NFA Proposes Dropping Site-Disclosure Requirement for Cloud-Only Disaster Recovery

The NFA proposed amending its business continuity rules to condition the disaster recovery site-disclosure requirement on whether futures commission merchants, swap dealers, and forex dealer members maintain a physical site.

In the proposal submitted to the CFTC, the NFA sought to update requirements that currently obligate those categories of association members to provide the location and telephone number of primary and alternative disaster recovery sites. The requirement does not reach the full NFA membership. Under the proposed amendment to NFA Compliance Rule 2-38 ("Business Continuity and Disaster Recovery Plan"), the disclosure obligation would apply only if a member maintains a physical site. A member that uses only cloud-based recovery would have no physical site to report.

The NFA also proposed minor amendments to NFA Interpretive Notice 9052 ("NFA Compliance Rule 2-38: Business Continuity and Disaster Recovery Plan"), which applies to all members. The revised notice updates references from physical facilities to processing infrastructure and expressly recognizes cloud-based services as an acceptable backup arrangement alongside third-party physical facilities.

The NFA invoked the 10-day provision of CEA Section 17(j) ("Registered futures associations"). The association said the amendments could become effective as early as 10 days after the CFTC receives the August 17, 2026, submission. That timeline does not apply if the NFA requests CFTC review and approval within the 10-day window or if the Commission notifies the NFA that it will review the proposals for approval.