Recherche vérifiée par sources: CFTC Passive Software NO

Verified source facts

1. CFTC staff announced the passive-software no-action position on September 17, 2026. 2. The relief is expressed as a staff no-action position rather than a generally applicable statutory exemption. 3. The operative staff letter and its conditions control the scope of reliance. 4. Custody, execution control, order routing and discretionary intervention are material boundary questions for software providers.

Comparison at a glance

1. Control test: Status

A trading-control disclosure is meaningful only when converted into a testable rule. For status, inspect announced, filed or live. Use a sandbox, non-production context, or the smallest reversible test available, then verify milestone. Capture configuration and event evidence without recording credentials, and verify the documented cancel, reject, decrement, or history behavior.

Model the failure path, not just the setup path. Ask which strategy owns the maker and taker orders, which account boundary the venue evaluates, which message reveals intervention, and how reconciliation behaves after a partial fill or disconnect. Platform documentation describes supported settings; it cannot prove that an operator configured them correctly. In this dimension, premature conclusion is therefore an explicit audit gap.

The status row should end with a concrete monitoring rule tied to announced, filed or live. Make the operator verify milestone, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; premature conclusion remains a separate production risk until observed.

2. Control test: Time

For time, inspect official UTC timestamp. Use a sandbox, non-production context, or the smallest reversible test available, then convert locally.

In this dimension, missed cutoff is therefore an explicit audit gap.

The time row should end with a concrete monitoring rule tied to official UTC timestamp. Make the operator convert locally, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; missed cutoff remains a separate production risk until observed.

3. Control test: Eligibility

For eligibility, inspect jurisdiction and account type. Use a sandbox, non-production context, or the smallest reversible test available, then check access.

In this dimension, blocked action is therefore an explicit audit gap.

The eligibility row should end with a concrete monitoring rule tied to jurisdiction and account type. Make the operator check access, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; blocked action remains a separate production risk until observed.

4. Control test: Instrument

For instrument, inspect spot, future or tokenized claim. Use a sandbox, non-production context, or the smallest reversible test available, then identify legal form.

In this dimension, category error is therefore an explicit audit gap.

The instrument row should end with a concrete monitoring rule tied to spot, future or tokenized claim. Make the operator identify legal form, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; category error remains a separate production risk until observed.

5. Control test: Execution

For execution, inspect book, pool or matching mode. Use a sandbox, non-production context, or the smallest reversible test available, then inspect mechanism.

In this dimension, fill surprise is therefore an explicit audit gap.

The execution row should end with a concrete monitoring rule tied to book, pool or matching mode. Make the operator inspect mechanism, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; fill surprise remains a separate production risk until observed.

6. Control test: Fees

For fees, inspect published schedule. Use a sandbox, non-production context, or the smallest reversible test available, then calculate total cost.

In this dimension, cost overrun is therefore an explicit audit gap.

The fees row should end with a concrete monitoring rule tied to published schedule. Make the operator calculate total cost, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; cost overrun remains a separate production risk until observed.

7. Control test: Liquidity

For liquidity, inspect venue and symbol specific. Use a sandbox, non-production context, or the smallest reversible test available, then check depth.

In this dimension, slippage is therefore an explicit audit gap.

The liquidity row should end with a concrete monitoring rule tied to venue and symbol specific. Make the operator check depth, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; slippage remains a separate production risk until observed.

8. Control test: Operations

For operations, inspect deposit, withdrawal or settlement. Use a sandbox, non-production context, or the smallest reversible test available, then verify live status.

In this dimension, stuck funds is therefore an explicit audit gap.

The operations row should end with a concrete monitoring rule tied to deposit, withdrawal or settlement. Make the operator verify live status, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; stuck funds remains a separate production risk until observed.

9. Control test: Evidence

For evidence, inspect primary notice and file number. Use a sandbox, non-production context, or the smallest reversible test available, then retain source.

In this dimension, audit gap is therefore an explicit audit gap.

The evidence row should end with a concrete monitoring rule tied to primary notice and file number. Make the operator retain source, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; audit gap remains a separate production risk until observed.

10. Control test: Stop rule

For stop rule, inspect material fact remains unverified. Use a sandbox, non-production context, or the smallest reversible test available, then pause and confirm.

In this dimension, unsupported decision is therefore an explicit audit gap.

The stop rule row should end with a concrete monitoring rule tied to material fact remains unverified. Make the operator pause and confirm, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; unsupported decision remains a separate production risk until observed.

Sources and editorial method

• Staff Issues No-Action Position to Providers of Passive Software — CFTC
• CFTC Staff Letters — CFTC
• FAQs on crypto assets and blockchain activities — CFTC