact on collateral markets. Mr. Jeske noted 

that because of Basel III regulations, clearing costs four to six times more, which means that 

market participants may need to self-clear, which introduces operational risks. Dr. Lo stated that 

buy side firms are measuring liquidity and developing algorithms to trade around illiquidity 

pockets, and stated that liquidity is central to financial stability, which is a public good. Dr. 

Admati disagreed, stating that she found no connection between liquidity and financial stability. 

Further, financial stability is about the fragility of the system, and the ability of the system to 

provide credit to the economy along with appropriate services at appropriate prices. 

Ms. McLaughlin asked for suggestions for Commission action. Commissioner Wetjen noted that 

the CFTC has no control over accessibility as it relates to capital requirements, but based on the 

discussion the CFTC could focus on: (1) increased transparency; (2) accessibility to trading 

venues; (3) diversity of liquidity providers; ( 4) the floor trader exception, and ( 5) market 

structure changes for SEFs. Mr. Murray argued for longer implementation periods under DoddFrank. Mr. Chang commented that a coherent regulatory approach is needed across all markets 

because they are interconnected. Mr. Wipf suggested focusing on ways to increase new 

capacity, and also suggested that industry has not pushed enough on central clearing of SFTs. 

IV. Closing Remarks 

Commissioner Bowen concluded by thanking everyone for their attendance. Thereafter, Ms. 

Walker adjourned the meeting at 1 :34 p.m. 

I hereby certify that the foregoing minutes are accurate: 

Petal Walker 

Acting Chair, Market Risk Advisory Committee 

J 


Date 

7