By Megan Wright, Compliance Director, U.S.
The National Futures Association (NFA) has released its latest Notice to Members on March 3, 2026. For commodity pool operators (CPOs) and commodity trading advisors (CTAs), these updates are essential for strengthening controls and staying ahead of compliance risk.
Cybersecurity: increased focus on programs, controls and training
Cybersecurity remains a top NFA enforcement priority. Examiners continue to evaluate whether Member Firms:
- Maintain a written Information Systems Security Program (ISSP)
- Implement secure systems to safeguard data
- Provide robust and timely cybersecurity training, with adequate documentation and cadence
Third-party service providers: demonstrating due diligence
Under NFA Interpretive Notice 9070, which requires Member Firms to maintain a documented framework to identify, monitor and mitigate outsourcing risk. The Notice emphasizes the importance of initial and ongoing due diligence of service providers – and being able to demonstrate both in an exam.
CFTC 4.7 thresholds: updated requirements in effect
CPOs and CTAs relying on the CFTC 4.7 exemption are reminded that updated portfolio requirement thresholds became effective March 26, 2025. Firms must confirm their compliance under the revised standards.
Pool financial reporting: know the trigger events
NFA outlined five scenarios which require prompt notification to the regulator – one such scenario, under NFA Rule 2-50, mandates a notification by 5pm CT the following business day.
How to prepare now
To maintain a strong compliance posture, NFA Members should:
- Review cybersecurity programs to ensure alignment with current expectations
- Issue and track cybersecurity training on a minimum annual basis and completed promptly for new hires
- Strengthen and document due diligence of third-party service providers
- Review pool activity regularly to ensure timely notification under Compliance Rule 2-50
At IQ-EQ, our U.S. regulatory compliance team closely monitors NFA developments and supports CPOs and CTAs in navigating evolving requirements with confidence.
Get in touch today to ensure your compliance framework is ready for 2026.
