CFTC Recordkeeping Requirements for Electronic Communications

A text message, a chat log, an email thread. None of these becomes a regulatory record simply because someone labels it that way. Under the Commodity Exchange Act, the recordkeeping obligation depends on whether the communication or other record is one that the Act or CFTC regulations require the relevant entity to make and keep.

The applicable requirement can depend on the entity, the transaction, and the nature of the communication. That distinction is the foundation of a defensible electronic communications recordkeeping program, and it is where many compliance frameworks become too broad or too simplistic.

This guide works through what CFTC Regulation 1.31 and related provisions require for electronic communications: what makes a record subject to the CFTC recordkeeping framework, how the retention requirements differ by record category, what “authenticity and reliability” means in practice, and where a recordkeeping program can break down before an examination exposes the problem.

What Qualifies as a Regulatory Record Under CFTC Rules

The CFTC does not define a regulatory record simply by format or communication channel. Regulation 1.31 applies to regulatory records that a records entity is required to make and keep under the Commodity Exchange Act or CFTC regulations.

That means an email, text message, instant message, chat, or other electronic communication can fall within the recordkeeping framework when another applicable CFTC requirement requires that communication to be made or retained.

For example, Regulation 1.35 imposes specific recordkeeping requirements on certain registrants for written communications concerning quotes, solicitations, bids, offers, instructions, trading, and prices that lead to the execution of commodity interest transactions and related cash or forward transactions.

Certain entities also have requirements to record and retain specified oral communications. For swap dealers and major swap participants, Part 23 contains additional requirements covering pre-execution communications and other records needed for trade reconstruction.

The important point is that the regulatory test is not simply “business communication equals regulatory record.” The applicable rule must be identified based on the entity and the activity involved.

Who Counts as a “Records Entity”

The term “records entity” is tied to the obligation to maintain regulatory records rather than functioning as a simple list of every type of CFTC registrant.

The broader CFTC recordkeeping framework reaches entities and other regulated parties that are required by the Commodity Exchange Act or Commission regulations to make and keep regulatory records. Depending on the applicable requirement, this can include:

• Futures commission merchants
• Introducing brokers
• Retail foreign exchange dealers
• Swap dealers and major swap participants
• Members of designated contract markets and swap execution facilities
• Designated contract markets, swap execution facilities, swap data repositories, and derivatives clearing organizations
• Commodity pool operators and commodity trading advisors
• Other entities or market participants subject to specific CFTC recordkeeping requirements

The obligations are not uniform across these categories. A requirement that applies to an FCM may not apply in the same way to a CTA, CPO, swap dealer, or other market participant.

That distinction becomes particularly important for electronic communications. A firm needs to identify the specific CFTC and, where applicable, NFA requirements that govern its business rather than assume that every communication channel is subject to one identical retention rule.

The Rule Framework Governing Electronic Communications: 1.31, 1.35, and Part 23

No single provision answers every electronic communications recordkeeping question. Regulation 1.31 establishes the general framework for retaining and producing regulatory records, while other provisions determine which records particular entities must make and keep.

Regulation 1.31: The General Standard

Regulation 1.31 provides the general framework for the retention, form, accessibility, inspection, and production of regulatory records required under the Act or CFTC regulations.

For most regulatory records, the baseline retention period is five years from the date the record was created, subject to specific rules that establish different periods for particular record categories. Electronic regulatory records must remain readily accessible for the duration of the required retention period.

The rule also requires records to be maintained in a form and manner that ensures their authenticity and reliability. For electronic regulatory records, records entities must establish appropriate systems and controls to support those objectives and the ability to produce records when required.

Regulation 1.35: Transaction and Communication Records

Regulation 1.35 contains more specific requirements for FCMs, RFEDs, IBs, and members of DCMs and SEFs.

For covered entities, the rule requires records of written communications concerning quotes, solicitations, bids, offers, instructions, trading, and prices that lead to the execution of commodity interest transactions and related cash or forward transactions.

Certain covered entities must also record specified oral communications leading to commodity interest transactions. The oral-recording requirement is narrower than the written-communication requirement and does not apply identically to every registrant.

The retention period also differs. Records of oral communications subject to Regulation 1.35 are generally retained for one year, while the specified written communications are retained for five years.

This is why a firm cannot simply create one communications-retention policy and assume that it covers every channel and record category correctly.

Part 23: Swap Dealer and Major Swap Participant Communications

Part 23 imposes additional recordkeeping requirements on swap dealers and major swap participants.

Regulation 23.202 requires daily trading records for swaps and related cash or forward transactions, including specified pre-execution communications and the information necessary to reconstruct transactions. These requirements cover communications relating to quotes, solicitations, bids, offers, instructions, trading, and prices that lead to the execution or conclusion of covered transactions.

Regulation 23.203 addresses the retention, location, and inspection of those records. In general, records relating to a swap transaction are retained through the termination, maturity, expiration, transfer, assignment, or novation of the transaction and for five years thereafter, while specified pre-execution communications are subject to the five-year-from-creation rule established through the amendments to Regulation 1.31. Records of specified oral communications have a one-year retention period.

The distinction matters because “swap records” is not one uniform retention category. A compliance program needs to identify the type of record before applying the retention clock.

Firms that are NFA members also need to account for NFA requirements. NFA Compliance Rule 2-9 imposes supervisory obligations, and NFA guidance addresses websites, social media, instant messaging, text messaging, email, and other electronic communications used in commodity interest business. NFA Compliance Rule 2-10 also incorporates CFTC Regulation 1.35 for applicable members.

A firm therefore needs to assess its CFTC and NFA obligations together where both apply. Meeting one requirement does not automatically establish compliance with every other applicable requirement.

Retention Periods and the Logic Behind Different Record Categories

Retention under the CFTC framework is not a single number applied to every record. The applicable period depends on the record and the rule requiring it to be maintained.

The important distinction is not simply between “short” and “long” retention periods. It is between the regulatory provision that requires the record and the event that starts the applicable retention clock.

For example, certain pre-execution communications under Part 23 are retained for five years from creation, while records of the underlying swap transaction can remain subject to the longer life-of-transaction-plus-five-year requirement. That difference is easy to lose when a firm reduces its entire communications program to one generic five-year policy.

The paper-versus-electronic distinction also matters. Regulation 1.31 requires electronic regulatory records to remain readily accessible for the duration of the required retention period, while paper-only regulatory records have a two-year readily accessible requirement.

The rule does not, however, require every regulatory record to reside in one centralized archive. The requirement is that the applicable records be retained in accordance with the rule and be available for inspection and production when required.

Systems and Controls: What Authenticity and Reliability Actually Require

Rule 1.31 does not prescribe one specific storage technology. Instead, it requires regulatory records to be created and retained in a form and manner that ensures their authenticity and reliability.

For electronic regulatory records, the rule requires appropriate systems and controls that support those objectives. The regulation is deliberately technology neutral, so compliance does not depend on deploying one particular storage architecture, immutability technology, hashing mechanism, or timestamping method.

In practice, a defensible electronic recordkeeping architecture should address several areas:

Record integrity

Systems should preserve the security, signature, and data necessary to establish the authenticity of electronic regulatory records.

Availability and production

The firm needs systems and controls that allow electronic records to be produced when required and remain available despite an emergency or disruption.

Retrieval and identification

Records need to be maintained in a manner that allows required records to be located and retrieved reliably.

Traceability

The firm should be able to demonstrate how records were captured, maintained, and handled when that information is relevant to establishing their reliability.

Controlled recordkeeping processes

The firm should understand which systems contain regulated records, which requirements apply to them, and how those records are preserved and produced.

These controls do not mean that CFTC rules mandate cryptographic hashing, blockchain, trusted timestamping, or WORM storage in every case.

Those technologies can be useful ways of implementing the authenticity and reliability requirements, particularly where a firm wants strong technical evidence that stored records have not been altered. They are implementation choices rather than universal CFTC-mandated technologies.

The more important question is whether the firm’s actual controls can demonstrate that the records it produces are reliable, authentic, complete, and available when required.

Production Standards: Form, Medium, and the Meaning of “Promptly”

Retention is only half of Rule 1.31. The other half is production.

CFTC rules give Commission representatives authority to inspect required records, and Regulation 1.31 requires records to be produced promptly in the form and medium requested by the Commission representative, unless otherwise directed.

“Promptly” is not expressed as one universal number of hours or days in Rule 1.31. The practical requirement is therefore not simply to have records somewhere in the organization. The firm needs an architecture capable of locating and producing the relevant records when requested.

That does not mean the CFTC requires a single enterprise archive or one search interface.

A firm can maintain records across multiple systems and still satisfy its obligations if those systems collectively support the required retention, accessibility, reliability, retrieval, and production requirements. The problem arises when records are distributed across systems that cannot be reliably searched, retrieved, reconstructed, or produced within the time required.

This is particularly relevant where electronic communications, trading records, transaction data, and legacy application records are maintained separately. The compliance question is not whether all of those records sit in one database. It is whether the firm can identify and produce the records that fall within the scope of a request without compromising their integrity or completeness.

Where Recordkeeping Programs Actually Fail

Communication capture technology is mature and widely deployed. The harder problems often appear after capture, where firms have to apply the right retention rules, preserve record integrity, and retrieve evidence across systems.

Capture without retention discipline

A tool that records a message does not by itself determine which CFTC requirement applies to that message or which retention clock should govern it. This becomes particularly important when a firm has different obligations for written communications, oral communications, swap records, and other regulatory records.

Silos that are difficult to search together

Messaging archives, trading systems, email platforms, and legacy applications may sit in separate systems. Each system can be compliant on its own while the overall production process remains slow or incomplete.

Weak evidence of record integrity

A capture system should not merely retain the message. The firm also needs appropriate controls to preserve authenticity and reliability and to demonstrate how the record has been maintained.

No controlled disposition process

CFTC retention periods generally establish how long required records must be maintained. Once the applicable period expires, a firm may still need to consider legal holds, investigations, litigation, overlapping regulatory requirements, and its own policies before disposing of records. Indefinite retention is not automatically a compliance strategy, and neither is automatic deletion when one retention clock expires.

Capture Tools Versus a Governed Archive

A capture tool answers whether a communication was collected. A governed archive addresses the broader question of how that record is retained, protected, located, and produced alongside other records subject to the firm’s regulatory and legal obligations.

How Archon Data Store Supports CFTC Recordkeeping Compliance

Archon Data Store approaches recordkeeping as an enterprise data governance problem rather than only a communications capture problem.

The platform can bring structured, semi-structured, and unstructured records from supported systems into a governed archival environment. That allows electronic communications to be managed alongside other historical enterprise records where those records are subject to retention, legal hold, access, and production requirements.

For the authenticity and reliability requirements under Rule 1.31, Archon Data Store can apply policy-driven immutability and WORM controls to archived records, with cryptographic hashing and timestamping available to strengthen the evidence surrounding record integrity. These are technical controls used to support the regulatory objective, rather than controls mandated by the CFTC in a specific technology format.

An append-only audit trail can record actions performed on archived records and provide additional evidence of how those records have been handled. Where a customer requires an additional independent verification layer, ledger-based anchoring can provide another mechanism for demonstrating record integrity.

Retention can be configured by record category and policy rather than forcing every record into one blanket period. Legal hold workflows can suspend disposition where records need to be preserved for litigation, investigation, or another hold condition. When a record is eligible for disposition, controlled workflows can provide approvals and an audit history before deletion occurs.

On the production side, metadata-driven search can reach across connected enterprise systems and provide a consolidated way to locate archived records. This can reduce the need to reactivate legacy applications simply to locate historical records, where the relevant data has already been migrated and archived into ADS.

The value is not that CFTC rules require one centralized archive. They do not.

The value is that a governed archival environment can make it easier for a firm to apply consistent retention, integrity, access, legal hold, search, and production controls across records that would otherwise remain scattered across multiple systems.

None of this replaces a firm’s existing communication capture tools. Instead, ADS can sit alongside the capture layer, providing a governed archival environment for captured communications and other records that need to remain accessible after they leave the operational systems where they originated.

Building a Defensible Electronic Communications Program

A recordkeeping program that holds up under scrutiny is built around the actual regulatory obligations, not a single technology purchase.

• Inventory the communication channels actually used for regulated business. Include corporate email, text messaging, instant messaging, mobile devices, chat platforms, and other channels where applicable. Then map each channel to the specific CFTC and NFA requirements that apply.
• Separate record categories before assigning retention periods. General regulatory records, written pre-trade communications, oral communications, swap records, and other categories may have different retention clocks. One blanket period can be either insufficient or unnecessarily broad.
• Apply appropriate authenticity and reliability controls. Immutability, hashing, timestamping, audit trails, and related technologies can strengthen the evidentiary record, but the objective is compliance with the regulatory standard rather than adoption of one prescribed technology.
• Design for retrieval and production, not just storage. A compliant archive that cannot reliably locate and produce the requested record creates a practical examination problem. Search, indexing, metadata, and production workflows should be tested against realistic regulatory requests.
• Coordinate CFTC and NFA obligations. Where both frameworks apply, review the requirements together. NFA supervisory and recordkeeping obligations can create additional requirements beyond the applicable CFTC baseline.
• Control disposition rather than defaulting to either automatic deletion or indefinite retention. Before disposition, check applicable retention periods, legal holds, investigations, overlapping regulatory requirements, and internal policies. The objective is a documented, defensible process.

None of this depends on banning messaging platforms outright. A communications policy can restrict prohibited channels, but the recordkeeping program still needs to account for how regulated business is actually conducted.

The practical objective is to identify regulated records when they are created, preserve them under the correct requirements, and make them retrievable and producible when the CFTC or another authorized party asks for them.