On the deadline date for comments on the Commodity Futures Trading Commission’s proposed Operational Resilience Framework rule the US International Swaps and Derivatives Association, Inc. (ISDA) has released a letter that it has sent to the CFTC requesting significant revisions to the framework.
The new CFTC proposed rule is aimed at Futures Commission Merchants, Swap Dealers, and Major Swap Participants and proposes that regulated entities establish, document, implement, and maintain an operational resilience framework ‘reasonably designed to identify, monitor, manage, and assess risks relating to information and technology security, third-party relationships, and emergencies or other significant disruptions to normal business operations’.
ISDA has asked CFTC to make changes in the following four main areas:
Governance: provide an alternative to the attestation requirement and revisit the requirement for escalation to the chief compliance officer. ISDA believes that the Operational Resilience Framework is too prescriptive and that revising the standard to a more principles-based approach would be more effective.
Third-Party Relationships: ISDA believes that the National Futures Association’s requirements for third-party service provider programs are already a sufficient safeguard against risk; should the CFTC chose to add an additional layer of regulation, this should be targeted towards high-risk services (rather than all services at the service provider level).
Incident Notification: revise both the timeline and standard for incident notification. The proposed timeline is that the CFTC would be notified within 24 hours of a significant incident taking place. ISDA says that this is too short a period and will interfere in the immediate incident management activities: instead it believes that a 72-hour timescale should be implemented.
Implementation Period: extend the implementation period to allow for more time for compliance and substituted compliance determinations. The Proposal provides for a six-month implementation period. ISDA recommends extending this implementation period for at least one year because the Operational Resilience Framework presents an entirely new framework requiring significant work across various aspects of firms – legal, compliance, operational, and information technology. These efforts would be challenging and potentially impossible to implement within six months.
