1 

 MINUTES OF THE JULY 18, 2023 MEETING OF THE 

U.S. COMMODITY FUTURES TRADING COMMISSION’S

TECHNOLOGY ADVISORY COMMITTEE

The Technology Advisory Committee (“TAC”) convened for a public meeting on 

Tuesday, July 18, 2023, at 12:00 p.m., at the U.S. Commodity Futures Trading Commission’s 

(“CFTC” or “Commission”) Headquarters Conference Center, located at Three Lafayette Centre, 

1155 21st Street, N.W., Washington, D.C. The meeting consisted of three panels. Panel I 

discussed the responsible use of artificial intelligence (“AI”) in regulated financial services. 

Panel II discussed regulatory issues in decentralized finance (“DeFi”) including decentralized 

autonomous organizations (“DAOs”). Panel III discussed cyber resilience for financial markets.

TAC Members in Attendance

Carole House, Chair, TAC and Executive in Residence, Terranet Ventures Inc.,

Ari Redbord, Vice Chair, TAC and Head of Legal and Government Affairs, TRM Labs 

Hilary Allen, Professor of Law, Associate Dean for Scholarship, American University, 

Washington College of Law (Special Government Employee) 

Nikos Andrikogiannopoulos, Founder and Chief Executive Officer, Metrika 

Dan Awrey, Professor of Law, Cornell Law School (Special Government Employee) 

Christian Catalini, Co-Founder and Chief Strategy Officer, Lightspark 

Todd Conklin, Deputy Assistant Secretary of the Treasury for Office of Cybersecurity and

Critical Infrastructure Protection, U.S. Department of the Treasury

Jonah Crane, Partner, Klaros Group 

Sunil Cutinho, Chief Information Officer, CME Group 

Cantrell Dumas, Director, Derivatives Policy, Better Markets, Inc.

Timothy Gallagher, Managing Director, Digital Investigations & Cyber Defense and Chief 

 Security Officer, Nardello & Co. 

Michael Greenwald, Global Lead, Digital Assets and Financial Innovation, Amazon Web 

Services

Dan Guido, Co-Founder & Chief Executive Officer, Trail of Bits

Jill Gunter, Chief Strategy Officer, Espresso Systems 

Stanley Guzik, Chief Technology and Innovation Officer, S&P Global Commodity Insights 

Ben Milne, Founder & Chief Executive Officer, Brale 

Joe Saluzzi, Co-Founder, Partner, and Co-Head of Equity Trading, Themis Trading, LLC 

Emin Gun Sirer, Founder and Chief Executive Officer, Ava Labs 

Justin Slaughter, Policy Director, Paradigm 

Todd Smith, Director of Centralized Data Science and Analytics, National Futures Association

Steve Suppan, Senior Policy Analyst, Institute for Agriculture and Trade Policy 

Corey Then, Vice President of Global Policy, Circle 

Nicol Turner Lee, Senior Fellow, Governance Studies; Director, Center for 

Technology Innovation, The Brookings Institution

Adam Zarazinski, Chief Executive Officer, Inca Digital

Jeffrey Zhang, Assessment Professor of Law, University of Michigan Law School (Special 

Government Employee) 
2 

CFTC Commissioners and Staff in Attendance 

Christy Goldsmith Romero, Commissioner and TAC Sponsor 

Kristin N. Johnson, Commissioner 

Summer K. Mersinger, Commissioner (recorded remarks)

Caroline D. Pham, Commissioner and GMAC Sponsor 

Anthony Biagioli, Special Counsel to the Director, Division of Enforcement, TAC Designated

Federal Officer (“DFO”)

Laura Bennett, Trial Attorney, Division of Enforcement, Alternate Designated Federal Officer 

(“ADFO”) 

Invited Speakers in Attendance 

Kevin Greenfield, Deputy Comptroller for Operational Risk Policy, Officer of the Comptroller of 

the Currency

Travis Hall, Acting Deputy Associate Administrator, National Telecommunications and

Information Administration

Steve Silberstein, Financial Services Information Sharing and Analysis Center 

I. Opening Remarks

Mr. Biagioli, the DFO for the GMAC, called the meeting to order. 

Commissioner Goldsmith Romero, the sponsor of the TAC, provided opening remarks. 

She welcomed everyone to the CFTC and expressed the importance of discussing AI, DeFi, and 

cybersecurity in the context of digital asset markets. She thanked the TAC leadership and staff 

for organizing the event and introduced the new subcommittee co-chairs. 

Commissioner Goldsmith Romero then emphasized the need for responsible AI and 

transparency in AI algorithms, and discussed potential risks and societal concerns. She 

acknowledged the CFTC’s mission to promote responsible innovation and its own use of AI. 

She also mentioned opportunities for the CFTC to benefit from AI in areas like surveillance and 

data analysis. She mentioned the presentations ahead on responsible AI, regulatory issues 

related to DeFi, and cybersecurity. She also highlighted the relevance of third-party service 

provider guidance and the importance of cyber resilience. She expressed gratitude to TAC 

members for sharing their expertise and encouraging a diverse discussion. The Commissioner 

then gave a brief overview of the presentations and concluded by encouraging diverse 

viewpoints to be expressed in the panels. 

Commissioner Johnson began her remarks by thanking Mr. Biagioli for his service and 

thanking the attendees for their participation. She highlighted the significance of the TAC’s 

agenda and its impact on future regulations and legislation. She discussed President Biden’s AI 

Bill of Rights and the need for a values-driven discourse on AI integration. She also emphasized 

the need to examine the promise and potential perils of AI technologies in the context of 

financial markets, including the need for guardrails and enforcement capabilities in the face of 

AI-driven trading. She also mentioned her involvement in a project with the Administrative 

Conference of the United Stated to examine the integration of AI in administrative agencies. 
3 

Commissioner Johnson concluded by expressing her excitement about the panels and thanking 

Commissioner Goldsmith Romero for having her at the event. 

 

Commissioner Mersinger opened her recorded speech by expressing gratitude to 

Commissioner Goldsmith for hosting the TAC meeting. She noted that AI, DeFi, and 

cybersecurity are real challenges faced by regulators and financial markets. She expressed 

excitement for the expert discussions ahead and thanked the CFTC staff for organizing the 

meetings.

Finally, Commissioner Pham joined virtually and expressed gratitude for the opportunity 

to speak at the TAC and thanked Commissioner Goldsmith Romero for her leadership of the 

TAC and thanked CFTC staff including Ms. Bennett and Mr. Biagioli. She commended the 

TAC members for exploring critical topics and congratulated the Division of Enforcement for its 

work on the Ooki DAO case. She also discussed the impact of technological advancements, 

including AI, on financial markets. She emphasized the role of risk professionals in 

safeguarding markets and discussed the importance of using existing risk governance 

frameworks and risk management practices to handle emerging risks and new technologies. 

Mr. Biagioli then turned things over to the TAC chair, Ms. House. Ms. House introduced 

the newly appointed co-chairs of the TAC subcommittees and thanked all the members of the 

subcommittees. Ms. House stated that she and Mr. Awrey will serve as co-chairs of the Digital 

Assets and Blockchain Technology Subcommittee. Mr. Gallagher and Mr. Guido will serve as 

co-chairs of the Subcommittee on Cybersecurity. Finally, Ms. Turner Lee and Mr. Smith will 

serve as co-chairs of the Subcommittee on Emerging and Evolving Technologies. The co-chairs 

then shared some brief introductory remarks. 

II. Panel I: Responsible Use of AI in Regulated Financial Services

Ms. House introduced the first panelist, Mr. Hall, who discussed AI system 

accountability measures and policies. Mr. Hall emphasized the importance of trustworthiness in 

the context of AI, including with respect to things like design, documentation, risk management, 

regulation, and enforcement. Mr. Hall noted ongoing challenges related to new AI models, 

particularly the “frontier models,” which add complexity to existing debates. 

Mr. Hall then discussed some of the key insights from requests for public comment on AI 

regulation by the National Telecommunications and Information Association (“NTIA”). Mr. 

Hall explained that these include: the consensus that broad, one-size-fits-all regulation doesn’t 

make sense for AI and that there should be a focus on specific AI application deployment and 

associated risk; the importance of considering the life cycle of AI development for auditing and 

accountability purposes; disagreement on mandatory audits; the importance of liability issues, 

particularly regarding access to proprietary information, trade secrets, and other sensitive data for 

auditing; and the need to look at existing auditing models, such as privacy impact assessments, 

system of records notices, and traditional financial auditing, as references, though not necessarily 

as direct replicas.
4 

Mr. Hall concluded by observing that NTIA’s comment summary is still a work in 

progress, but a draft report should be released by the end of the summer, and the final report 

published in the fall. 

Ms. Turner Lee then presented on responsible AI. She emphasized that the AI ecosystem 

is continually evolving, with generative AI chatbots being a relatively recent addition. She noted 

the concerns and potential perils associated with AI, as well as the significant efficiencies and 

opportunities. She then focused on the issue of bias in AI, stressing that discussions have moved 

beyond the initial design phase and now include the iterative deployment process. She 

highlighted the importance of diversity in the design process as well as the need for a variety of 

perspectives. 

Ms. Turner Lee then discussed the significance of training data and its potential biases, 

which scholars have referred to as “traumatized data.” She pointed out that such biases can be 

overrepresented or underrepresented in publicly available data sources, which underscores the 

importance of addressing these issues in AI development. She also emphasized that the 

inclusiveness of AI models is determined by who is involved in their development and the 

interpretation of their results. 

She highlighted the need for a sociotechnical approach to achieve responsible AI, noting 

the importance of considering both technological and societal factors in regulating and 

developing AI systems. She suggested exploring sector-specific standards, the role of regulation 

versus voluntary commitments, the impact of civil rights, and consumer and industry disclosures 

for more responsible AI. 

Ms. House then opened the floor to questions and comments from the TAC membership. 

Generally, the concerns and discussions raised in this session included: examples of bias coming 

out of AI; whether there should be a new government agency to deal with these issues; AI 

technologies being used to empower women, people of color, and entrepreneurs; how AI models 

can be evaluated to determine if enough data has been used to be reliable; watermarking and 

disinformation; use of data gathered through AI technologies, including privacy and competition 

concerns; how AI models train on data gaps; and the benefits of multi-stakeholder input on AI 

issues.

Mr. Guido then discussed the impact of AI on cybersecurity. He mentioned that AI can 

be used for decompiling code into high-level languages and identifying software security 

vulnerabilities in browsers. AI can accelerate the capabilities of mid-level cybersecurity 

engineers, particularly in tasks requiring breadth where mistakes are acceptable. He gave 

examples of AI applications, such as automating code documentation and crafting highly 

targeted phishing emails. He acknowledged that AI has limitations and cannot replace tasks 

requiring mastery or perfection. He pointed out the risks posed by AI in bug bounties, phishing 

training, signature-based defenses, and threat actor attribution. He suggested that these areas are 

at risk of becoming obsolete due to AI’s capabilities. He emphasized that AI cannot be regulated 

or restricted to prevent negative outcomes. He stressed the need for systematic measurements 

and benchmarks for evaluating AI’s capabilities in cybersecurity. In closing, Mr. Guido said he 

views AI as a transformative force in cybersecurity, changing the cost model for attackers and 
5 

defenders. He advocated for experimentation and the development of defensive technologies 

that leverage AI.

Following the presentation, the floor was opened to questions and comments from the 

TAC membership. Generally, the concerns and discussions raised in this session included: 

sufficiently measuring and understanding cyber risk; how to use AI to benefit those that are 

being attacked; and how to keep cybersecurity updated in the context of AI. 

[Recess] 

 

III. Panel II: Regulatory Issues for DeFi, Including DAOs

Mr. Redbord said the next panel would continue the previous panel’s conversation and do 

a deep-dive into regulation and governance. He then introduced the first speaker, Mr. Biagioli. 

Mr. Biagioli discussed the CFTC’s litigation against Ooki DAO. The case raised the 

question of whether a DAO can act as an entity, be sued, and be held liable for its actions, or if 

only individual members are responsible. The Ooki DAO began as an LLC operating a trading 

platform for leveraged bets on digital assets. It later transformed into a DAO, transferring 

control to its members who held governance tokens. The court made three significant rulings. 

First, it ruled that a DAO is an unincorporated association and can be sued. Second, it held that 

DAOs lack traditional characteristics for service, but the court allowed service through 

unconventional means, such as a help chat-box on the DAO’s website and online discussion 

forums. Third, the court determined that the DAO qualifies as a person under the Commodity 

Exchange Act, making it subject to liability under federal laws. The case generally highlights 

the importance of DAOs’ compliance with the law and the potential challenges of regulating 

DeFi ecosystems involving DAOs. 

Mr. Slaughter then highlighted several key aspects of DeFi. First, he noted that holding 

crypto assets is essential for DeFi, as custodial entities contradict the idea of decentralization. 

Second, he observed that DeFi should ideally not require human approval for individual 

transactions to be truly autonomous. Third, DeFi protocols should be fully visible on-chain, 

minimizing off-chain transactions and maintaining privacy. Fourth, DeFi should allow data 

exchange with other applications and enable the building of applications on top of each other. 

Mr. Slaughter noted that decentralization exists on a spectrum with various degrees of control 

and governance. He also suggested the optimal approach to DeFi governance is minimization, 

allowing for flexibility and responsiveness to user behavior. He concluded by mentioning the 

importance of data and research to understand how DeFi operates and highlighting the need for 

regulatory clarity to navigate the evolving DeFi space. 

Next, Mr. Milne discussed smart contracts, their application, and how they relate to 

governance within DAOs. He emphasized that smart contracts can be used to enforce functions 

and policies in a digital and centralized manner. He stated that smart contracts have the potential 

to solve real-world problems. He emphasized the importance of clear definitions and regulatory 

certainty, and discussed several other key aspects, including: smart contracts in traditional 

systems; difference in smart contract mechanisms; privacy and public voting; smart contract 
6 

functionality; benefits from smart contracts; accountability, jurisdiction, and regulation; and 

definitions and regulation. 

Mr. Redbord then opened the floor to questions and comments from the TAC 

membership. Generally, the concerns and discussions raised in this session included: 

surveillance; how to get the status of a DAO and how to maintain it; how much governance 

should be minimized; how much things should be automated; what happens if something goes 

wrong; whether it is possible to have a consistent decentralized system in perpetuity; and the 

necessity for a DAO to be credibly neutral and what that means.

Mr. Awrey then presented on the topic of stability and security challenges, and the 

regulatory implications for DeFi. He discussed several key points, including the dimensions of 

decentralization; historical regulatory centralization; delegated responsibility; challenges in 

decentralization; the regulatory perimeter; responsibility allocation; embedding regulations in 

automated systems; compliance with changing rules; and sensitivity to different perspectives. 

Overall, he emphasized the need to rethink regulatory frameworks in response to the challenges 

posed by decentralized systems and actors in DeFi. He discussed how decentralized systems and 

actors impact existing regulatory frameworks and described five dimensions of decentralization: 

development, governance, operational and transactional decentralization, balance sheet 

decentralization, and self-custody. He concluded by emphasizing the need to address these 

questions collaboratively to ensure regulations evolve effectively.

Mr. Redbord then opened the floor to questions and comments from the TAC 

membership. Generally, the concerns and discussions raised in this section included: 

responsibility and accountability in this new landscape; the importance of cyber resilience in 

decentralized systems; comparisons between networks and endpoints (applications and services); 

regulating information transactions and what protections are needed; and whether existing 

regulations can accommodate decentralized systems.

IV. Panel III: Cyber Resilience for Financial Markets

Ms. House introduced Mr. Greenfield, who presented on third-party relationships and 

interagency guidance on risk management from the perspective of the Office of the Comptroller 

of the Currency. Key points discussed included that third-party risk management has been a 

focus of bank supervision; that the OCC has guidance on these issues; that the OCC takes a riskbased approach; a discussion of the risk management life cycle; the importance of contracts in 

outlining third-party expectations; ongoing monitoring to assess whether third parties are 

meeting their obligations; planning for the end of a third-party relationship; the responsibility of 

financial institutions; and various forms of third-party relationships. 

Mr. Gallagher and Ms. Allen then focused on understanding cybersecurity risk and its 

implications for operational risk regulation. Mr. Gallagher highlighted the threat environment in 

the cyber realm, including cybercrime. He emphasized the need for resilience (that is, the ability 

to prevent, withstand, and recover from cyberattacks) and suggested best practices that 

organizations could consider. Ms. Allen discussed the importance of incentivizing cyber 

resilience without being overly prescriptive and offered recommendations for setting standards. 
7 

She also discussed the important considerations related to operational risk regulation and 

resilience in complex systems, particularly in the context of financial institutions. She suggested

considering, among other aspects, complex system vulnerabilities, tech glitches, and potential 

systemic interactions in the financial industry. 

 Ms. House introduced the final panelist, Mr. Silberstein, who presented on the state of 

financial sector defense and collaboration to combat cyber threats. He stated that financial 

institutions have a historic culture of security, financial responsibility, and public-private 

collaboration. He emphasized the need for good cyber hygiene through regulation and multifactor authentication. He also discussed challenges in the threat landscape both today and in the 

future, as well as the need to conduct exercises to prepare for critical incidents, foster 

collaboration, and ensure business resilience. 

Ms. House opened the floor to questions and comments from the TAC membership. 

Generally, the concerns and discussions raised in this section included: third-party risk 

management, supply chain complexity in financial markets, the need for collaboration and 

cooperation in dealing with these challenges, and the need for clear guidelines in managing 

cybersecurity and third-party risks within the financial sector.

V. Closing Remarks 

In closing, Commissioner Goldsmith Romero thanked all for the excellent discussions, 

thanked the organizers, and stated she was looking forward to future discussions. 

 Mr. Redbord adjourned the meeting. 

___________________________________ ___________________ 

Carole House Date 

Chair, TAC 

25SEP2023