Blog Masonry Full Width

In this first installment on position limits, Regulatory Guidance expert Greg Hotaling surveys the current landscape of position limits imposed for U.S.-listed commodity derivative holdings, which can affect investment firms and other speculative investors regardless of where they are based. Stay tuned for coverage of EU position limits in the next edition.

“Who shot J.R.?!” everyone wondered in 1980.  Long before the final occupant of the Iron Throne transfixed our current generation, the question of who tried to knock off J.R. Ewing, in the hit American TV series Dallas, was splashed on the covers of national magazines, unashamedly pondered on nightly news TV (alongside a Presidential election and Iran hostage crisis), and personally posed to actor Larry Hagman by none other than the Queen of England.

What some market surveillance officials were also following was the actual inspiration behind Hagman’s conniving “J.R. Ewing” and his Texas oil family: the real-life bloodline whose fortunes and misfortunes ultimately came to a head at the very same time as the Dallas frenzy they inspired.  They were the Hunts, notably brothers Nelson Bunker Hunt and William Herbert Hunt, Texas oil barons whose attempts to corner the silver market in 1979 had driven up the price of silver from $6 to almost $50 per oz.  (Already by 1974, the Hunts had begun to take measures worthy of a primetime drama, amassing 55 million oz. of silver – 8% of the world’s deliverable supply – and loading most of it onto planes bound for Switzerland in the middle of the night, with their ranch cowboys serving as marksmen for security.)

As the exchanges CBOT and COMEX responded to the 1979 price spike with emergency position limits (maximums of 600 contracts and 2,000 contracts respectively) among other measures, the price declined sharply and by March 21, 1980 – the broadcast date of the Dallas cliffhanger – silver was down to $21 per oz.  Just six days later, as selling pressure continued and with the Hunts unable to meet a margin call of $100 million, silver dipped below $11 and the sell-off expanded to the commodities and financial markets generally, in what would be dubbed the “Silver Thursday” crash.  When the dust settled, the Hunt brothers were $1.5 billion in the red and, after several years of investigations and lawsuits, by 1988 declared bankruptcy and were found liable in a civil court for having conspired to manipulate silver prices. (Dallas, by the way, was following a similar trajectory, having slid from first to 21^st in TV viewership.)

While the CFTC attracted criticism generally for not doing enough to stem the crisis, Chairman Jim Stone stood in the minority among his colleagues for acknowledging a threat to “the financial fabric of the United States.” Stone’s comments foreshadowed the CFTC’s current proposal to broaden the scope of its position limit regime: from nine core agricultural commodities to an expanded 25 core commodities that also include energy sources and metals (including, of course, silver).  In these recent efforts, the CFTC has explicitly recognized that “speculative limits would have helped to prevent the buildup of the silver price spike of 1979-80.”

Whether the latest position limit proposal by the CFTC is a silver bullet that prevents market manipulation is debatable, but what is clear is that, if and when it becomes effective, it will change the way many market participants manage their relevant holdings. In fact, a major part of the proposal is directed at the very issue of what holdings are relevant: not only the larger number of underlying commodities covered (25), but also a broader set of instruments that are “economically equivalent” to standard futures, including swaps and cross-border OTC contracts.

Those more expansive requirements within the proposal are accompanied by some more lenient measures.  Most of the limit levels relating to the current nine core agricultural commodities would be relaxed.  As for the remaining 16 core commodities as proposed, the limits would apply only to the spot month (no “single month” or “all month” limits), and set at higher levels than those currently set by the exchanges.  (A reminder here, that while the CFTC sets position limits for these U.S.-listed derivatives with “core” commodity underlyings, the U.S. exchanges are free to set lower limits on those products if they so choose.  And perhaps even more importantly for market participants, U.S.-based exchanges such as CBOT, COMEX and ICE choose to impose their own position limits on hundreds of other commodity and financial derivatives that do not relate to core commodities.)

Qualifying for exemptions will also be easier under the CFTC’s proposal.  11 “enumerated” hedging exemptions are set forth, without the need for CFTC approval (Form 204 would be eliminated).  Other “bona fide” hedging activities would also be deemed exempted, upon approval of the relevant exchange and as long as the CFTC does not object within 10 days.

Compliance professionals and other concerned parties would be forgiven for viewing this latest proposal with some fatigue, as it follows a string of unsuccessful CFTC position limit efforts since passage of the Dodd-Frank Act in 2010 (which amended the Commodity Exchange Act, to authorize the CFTC to establish position limits for an expanded set of instruments).  The CFTC’s current proposal overrides several prior versions and underwent a public comment period that was extended until 15 May 2020.  With more than 160 submissions received (you can view them here), it’s no surprise that one Commissioner has suggested that the proposal may be altered based on the comments.  At the same time, some have suggested that the CFTC would be motivated to enact its proposal before the Presidential election in November. Once approved – whenever that may occur – the new regulations would take effect one year thereafter (to be precise, one year after their publication in the Federal Register).  The takeaway for asset managers, therefore, is not one of immediate urgency, but rather to remain abreast of these developments which at some point may affect their commodity derivative holdings.

Meanwhile, the CFTC regulates the issue of aggregation – how each firm as a group must combine its various corporate entities for the purpose of adding up its holdings subject to the limits – under an entirely separate proposal that was approved in 2016. These aggregation rules currently relate only to the nine core commodities covered by the current CFTC position limit regime and would broaden to the relevant 25 core commodities once that separate proposal is enacted (as described above).  Perhaps more significantly, the aggregation rules are the subject of extensive “no-action” relief provided by the CFTC – meaning that many of the new aggregation requirements do not apply – until at least 12 August 2022. The clear takeaway for investment firms with commodity derivative holdings, that don’t already benefit from a hedging exemption or other relief, is to become familiar with the aggregation requirements and related exemptions, as well as the CFTC’s relevant no-action relief (found here).

Finally, as to who shot J.R. in Dallas, that one you’ll need to figure out on your own.  (No spoilers here, sorry.)

To submit a question to our Regulatory Guidance experts on position limits, please email info@cssregtech.com.

Cybersecurity is a fast-moving target, so it is not uncommon for firms to have questions when it comes to assessing and understanding their cybersecurity risks. Here at CSS we receive a lot of cybersecurity questions, so we thought we would take the time to answer 10 of the most common Frequently Asked Questions.

(1) What is a vulnerability? What is the difference between “vulnerability scanning” and “penetration testing”? How often is this type of testing performed?

A vulnerability is a flaw that can be exploited by hackers to gain access to company systems. Vulnerability scanning is a testing method that attempts to locate any flaws on existing systems.

Penetration testing goes a step further and attempts to exploit those vulnerabilities discovered in a vulnerability scan to gain access to systems. While the SEC has not mandated a specific testing frequency, we have seen much of our client base in financial services settle on performing vulnerability scanning quarterly and performing penetration testing annually. It is recommended that a penetration test also be performed after any major changes to a network infrastructure are implemented.

(2) What is the “dark web”?

Only a small percentage of all content is publicly available on the Internet. The majority of Internet-based content exists in the “deep web” – content which is stored in forms, databases, social media sites, and other forums, and is generally not indexed by common web browsers. A subset of the deep web’s hidden content is what is known as the “dark web.” The dark web requires special anonymized browsers to access and is often used for illicit purposes, including selling stolen or compromised account credentials such as usernames and passwords. It is here on the dark web that we monitor for compromised credentials for our clients.

(3) What is Multi-Factor Authentication (MFA) and why is it important?

Multi-factor authentication (MFA) is a security practice that requires users to combine something they know with something they have to confirm their identity. In practice, the something you know would typically be an account password, and the something you have is associated with a physical device – either a unique one-time password that displays on a keychain token at timed intervals or a unique code that is provided from a mobile device in the user’s possession. The use of biometrics is another form of MFA which typically uses a fingerprint or retinal scan as the second factor.

(4) Is my vendor SEC-compliant / FINRA-compliant?

As a general matter, regulators do not take a position as to whether a particular vendor you are using is compliant. Technology vendors that store electronic records for broker-dealers do need to ensure that their record retention is WORM-compliant (e.g. the records cannot be deleted or overwritten) to adhere to SEC Exchange Act Rule 17a-4. As far as the reasonableness of the controls of other service providers to SEC-registered firms, the SEC expects firms to implement a robust vendor due diligence process reasonably designed to assess the vendors’ safeguards for data entrusted to them. Vendor due diligence should be conducted initially and periodically thereafter for critical vendors and service providers. So, the SEC and FINRA are not likely to tell firms that their vendors are noncompliant; rather, they may opine on the adequacy of your oversight of such vendors.

(5) Cybersecurity attacks: events/incidents versus data breaches?

The distinction between cybersecurity events/incidents and data breaches is important. A cybersecurity event/incident occurs when information has been compromised, or there has been an attempt at such compromise, resulting in the potential exposure of such information. A data breach, on the other hand, occurs when the actual disclosure of compromised information has been confirmed. Cybersecurity events/incidents should not be classified or referred to as breaches until proper legal and forensic analysis has been performed, as a “data breach” is typically a reportable compliance issue under state data breach notification regulations.

(6) What is a phishing attack?

Phishing attacks are attempts perpetuated through email to gain information, such as usernames, passwords, and credit card information, from unwitting people. Examples of phishing attacks are emails claiming that a person’s account password needs to be reset immediately or that there has been suspicious activity related to a bank account or credit card. Unsuspecting people provide the login credentials to these accounts and attackers have all the information they need to do damage. Phishing attacks can also be in the form of an attacker representing themselves as a C-level executive asking an employee to do something for them while they are “out of the office and unavailable by phone,” such as purchasing gift cards. The best defenses against phishing attacks are to conduct simulated phishing campaigns against your own staff to see how they fare, and to reinforce such concepts with regular security awareness training.

(7) What are the costs of a cybersecurity attack?

According to the 2019 Cost of a Data Breach Report published by IBM and the Ponemon Institute, the average cost of a data breach across the globe is $3.92 million. In the United States alone, the average cost of a data breach is more than double the global average, with a cost of $8.19 million. There are many factors people may not immediately associate with a data breach that drive the cost into the multiple millions of dollars, including increases in insurance premiums, business disruptions, loss of intellectual property and long-term losses related to reputational damages. Forensics investigation costs and legal costs associated with breach reporting contribute to a substantial part of the average price tag of a data breach.

(8) What is encryption and what information should be encrypted?

Encryption can be thought of as converting data into a special code that requires a specific key to read the data; only authorized users possess the key. Confidential and sensitive information, such as social security numbers and financial records relating to firm operations, should be encrypted at all times. It should be noted here that email is generally not encrypted, and sensitive or confidential information should never be transmitted through email.

(9) What is the difference between data in transit and data at rest?

Data at rest refers to data that is being stored on a device, server, or backup device; information that exists and is stored but is not being used at the moment. Data in transit refers to information that is being transmitted between a computer and a server or a web browser and a web server. Login portals and online shopping websites encrypt information you exchange with the server while you’re accessing the site.

(10) What are the European Union’s General Data Protection Regulation (GDPR) and California’s Consumer Privacy Act (CCPA)? If I’m already in compliance with the GDPR, do I need to worry about the CCPA?

The General Data Protection Regulation (GDPR) is an EU privacy regulation covering data pertaining to individuals residing in the EU. The GDPR confers certain rights to individuals to be informed of what personal information companies collect, how it is used, and to whom it is shared, as well as rights to request corrections and deletions to such data. The California Consumer Privacy Act (CCPA) is similar to the GDPR in that it confers certain privacy rights which parallel many of those under the GDPR. However, while the GDPR is applicable to personal information about individuals in the EU, the CCPA is applicable to personal information of California residents and includes an exemption for certain data covered under the Gramm-Leach-Bliley Act. As such, compliance with GDPR likely means that a firm has the operational capabilities to handle data access requests but does not imply that the firm is fully compliant with requirements under the CCPA.

We hope this helps, and if you have a burning cybersecurity question you would like us to answer, please send your questions to cybersecurity@cssregtech.com and our cyber experts will look to tackle the next round of FAQs in a future blog post.

This is the second installment of Regulatory Guidance Expert Greg Hotaling’s blog on position limits, this time addressing EU-listed commodity derivatives and related products.  As always, keep in mind that these limits can apply to asset managers, and other market participants, regardless of where they are based.

In 2009, the European Union’s first comprehensive position limit regime, for commodity derivatives, was indeed born in Steel City, USA. While obviously not part of Europe, the locale, otherwise known as Pittsburgh, Pennsylvania, was somewhat fitting.  For so long, its reputation and prosperity rested on a dependable supply of specific raw materials – the very function that commodity position limits seek to protect.

Pittsburgh had arduously but successfully transitioned from its identity as a major steel manufacturing center for the better part of a century, to a more diversified economy, and then one of the few American cities to emerge from the 2008-09 global recession with continuing economic growth. It was for this stated reason that President Obama, as the official host of the 2009 G20 Summit, chose Pittsburgh as its site, taking place on 24-25 September. On a more practical note, New York City wasn’t available.  But the storyline was nonetheless inspiring: the glitzy world summit typically hosted in global capitals, attended by the world’s most important heads of state, and tasked with addressing the largest economic crisis in recent memory, would take place in the Little Old Steel Town That Could.

It wasn’t easy. Roads were repaved. Schools and universities closed. Alternative summits were held in protest, flanking both political sides of the G20’s agenda with a “Peoples Summit” as well as a “Freedom Conference.” Police officers were brought in from other States and, for the first time in America, new “sonic weapons” used to disperse unruly crowds. Blackhawk helicopters patrolled the skies, Humvees the streets, Coast Guard gunboats the waterways.

Cloistered from the surreal atmosphere, G20 officials produced a “Leaders’ Statement” that called for strong regulatory measures in response to the financial crisis, including increased oversight of commodity futures markets. This would not only help set the tone for the American government to authorize stronger position limits on commodity derivatives a year later (through the Dodd-Frank Act), but would also drive the EU to establish its first position limit regime.

Pittsburgh survived the summit, which in fact elevated the importance of a G20 that pronounced itself as “the premier forum for our international economic cooperation.”  And within a few short years, the European Parliament and Council would produce MiFID II, the EU’s largest piece of financial legislation since its origins, finding room in that text to acknowledge that “the G20 summit in Pittsburgh on 25 September 2009 agreed to improve the regulation, functioning and transparency of financial and commodity markets to address excessive commodity price volatility.” Hence the MiFID II position limit regime for commodity derivatives, which after some delays would ultimately take effect on 3 January 2018, arrived on the scene.

From a compliance perspective, one of the most significant aspects of MiFID II position limits is that they apply broadly, regardless of where the position holder may be based, and regardless of whether the position holder qualifies as a “MiFID firm” or “investment firm” as defined in MiFID parlance (these are mainly “sell-side” entities such as intermediaries). While in large part MiFID II requirements are restricted to such firms (see Article 2 of MiFID II), for the purpose of its position limits regime MiFID II extends to most types of entities (Article 1(6)).  An important exception is commercial firms taking relevant positions to reduce the risks in their commercial activities. Such “non-financial” entities engaging in hedging practices are exempt (Article 57(1)).

The wide variety of commodity derivatives covered by MiFID II position limits is also noteworthy for investment managers who need to know if their holdings are affected. Unlike the American federal regime which covers derivatives related to an enumerated set of underlying commodities, MiFID II position limits apply to “commodity derivatives” generally, defined broadly to include futures, options, swaps, forwards, and both physically-settled and cash-settled contracts. Moreover, investors will be caught by the regime not just for their EU-listed commodity derivative holdings, but also for any OTC contracts that are deemed “economically equivalent” to these. Significantly, contracts trading on “third-country” (e.g. non-EU) venues are considered as OTC for this purpose (with the exception of certain exchanges deemed, by EU financial regulator ESMA, to have sufficient supervisory safeguards).

Investment managers also need to be aware that the limit levels can change. MiFID II does not set precise position limits but requires EU Member States to do so within certain parameters (based for example on a percentage range of deliverable supply of the underlying commodity). Thus, after an EU country sets position limits on a particular derivative (e.g. a maximum of 20,000 lots of wheat futures during its spot month period), possible factors that may cause an eventual change to the limit can include a change in the commodity’s deliverable supply, or a review by the Member State or ESMA of the limit’s appropriateness or adherence to MiFID II standards. Moreover, market participants should remain cognizant that EU exchanges may choose to impose their own position limits on other products that may not be “commodity derivatives” under MiFID II, such as financial and index derivatives.

For a compliance officer tasked with adhering to the limits, another critical aspect involves how to calculate holdings (which indeed is important for position limit regimes everywhere). Aggregating similar products held, remaining attentive to “contract” or “lot” sizes, and properly combining positions held by related corporate entities are essential, for knowing how much is considered to be held under MiFID II position limit standards. In addition, knowing precisely when the “spot” period goes into effect (during which the limits are often dramatically lower) is critical. In its review of each Member State position limit under MiFID II, ESMA has published Opinions which can offer some helpful insight into some of these nuances (see, for example, three such Opinions published by ESMA in September 2020).  Note, too, that any Member State’s MiFID II position limit that is pending review by ESMA should still be adhered to (in other words, comply with the limit, rather than wait for ESMA to issue an Opinion that approves it).

Looking well ahead, investors can expect changes to MiFID II position limit rules. In April 2020, ESMA published its review and assessment of the regime’s effectiveness, suggesting these changes among others:

• Abandoning the limits on securitized derivatives that relate to commodities.
• Requiring limits only for commodity derivatives deemed to be important, based on open interest, number of market participants and the underlying commodity. (Alternatively, introducing an exemption for counterparties providing liquidity to the market.)
• Expanding the commercial hedging exemption, to include financial counterparties that are part of (and reducing risk for) a commercial group.
• Broadening the definition of the “same commodity derivative” trading on multiple venues (which requires the competent authority where the largest volume of trading occurs to set a single limit for all the relevant venues). Doing so would reduce the number of derivatives with the same underlying that are subject to different position limits in different Member States, hence reducing regulatory arbitrage.

Such changes require approval of the EU Commission, as part of a broad set of public consultations undertaken for much of MiFID II generally, which have been launched both by ESMA and by the Commission. The EU Parliament then needs to approve the resulting amendments. The takeaway for investors, therefore, is to periodically review developments (with the realization that such changes will not occur immediately).

As for Brexit, although the UK has officially left the EU, its financial regulator the FCA has stated that it will continue to impose its position limits that were mandated under MiFID II, even after the end of the Brexit transition period (slated for 31 December 2020). Moreover, in an October 2020 statement, ESMA acknowledged that commodity derivatives trading on some UK venues, from the moment these are considered to be “third-country trading venues” once the Brexit transition period ends, could be subject to MiFID II position limits if they are deemed to be “economically equivalent” OTC contracts. As referenced further above, any UK venue that ESMA determines has sufficient regulatory safeguards will not be considered to be hosting “OTC” products for this purpose, and hence would be out-of-scope for such MiFID II position limits. (ESMA stated that it will undertake such determinations about UK venues “before the end of the transition period”.)

A final note on two related frameworks, to avoid confusion. EU position limits are separate from “position reporting” and “position management controls,” which are not covered here. As they tend to be discussed in tandem (and sometimes confused) with position limits, be aware that position reporting requires daily reporting of commodity derivative holdings acquired OTC (MiFID II, Art. 58), while position management controls dictate that commodity derivative positions are subject to reduction by trading venues, who are tasked with monitoring open positions (MiFID II, Art. 57).  Because these regimes don’t always cover the same types of entities as do position limits, it’s helpful to keep in mind the proper terminology in use when assessing the scope and impact of the EU’s commodity derivative initiatives.

To submit a question to our Regulatory Guidance experts on position limits, please email info@cssregtech.com.