The exchange that went dark

When a reporting node stops reporting

On 29 September 2022, the Commodity Futures Trading Commission settled with CX Futures Exchange, L.P., a designated contract market then being renamed FMX Futures Exchange, for $6.5 million. The order reads as three faults braided together, but they share a single consequence. A designated contract market is not just a venue where people trade; it is a source node in the apparatus the Commission uses to see the market. When it stops feeding that apparatus, the regulator goes blind in exactly the places the exchange was supposed to illuminate.

The core of it is a reporting failure of unusual duration. Beginning in 2017 and running for years, CX failed to report more than two hundred thousand options and swaps transactions, both to the Commission directly under one rule and to a swaps data repository under another. For a stretch, the same transactions were invisible to both. The order records that reporting to the repository had not resumed even as of the date it was signed, roughly five years after it stopped.

Around that sit two more faults. The exchange's system-safeguards program, the regime meant to keep critical market infrastructure resilient and secure, was largely a shell: a risk assessment that identified only three risks and none specific to the exchange, a board that reviewed none of it, a migration of the entire platform to the cloud with no penetration testing and no advance notice to the Commission. And at the origin of the reporting gap was a representation CX had made to Commission staff, to obtain relief from one reporting duty, that it was satisfying another, when it should have known it was not.

Three faults, one settlement

The reporting failures span two separate regimes. Under Regulation 16.02, a designated contract market must report transaction data on its options to the Commission so that the Commission's market and financial surveillance can function. From 2017 through June 2020, CX failed to report more than two hundred thousand of its binary-option and pari-mutuel weather-contract transactions under that rule. Separately, under Parts 43 and 45, swaps must be reported to a registered swaps data repository. CX had done so since 2013, but in November 2017 it stopped reporting its binary-option transactions to the repository, and it had not resumed by the time of the order in 2022. The Commission describes why this matters in plain terms: without accurate and complete data, its ability to detect and prevent market disruptions, to enforce speculative position limits, and to measure the financial risk large positions pose is compromised.

The system-safeguards findings describe an oversight regime that existed mostly on paper. Between 2017 and 2020, neither CX nor its outside administrative-services provider kept a library of the automated systems and controls that were supposed to be the subject of its risk oversight, and neither ran controls testing to confirm those controls worked as intended. The enterprise technology risk assessments were generic: the 2020 assessment identified only three risks applicable to CX and analyzed no CX-specific threats at all. The board of directors received and reviewed none of those assessments, and none of the IT testing results, across that entire period. When CX migrated its systems to a cloud platform between September 2019 and April 2020, a material change to critical infrastructure, it conducted no internal or external penetration testing in connection with the move, contrary to its own provider's policy, and it did not tell Commission staff about the change until after it had happened.

The third fault is the one that colors the rest. In 2017, CX asked Commission staff for a no-action letter regarding its repository-reporting obligations. Staff granted the relief, relying in part on CX's representation that it was providing the transactional information required under Regulation 16.02. That representation was contrary to the facts: CX should have known it was not reporting that data. The false statement violated Section 6(c)(2) of the Commodity Exchange Act. CX settled all of it without admitting or denying the findings, and the Commission credited its cooperation and its remediation, which included back-reporting the Commission data and committing to provide the missing swap data to a repository.

Why reporting is a market-integrity control

It is tempting to file transaction reporting under back-office hygiene, a box to be ticked after the real work of running a market is done. This case is a clean argument against that view. The Commission's surveillance of manipulation, its enforcement of position limits, and its measurement of systemic risk all run on data that the regulated firms themselves supply. When a designated contract market stops reporting, it does not simply fall out of compliance with a technical rule; it removes a whole category of activity from the regulator's field of vision. Two hundred thousand transactions reported to no one is not a paperwork lapse. It is a surveillance outage, and the firm that caused it was the one entity positioned to know the outage existed.

The duration is what elevates the matter. Reporting systems break all the time, and the enforcement record is full of firms that misfired a feed, backreported, and moved on. What distinguishes CX is that the gap persisted for years and, for the repository channel, had not been closed even when the order was signed. A short outage is an incident. A multi-year silence is a control that was never really owned. Somewhere in the organization, the question of whether the firm was actually reporting had no owner who checked, which is the same pathology that let a risk assessment ship with three generic risks and a board that reviewed none of it.

That points at the deeper theme, which is the hazard of inherited, outsourced assurance. CX relied on an administrative-services provider for much of its safeguards program, and what it received was an enterprise-wide risk assessment that did not analyze CX's specific threats, applied to CX without adaptation. This is the same failure mode that recurs across financial-crime and controls cases: a firm accepts a generic artifact produced by a third party as if it were its own tailored analysis. Responsibility for system safeguards, like the responsibility to report, stays with the licensed entity. A provider can do the work; it cannot hold the obligation.

The false representation is the hinge, and it carries the sharpest governance lesson. CX obtained regulatory relief on a premise that was not true, and a no-action letter resting on a false premise is not the shield it appears to be. Representations to a regulator are themselves controls: the comfort a firm receives is only as sound as the facts it asserts to get it. When those facts are wrong, the relief does not merely evaporate, it becomes an independent violation, and the exposure compounds rather than contains. Any firm that seeks interpretive relief, no-action comfort, or an extension should treat the accuracy of its representations as a first-order control, verified before it is asserted, not after.

None of this required bad intent, and the Commission did not find a market was harmed. It found an exchange that had quietly stopped doing the things that let the market be watched, and had told the regulator otherwise. The remediation, back-reporting and new daily-confirmation processes, is the tell: the fix for a silent failure is a control that makes the silence impossible to miss.

Six gaps, one blind regulator

Each finding removed a different kind of visibility, whether into the market, into the exchange's own systems, or into the truth of what it had told the Commission.

What this case asks every reporting firm

The first and most portable lesson is that reporting completeness needs an owner and a heartbeat. The failure here was not a wrong field or a late file; it was a channel that simply went quiet and stayed quiet for years. Firms guard against that with a positive confirmation that reporting happened each day, a reconciliation of what was executed against what was reported, and an alert when the count drops to zero. CX's own remediation, implementing processes to confirm that data is reported each trading day, is the control that should have existed all along. Silence should be the loudest alarm in a reporting program, not the quietest.

The second is that regulatory relief is conditional, and the conditions are controls. A no-action letter, an exemption, or an interpretive comfort almost always rests on representations the firm makes and conditions it agrees to keep. Those are not one-time statements; they are ongoing obligations that need an owner, a periodic re-verification, and a trigger to revisit the relief if the underlying facts change. A firm that relies on relief without tracking whether it still qualifies is building on a foundation it has stopped inspecting.

The third is that outsourced assurance is not assurance. CX leaned on a service provider whose enterprise-wide risk assessment never analyzed CX's own threats, and treated that as sufficient. Any firm that receives a risk assessment, a control test, or a safeguards review from a third party should ask whether it actually analyzes this entity, this infrastructure, these threats, or whether it is a template with a different name on the cover. The licensed firm owns the obligation regardless of who holds the pen.

The fourth is that change management is where safeguards are won or lost. A migration of critical systems to the cloud is precisely the moment to test, because it is the moment most likely to introduce a vulnerability or break a control. Running that change with no penetration testing, against the firm's own stated policy, and without notifying the regulator, is the kind of decision that looks like speed in the moment and like a finding in hindsight. Material changes to market infrastructure deserve the most testing, not the least.

Each maps to a specific gap in the finding map above, and each is a question a firm can answer about its own program today, well before an examiner asks it.

The CFTC's long line on reporting

Swap and transaction reporting is one of the most heavily enforced corners of the CFTC's docket, and the cases rhyme: a reporting system that was incomplete, inaccurate, or silent, usually for years, usually discovered late. These three are drawn from that line and, between them, cover the parts of the CX story that are not unique to it.

CX's $6.5 million sits comfortably inside this line, and the comparison makes the point that size of penalty tracks scale and candor, not the type of firm. A designated contract market, a global swap dealer, and a foreign bank all answer to the same expectation: report completely, report accurately, and tell the regulator the truth about whether you are doing so.

Where the scrutiny is moving

Two themes in this case are getting hotter, not cooler. The first is reporting completeness as a market-integrity priority in its own right. For years, data-reporting enforcement was seen as a secondary concern next to manipulation and fraud. That has changed. Regulators have come to treat the integrity of the data feed as foundational, because every other form of surveillance depends on it, and they have shown they will bring significant actions where the data is incomplete even absent any proven market harm. A firm that regards its regulatory reporting as a cost center is misreading where enforcement attention now sits.

The second is system safeguards and technology resilience at market infrastructure. Exchanges, clearinghouses, and the large intermediaries that connect to them are increasingly judged on whether their risk assessments are real, their change management is disciplined, and their boards actually see the technology risk they are accountable for. The CX findings, a generic risk assessment, an untested cloud migration, a board that reviewed nothing, read like a checklist of what examiners are now trained to look for as critical systems move to the cloud and as cyber risk climbs the supervisory agenda. The rarity of system-safeguards enforcement to date makes each such case a louder signal of intent.

Underneath both sits the oldest theme of all, which is candor. The detail that turned a set of operational failures into a Section 6(c)(2) violation was a representation to the regulator that was not true. Across regimes and borders, the one thing supervisors treat as non-negotiable is the honesty of what firms tell them, and relief obtained on a false premise is a fault that outlasts the operational problem that produced it. For any firm reading this case as a forecast, the message is layered: report completely, build safeguards that are genuinely your own, and above all, make sure that everything you have told your regulator is still true.