Securities Regulation Daily Wrap Up, CFTC NEWS AND SPEECHES—Commissioner Johnson advises symposium attendees on risks of AI and cloud provider use, (Apr 4, 2025)

By Rebecca E. Hoffman, J.D.

In her remarks, the CFTC commissioner said that each of these “twin peaks…has the potential to deeply impact market structure and how we supervise financial markets,” and each “merits careful consideration.”

Delivering a keynote address at Yale Law School for the “Governing Data” symposium March 29, Commissioner Kristin Johnson of the CFTC highlighted “the rise of data-fueled AI and the increasing role of a concentrated group of critical third-party service providers” as notable challenges for those involved in data governance.

Johnson first noted that the use of AI is significantly on the rise in all aspects of financial operations, including market intelligence monitoring and cybersecurity risk management. Market participants, academics, and other interested parties are concerned with the impact of AI, and “[a]s debates proliferate regarding the merits and limitations of automated decision-making technologies, a steady drumbeat declares the future of finance,” she said.

The second of the “twin peaks” is third-party service providers such as cloud storage and data centers, which are often critical to a market participants’ operations, Johnson said. She observed that larger market participants have partnered with cloud service providers “to handle exceptional volumes of data and enhance their scalability.”

Critical concentration. These days, AI and critical service providers are few. “The top three cloud providers, Amazon, Microsoft, and Google, respectively, account for 73% of the cloud infrastructure market,” Johnson said. The number of Futures Commission Merchants has also decreased, while clearing volume has “dramatically increased,” such that there are “far fewer FCMs available to provide the critical functions they traditionally perform.”

Cyber risk. Losses from cybersecurity breaches “can cascade through the markets when that breach occurs in a critical third-party service provider who is linked to a significant number of market participants,” Johnson warned, pointing to the ION ransomware attack in January 2023, which forced financial firms to confirm trades manually for several days, affecting the recording of trade reconciliation data, which in turn impacted Commitments to Traders reports and other determinations.

Directing DCOs. Addressing possible solutions to these issues, Johnson assured the attendees that “[a]t the CFTC, we are increasingly focused on how to ensure markets benefit from responsible innovation and mitigate the threats to risk management that may lead to market disruption.” She explained that derivatives clearing organizations (DCOs) are mandated by the Commodities Exchange Act to implement risk analysis programs and develop controls and systems, emergency procedures, backups, and plans for recovery. The Dodd-Frank Act gave the CFTC more regulatory power, and Rule 39.18 directing DCO compliance was codified in 2011, and then modernized to tackle increasing threats. Notably, it now states that a DCO that outsources to a service provider “‘shall retain complete responsibility for any failure to meet” the requirements of the rule, and the DCO “‘must employ personnel with the expertise necessary to enable it to supervise the service provider’s delivery of the services.’”

The Market Risk Advisory Committee (MRAC), which Johnson sponsors, has recommended that proposed regulations “build upon and incorporate the principles and language set forth in the System Safeguards Rule with respect to DCOs and, further, that DCOs be required to establish and maintain a robust Third-Party Relationship Management Program that identifies, assesses, mitigates and monitors the full scope of risks that are associated with the use of third party arrangements.”

Beyond DCOs. Johnson acknowledged the need for further discussion and problem-solving, especially given that DCOs are not the only ones affected by these progressions and the accompanying risks. Although there is guidance for other registrants, as with DCOs, “it is important to consider instances in which reliance on critical third party service providers may introduce risk management concerns,” Johnson said.

For the CFTC and other oversight authorities, “governing data proves challenging, in part, because market participants may rely on intermediaries that are not registered with financial market regulators,” Johnson said.

RegulatoryActivity: AINews Blockchain CFTCNews FormsFilings InvestorEducation