CFTC 24/7 Trading: An Operational Resilience Checklist
Quick answer. Staff Letter 26-16 creates no new obligations: existing CFTC obligations simply apply around the clock. DCMs, SEFs, DCOs and FCMs should show continuous surveillance, high availability, live-safe change management, tested weekend margin and liquidity, protected segregation, and early staff engagement.
Video transcript
The CFTC's twenty four seven staff advisory creates no new obligations. Existing ones simply apply around the clock.
Staff Letter twenty six sixteen, issued May 29, 2026, covers DCMs, SEFs, DCOs and FCMs. Staff encourage engagement before going continuous.
The 2024 operational resilience proposal was withdrawn in September 2025. The governing texts are the rules already in force.
With short maintenance windows or none, releases ship into a live market. Staff expect redundancy, no single points of failure, rolling upgrades, live cutovers and back-out procedures. That is guidance, not a zero-downtime rule.
Staff expect surveillance and real-time monitoring overnight and on weekends. Security monitoring runs on the same clock. A Sunday intrusion now meets an open order book.
Continuous trading does not mean continuous clearing. Staff describe three collateral models: traditional hours, optional weekend posting and required weekend posting. A stablecoin that moves on Sunday is not automatically eligible collateral.
In Guardian's review of Veranta, an onchain perp exchange, 106 of 110 listed pairs had no backup feed at the examined block. A historical finding about one venue.
Give each check an owner and evidence before you file or launch. This is Guardian's synthesis, not a CFTC form.
Read the full checklist. Guardian Managed Security watches contracts, signing, cloud and domains around the clock, with an engineer on every alert. It does not replace market surveillance.
What the CFTC Staff Advisory Says
On May 29, 2026, three CFTC divisions issued Staff Letter 26-16, an advisory on 24/7 trading, clearing and settlement. Commodity Futures Trading Commission
This checklist maps it, and the rules it points back to, onto evidence a venue can hold. It covers operations and security, not legal advice.
The advisory comes from the Divisions of Clearing and Risk, Market Oversight and Market Participants. It covers DCMs, SEFs and DCOs extending to 24/7, and the FCMs intermediating them.
It is informational and creates no new obligations. Every existing obligation under the Commodity Exchange Act and Commission rules applies around the clock.
Staff encourage firms to engage with them before going continuous, and will review plans and supporting analysis. Foley & Lardner
Staff see crypto derivatives as possibly well suited to 24/7 trading, given their digital infrastructure and global reach. Agricultural derivatives may be less so, given regional markets, customer bases and specialized hedging.
Answering the CFTC's later crypto ANPRM instead? Our guide to its technical questions covers that consultation.
| Related action | Date | What it does |
|---|---|---|
| KalshiEX BTCPERP order | May 29, 2026 | Approves one perpetual contract under Regulation 40.3 |
| Perpetual contracts policy statement | 91 FR 33160, published June 3, 2026 | Favors case-by-case review for other perpetuals |
| CME Submission 26-114 | Certified May 28; effective May 29, 2026 | 24/7 trading and clearing hours for CME crypto futures and options |
Where this article discusses regulation, it covers the technical and security side only. It is not legal advice; confirm how the rules apply to you with counsel.
FCM Operational Resilience: The Withdrawn Rule
On January 24, 2024, the CFTC published a proposed operational resilience framework for FCMs, swap dealers and major swap participants (89 FR 4706). Federal Register, U.S. Government Publishing Office, Commodity Futures Trading Commission
It was never adopted. Announced September 9, 2025, the withdrawal took effect as of September 8, per the Federal Register notice published September 11.
The CFTC said it would reconsider how the proposal interacted with other regulators' resilience rules. Reviving it would take new proposed rules.
The resilience rules that apply are the ones already in force, read through the advisory: Office of the Federal Register, eCFR, U.S. Government Publishing Office
| Registrant | Existing rule | Already requires |
|---|---|---|
| DCM | 17 CFR 38.1050 and 38.1051 | Operational risk controls, change management, testing, continuity, incident notices |
| SEF | 17 CFR 37.1400 and 37.1401 | Safeguards, change management, testing, continuity, prompt notices |
| DCO | 17 CFR 39.18 and 39.13 | Six operational risk domains, testing cadence, margin and collateral quality |
| FCM | 17 CFR 1.11 | Written risk program covering operational, settlement, segregation and technology risk |
Change Management in a Live Market
A weekday venue can patch on Saturday. A 24/7 venue has short windows or none, so many releases ship into a live market.
DCM rules already name the controls, including configuration and patch management, pre-production and regression testing, change approvals and vendor management. Office of the Federal Register, eCFR
SEFs carry parallel duties, including timely advance notice to staff of material planned changes.
The advisory lists high-availability measures such as no single points of failure, redundancy, real-time data synchronization, parallel production environments, rolling upgrades, live cutovers and back-out procedures. Commodity Futures Trading Commission, Legal 500, contributed by Katten
These are staff expectations, not a zero-downtime rule. CME's self-certified 24/7 crypto schedule still keeps a two-hour Saturday window and two-minute weekday maintenance windows.
Part 40 filings for 24/7 should explain the changes, risk effects and mitigations, Core Principle compliance, and any substantive opposing views not adopted.
For each production change, hold evidence that it can fail safely:
- Approval record and regression results for the exact version deployed
- Component health checks before and after cutover
- A back-out procedure rehearsed with timings, not just written down
- Trading and clearing records reconciled after any rollback
Monitoring and On-Call Response
The advisory expects DCMs and SEFs to keep enough compliance staff for audit-trail review, trade-practice and market surveillance, and real-time monitoring, overnight and weekend sessions included. Their regulatory service providers need the same coverage. Commodity Futures Trading Commission, Foley & Lardner
Staff warn 24/7 trading can thin liquidity, raise volatility and widen spreads, so surveillance and disruption controls must work at every hour.
Staff also advise against settling during illiquid overnight or weekend periods in the underlying market, where prices are easier to manipulate or distort.
Security monitoring runs on the same clock. An intrusion before dawn on a Sunday now meets an open order book.
SEFs must promptly notify staff of specified trading halts, malfunctions, cybersecurity incidents or threats, and continuity plan activations. Office of the Federal Register, eCFR
DCOs must test for vulnerabilities at least quarterly. Annual minimums cover internal pentests, external pentests by an independent contractor, incident response plan tests and a technology risk assessment.
Name who can halt trading or withdrawals at any hour. Our crypto exchange incident response plan is a first-hour runbook, from declaring an incident to halting withdrawals and notifying partners.
Buying weekend coverage? Our guide to Web3 MDR lists the SLA terms to pin down.
Weekend Margin and Stablecoin Settlement
Continuous trading does not mean continuous clearing. Staff describe three collateral call models: traditional hours, optional weekend posting and required weekend posting. Commodity Futures Trading Commission, Foley & Lardner, Legal 500, contributed by Katten
Where collection stays weekday-only, the DCO must still show enough resources and liquidity through multi-day bank closures. It should also assess the gap between trading and clearing frequencies.
Section 39.13 requires initial margin matched to product and portfolio risk. Margin assets need minimal credit, market and liquidity risk, with haircuts and concentration limits. Office of the Federal Register, eCFR
Weekend models keep collateral eligibility standards in force. Staff point to reliable movement, conversion between collateral types, exposure monitoring and default management.
Stablecoins may ease weekend transfers but bring other risks. A token that moves on Sunday is not thereby eligible collateral, or saleable in a default.
Coinbase Financial Markets' May 29 relief, for customer digital commodities and payment stablecoins posted to an affiliated foreign broker, is conditional. It is not permission for every FCM.
FCMs must keep customer funds segregated at all times. Staff warn that weekend volatility without settlement can strain segregation and capital compliance. Legal Information Institute, Cornell Law School
That means reassessing residual interest, which section 1.11 says must be documented so regulators can reproduce it, and considering customer prefunding. U.S. Government Publishing Office
Staff also flag cascading auto-liquidations when customers cannot top up margin, and the need for clear risk disclosures.
- Who approves a weekend wallet movement, and who backs them up?
- Does the receiving FCM, DCO or custodian credit transfers on a Sunday?
- What happens if the chain, custodian or conversion route is down?
- Can defaulted collateral become usable liquidity before banks reopen?
Chains, Oracles and Custodians
A 24/7 venue inherits the hours and failure modes of every chain, oracle, custodian and bank it relies on.
Staff also expect FCMs to confirm that front-office, back-office and third-party systems can run overnight and on weekends, per Katten's summary of the advisory. Legal 500, contributed by Katten
DCM safeguards expressly cover vendor management. A DCO that outsources a resource keeps full responsibility for meeting the requirements. Office of the Federal Register, eCFR
Section 39.13 also requires DCO procedures for prices that are unavailable or unreliable. Oracle fallbacks are where that procedure meets code.
Guardian's review of Veranta, an onchain perp exchange, shows how a fallback can exist mostly on paper. At the examined Base block, 106 of 110 listed pairs had no backup feed. Guardian Security
Stale backups were skipped silently, so a faulty primary price could settle trades without the backup check (M-15, Medium, acknowledged). It is a historical observation of one onchain venue.
The lesson carries over: an independent fallback per material market, freshness limits per feed, and degraded modes that block new exposure but keep exits and liquidations open.
A 24/7 Readiness Checklist
Give each row an owner and evidence before you file or launch. This is Guardian's synthesis, not a CFTC form.
| Check | Evidence to hold | Red flag |
|---|---|---|
| Product fit | Written case for why this product suits 24/7 | One template for crypto and agricultural contracts |
| Trading vs clearing hours | Separate schedules for trading, margin calls and settlement | Assuming 24/7 trading means 24/7 clearing |
| Filing and staff contact | Part 40 analysis, opposing views, staff engagement record | Engaging staff only after launch |
| Live changes | Approvals, regression results, rehearsed back-out timings | Live releases with no health checks or rehearsed back-out |
| Coverage | Weekend surveillance and security rotas, tested escalation | Weekend alerts queue until Monday |
| Notices | Call tree reaching notice owners at any hour | Nobody authorized to notify staff on weekends |
| Margin and default | Liquidity through bank closures, haircuts, weekend default drill | Collateral accepted because it transfers on Sunday |
| FCM segregation | Residual interest reassessed for weekend moves; prefunding policy | Segregation checked only on business days |
| Critical providers | Provider hours, fallbacks and outsourcing responsibilities mapped | One oracle, custodian or bank with no fallback |
Frequently Asked Questions
Is there a compliance deadline for CFTC 24/7 trading?
No. The advisory has no compliance date. The August 26, 2026 deadline belonged to a separate request for comment on 24/7 standard futures and energy perpetuals, and has passed. The CFTC hosts a public roundtable on 24/7 trading on December 15, 2026. Commodity Futures Trading Commission
Does 24/7 clearing change a DCO's recovery time objective?
Not by itself, and the advisory sets no new target. Section 39.18 sets a DCO recovery objective of the next business day, but systemically important and Subpart C DCOs must resume clearing and settlement within two hours under section 39.34. Office of the Federal Register, eCFR
Can a security provider cover the weekend surveillance expectation?
No. Staff's surveillance point concerns trading conduct, a compliance function. Security monitoring answers a different duty, system safeguards. Guardian's Managed Security watches contracts, multisigs, cloud and domains around the clock, with an engineer responding. It does not replace market surveillance, clearing staff, treasury liquidity or legal advice. Guardian Security, Commodity Futures Trading Commission
Related reading
- crypto exchange security
- perp dex security
- crypto incident reporting requirements
- omnibus vs segregated crypto wallets
- equity perps explained
Sources
- Commodity Futures Trading Commission: CFTC Staff Issues Advisory on 24/7 Trading, Clearing, and Settlement
- Commodity Futures Trading Commission: CFTC Staff Letters: entries for Letters 26-16, 26-17 and 26-19
- Commodity Futures Trading Commission: CFTC Issues Withdrawal of Operational Resilience Framework Proposed Rules
- Federal Register, U.S. Government Publishing Office: Operational Resilience Framework: Withdrawal of Proposed Regulatory Action, 90 FR 43949
- Office of the Federal Register, eCFR: 17 CFR Part 38 Subpart U: System Safeguards
- Office of the Federal Register, eCFR: 17 CFR Part 37 Subpart O: System Safeguards
- Office of the Federal Register, eCFR: 17 CFR 39.18: System safeguards
- Office of the Federal Register, eCFR: 17 CFR 39.13: Risk management
- U.S. Government Publishing Office: 17 CFR 1.11: Risk Management Program for futures commission merchants
- Legal Information Institute, Cornell Law School: 17 CFR 1.11: Risk Management Program for futures commission merchants
- Office of the Federal Register, eCFR: 17 CFR 40.6: Self-certification of rules
- Legal 500, contributed by Katten: No Closing Bell: CFTC Staff Advisory Provides Guidance on 24/7 Trading and Clearing
- Foley & Lardner: 24/7 Trading and Clearing: Recent CFTC Developments and Key Issues for Market Participants
- Federal Register, U.S. Government Publishing Office: Policy Statement Concerning the Listing of Perpetual Contracts, 91 FR 33160
- Commodity Futures Trading Commission: CFTC Approves BTCPERP Contract Submitted by KalshiEX, LLC
- Commodity Futures Trading Commission: Commission Staff Confirms Categorization of Certain Crypto Asset Perpetuals as Foreign Futures
- Commodity Futures Trading Commission: CFTC Extends Public Comment Period on 24/7 Trading and Energy Perpetual Contracts
- Guardian Security: Published Smart Contract Audit Reports
- Guardian Security: Veranta V2 Review, M-15: Most pairs lack effective oracle backups
- Guardian Security: Managed Digital Asset Security Services
- Commodity Futures Trading Commission: CFTC to Host Roundtable on 24/7 Trading
- Commodity Futures Trading Commission: CFTC Staff Letter No. 26-16: Staff Advisory for Extending Trading and/or Clearing Operations to a 24 hours-a-day, 7 days-a-week Basis
- Office of the Federal Register, eCFR: 17 CFR 39.34: System safeguards for systemically important DCOs and Subpart C DCOs
- Commodity Futures Trading Commission: CFTC Industry Filing 60767: CME expansion of cryptocurrency futures and options trading and clearing hours
- Commodity Futures Trading Commission: CME Submission No. 26-114: 40.6(a) Certification for expansion of cryptocurrency futures and options hours
Cover the Hours Your Venue Never Closes
Guardian Managed Security watches contracts, signing, cloud and domains around the clock, reviews deployments and configuration changes as they land, and puts an engineer on every alert.