FIA Audit Trail Recommendations 

U.S. Commodity Futures Trading Commission

Technology Advisory Committee (TAC) Meeting 

February 26, 2020
Presenters 

• Tammy Botsford, Executive Director and Assistant General Counsel, J.P. 

Morgan

• Mark Fabian, Vice President, Market Regulation, ICE Futures U.S.

• Jeff Ramsey, Managing Director and General Counsel, Geneva Trading 

• Andrew Vrabel, Executive Director, Global Head of Investigations, CME 

Group
Background 

• FIA’s Audit Trail Working Group is comprised of representatives from 

the following communities:

• Futures Commission Merchant (FCM)

• Designated Contract Market (DCM)

• Principal Trading Group (PTG)

• In October 2018, representatives of the Working Group met with 

Commissioner Quintenz, as the Sponsor of the TAC, and senior 

members of CFTC staff, including DOE and DMO, to share their 

concerns regarding current audit trail requirements 

• In January 2020, the Working Group submitted a letter to 

Commissioner Quintenz and the Directors of DMO, DSIO, and DCR 

making four primary recommendations
Overview of Recommendations 

1. Amend Regulation 38.553 to eliminate the requirement that DCMs 

conduct annual audit trail reviews

2. Amend Regulation 38.552 to remove the specific elements of an 

adequate transaction database

3. Confirm that DCMs may maintain records of Tier 1 Data on behalf of 

FCMs and other trading participants

4. DCMs should amend their rules to confirm that clearing FCMs do not 

have to maintain records of orders that are transmitted directly into the 

DCM trading system by direct access customers 

We propose to modify certain aspects of Part 38, DCM-specific audit trail 

requirements only; we are not proposing any change to existing recordkeeping requirements prescribed by Regulations 1.31 or 1.35
Overview of Requirements 

• Regulations 1.31 and 1.35 require the retention and maintenance of 

records required to be made and kept in accordance with the CEA for 

a period of no less than 5 years, including order message and 

transaction data

• All FCMs, retail foreign exchange dealers, certain introducing brokers, 

and members of DCMs are still required to maintain their respective 

audit trail records in accordance with Regulations 1.31 and 1.35

• Regulations 38.551-553 pertain to audit trail requirements specific to 

DCMs 
Regulation 38.551, Audit trail required 

• Regulation 38.551 requires that –

A [DCM] must capture and retain all audit trail data necessary to detect, 

investigate, and prevent customer and market abuses. Such data must be 

sufficient to reconstruct all transactions within a reasonable period of time 

and to provide evidence of any violations of the rules of the designated 

contract market. An acceptable audit trail must also permit the designated 

contract market to track a customer order from the time of receipt through fill, 

allocation, or other disposition, and must include both order and trade data.

• The Working Group has confirmed with DMO staff that this 

requirement is specific to records of order and transaction messages 

received and sent by DCMs

• DCMs do this today and FIA is not proposing any change to 

Regulation 38.551
Regulation 38.552, Elements of an acceptable 

audit trail program 

• Regulation 38.552 states that –

A [DCM’s] audit trail program must include an electronic transaction history 

database. An adequate transaction history database includes a history of all 

trades executed via open outcry or via entry into an electronic trading system, 

and all orders entered into an electronic trading system, including all order 

modifications and cancellations. 

• The Regulation then lays out specific data elements that must be 

included in a transaction history database, including CTI codes. 
Regulation 38.553, Enforcement of audit trail 

requirements 

• Regulation 38.553 requires that a DCM must enforce its audit trail rules by 

conducting at least an annual review of all members, firms and persons 

subject to its recordkeeping rules to verify their compliance with the DCM’s 

audit trail and recordkeeping requirements

• These audits must include “reviews of randomly selected samples of frontend audit trail data for order routing systems; a review of the process by 

which user identifications are assigned and user identification records are 

maintained; a review of usage patterns associated with user identifications to 

monitor for violations of user identification rules; and reviews of account 

numbers and customer type indicator codes in trade records to test for 

accuracy and improper use”

• Current DCM annual audit trail review practices and components
Tier 1 vs. Tier 2 Data 

• For purposes of distinguishing the audit trail records required to be 

captured and maintained by DCMs versus the audit trail and 

recordkeeping requirements under Regulations 1.31 and 1.35, we will 

refer to the following:

• “Tier 1 Data” – audit trail data that is captured and maintained by the DCM 

• “Tier 2 Data” – all order messages not included in the definition of Tier 1 Data 

that are required to be maintained pursuant to Regulations 1.31 and 1.35.
Tier 1 vs. Tier 2 Data (cont’d.)
Trade Practice Investigations 

• Tier 1 Data, which is not only highly granular but also uniform, is the 

foundation for the initiation of nearly every DCM trade practice 

investigation (99%) 

• Where Tier 2 Data is necessary for a trade practice investigation, a 

DCM can obtain that data from the respective firm or participant, 

where such firm or participant is required to maintain it
Example 

• A firm offers a front-end trading application to its clients

• That trading application has functionality that allows clients to synthetically 

create iceberg orders, where only a portion of the total order quantity is 

displayed to the market at a time 

• A client electronically sends instructions to the trading application to sell 

1,000 contracts (referred to as the “parent order”), displaying only 50 

contracts (referred to as a “child order”) to the market at a time

• The 50-lot child orders transmitted from the trading application to the exchange’s electronic trading system constitute Tier 1 Data

• The client’s instructions to the trading application to sell 1,000 contracts as an 

iceberg order constitute Tier 2 data
Recommendations 
1 – Eliminate Required Annual Audit Trail 

Reviews 

• Annual audit trail and recordkeeping reviews for electronic trading do 

not assist a DCM in preventing customer and market abuses since the 

same data is already a component of the DCM’s audit trail

• Regulatory focus should be on DCM audit trail enforcement programs 

that review components of audit trail data for accuracy (e.g., reviews 

of user identifications and account numbers to test for accuracy and 

improper usage) 

• Industry benefits by eliminating non-value-adding work and reducing 

multiple redundant copies of audit trail records
2 – Remove Specific Elements of Adequate 

Transaction Database 

• The value of audit trail data elements changes over time (e.g., CTI 

codes have reduced in value, but Automated/Manual have increased)

• This has rendered part of Regulation 38.552 (i.e., requiring CTI codes 

to be maintained) stale

• The prescriptive components of Regulation 38.552 are also redundant 

since Core Principle 10 and Regulation 38.551 require DCM audit trail 

to be sufficient to reconstruct transactions, provide evidence of any 

violations, and track a customer order

• Industry benefits with principles-based regulations that can more 

easily adapt to evolution
3 – DCMs Could Maintain Tier 1 Data on 

Behalf of 

• As DCMs are required to maintain Tier 1 Data to satisfy core principle 

and regulatory obligations, DCMs could offer a Tier 1 recordkeeping 

service to firms subject to Regulations 1.35 and 1.31

• Industry benefits by reducing the number of redundant copies of Tier 

1 Data, which is costly and presents risk, and better assuring 

consistency in audit trail data elements 
4 – FCMs Not Required to Maintain Direct 

Access Orders 

• The Working Group recommends that DCM audit trail rules be 

amended so that a clearing FCM is not responsible for the 

maintenance of audit trail records for customers that directly access 

the DCM trading platforms without passing through the clearing 

FCM’s infrastructure

• Regulation 1.35 reflects that records were originally created on paper 

to capture information on orders going into/fills coming out of the 

open outcry pits. Evolution has moved most records onto digital 

media (whether written or oral records) and trading itself has not only 

moved to computers, but has, in some cases, resulted in transactions 

flowing directly between the market participant and exchange. In DEA 

situations, no order is given to the FCM/clearing member; accordingly, 

the best source for that information is the relevant exchange. 
Questions?