Securities Regulation Daily Wrap Up, CFTC NEWS AND SPEECHES—CFTC seeks comment on Privacy Act exemptions for system of records underlying its Insider Risk Program, (May 8, 2026)

By Rebecca E. Hoffman, J.D.

The Commission is proposing exemptions to individuals’ right under the Privacy Act to access and request amendment to records about themselves.

The CFTC on May 4 issued two concurrent notices describing the Commission's new Insider Risk Program and its associated Privacy Act system of records used to detect and prevent insider risk. The Commission is requesting comment on the system of records and on its proposed rulemaking which would establish exemptions to the Privacy Act, limiting individuals’ access to records about themselves.

Insider Risk Program. An “insider” is a person with access to CFTC resources, such as an employee, and an “insider risk” is the risk that such a person will use CFTC information “to harm the security of organizational operations and assets, individuals, other organizations, or the Nation,” the notice explained. Under the Insider Risk Program, risks may be uncovered by monitoring unusual behavior of insiders, such as logging into the network in the off-hours or downloading a lot of materials at once.

System of records. The new system, effective June 15, will contain various categories of information, such as names, biometric data, Social Security numbers, employment history, and clearance status.

“The records in this system of records will be used to manage insider risk inquiries and complaints; identify and track potential insider risks to the CFTC; … and support the identification of systemic insider risk issues and challenges to develop solutions for detecting, deterring, and mitigating those challenges,” the CFTC explained.

Privacy Act exemptions. In a concurrently published notice of proposed rulemaking, the CFTC is seeking public opinion on an update to its regulations to exempt the system of records from provisions permitting individuals to access and request changes to records about themselves, “in order to maintain the integrity of insider risk investigations and to keep confidential the identity of confidential sources.”

If adopted, Commission Regulation §146.12 would have a new subsection (h) exempting the system of records from sections of the Privacy Act, including the access and amendment sections. Permitting access could alert the subject of an investigation to that investigation, could allow evidence to be destroyed, and might allow witnesses and confidential sources to be influenced, thereby impeding investigations into insider risks, the CFTC said.

Comments as to both notices are due by June 5, 2026.

RegulatoryActivity: CFTCNews RiskManagement