“Not Your Keys” Becomes Federal Law: The CFTC Finally Tells Exchanges How to Be Legal

The CFTC published a 108-page advance notice sketching an optional federal pathway for leveraged retail crypto trading while pinning the definition of “actual delivery” to private-key control — the first systematic answer from US regulators to the question of who truly holds the assets since FTX.

CFTC: The First Compliance Guide After a Decade of Enforcement

On October 13, 2026, the CFTC’s advance notice of proposed rulemaking, “Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets,” was officially published in the Federal Register under RIN 3038-AF80, covering 17 CFR Parts 1, 38, and 39, with public comments due December 14. The document was first unveiled on October 5 by CFTC Chairman Michael Selig at Fordham Law School’s blockchain regulatory symposium, where he quoted President Reagan’s famous line (“I’m from the government and I’m here to help”) and framed it as a turning point from punishment toward assistance.

The legal hook is Section 2(c)(2)(D) of the 2010 Dodd-Frank Act: any retail commodity transaction offered on a leveraged, margined, or financed basis must be executed as a futures contract on a registered exchange, unless the asset is “actually delivered” to the buyer within 28 days. For a decade, the CFTC enforced this rule against crypto firms — in the Kraken, Ooki DAO, and Uniswap cases — without ever telling the industry how to become compliant. This ANPR fills that void.

The most far-reaching reading concerns the definition of an “offer of leverage”: if an exchange’s onboarding documents, terms of service, or margin paperwork contain a leverage option, that “offer” attaches to every trade in the account — even when a customer pays in full. This means that as long as crypto assets sit on the exchange’s internal ledger rather than in the customer’s own wallet, a cash purchase could fall under futures-style regulation. The only way out of this framework is “actual delivery”: the customer obtains private-key control, or can independently transfer the assets off the exchange.

The “actual delivery” standard draws on the Ninth Circuit’s 2019 precedent in CFTC v. Monex Credit Co.: customers must gain “meaningful possession or control” of the asset. For crypto assets, the document’s answer is private-key possession. A book entry on an exchange’s internal ledger does not constitute actual delivery. Where a token carries staking or governance rights, actual delivery also requires that customers can exercise those rights directly, rather than through an intermediary that charges fees.

Reg CAM: One License, Dual Structure, One Reserve Audit

Regulation CAM designs a “Crypto Asset Market” as a subcategory of the designated contract market (DCM) license. The core structure: every covered trade must be intermediated by a futures commission merchant (FCM), which also holds customer tokens; a derivatives clearing organization (DCO) clears and settles; leverage can only come from an FCM or a qualified bank it sponsors, and every financing arrangement must be written into the exchange’s rulebook.

The document permits an integrated model, where one firm can register as exchange, broker, and clearinghouse simultaneously, while existing futures exchanges can offer these trades under their current license. It also preserves a segmented model that splits trading, financing, and clearing functions across different entities to avoid single points of failure. The design responds directly to the FTX collapse — the notice characterizes FTX as an $8 billion fraud, and Selig has been explicit that the goal is to “prevent FTX-style schemes, not just prosecute them afterwards.”

On customer protection, the document proposes third-party audited proof-of-reserves reports, targeting customer assets held in omnibus custodial accounts. Listing review would weigh token circulating supply, distribution, and vesting schedules to screen out assets prone to manipulation. Market surveillance would adapt to on-chain execution, price oracles, and cross-exchange activity. On the technical side, the notice discusses smart-contract vulnerability safeguards, validator diversity, formal verification, and emergency procedures.

The scope of regulation is not monolithic. The document is explicit: typical on-chain apps that deliver tokens directly to user wallets fall outside the regime; a de minimis exemption for venues with minimal activity is under consideration; and it asks whether exchanges could stay under the existing state-by-state spot framework. The notice poses 77 numbered questions, with 24 on core principles, 13 on broker rules, and 10 on margin.

SEC: The Intermediary Liability Gap Under a Comment-Period Deadline

While the CFTC opened its consultation window, the comment period for the SEC’s Regulation Crypto Assets (Release No. 33-11434, File No. S7-2026-27) closes on Monday, October 20. The proposal, released August 18 and published in the Federal Register on August 21, centers on two exemption tiers plus a safe harbor: a startup exemption (Rule 200) allows raises of up to $5 million over four years; a fundraising exemption (Rules 300-307) modeled on Regulation A permits $20 million per year at Tier 1 and $75 million per year at Tier 2; and Rule 400 lets issuers certify through Form TR that they have completed or permanently abandoned their promised “essential managerial efforts,” ending their status as an investment contract.

A&O Shearman’s analysis flags a structural gap: while the proposal offers a pathway for issuers, exchanges, brokers, and dealers transacting in covered investment contracts remain subject to existing federal securities law registration requirements, and Rule 500 explicitly excludes dealers from the secondary-market preemption provision. The fungibility of assets means secondary-market participants may struggle to distinguish how a token was originally sold, leaving the intermediary liability gap unresolved. The SEC acknowledged the gap in a footnote, stating it “will continue to consider whether further action with respect to covered investment contracts beyond the proposed rules in this release is warranted.”

Criticism is building. Five legal scholars — John Coates, John C. Coffee Jr., James D. Cox, Merritt B. Fox, and Joel Seligman — writing as the “Shadow SEC” on the CLS Blue Sky Blog, argue the proposal should be reproposed: 9,746 crypto assets were listed under existing exemptions between 2013 and 2024, suggesting the current framework already works; and the disqualification provisions in Rule 104 would not reach pre-existing bad conduct, effectively granting a free pass for prior misconduct.

The other leg of the administrative path runs through the Treasury. The comment period for Treasury’s proposal implementing Section 3 of the GENIUS Act (91 FR 53368, published August 19) closes on Sunday, October 19 — defining what counts as “issuing a payment stablecoin in the United States,” a safe harbor for foreign issuers, and the process for determining “comparable regulatory regimes.” Freshfields’ summary notes that Treasury has not yet proposed the process for making that “comparable regime” determination, yet the restriction on platforms offering foreign stablecoins takes effect on January 18, 2027 — a compliance obligation without a yardstick.

Key Takeaways for Practitioners