CFTC Request for Comment on Crypto: The Technical Questions

Video transcript

Comments on the CFTC's crypto markets advance notice are due December 14, 2026. Its technical questions are where exchanges and protocols can shape the rule.

This is an advance notice, not a proposed rule. With no rule text yet, now is the earliest point to influence it.

File by December 14 through Regulations.gov, using one method only. Cite the question number at the head of each answer.

Question V B 5 seven asks about testing, formal verification, audits and fail-safes for smart contracts. Say what each control proves and misses. None is enough alone.

Every fail-safe is also a privileged power. Describe what it can do, who holds it, the signing threshold, and the delay before it acts.

Validator count alone can mislead. Propose stake concentration, independence, client diversity, and who controls upgrades as better measures.

An asset-side reserves attestation can be accurate and still miss a shortfall. Strong methods state liabilities, control, encumbrance, timing and scope.

Structure each answer: who you are, the question reference, current practice, what it proves and misses, and a standard an examiner can test.

Guardian can supply the evidence behind your current practice, from audit reports to deployment verification. We are not a law firm. Read the full article or talk to Guardian.

The CFTC request for comment on crypto markets is an advance notice of proposed rulemaking (ANPRM), not a proposed rule. There is no rule text to mark up yet.

That makes this the earliest point to shape what follows. Its technical questions are where exchanges and protocols can shape the rule.

The Commission announced it on October 5, 2026 (Release 9307-26) and published it in the Federal Register on October 13.

This article explains the technical and security side of the CFTC's crypto ANPRM. It is not legal advice; confirm how it applies to you with counsel.

How to File by December 14

• Comments due: received on or before December 14, 2026.
• Citation: 91 FR 64811 (October 13, 2026), RIN 3038-AF80.
• Docket: CFTC-2026-2179 on Regulations.gov.

The notice gives three ways to file, and asks you to use only one:

1. Regulations.gov (encouraged), at regulations.gov/commenton/CFTC-2026-2179-0001.
2. Mail to the Secretary of the Commission, Three Lafayette Centre, 1155 21st Street NW, Washington, DC 20581.
3. Hand delivery or courier to the same address.

Reference the notice title and RIN 3038-AF80. Comments are published without removing personal or business information.

For confidential material, contact the staff listed in the notice before filing and follow 17 CFR 145.9.

Quote the question reference, such as V.B.5.vii, at the head of each answer. Staff can then map your letter to the question.

What the CFTC Is Considering

Regulation CTX would interpret when a retail crypto transaction falls under section 2(c)(2)(D) of the Commodity Exchange Act.

Its main exception, actual delivery, requires a meaningful degree of possession or control. The Commission preliminarily believes this may require holding the credentials, such as private keys.

It also preliminarily understands that onchain trading protocols typically give the buyer possession and control.

Regulation CAM would let an exchange listing only crypto asset transactions register as a crypto asset market, a new subcategory of designated contract market. All transactions would be intermediated by an FCM.

The notice follows the Commission's December 2025 withdrawal of its 2020 actual delivery guidance (90 FR 58149).

The technical questions, mapped:

Smart Contracts and Fail-Safes

Question V.B.5.vii is the core one. It asks how to judge a CAM's controls over smart contracts that execute without human intervention.

Then it asks: “Should the Commission require pre-deployment testing, formal verification, audit, or fail-safe mechanisms?”

None of them is sufficient alone. A useful answer separates what each one establishes:

A testable standard combines them. Each version that touches customer property gets independent review before deployment, with scope and commit stated.

Fixes are re-reviewed. Deployed code is verified against the reviewed commit, and privileged functions are monitored.

A bare requirement to “audit smart contracts” cannot be examined. It says nothing about which code, when, or by whom.

Fail-safes need their own answer. Pauses, circuit breakers, rate limits and upgrade keys all reduce harm in an incident. Each is also a privileged power someone holds.

Describe each by four facts: what it can do, who holds it, the signing threshold, and the delay before it takes effect.

A narrow pause held by a multisig with a short delay is a different risk from an upgrade key that can rewrite the contract immediately.

The same powers drive decentralization analyses. See which admin powers make a protocol centralized and how the decentralization tests compare.

Validators and Proof of Reserves

Question V.B.5.v asks whether “validator/operator count, independence, and geographic and client diversity” should feed a CAM's operational risk assessment.

Count alone can mislead. Propose better measures:

• Concentration: how few operators could halt the chain or finalize a conflicting history.
• Independence: validators sharing an entity, cloud provider or region count as one.
• Client diversity: the share on each client, since one client's bug can affect every node running it.
• Upgrade control: who can ship and activate protocol changes, and how quickly.

Self-run nodes (V.B.5.vi) reduce dependence on RPC providers, not consensus risk. Say which one your control addresses.

Section V.B.6 asks which proof of reserves practices to consider. An asset-side attestation can be accurate and still miss a shortfall if the liability side is incomplete.

A strong method states each of these:

• Liabilities: whether every customer balance is included, and how customers check theirs.
• Control: whether the exchange proved it can sign for the addresses.
• Encumbrance: whether the assets were lent, pledged or committed elsewhere.
• Timing: a single date, or continuous.
• Scope: which assets, chains and entities were included.

24/7 Operations and Incidents

Question V.B.3.iv asks how 24/7 markets bear on Core Principle obligations. V.B.5.iv asks about continuity for blockchains a CAM does not control.

The notice cites a May 29, 2026 staff advisory (Release 9239-26). It reminded firms extending to 24/7 trading and clearing that existing obligations still apply.

Concrete answers describe the runbooks: who can halt listing at 3 a.m. on a Sunday, and how a chain halt, fork or oracle failure is handled.

A Comment Letter Outline

1. Who you are and why the question affects you.
2. The question reference, such as V.B.5.vii.
3. Current practice, specific enough to be checked.
4. What the control proves and misses, in the terms above.
5. A proposed standard an examiner can test, proportionate to what the system can move.
6. Cost and timing, with assumptions stated.
7. Other regimes: SEC, state and foreign rules you already meet.

For how other regimes word these controls, see our crypto regulatory compliance guide.

The CFTC says the notice complements the SEC's August 18, 2026 safe harbor proposal, covered in our post on that proposal.

How Guardian Helps

Answers on current practice should rest on evidence. Guardian's regulatory compliance practice produces it.

That means audit reports with fix review, privileged role maps read from deployed contracts, deployment verification, pentests with retest and incident timelines.

For live systems, Managed Security monitors contracts on every block, with detections triaged by a Guardian engineer. We are not a law firm; the legal positions in your letter stay with your counsel.

Frequently Asked Questions

When are comments due on the CFTC crypto ANPRM?

Comments must be received on or before December 14, 2026. The notice was published in the Federal Register on October 13, 2026 (91 FR 64811, RIN 3038-AF80).

Is the CFTC crypto ANPRM a proposed rule?

No. It sets out the Commission's preliminary views and asks questions; there is no rule text yet. The comments will inform whether and how the CFTC proceeds.

How do I submit a comment to the CFTC?

Use Regulations.gov (docket CFTC-2026-2179), or mail or courier to the Secretary of the Commission. Reference the notice title and RIN 3038-AF80, and use only one method.

What does the CFTC ask about smart contracts?

Question V.B.5.vii asks whether to require pre-deployment testing, formal verification, audit or fail-safes. Question V.D.vi asks about smart contract margining and auto-liquidation.

Sources

• Federal Register: Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets, advance notice of proposed rulemaking, 91 FR 64811 (October 13, 2026)
• CFTC: Release 9307-26, CFTC Seeks Public Comment on Advanced Notice of Proposed Rulemaking Relating to Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets (October 5, 2026)
• CFTC: Release 9239-26, CFTC Staff Issues Advisory on 24/7 Trading, Clearing, and Settlement (May 29, 2026)
• Federal Register: Withdrawal of Interpretive Guidance: Retail Commodity Transactions Involving Certain Digital Assets, 90 FR 58149 (December 16, 2025)