What does CFTC Staff Advisory 24-17 on AI say about AI in banking?

What are the key points of CFTC Staff Advisory 24-17 on AI?

• Defines AI per Executive Order 14110; applies to entities that design, develop, use, or evaluate AI 'directly or by a third-party service provider'
• DCMs/SEFs/SDRs: AI in order processing, market surveillance, and system safeguards must satisfy DCM Core Principles 2, 4, 9, 12 and 20, SEF Core Principles 2, 3, 4 and 14, and Regulation 49.24; controls required across all seven system-safeguard risk categories
• Registered entities must give staff advance notice of material planned changes to automated systems (Regulations 38.1051(f)(1), 37.1401(f)(1), 49.24(h)(1), 39.18(h))
• DCOs: Core Principles B, C, D, E and I continue to apply; Regulation 39.18(d)(2) makes a DCO responsible even when AI is outsourced
• Swap dealers using AI to calculate or collect initial margin under Regulation 23.152 must still confirm adequate system performance
• A CPO using generative AI to prepare disclosure documents or account statements remains fully subject to Part 4; FCMs using AI for segregated-funds accounting remain bound by Part 1 and Regulation 1.20
• Staff may raise AI in routine examinations and will keep evaluating the need for future regulation or guidance
• Chairman Behnam called it 'a measured first step'; Commissioner Johnson issued a concurring statement urging an AI Fraud Task Force and heightened penalties

What did CFTC Staff Advisory 24-17 on AI change for banks?

For bank swap dealers, FCMs, and exchange/clearing members it converted AI from an open question into an examination topic: firms are expected to have assessed AI risks, updated policies, procedures, controls and systems, and reviewed AI adoption for CEA compliance as they would any material system change. The explicit third-party point means vendor AI (including cloud and generative tools) sits inside the firm's own compliance perimeter.