NFA Clears Use of Cloud-Based Data Recovery Sites

NFA amended its business continuity rule and the related interpretive notice to let members use cloud-based applications as their primary or back-up data recovery sites instead of physical locations, effective immediately.

Compliance Rule 2-38 requires members who are futures commission merchants ("FCMs"), introducing brokers, commodity pool operators, or commodity trading advisor members, along with forex dealer members ("FDMs"), to maintain a written business continuity and disaster recovery plan reasonably designed to let the firm keep operating, reestablish operations, or transfer its business to another member with minimal disruption. A separate subsection has required FCMs, swap dealers ("SDs"), major swap participants ("MSPs"), and FDMs to report the location, address, and telephone number of their primary and alternative disaster recovery sites. Interpretive Notice 9052, which applies to all members, had required a physical back-up facility, according to NFA.

NFA said in a Notice to Members, along with its proposal letter to the CFTC, that the site-reporting obligation in Rule 2-38(b) is now conditional: an FCM, SD, MSP, or FDM must provide the location and telephone number of its recovery sites only if it maintains a physical primary or alternative site. A member running cloud-only recovery has nothing to report. NFA left Subsections (a) and (c) untouched, noting that neither requires other membership categories to supply physical locations. The association's letter also observed that Subsection (b) applies to MSPs but that it currently has no MSP members.

The interpretive notice changes are narrower but reach the full membership. The revised text swaps references to back-up "facilities" for "processing infrastructure," and names cloud-based services and/or physical facilities as acceptable temporary back-up arrangements. The geographic separation guidance survives: primary and back-up infrastructure should sit in reasonably separate areas, with the interpretive notice citing different power grids and different telecommunication vendors as examples.

The association invoked the 10-day provision of CEA Section 17(j) ("Registered futures associations") rather than seeking affirmative CFTC approval, a route that let the amendments take effect 10 days after the Commission received the August 17, 2026, proposal letter absent a CFTC decision to review them (see prior coverage). The Commission did not intervene, and the amendments are now in force.