The National Futures Association ("NFA") proposed adoption of an Interpretive Notice that requires commodity pool operators ("CPOs") to adopt internal control systems to deter fraud, protect customer funds and pool assets, and assure the accuracy of pool records.

The Interpretive Notice will become effective 10 days after receipt of the submission by the CFTC, unless otherwise determined. The principal requirements of the Interpretive Notice are set forth below.

Internal Controls: The Interpretive Notice requires that CPOs have a robust control environment, including by implementing written policies to comply with applicable NFA and CFTC requirements. A CPO's written internal control policies should (i) explain the firm's internal controls, (ii) subject all personnel, including senior management, to internal control procedures, (iii) include escalation procedures for reporting individuals seeking to circumvent internal control procedures, and (iv) include procedures describing the circumstances in which matters should be reported to regulators.

Separation of Functions: Procedures should be reasonably designed to prevent individuals from being in a position to conceal errors or fraud. For this purpose, the Interpretive Notice generally requires firms to have different personnel to conduct day-to-day custody, trading, financial recordkeeping and risk functions from those who supervise those functions. Where supervisors themselves carry out those functions, a firm should assign different supervisory personnel to supervise those functions. In addition, the Interpretive Notice (i) requires firms to have different personnel carry out custodial functions from those who prepare financial reports (so that personnel with responsibility for custodial functions cannot conceal the misappropriation of funds) and (ii) prohibits firms from having any one individual with responsibility for all stages of redemptions, subscriptions and transfers of pool assets.

Pool Subscriptions, Redemptions and Transfers: Internal control procedures should be reasonably designed to protect investor and pool assets. Relevant internal control procedures include (i) verifying that pool assets are held in separate accounts in the pool's name, and are not commingled with other assets, (ii) conducting regular reconciliations of records of pool assets in the firm's ledger against the records of external custodians, (iii) verifying the authenticity of redemption requests, and accurately calculating and disbursing redemption proceeds to investors, and (iv) verifying that the CPO does not effect prohibited loans of pool assets to the CPO or affiliated entities in breach of NFA Compliance Rule 2-45.

Risk Management, Investment and Valuation of Pool Funds: A CPO should (i) verify that a pool's investments are authorized and that they conform to the pool's investment strategy, (ii) verify that the firm values pool investments in accordance with applicable valuation policies, (iii) conduct "ongoing" due diligence of counterparties and depositories, (iv) conduct "ongoing monitoring" of risks to investments held by third parties, including market and credit risk, and (v) conduct "ongoing monitoring" of a pool's liquidity so that a pool can meet its financial obligations, including redemption requests and margin calls.

Oversight of Administrators: A CPO must perform "adequate" due diligence on an administrator, including (i) conducting initial and "ongoing" due diligence on the administrator, (ii) obtaining evidence that the administrator's controls and security measures have been tested, either by the administrator's internal audit department or an independent consultant, and (iii) implementing appropriate controls to verify the accuracy of financial statements produced by the administrator (e.g., by confirming that financial statements produced by the administrator conform to "shadow books" maintained by the firm, or conducting periodic reconciliations with records produced by the firm's custodians).

Other Risks: In addition to the elements described above, the Interpretive Notice requires each firm to determine whether there are any other risks inherent in the firm's activities and operations, and implement appropriate internal controls to address those risks.

Commentary / Mark Highman

Many of the measures included in the Interpretive Notice reflect good control practices that firms already may have in place to safeguard investor funds and pool assets, and ensure the accuracy of financial statements provided to investors. However, the Interpretive Notice contains a number of specific requirements, and firms should adjust their existing procedures where necessary. In particular, firms should consider the following points in reviewing current practices in light of the Interpretive Notice:

Scope: The Interpretive Notice applies to all CFTC-registered CPOs, regardless of size. The Interpretive Notice does, however, acknowledge that a firm's internal control system may reflect its "size and complexity of operations." Further, the Interpretive Notice does not distinguish between the types of pools operated by a CPO (e.g., fully-regulated pools and pools operated under Rule 4.7). Absent specific exemptive guidance, it is likely that the NFA would read the Interpretive Notice as applying to all pools operated by a CFTC-registered CPO.

Written Procedures: While the Interpretive Notice acknowledges that some firms may have existing internal control procedures to meet the requirements of other regulators, firms still should conduct a "gaps analysis" to identify whether there are any other measures they need to adopt to meet the requirements of the Interpretive Notice.

Ongoing Requirements: The Interpretive Notice emphasizes that implementation of internal control procedures requires ongoing engagement by the firm. This includes conducting periodic reviews to determine the effectiveness of the firm's existing internal control procedures, assessing new risks arising from changes to the firm's activities or operations, and conducting ongoing monitoring of counterparties, depositories and administrators. Firms should thus consider what ongoing monitoring and due diligence to conduct, including the frequency of such reviews, methods of review, and circumstances that warrant specific reviews (e.g., changes to business activities, changes in market conditions, and geographic risks).

Personnel Issues: Concerning provisions of the Interpretive Notice requiring separation of certain functions, firms may need to make adjustments to personnel arrangements, including the appointment of new supervisors. Any new appointees should have the requisite expertise to supervise the relevant area, and should be aware of their regulatory responsibility for the areas under their supervision. In addition, the Interpretive Notice emphasizes the importance of senior management creating a strong internal control culture, and requires a firm's business and trading principals to play "a direct and primary role" in monitoring the risks involved in investment, custody and valuation of pool funds.

Recordkeeping: Firms should be mindful of the requirement to maintain records that "support the implementation and effectiveness" of the firm's internal control system. The NFA is likely to request internal control records in conducting audits of CPOs. Firms should document the steps they take to implement the requirements of the Interpretive Notice in order to demonstrate that they meet the overarching requirement to have an "adequate system of internal controls."

Supervisory Liability: The NFA is adopting the proposed Interpretive Notice under NFA Compliance Rule 2-9, which requires firms to "diligently supervise" their employees and agents in the conduct of CFTC-regulated activities. Firms thus should be on notice that failure to implement the requirements of the Interpretive Notice may provide grounds for enforcement action, particularly where internal control failures result in losses to investors. In those circumstances, both the firm and relevant supervisory personnel may be at risk of regulatory sanction. Both the CFTC and the NFA previously have sanctioned firms for failure to adequately monitor their administrators. See, e.g., Tillage Commodities and Cambridge Strategy Asset Management enforcement actions.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.