UNITED STATES OF AMERICA 

Before the 

COMMODITY FUTURES TRADING COMMISSION 

In the Matter of: 

CX Futures Exchange, L.P., 

Respondent.

) 

) 

)

) 

) 

)

)

) 

CFTC Docket No. 22-51

ORDER INSTITUTING PROCEEDINGS PURSUANT TO 

SECTION 6b OF THE COMMODITY EXCHANGE ACT, MAKING FINDINGS, AND 

IMPOSING REMEDIAL SANCTIONS

I. INTRODUCTION

The Commodity Futures Trading Commission (“Commission”) has reason to believe that 

between in or about November 2017 and at least August 2022 (“Reporting Relevant Period”), 

CX Futures Exchange, L.P., a/k/a FMX Futures Exchange, L.P. (“CX or “Respondent”) violated 

Sections 2(a)(13)(G) and 6(c)(2) of the Commodity Exchange Act (“Act”), 7 U.S.C. §§ 

2(a)(13)(G), 9(2), and Commission Regulations (“Regulations”) 43.3(a)(1), 43.3(a)(2), and 

45.3(a), 17 C.F.R. §§ 43.3(a)(1), 43.3(a)(2), 45.3(a) (2020) (amended 2021),1 as well as 

Regulation 16.02, 17 C.F.R. § 16.02 (2021). The Commission further has reason to believe that 

between in or about September 2017 and August 2021 (“System Safeguards Relevant Period”), 

CX violated Section 5(d)(20) of the Act, 7 U.S.C. § 7(d)(20), and Regulations 38.1050, 

38.1051(f), 38.1051(h)(3), 38.1051(h)(4), 38.1051(h)(5), 38.1051(h)(7), 38.1051(k), and 

38.1051(l), 17 C.F.R. §§ 38.1050, 38.1051(f), 38.1051(h)(3), 38.1051(h)(4), 38.1051(h)(5), 

38.1051(h)(7), 38.1051(k), 38.1051(l) (2021). Therefore, the Commission deems it appropriate 

and in the public interest that public administrative proceedings be, and hereby are, instituted to 

determine whether Respondent engaged in the violations set forth herein and to determine 

whether any order should be issued imposing remedial sanctions. 

In anticipation of the institution of an administrative proceeding, Respondent has 

submitted an Offer of Settlement (“Offer”), which the Commission has determined to accept. 

Without admitting or denying any of the findings or conclusions herein, Respondent consents to 

the entry of this Order Instituting Proceedings Pursuant to Section 6b of the Commodity 

1

 The Commission amended Parts 43, 45, and 49 on November 25, 2020, with the new regulations becoming 

effective on January 25, 2021. Certain Swap Data Repository and Data Reporting Requirements, 85 FR 75601 (Nov. 

25, 2020). The amendments did not affect the substantive requirements at issue in this order. 
2 

Exchange Act, Making Findings, and Imposing Remedial Sanctions (“Order”), and 

acknowledges service of this Order.2

II. FINDINGS 

The Commission finds the following: 

A. SUMMARY 

CX is a designated contract market (“DCM”). As a DCM, CX must comply with DCM 

Core Principle 20, which imposes, among other things, requirements relating to the reliability, 

security, and adequate scalable capacity of operations and automated systems. See 17 C.F.R. § 

38.1050 (2021); see also 7 U.S.C. § 5(d)(2). Regulation 38.1051 imposes additional 

requirements relating to DCM Core Principle 20, including requirements for specific forms of 

testing and analysis of IT systems. 

The Commission’s system safeguards rules are critical to ensuring the security of the 

financial markets. Cyberattacks against financial institutions are becoming more frequent, more 

sophisticated, and more widespread. System Safeguards Testing Requirements, 80 Fed. Reg. 

80140 (Dec. 23, 2015). The financial system, moreover, is increasingly connected, and a threat 

to one entity may often pose threats to others. Id. at 80141. Cybersecurity testing can harden 

cyber defenses, mitigate operations, reputation, and financial risk, and maintain cyber resilience 

and the ability to recover from cyberattacks. Id. 

During the System Safeguards Relevant Period, CX failed to comply with multiple 

aspects of Regulations 38.1050 and 38.1051, which require DCMs to establish and maintain a 

program of risk analysis and oversight to identify and minimize sources of operational risk. 

Among other things, CX failed to develop comprehensive enterprise technology risk assessments 

(“ETRA”), failed to conduct adequate information security testing, and failed to review such 

ETRAs and testing at the board level, in violation of these Regulations. 

As a DCM, CX is also required to comply with certain reporting requirements relating to 

its options and swaps transactions set forth in Parts 16, 43, and 45 of the Regulations, 17 C.F.R. 

pts. 16, 43, 45 (2021). From in or around November 2017 to at least June 2020, CX failed to 

report certain data for over two hundred thousand options transactions to the Commission in 

violation of Regulation 16.02. And, from in or around November 2017 to at least August 2022, 

CX failed to report certain data for the same transactions, which were also considered swaps 

transactions under the Commission’s Regulations, to a swaps data repository (“SDR”) in 

 

2

 Respondent consents to the use of the findings of fact and conclusions of law in this Order in this proceeding and 

in any other proceeding brought by the Commission or to which the Commission is a party or claimant, and agrees 

that they shall be taken as true and correct and be given preclusive effect therein, without further proof. Respondent

does not consent, however, to the use of this Order, or the findings or conclusions herein, as the sole basis for any 

other proceeding brought by the Commission or to which the Commission is a party or claimant, other than: a 

proceeding in bankruptcy or receivership; or a proceeding to enforce the terms of this Order. Respondent does not 

consent to the use of the Offer or this Order, or the findings or conclusions in this Order, by any other party in any 

other proceeding.
3 

violation of Section 2(a)(13)(G) of the Act, 7 U.S.C. § 2(a)(13)(G), and Regulations 43.3(a)(1), 

43.3(a)(2), and 45.3(a), 17 C.F.R. §§ 43.3(a)(1), 43.3(a)(2), 45.3(a) (2020). 

Relatedly, in connection with a 2017 request for a no-action letter regarding its SDR 

reporting obligations, CX falsely represented to Commission staff that it was reporting data to 

the Commission pursuant to Regulation 16.02 and would continue to do so, when in fact CX 

should have known that it was not reporting such data at the time of its request and did not report 

Regulation 16.02 data to the Commission during much of the Reporting Relevant Period. CX’s 

false statement violated Section 6(c)(2) of the Act, 7 U.S.C. § 9(2). 

In accepting Respondent’s Offer, the Commission recognizes the substantial cooperation 

of CX with the Division of Enforcement’s investigation of this matter. The Commission also 

acknowledges Respondent’s representations concerning its remediation in connection with this 

matter. The Commission’s recognition of Respondent’s substantial cooperation and appropriate 

remediation is further reflected in the form of a reduced penalty. 

B. RESPONDENT 

CX Futures Exchange, L.P. is a Delaware corporation headquartered in New York, 

New York. CX was designated as a contract market in 2010 under the name Cantor Futures 

Exchange, L.P. and changed its name to CX Futures Exchange, L.P. in 2018. In or around April 

2022, CX changed its name to FMX Futures Exchange, L.P. (“FMX Futures Exchange”). CX 

was a DCM at all times during the Relevant Periods. During the Relevant Periods, CX primarily 

listed options and swap contracts relating to weather events, including precipitation, storms, and 

temperature. 

C. FACTS 

1. CX’s Failure to Comply with System Safeguards Requirements 

During the System Safeguards Relevant Period, CX failed to comply with multiple 

aspects of the system safeguards requirements contained in Regulations 38.1050 and 38.1051, 

including by (1) failing to conduct controls testing, (2) failing to conduct sufficient internal and 

external penetration testing, (3) failing to conduct adequate enterprise technology risk 

assessments (“ETRA”), (4) failing to review ETRAs and testing results at the board level, and 

(5) failing to provide timely advanced notice to the Commission of a planned change to 

automated systems that may impact the security of such systems. 

During the System Safeguards Relevant Period, CX contracted with an administrative 

services provider (“Administrative Services Provider”) to administer CX’s IT systems. Between 

2017 and 2020, neither CX nor its Administrative Services Provider maintained a library of the 

automated systems and controls that were part of CX’s program of risk analysis and oversight. 

Furthermore, neither CX nor its Administrative Services Provider conducted an analysis to 

determine the appropriate scope or frequency of controls testing necessary to identify risks and 

vulnerabilities in CX’s systems. Although CX and/or its Administrative Services Provider 

conducted certain system testing during the System Safeguards Relevant Period—including 

certain internal and external penetration testing, vulnerability scans, and testing of its business 
4 

continuity-disaster recovery capabilities—they did not otherwise conduct controls testing to 

ensure that CX’s controls were implemented correctly, operating as intended, and enabling CX 

to meet the requirements of Regulation 38.1051. 

CX also failed to conduct internal or external penetration testing in 2020. The policies of 

the Administrative Services Provider, which performed penetration testing of CX’s systems 

during the System Safeguards Relevant Period, required that internal and external penetration 

testing be conducted (i) on an annual basis, or (ii) when significant changes were made to its IT 

systems. CX migrated its systems to a cloud-based platform between September 2019 and April 

2020—a significant and material change that had the potential to impact the reliability, security, 

or adequate scalable capacity of CX’s systems. However, neither CX nor its Administrative 

Services Provider conducted internal or external penetration testing in connection with this 

significant change to CX’s IT systems between June 2019 and May 2021. CX, moreover, did 

not inform Commission staff of this material change until after it had occurred. 

CX likewise failed to prepare adequate ETRAs between 2017 and 2020. During that 

time, the Administrative Services Provider prepared ETRAs on an enterprise-wide basis for each 

registered entity for which the Administrative Services Provider was providing IT-related 

services, including CX. These enterprise-wide ETRAs, however, were not sufficient to analyze 

CX’s threats and vulnerabilities. For example, the Administrative Services Provider’s 2020 

ETRA identified only three risks applicable to CX and did not analyze any CX-specific risks. 

Finally, between 2017 and 2020, CX’s board of directors did not receive or review any 

ETRA and did not receive or review the results of any IT systems testing conducted pursuant to 

Regulation 38.1051. 

2. CX’s False Statement to the Commission 

In May 2017, CX submitted a request for a no-action letter (“Request”) to the 

Commission’s Division of Market Oversight (“DMO”). Among other things, the Request asked 

that DMO not recommend that the Commission take enforcement action against CX if the DCM 

ceased the reporting of certain transactions to an SDR under Parts 43 and 45 of the Regulations, 

as CX had been doing since commencing trading in 2013. CX represented in its Request that it 

listed “binary options,” which it stated were “characterized at expiration by the payment of an 

absolute amount to the holder of one side of the option and no payment to the counterparty, 

depending upon the value of the underlying commodity at contract expiration compared to the 

strike price or strike value of the option.” CX further stated that “[t]he settlement obligation [of 

a binary option] does not vary based upon the amplitude by which the price at expiration exceeds 

the strike or strike price.” CX also represented that it “provides transactional information to the 

Division under Commission Rule 16.02” in connection with its binary options and was obligated 

to continue to make such reports, thereby implying that it would continue to make such reports 

going forward. 

Commission staff granted the Request in a no-action letter dated June 30, 2017 (“NoAction Letter”). In granting the Request, Commission staff relied on certain representations 

made by CX in its Request, including that CX provides transactional information to DMO 

pursuant to Regulation 16.02. The No-Action Letter was subject to certain express conditions, 
5 

including that “CX continue[] to provide DMO with transactional information as described in 

Commission Regulation 16.02.” Further, the No-Action Letter applied only to “CX Binary 

Options,” defined as “binary options traded on or pursuant to CX’s rules and cleared by [a 

specified derivatives clearing organization].” Quoting the Request, the No-Action Letter further 

defined a “CX Binary Option” as follows: 

CX describes its binary options . . . as generally characterized at expiration by “the 

payment of an absolute amount to the holder of one side of the option and no 

payment to the counterparty, depending upon the value of the underlying 

commodity at contract expiration compared to the strike price or strike value of the 

option.” Furthermore, CX stated that “[t]he settlement obligation does not vary 

based upon the amplitude by which the price at expiration exceeds the strike or 

strike price.” 

Contrary to CX’s representation, CX was not reporting Regulation 16.02 data to the 

Commission when it made its Request. At the time CX submitted its Request in 2017, CX 

provided Regulation 16.02 data to its regulatory services provider (“Regulatory Services 

Provider”). However, the contract between CX and the Regulatory Service Provider, executed in 

2013, did not require that the Regulatory Service Provider report Regulation 16.02 data to the 

Commission on behalf of CX, and the Regulatory Service Provider was not reporting this 

information to the Commission. CX also was not reporting this information to the Commission 

on its own. Moreover, the Regulatory Service Provider informed CX in 2014 that it was not 

reporting Regulation 16.02 data to the Commission, and CX should have known that such data 

was not being reported. 

By representing that it was reporting transaction data to the Commission pursuant to 

Regulation 16.02, when in fact it was not, and implying that it would continue to report such data 

going forward, CX made statements of material fact that it reasonably should have known were 

false and misleading. 

3. CX’s Failure to Report Options Transactions to the Commission 

Beginning at least as early as 2017, and continuing through at least June 2020, CX failed 

to report over two hundred thousand CX Binary Options and CX Pari-Mutuel Contracts (defined 

below) pursuant to Regulation 16.02. 

As a DCM, Respondent is required to report certain data about options transactions to the 

Commission pursuant to Regulation 16.02. The CX Binary Options were cash-settled options 

subject to the reporting requirements of Regulation 16.02. As described above, CX failed to 

report the CX Binary Options under Regulation 16.02, either on its own or through its 

Regulatory Services Provider. In addition, in or around 2019, CX self-certified with the 

Commission and began listing a new type of weather contract that it called “pari-mutuel” 

contracts (“CX Pari-Mutuel Contracts”). Pari-mutuel means, in essence, that orders of a 

particular type are grouped into a pool, and a trader’s return is based on (among other things) the 

size of the pool and the number of contracts held by the trader in the pool. Like the CX Binary 
6 

Options, the CX Pari-Mutuel Contracts were cash-settled options subject to the reporting 

requirements of Regulation 16.02. 

4. CX’s Failure to Report Swaps Transactions to an SDR 

Between November 2017 and at least August 2022, CX failed to report over two hundred 

thousand transactions to an SDR as required under Parts 43 and 45. 

As a DCM, Respondent is required to report certain data about swap transactions to an 

SDR pursuant to Parts 43 and 45 of the Regulations. The CX Binary Options and CX PariMutuel Contracts met the Act’s definition of “swap,” 7 U.S.C. § 1a(47), and were therefore 

subject to the swap reporting requirements of Parts 43 and 45 of the Regulations. Beginning in 

2013, CX reported swaps transactions to an SDR as required by Parts 43 and 45. In November 

2017, relying on the No-Action Letter, CX stopped reporting CX Binary Option transactions 

pursuant to Parts 43 and 45. However, the No-Action Letter was contingent on CX reporting 

transaction data pursuant to Regulation 16.02. CX did not meet this condition because it failed 

to report transaction data pursuant to Regulation 16.02. CX therefore was not entitled to rely on 

the No-Action Letter in connection with its obligation to report CX Binary Options under Parts 

43 and 45. Although CX is now taking steps to resume Parts 43 and 45 reporting, it has not 

resumed such reporting as of the date of this Order. 

CX also was not entitled to rely on the No-Action Letter in connection with the CX PariMutuel Contracts. The No-Action Letter was limited to CX Binary Options, and the CX PariMutuel Contracts did not meet the definition of a CX Binary Option. There are important 

differences between the CX Pari-Mutuel Contracts and CX Binary Options. Whereas CX stated 

in its Request that the CX Binary Options pay an “absolute amount” to the holder of an in-themoney option, the payout on a CX Pari-Mutuel contract was not “absolute,” but instead varied 

based on the size of the distribution pool and the number of in-the-money position holders. 

Similarly, whereas CX described the CX Binary Options in the Request as yielding “no 

payment” for an out-of-the-money option, the CX Pari-Mutuel Contracts did pay small amounts 

to out-of-the-money position holders. And, whereas CX stated in the Request that the 

“settlement obligation [for CX Binary Options] does not vary based upon the amplitude by 

which the price at expiration exceeds the strike or strike price,” the CX Pari-Mutuel contracts 

operated differently, as payout varied based on the distance between the index level and the 

strike level. 

CX also was not entitled to rely on the No-Action Letter in connection with the CX PariMutuel Contracts because it failed to report Regulation 16.02 data in connection with them and 

therefore did not meet the conditions of the No-Action Letter. 

III. LEGAL DISCUSSION 

A. CX’s Failure to Maintain an Adequate Program of Risk Analysis and Oversight in 

Violation of Section 5(d)(20) of the Act and Regulation 38.1050 

Section 5(d)(20) of the Act, 7 U.S.C. § 7(d)(20), provides that a board of trade (i.e., an 

organized exchange or other trading facility, such as a DCM, 7 U.S.C. §§ 1a(6), (37), (51)) shall: 
7 

(A) establish and maintain a program of risk analysis and oversight to identify and 

minimize sources of operational risk, through the development of appropriate 

controls and procedures, and the development of automated systems, that are 

reliable, secure, and have adequate scalable capacity; 

(B) establish and maintain emergency procedures, backup facilities, and a plan for 

disaster recovery that allow for the timely recovery and resumption of operations 

and the fulfillment of the responsibilities and obligations of the board of trade; and 

(C) periodically conduct tests to verify that backup resources are sufficient to 

ensure continued order processing and trade matching, price reporting, market 

surveillance, and maintenance of a comprehensive and accurate audit trail. 

As a condition to registration, DCMs must comply with Regulation 38.1050, which 

contains identical requirements. 17 C.F.R. § 38.1050 (2021). 

As set forth above, Respondent failed to establish and maintain an adequate program of 

risk analysis and oversight to identify and minimize sources of operational risk. By this conduct, 

CX violated Section 5(d)(20) of the Act and Regulation 38.1050. 

B. CX’s Failure to Conduct Controls Testing in Violation of Regulation 38.1051(h)(5) 

and (k) 

Regulation 38.1051(h)(5) provides that “[a] designated contract market shall 

conduct controls testing of a scope sufficient to satisfy the requirements set forth in paragraph 

(k) of this section.” 17 C.F.R. § 38.1051(h)(5) (2021). Paragraph (k) provides, in turn: 

The scope for all system safeguards testing and assessment required by this part 

shall be broad enough to include the testing of automated systems and controls that 

the designated contract market’s required program of risk analysis and oversight 

and its current cybersecurity threat analysis indicate is necessary to identify risks 

and vulnerabilities that could enable an intruder or unauthorized user or insider to: 

(1) Interfere with the designated contract market’s operations or with fulfillment of 

its statutory and regulatory responsibilities; (2) Impair or degrade the reliability, 

security, or adequate scalable capacity of the designated contract market’s 

automated systems; (3) Add to, delete, modify, exfiltrate, or compromise the 

integrity of any data related to the designated contract market's regulated activities; 

or (4) Undertake any other unauthorized action affecting the designated contract 

market’s regulated activities or the hardware or software used in connection with 

those activities. 

17 C.F.R. § 38.1051(k) (2021). Paragraph (h)(5)(i) further provides: 

A designated contract market shall conduct controls testing, which includes testing 

of each control included in its program of risk analysis and oversight, at a frequency 
8 

determined by an appropriate risk analysis. Such testing may be conducted on a 

rolling basis. 

17 C.F.R. § 38.1051(h)(5)(i). 

 As set forth above, Respondent failed to conduct controls testing between 2017 and 2020. 

By this conduct, CX violated Regulations 38.1051(h)(5) and (k). 

C. CX’s Failure to Conduct Sufficient Internal and External Penetration Testing in 

Violation of Regulation 38.1051(h)(3), (h)(4), and (k) 

“External penetration testing” means “attempts to penetrate the designated contract 

market’s automated systems from outside the systems’ boundaries to identify and exploit 

vulnerabilities.” 17 C.F.R. § 38.1051(h)(1) (2021). Regulation 38.1051(h)(3) provides that “[a] 

designated contract market shall conduct external penetration testing of a scope sufficient to 

satisfy the requirements set forth in paragraph (k) of this section.” 17 C.F.R. § 38.1051(h)(3) 

(2021). Furthermore, “[a] designated contract market shall conduct such external penetration 

testing at a frequency determined by an appropriate risk analysis.” Id. § 38.1051(h)(3)(i). 

“Internal penetration testing” means attempts to penetrate the designated contract 

market’s automated systems from inside the systems’ boundaries, to identify and exploit 

vulnerabilities.” 17 C.F.R. § 38.1051(h)(1). Regulation 38.1051(h)(4) provides that “[a] 

designated contract market shall conduct internal penetration testing of a scope sufficient to 

satisfy the requirements set forth in paragraph (k) of this section.” 17 C.F.R. § 38.1051(h)(4) 

(2021). Furthermore, “[a] designated contract market shall conduct such internal penetration 

testing at a frequency determined by an appropriate risk analysis.” Id. § 38.1051(h)(4)(i). 

As set forth above, Respondent failed to conduct internal and external penetration testing 

between June 2019 and May 2021 and failed to conduct such testing in connection with a 

material change to CX’s IT systems. By this conduct, CX violated Regulations 38.1051(h)(3), 

(h)(4), and (k). 

D. CX’s Failure to Conduct Adequate Enterprise Technology Risk Assessments in 

Violation of Regulation 38.1051(h)(7) and (k) 

An “enterprise technology risk assessment” is “a written assessment that includes, but is 

not limited to, an analysis of threats and vulnerabilities in the context of mitigating controls.” 

17 C.F.R. § 38.1051(h)(1). An ETRA “identifies, estimates, and prioritizes risks to designated 

contract market operations or assets, or to market participants, individuals, or other entities, 

resulting from impairment of the confidentiality, integrity, and availability of data and 

information or the reliability, security, or capacity of automated systems.” Id. Regulation 

38.1051(h)(7) provides that “[a] designated contract market shall conduct enterprise technology 

risk assessment of a scope sufficient to satisfy the requirements set forth in paragraph (k) of this 

section.” 17 C.F.R. § 38.1051(h)(7) (2021). Furthermore, “[a] designated contract market shall 
9 

conduct an enterprise technology risk assessment at a frequency determined by an appropriate 

risk analysis.” 17 C.F.R. § 38.1051(h)(7)(i). 

As set forth above, CX failed to conduct an ETRA between 2017 and 2020 that met the 

requirements of these provisions. By this conduct, CX violated Regulations 38.1051(h)(7) and 

(k). 

E. The CX Board’s Failure to Receive or Review Enterprise Technology Risk 

Assessments and Results of Testing in Violation of Regulation 38.1051(l) 

Regulation 38.1051(l) provides that “the Board of Directors of a designated contract 

market shall receive and review reports setting forth the results of the testing and assessment 

required by this section.” 17 C.F.R. 1051(l) (2021). As set forth above, CX’s board of directors 

failed to receive or review ETRAs or the results of testing pursuant to Regulation 38.1051. By 

this conduct, CX violated Regulation 38.1051(l). 

F. CX’s Failure to Provide Timely Advance Notice of a Material Planned Change to Its 

Automated Systems in Violation of Section 38.1051(f) 

Regulation 38.1051(f) provides that “[a] designated contract market must give 

Commission staff timely advance notice of all material . . . [p]lanned changes to automated 

systems that may impact the reliability, security, or adequate scalable capacity of such 

systems . . . .” 17 C.F.R. § 38.1051(f) (2021). As set forth above, CX failed to provide timely 

advance notice to Commission staff regarding a material planned change to its automated 

systems. By this conduct, CX violated Regulation 38.1051(f). 

G. CX’s Failure to Report Options Transactions to the Commission in Violation of 

Regulation 16.02 

Regulation 16.02 requires that DCMs “provide trade and supporting data reports to 

the Commission on a daily basis,” including “transaction-level trade data and related order 

information for each futures or options contract.” 17 C.F.R. § 16.02 (2021). The accuracy and 

completeness of these reports and data “are critical to the Commission’s mission to protect 

market participants and promote market integrity.” In re ICE Futures U.S., Inc., No. 15-17, 

2015 WL 1276463 (Mar. 16, 2015). The effectiveness of the Commission’s market and financial 

surveillance programs, as well as other Commission work, hinge upon correct and thorough 

reporting data. Without accurate and complete data, the Commission’s ability to detect and 

prevent market disruptions, to enforce speculative position limits, and to measure the financial 
10 

risks that large contract positions may pose to Commission registrants and clearing organizations 

is compromised. 

As set forth above, Respondent failed to report over two hundred thousand options 

transactions to the Commission between November 2017 and June 2020. By this conduct, CX 

violated Regulation 16.02. 

H. CX’s Failure to Report Swaps Transactions to an SDR in Violation of Section 

2(a)(13)(G) of the Act and Regulations 43.3(a)(1), 43.3(a)(2), and 45.3(a) 

All swaps, both cleared and uncleared, are required to be reported to a registered SDR, 

and the Act establishes requirements for real-time reporting and public availability of swap 

transaction data. See Sections 2(a)(13)(F) and (G) of the Act, 7 U.S.C. §§ 2(a)(13)(F), (G). 

Pursuant to these requirements, the Commission adopted regulations implementing swaps data 

reporting requirements, which apply to CX in its capacity as a DCM. See, e.g., Parts 43 and 45 

of the Regulations, 17 C.F.R pts. 43, 45 (2020). Regulations 43.3 and 45.3, 17 C.F.R. 

§§ 43.3, 45.3 (2020), require reporting of reportable swap transactions to a registered SDR. 

Specifically, Regulation 43.3(a)(1) states that a DCM “shall report the publicly reportable 

swap transaction to a swap data repository as soon as technologically practicable after 

execution . . . .” 17 C.F.R. § 43.3(a)(1). Similarly, Regulation 43.3(a)(2) states that “[f]or 

each swap executed on or pursuant to the rules of a . . . designated contract market, the . . . 

designated contract market shall report swap transaction and pricing data to a swap data 

repository as soon as technologically practicable after execution.” 17 C.F.R. § 43.3(a)(2). 

Regulation 45.3(a) states that “[f]or each swap executed on or pursuant to the rules of a . . . 

designated contract market, the . . . designated contract market shall report required swap 

creation data electronically to a swap data repository in the manner provided in § 45.13(a) not 

later than the end of the next business day following the execution date.” 17 C.F.R. § 45.3(a). 

These swap data reporting provisions were designed to enhance transparency, promote 

standardization, and reduce systemic risk. The accuracy and completeness of swap reporting are 

critical to the Commission’s mission to protect market participants and to ensure market 

integrity. See, e.g., In re BNP Paribas, CFTC No. 22-9, 2022 WL 2734273 (July 5, 2022) 

(consent order); In re NatWest Markets Plc, CFTC No. 18-32, 2018 WL 4502270 (Sept. 14, 

2018) (consent order); In re Citibank, NA., CFTC No. 17-26, 2017 WL 4280594 (Sept. 25, 

2017) (consent order). 

As set forth above, Respondent failed to report over two hundred thousand swap 

transactions to an SDR between November 2017 and at least August 2022. By this conduct, CX 

violated Section 2(a)(13)(G) of the Act and Regulations 43.3(a)(1), 43.3(a)(2), and 45.3(a). 

I. CX’s False Statement to the Commission in Violation of Section 6(c)(2) of the Act 

Section 6(c)(2) of the Act, 7 U.S.C. § 9(2), makes it unlawful for any person: 

[T]o make any false or misleading statement of a material fact to the Commission 

. . . or to omit to state in any such statement any material fact that is necessary to 

make any statement of a material fact made not misleading in any material respect, 
11 

if the person knew, or reasonably should have known, the statement to be false or 

misleading. 

 As set forth above, in connection with its Request for a No-Action Letter, Respondent 

falsely represented to Commission staff that it was reporting transaction data to the Commission 

for CX Binary Options pursuant to Regulation 16.02, when in fact it was not, and implied that it 

would continue to report such data going forward. CX reasonably should have known that its 

statements were false or misleading. These statements were material because it was important 

for DMO to know that the Commission would continue to have access to CX’s transaction data if 

CX’s Request for a No-Action Letter were granted, and DMO expressly relied on these 

statements in granting CX’s Request for a No-Action Letter. By this conduct, CX violated 

Section 6(c)(2) of the Act. 

IV. FINDINGS OF VIOLATIONS 

Based on the foregoing, the Commission finds that, during the Reporting Relevant Period 

and System Safeguards Relevant Period, as applicable, CX Futures Exchange, L.P. violated 

Sections 2(a)(13)(G), 5(d)(20), and 6(c)(2) of the Act, 7 U.S.C. §§ 2(a)(13)(G), 7(d)(20), 9(2), 

and Regulations 43.3(a)(1), 43.3(a)(2), and 45.3(a) (2020), as well as Regulations 16.02, 

38.1050, 38.1051(f), 38.1051(h)(3), 38.1051(h)(4), 38.1051(h)(5), 38.1051(h)(7), 38.1051(k), 

and 38.1051(l), 17 C.F.R. §§ 16.02, 43.3(a)(1), 43.3(a)(2), 45.3(a), 38.1050, 38.1051(f), 

38.1051(h)(3), 38.1051(h)(4), 38.1051(h)(5), 38.1051(h)(7), 38.1051(k), 38.1051(l) (2021). 

V. OFFER OF SETTLEMENT 

Respondent has submitted the Offer in which it, without admitting or denying the 

findings and conclusions herein: 

A. Acknowledges service of this Order; 

B. Admits the jurisdiction of the Commission with respect to all matters set forth in this 

Order and for any action or proceeding brought or authorized by the Commission based 

on violation of or enforcement of this Order; 

C. Waives: 

1. The filing and service of a complaint and notice of hearing; 

2. A hearing; 

3. All post-hearing procedures; 

4. Judicial review by any court; 

5. Any and all objections to the participation by any member of the Commission’s 

staff in the Commission’s consideration of the Offer; 
12 

6. Any and all claims that it may possess under the Equal Access to Justice Act, 5 

U.S.C. § 504, and 28 U.S.C. § 2412, and/or the rules promulgated by the 

Commission in conformity therewith, Part 148 of the Regulations, 17 C.F.R. 

pt. 148 (2021), relating to, or arising from, this proceeding; 

7. Any and all claims that it may possess under the Small Business Regulatory 

Enforcement Fairness Act of 1996, Pub. L. No. 104-121, tit. II, §§ 201–253, 110 

Stat. 847, 857–74 (codified as amended at 28 U.S.C. § 2412 and in scattered 

sections of 5 U.S.C. and 15 U.S.C.), relating to, or arising from, this proceeding; 

and 

8. Any claims of Double Jeopardy based on the institution of this proceeding or the 

entry in this proceeding of any order imposing a civil monetary penalty or any 

other relief, including this Order; 

D. Stipulates that the record basis on which this Order is entered shall consist solely of the 

findings contained in this Order to which Respondent has consented in the Offer; 

E. Consents, solely on the basis of the Offer, to the Commission’s entry of this Order that: 

1. Makes findings by the Commission that Respondent violated Sections 2(a)(13)(G), 

5(d)(20), and 6(c)(2) of the Act, 7 U.S.C. §§ 2(a)(13)(G), 7(d)(20), 9(2), and 

Regulations 43.3(a)(1), 43.3(a)(2), 45.3(a), 17 C.F.R. §§ 43.3(a)(1), 43.3(a)(2), 

45.3(a) (2020), as well as Regulations 16.02, 38.1050, 38.1051(f), 38.1051(h)(3), 

38.1051(h)(4), 38.1051(h)(5), 38.1051(h)(7), 38.1051(k), and 38.1051(l), 17 

C.F.R. §§ 16.02, 43.3(a)(1), 43.3(a)(2), 45.3(a), 38.1050, 38.1051(f), 

38.1051(h)(3), 38.1051(h)(4), 38.1051(h)(5), 38.1051(h)(7), 38.1051(k), 

38.1051(l) (2021); 

2. Orders Respondent to cease and desist from violating Sections 2(a)(13)(G), 

5(d)(20), and 6(c)(2) of the Act and Regulations 16.02, 43.3(a)(1), 43.3(a)(2), 

45.3(a), 38.1050, 38.1051(f), 38.1051(h)(3), 38.1051(h)(4), 38.1051(h)(5), 

38.1051(h)(7), 38.1051(k), and 38.1051(l); 

3. Orders Respondent to pay a civil monetary penalty in the amount of six million 

and five hundred thousand dollars ($6,500,000), plus any post-judgment interest 

within ten days of the date of entry of this Order; and 

4. Orders Respondent and its successors and assigns, including but not limited to 

FMX Futures Exchange, to comply with the conditions and undertakings 

consented to in the Offer and as set forth in Part VI of this Order; 

F. Represents that it has already taken steps to remediate the above-referenced violations, 

including, but not limited to, the following: 

1. Back-reporting transaction data pursuant to Regulation 16.02 for all of the 

transactions that are the subject of this Order; 
13 

2. Implementing new processes designed to confirm that Part 16 data is reported to 

the Commission each trading day; 

3. Adding an addendum to its compliance manual setting forth policies and 

procedures designed to ensure compliance with Regulation 38.1051; 

4. Establishing an IT controls library and implementing policies and procedures 

requiring regular controls testing; 

5. Conducting internal and external penetration testing and controls testing; 

6. Conducting an enterprise technology risk assessment; 

7. Revising its administrative services agreement with the Administrative Services 

Provider to clearly set forth responsibilities for system safeguards-related 

services; 

8. Updating its compliance manual to require regular meetings between CX and the 

Administrative Services Provider; and 

9. Implementing policies requiring semi-annual meetings between CX’s IT and 

Compliance personnel to assess compliance with Regulation 38.1051. 

Upon consideration, the Commission has determined to accept the Offer. 

VI. ORDER 

Accordingly, IT IS HEREBY ORDERED THAT: 

A. Respondent and its successors and assigns, including but not limited to FMX Futures 

Exchange, shall cease and desist from violating Sections 2(a)(13)(G), 5(d)(20), and 

6(c)(2) of the Act, 7 U.S.C. §§ 2(a)(13)(G), 7(d)(20), 9(2), and Regulations 43.3(a)(1), 

43.3(a)(2), 45.3(a), 17 C.F.R. §§ 43.3(a)(1), 43.3(a)(2), 45.3(a) (2020), as well as 

Regulations 16.02, 38.1050, 38.1051(f), 38.1051(h)(3), 38.1051(h)(4), 38.1051(h)(5), 

38.1051(h)(7), 38.1051(k), and 38.1051(l), 17 C.F.R. §§ 16.02, 43.3(a)(1), 43.3(a)(2), 

45.3(a), 38.1050, 38.1051(f), 38.1051(h)(3), 38.1051(h)(4), 38.1051(h)(5), 38.1051(h)(7), 

38.1051(k), 38.1051(l) (2021). 

B. Respondent shall pay a civil monetary penalty in the amount of six million and five 

hundred thousand dollars ($6,500,000) (“CMP Obligation”), within ten days of the date 

of the entry of this Order. If the CMP Obligation is not paid in full within ten days of the 

date of entry of this Order, then post-judgment interest shall accrue on the unpaid portion 

of the CMP Obligation beginning on the date of entry of this Order and shall be 

determined by using the Treasury Bill rate prevailing on the date of entry of this Order 

pursuant to 28 U.S.C. § 1961. 

Respondent shall pay the CMP Obligation and any post-judgment interest by electronic 

funds transfer, U.S. postal money order, certified check, bank cashier’s check, or bank 
14 

money order. If payment is to be made other than by electronic funds transfer, then the 

payment shall be made payable to the Commodity Futures Trading Commission and sent 

to the address below:

MMAC/ESC/AMK326 

Commodity Futures Trading Commission 

6500 S. MacArthur Blvd. 

HQ Room 266 

Oklahoma City, OK 73169 

9-amz-ar-cftc@faa.gov 

 If payment is to be made by electronic funds transfer, Respondent shall contact Tonia 

King or her successor at the above email address to receive payment instructions and 

shall fully comply with those instructions. Respondent shall accompany payment of the 

CMP Obligation with a cover letter that identifies the paying Respondent and the name 

and docket number of this proceeding. The paying Respondent shall simultaneously 

transmit copies of the cover letter and the form of payment to (1) the Chief Financial 

Officer, Commodity Futures Trading Commission, Three Lafayette Centre, 1155 21st 

Street, NW, Washington, D.C. 20581, and (2) the Deputy Director, Commodity Futures 

Trading Commission, Eastern Regional Office, 290 Broadway, New York, New York 

10007. 

C. Respondent and its successors and assigns, including but not limited to FMX Futures 

Exchange, shall comply with the following conditions and undertakings set forth in the 

Offer: 

1. Public Statements: Respondent agrees that neither it nor any of its successors and 

assigns, agents or employees under its authority or control shall take any action or 

make any public statement denying, directly or indirectly, any findings or 

conclusions in this Order or creating, or tending to create, the impression that this 

Order is without a factual basis; provided, however, that nothing in this provision 

shall affect Respondent’s: (i) testimonial obligations; or (ii) right to take legal 

positions in other proceedings to which the Commission is not a party. 

Respondent and its successors and assigns, including but not limited to FMX 

Futures Exchange, shall comply with this agreement, and shall undertake all steps 

necessary to ensure that all of its agents and/or employees under its authority or 

control understand and comply with this agreement. 

2. Cooperation, in General: Respondent shall cooperate fully and expeditiously with 

the Commission, including the Commission’s Division of Enforcement, in this 

action, and in any current or future Commission investigation or action related 

thereto. Respondent shall also cooperate in any investigation, civil litigation, or 

administrative matter related to, or arising from, the subject matter of this action. 

3. Partial Satisfaction: Respondent understands and agrees that any acceptance by 

the Commission of any partial payment of Respondent’s CMP Obligation shall 

not be deemed a waiver of its obligation to make further payments pursuant to this 
Order, or a waiver of the Commission's right to seek to compel payment of any 

remaining balance. 

4. Change of Address/Phone: Until such time as Respondent satisfies in full its 

CMP Obligation as set forth in this Order, Respondent shall provide written 

notice to the Commission by certified mail of any change to its telephone number 

and mailing address within ten calendar days of the change. 

5. Until such time as Respondent satisfies in full its CMP Obligation, upon the 

commencement by or against Respondent of insolvency, receivership or 

bankruptcy proceedings or any other proceedings for the settlement of 

Respondent's debts, all notices to creditors required to be furnished to the 

Commission under Title 11 of the United States Code or other applicable law with 

respect to such insolvency, receivership bankruptcy or other proceedings, shall be 

sent to the address below: 

Secretary of the Commission 

Office of the General Counsel 

Commodity Futures Trading Commission 

Three Lafayette Centre 

1155 21st Street N.W. 

Washington, DC 20581 

6. Remediation 

a. Respondent will continue to implement and improve its internal controls and 

procedures in a manner designed to ensure the accuracy and integrity of its 

swaps and options reporting and its compliance with Regulations 38.1050 and 

38.1051. 

b. Within 180 days of the entry of this Order, Respondent shall provide swap 

data to an SDR with respect to transactions subject to SDR reporting executed 

after November 2017. For good cause show, Division staff may extend this 

deadline. 

The provisions of this Order shall be effective as of this date. 

By the Commission. 

~!--~-

Christopher J. Kirkpatrick 

Secretary of the Commission 

Commodity Futures Trading Commission 

Dated: September 29, 2022 

15