Commissioner Kristin Johnson’s Keynote Address at the University of Chicago Law School: Charting the Future of Financial Regulation

Good afternoon. Thank you to Dean Miles, Professor Birdthistle and the broader University of Chicago Law School for the kind invitation to join you for today's event. We can often learn a great deal about the future by looking at the past. About 4,000 years ago (c. 2000 B.C.E.), Phoenician sailors developed charts and observations of the Sun and stars. Early mariners' compasses were inaccurate or inconsistent because they lacked an understanding of magnetic variation. Later, the astrolabe, sextant, chip log, gyroscopic compass, radar, and GPS replaced earlier, primitive tools.<_o3a_p>

In remarks earlier this week at a blockchain event at the World Economic Forum in Davos, I explored rapidly advancing technologies-an area that has long been a central focus of my contributions as a lawyer in private practice, in-house counsel, an academic, and most recently, a financial market regulator at the CFTC.[1]Today, on the eve of the Commodity Futures Trading Commission's (CFTC) 50^th Anniversary, we stand, once again on the frontier-a frontier of technological development in markets-including increasingly advanced computing, predictive analytical models, and algorithmic trading, and digital trading, clearing and settlement.<_o3a_p>

During the most recent past administration, the Securities Exchange Commission Divisions of Trading and Markets and of Investment Management announced rule amendments to shorten the standard settlement cycle for most broker-dealer transactions from two business days after the trade date ("T+2") to one business day after the trade date ("T+1")[2]marking faster, more efficient, less costly trading ushered in, in part, by digitization of trading market infrastructure. Many of our largest market participants have partnered with technology firms to migrate exceptional volumes of data including orders, quotes, trades, cancellations and settlement data to cloud-based storage.<_o3a_p>

Executive Orders this week on AI and digital assets or cryptocurrency indicate the new administration's intent to focus on these new technologies. As we prepare to hear from the new administration regarding solutions to address the intricacies of balancing responsible innovation with the critical goals of ensuring market integrity, market stability, and protection of vulnerable market participants, let's keep top-of-mind the lessons of the past and the benefits of well-honed regulatory tools which aid us in navigating the sea of technological innovation set forth before us.<_o3a_p>

Today, we will consider the two specific technologies at the center of the new administration's Executive Orders issued yesterday-AI and crypto.<_o3a_p>

Artificial Intelligence in Financial Markets<_o3a_p>

Financial markets regulation is often defined by two salient questions-what should we regulate and, if we regulate, what should be the scope of regulation. Knowing that crypto technologies are a focus of my remarks, some of you might demand that we tailor these questions and simply focus on the legal standard for distinguishing among regulated products, namely securities and commodities, citing the debate surrounding the legal standard articulated by the Supreme Court of the United States in SCOTUS's now (in)famous 1946 decision S.E.C. vs Howey,[3]explaining that investment contracts that involve an investment of money in a common enterprise with an expectation of profits to be derived from the efforts of others.<_o3a_p>

Leaving this question aside for a moment and focusing on the macro issue, I would note an underlying premise of these two fundamental questions. It is presumed that regulators understand both the products and the markets that are the subject of regulation-that we are clear on the benefits as well as the risks and limitations posed by products, processes, and market structures introduced in our markets. In other words, we are well-informed and deeply engaged in discussions regarding the attributes of what we regulate. I would also share that, for me, this understanding informs "how" I think about regulation.<_o3a_p>

The Ever-Expanding Universe of AI Use Cases<_o3a_p>

AI has long served financial services firms. For decades, firms have integrated standard algorithms and earlier forms of machine learning in both external client-facing applications as well as internal operations.[4]Developers tout the potential for more nascent uses of AI to enhance critical risk management tools, "inform[ing] trading strategies by identifying patterns, optimizing execution, managing portfolio workflows, and assessing risk-return tradeoffs."[5]According to proponents, deep learning through neural networks holds promise to simulate the multi-layered, complex decision-making capabilities of the human brain.<_o3a_p>

Several years ago, the CFTC identified a number of AI use cases in our regulated markets:<_o3a_p>

• Trading (including market intelligence, robo-advisory, sentiment analysis, algorithmic trading, smart routing, and transactions)<_o3a_p>
• Risk Management (including margin and capital requirements, trade monitoring, fraud detection)<_o3a_p>
• Risk Assessments and Hedging<_o3a_p>
• Resource Optimization (including energy and computer power)<_o3a_p>
• RegTech - Applications that enhance or improve compliance and oversight activities (including surveillance, reporting)<_o3a_p>
• Compliance (including identity and customer validation, anti-money laundering, regulatory reporting)<_o3a_p>
• Books and Records (including automated trade histories from voice or text)<_o3a_p>
• Data Processing and Analytics<_o3a_p>
• Cybersecurity and Resilience<_o3a_p>
• Customer Service.[6]<_o3a_p>

The ever-expanding universe of AI use cases impacts investment, trading, surveillance and compliance, fraud detection, cyber security and supervision and enforcement across the derivatives and broader financial markets. In discussing AI's application across financial markets, a Treasury report released last month stated "some financial firms have been experimenting with Generative AI tools-to explore the capabilities of AI in enhancing existing processes."[7]<_o3a_p>

"Robo-advisors offer personalized investment advisory services, while AI-driven insights improve forecasting and trading process automation."[8]The Treasury Department's recent report on Artificial Intelligence in Financial Services also notes that "financial firms are increasingly using AI-and particularly experimenting with Generative AI-internal business operations, including but not limited to risk management, regulatory compliance, treasury management, fraud detection, and back-office functions."[9]<_o3a_p>

Risks and Challenges Remain<_o3a_p>

Attendant risks associated with the increase in use of AI, however, deserves equal attention, particularly for regulators tasked with safeguarding the integrity and stability of financial markets and the global economy. In testimony before Congress and academic work prior to my service at the Commission, I have encouraged regulators and market participants to also consider the following risks fraud and market manipulation, bias and discrimination, and privacy and data protection risks.[10]<_o3a_p>

As the Financial Stability Board recently explained, "many of the potential risks of AI may seem new, but when you look beneath the surface, they are strikingly similar to traditional financial risks. Risks that we are familiar with. We already have frameworks to assess concentration risk, third party dependence and interconnectedness. This is good news. But potential new forms of interconnectedness in the financial system may emerge."[11]<_o3a_p>

To that end, it will be imperative for regulators to understand, track, and be poised to address emerging cybersecurity, third-party, concentration, and human capital risks.<_o3a_p>

1. Cybersecurity

Few would disagree that cybersecurity attacks and related disruptions pose one of the most pernicious and persistent threats to global financial markets. In a timely and critical report on cybersecurity and AI, Treasury notes that "complex and persistent cyber threats continue to grow, and some experts from financial institutions believe the availability of advanced AI tools such as Generative AI will, at least initially, give threat actors an upper hand."[12]Following a recent attack that disrupted clearing and settlement in derivatives markets in January of 2023, the Commission adopted a proposed rule enhancing operational resilience for swap dealers. In parallel to this rule, the Market Risk Advisory Committee that I sponsor, encouraged the Commission to consider comprehensive reform and consider the need for parallel reforms for our derivatives clearing organizations. While our principles-based approach to regulation enables dynamic application of existing rules, we must be ever vigilant to ensure that regulation is keeping pace and fit-for-purpose. I am looking forward to advancing these initiatives.<_o3a_p>

1. Third-Party Risk Management

Financial market regulators have, for several years, noted the challenges of relying on third parties for critical services. While regulated entities may have robust tools to monitor their own activities, our market participants increasingly partner with and rely upon third parties for critical services. Third party critical service providers may not have the comprehensive compliance processes and procedures the regulated entities have. The cascading impact of disruption may impact the many financial institutions that rely on the same critical third-party service providers, potentially engendering systemic risk concerns.[13]<_o3a_p>

1. Concentration Risk

The increasing reliance on third party service providers and the limited number of critical third-party service providers creates concentration risk. While the largest financial services firms in the world may have less exposure to these threats, smaller and medium sized firms without the technical expertise to develop high-cost technologies may need to rely on third parties and may also adapt these technologies in ways not anticipated by original developers, creating additional frictions.<_o3a_p>

At the CFTC, we have been engaged in a longstanding dialogue with our market participants and our colleagues at other federal regulatory agencies to analyze and work to address these concerns-and we plan to continue the conversation.<_o3a_p>

Last year, our staff released a request for comment, soliciting data regarding our market participants' increasing use of AI.[14]We have not been alone in this work. The U.S. Department of Treasury similarly issued a request for information.[15]I worked with staff at the CFTC and staff at Treasury prior to and following these RFIs. The important results of these forms of engagement have only scratched the surface, given that "[o]ne of the most significant learnings from the comment responses is the reported ubiquity of AI usage-in particular traditional AI such as algorithms or machine learning-in virtually every function of financial firms, ranging from compliance management, internal operations, underwriting, customer service, treasury management, and product development and marketing."[16]<_o3a_p>

A Roadmap for the Future<_o3a_p>

I have advanced, and will continue to advance, several policy initiatives over the course of my time at the Commission.<_o3a_p>

Collaboration is Key<_o3a_p>

1. Continued Dialogue

There is still much work to be done. Continuing conversations with interested stakeholders across the board is the only way to ensure that we are learning in real time and incorporating that knowledge into sensible actions, both within the regulatory sphere and in the private sector.<_o3a_p>

This dialogue "create[s] a framework that simultaneously serves two goals. The first is protecting the integrity of the trading markets so that they fairly serve the interests of participants and the larger public. The second is welcoming and encouraging the development and application of the newest technologies with responsible guardrails. In this way, we can ensure that these technologies help assure that the United States financial markets remain leaders in financial innovation in the years ahead."[17]<_o3a_p>

1. Interagency coordination

In the December Treasury report, a brief discussion of the existing and proposed frameworks related to the use of AI in financial services is more than two pages long.[18]And that is just the first layer before adding state laws on AI, which can differ from each other and from federal frameworks, and finally, international standards.<_o3a_p>

Of course, each regulator has its own specific mission and mandate. However, regulators must work together to harmonize regulation.[19]<_o3a_p>

The Financial Stability Oversight Council echoes this recommendation in its annual report: "The Council supports interagency development of expertise to analyze and monitor potential systemic risks associated with the use of AI in the financial services sector, as well as further inter-agency discussions on developments in AI and associated financial stability risks."[20]<_o3a_p>

FSOC also recognizes the need for collaboration on a global scale. "The U.S. financial system is part of a global network and could potentially be vulnerable to shocks that originate abroad. The Council supports continued engagement with international counterparts on the risks and benefits of AI in financial services."[21]<_o3a_p>

Enhanced Resources for An Enhanced Mission<_o3a_p>

1. Resources Must Keep Pace with Demand

The CFTC is small but mighty, and continues to punch above its weight on all matters that come before it. In 2015 amidst the Dodd-Frank regulatory mandates, the CFTC had completed a greater percentage of its Dodd-Frank rules than other domestic financial regulatory agencies despite its smaller staff.[22]The same has been true in the past few years, as the Commission has taken on an increased role in addressing digital assets, while continuing its existing work, without any increase in budget.<_o3a_p>

As the CFTC oversees increasingly complex markets, and must identify threats from increasingly sophisticated bad actors, it must have the resources to continue to do so effectively. I feel it important to reiterate that "the Commission would benefit from increased resources dedicated to enabling several of the Divisions within the Commission to prepare for and meet the challenges of regulating innovative trading, clearing, and settlement technologies, among other changes to operational infrastructure that merits consideration."[23]<_o3a_p>

1. An AI Fraud Task Force to Tackle Fraud Full Force

I have expressly called for the CFTC Division of Enforcement to create an AI Fraud Task Force. While there may be divergent opinions on the benefits and risks engendered by AI, preventing bad actors from using AI to commit fraud against consumers and potentially market participants should be common ground. "Policing derivatives markets is one of the cornerstones of the CFTC's mission. We must adapt our surveillance technologies and enforcement penalties to keep pace with the rapidly evolving innovation that characterizes global financial markets."[24]<_o3a_p>

A Future Framework for Digital Asset Markets <_o3a_p>

A second Executive Order released yesterday established a Presidential Working Group on Digital Asset Markets within the National Economic Council and appointed a Special Advisor for AI and Crypto to serve as Chairman of the PWG.<_o3a_p>

Meaningful regulation in any market begins with identifying and developing standards to address certain risk management concerns. Many of the risks in the digital asset markets are well known.Learning from the lessons of the past few years, I am hopeful that any action to establish digital asset regulation include needed clarity regarding the application of rules and protections that safeguard the integrity of our markets. These regulations often also serve the organizations that implement them well.<_o3a_p>

Digital asset market regulation should incorporate the same governance principles that have long governed our markets. Evidence of recent crises in digital asset markets underscore the benefits of strong corporate governance, rules governing conflicts of interest, and separation of customer property to preserve customer assets as part of a broader default management, recovery, and resilience strategy.<_o3a_p>

1. Segregation of Customer Assets

Our markets are built on trust. Any market that we supervise should have measures in place to protect the trust and confidence of customers and counterparties. Such recovery, resilience, and default risk management approaches should be applicable across markets that engender similar risks. <_o3a_p>

At the core these default-focused efforts create protections that preserve customer assets in the event of a liquidity or solvency crisis. The measures also guard against the commingling of customer funds witnessed in the 2022 crypto crises.[25] <_o3a_p>

The Commodity Exchange Act (CEA) expressly requires separation of customer funds in certain contexts. Section 4d(a)(2) of the CEA requires each FCM to segregate from its own assets all money, securities, and other property deposited by futures customers to margin, secure, or guarantee futures contracts and options on futures contracts traded on designated contract markets.[26]As the PGW takes up the mantle, preservation of customer capital must be a central and key issue. <_o3a_p>

1. Governance

Basic corporate governance and internal controls should form part of the health and welfare of any market participant subject to the Commission's supervision. Among other obligations, our regulations uniformly call for registered entities to have boards of directors, including independent directors, risk management committees, and executive officers that include chief compliance and risk officers who possess the requisite skills and expertise.[27]<_o3a_p>

We continuously refine and update our governance standards as our markets evolve. In 2023, the Commission unanimously (please confirm) approved a final rule requiring derivatives clearing organizations (DCOs) to establish and consult with one or more risk management committees (RMCs) comprised of clearing members and customers of clearing members on matters that could materially affect the risk profile of the DCO. Section 5b(c)(2) of the CEA establishes core principles with which a DCO must comply in order to be registered and to maintain registration as a DCO (DCO Core Principles),1 and part 39 of the Commission's regulations implement the DCO Core Principles. DCO Core Principle O requires a DCO to establish governance arrangements that are transparent, fulfill public interest requirements, and permit the consideration of the views of owners and participants.2 Regulation § 39.24 implements this aspect of Core Principle O by providing minimum requirements regarding the substance and form of a DCO's governance arrangements.<_o3a_p>

In the earlier referenced 2023 final risk governance rule, the Commission adopted minimum requirements for RMC composition and rotation, and required DCOs to establish and enforce fitness standards for RMC members. The Commission adopted requirements for DCOs to maintain written policies and procedures governing the RMC consultation process and the role of RMC members. Finally, the Commission adopted requirements for DCOs to establish one or more market participant risk advisory working groups (RWGs) that must convene at least twice per year, and adopt written policies and procedures related to the formation and role of the RWG.<_o3a_p>

1. Compliance with AML/KYC laws and regulations

Our experience regulating financial markets has demonstrated that strong AML/KYC regulations protects not only market integrity and stability, but also national security interests. These regulations are foundational and define the scope of who is permitted to actively engage our markets and, in many instances, the broader financial services and banking sector of our economy.<_o3a_p>

Concluding with A Word Collaboration<_o3a_p>

One of the greatest strengths of our government and, more specifically, the federal agencies that supervise many of the largest global financial market participants in the world is the intellectual leadership that our market regulators demonstrate. Our financial market regulations enhance efficiency, reduce the costs of raising capital, attract global investments, and serve as a model for regulation around the world. Our successful regulation is due, in large part, to our engagement with markets and the global regulatory community.<_o3a_p>

As I noted in keynote remarks last year at NYU's AI Convening, it is imperative for government and regulators to demonstrate a deep and abiding commitment to developing well-informed, research-based, data-driven regulatory solutions that are well-tailored, fit-for-purpose interventions. This requires a multi-stakeholder, public-private partnership that may include for advancing technologies developers, market participants, academics, government and industry researchers, diverse regulators across the financial markets, and public interest organizations.[28]<_o3a_p>

Last year, in response to a staff advisory on the use of AI in CFTC-regulated markets,[29]I noted that "[w]orking in partnership with market participants, we are able to enhance our ability to accomplish our mission of ensuring market stability and market integrity. ."[30]<_o3a_p>

I started this week in Davos, Switzerland, where I shared remarks at a conference about blockchain and AI, and about how the World Economic Forum Annual Meeting theme of "Collaboration for the Intelligent Age" is relevant to my work at the CFTC on these topics. World leaders in government, business, and civil society are still there, discussing the most pressing issues facing our global markets and broader societies, and trying to solve problems on a global scale. Nowhere is that more salient than in the United States, as we are close out the first week of a new executive administration.<_o3a_p>

When we reflect on the future of finance, we must think back to the lessons learned as markets navigated sustained periods of extreme distress. Collaboration has served as one of the most important tools in our toolkit.<_o3a_p>

The creation of the Financial Stability Oversight Council has proved a valuable source for convening the heads of financial market regulators across our government can carefully identifying and addressing anticipated systemic risk concerns. In addition to collaboration across market and prudential regulators, efforts by the SEC and CFTC to navigate implementation of the Dodd-Frank Act rules offers a second example of successful collaboration among market regulators. The discussions regarding regulation of AI, crypto, and other novel and emerging technologies should benefit from similar collaboration across regulators authority and across the aisle.<_o3a_p>

Navigating difficult conditions requires focus, discipline, leadership and a steady hand at the helm. In recent years, our markets have navigated the onset of a global pandemic, geopolitical conflicts, sustained inflation.<_o3a_p>

I am committed to working together to achieve this goal. As we enter this new year and new administration, collaboration will be as important as ever to achieve the benefits of scale and take advantage of all that innovation has to offer financial markets.<_o3a_p>

Simply stated, and echoing this year's World Economic Forum theme at Davos, we must find a path to collaboration in an intelligent age.