The CFTC Wants to Let You Hold Your Own Keys

This article originally appeared in Galaxy Research's weekly newsletter. Subscribe to get timely insights delivered to your inbox every Friday morning.

WHAT HAPPENED

Michael Selig walked into a Fordham Law symposium on Monday, quoted Ronald Reagan on "the nine most terrifying words in the English language" (I'm from the Government, and I'm here to help), and then unveiled Regulation CTX, which is how the Commodity Futures Trading Commission plans to help.

The help, Reg CTX and its companion Reg CAM, fills a 108-page advance notice of proposed rulemaking (ANPR). The Dodd-Frank Act of 2010 says leveraged, margined, or financed retail commodity trades must happen on a registered exchange. The CFTC spent the last decade enforcing that requirement against crypto without explaining how to comply. Finally, the industry is getting a guide.

OUR TAKE

This ANPR is a fantastic starting point for the industry to work from. The questions are specific and well informed, which means the industry finally gets to argue about margin rules and custody, instead of coming in with comments and leaving with a Wells notice.

Let’s back up: Traditional futures markets are deliberately split into separate pieces. The exchange (a designated contract market, or DCM) matches trades, enforces rules, and surveils its markets. The broker (a futures commission merchant, or FCM) holds your money, segregated from its own, at approved depositories, backed by net capital and watched over by the National Futures Association. The clearinghouse (a derivatives clearing organization, or DCO) steps into the middle of every trade, guarantees both sides, and has to keep enough resources to survive the default of its largest member. One company can own several of these; the CME Group owns both an exchange and a clearinghouse, but each is a separate registration with its own rulebook.

Crypto exchanges were never built that way, partly because of the bearer nature of crypto, and partly because of a lack of regulatory guidance. They list, match, settle, and custody all in one place, with your coins recorded as a line on their internal ledger. Reg CAM wouldn’t force crypto exchanges to break up these functions into different entities. It would let a crypto asset market register as its own FCM, its own DCO, or both, a "fully integrated CAM" (a structure Coinbase asked for last year in a comment letter).

Now yes, an exchange that is also your broker, your lender, and your clearinghouse is roughly what FTX was. The CFTC's answer is that FTX already ran the experiment and that the CFTC’s regulations worked to protect the minority of FTX customers under its purview.

Selig noted: "Although FTX had a U.S. subsidiary with state money transmitter licenses, its customers’ funds were nowhere to be found. However, the customer property held by FTX’s CFTC-registered subsidiaries remained segregated and secure” (in contrast to 130 other FTX affiliates that the ANPR noted went bankrupt).

The integrated structure is for Coinbase and other existing U.S. crypto exchanges. The rest of the document is for everyone else, and it's where things get interesting.

It is a strange and lovely thing to watch a futures regulator arrive, through 300 footnotes of case law, at "not your keys, not your coins."

Delivery: A trade escapes the exchange requirement if it results in "actual delivery" within 28 days, and Reg CTX finally sketches what that means for crypto. Real delivery "may require possession of the credentials (e.g., private key(s))," which we anticipate means that coins on an exchange's internal ledger don't count, but coins in a wallet where you hold the private keys probably do. The CFTC "preliminarily understands" that onchain trading protocols typically deliver assets "directly to the purchaser's digital wallet." Once that happens, footnote 279 says the agency "no longer has jurisdiction" beyond policing fraud and manipulation. It is a strange and lovely thing to watch a futures regulator arrive, through 300 footnotes of case law, at "not your keys, not your coins" in an ANPR (and also tweet the slogan).

"For those who prefer to do things the way the cypherpunks originally envisioned…we aim to provide the clarity needed for onchain finance to flourish," Selig said.

We’re not lawyers, but to us this suggests a Uniswap-style swap into your own wallet needs no CAM, no DCM, and no FCM. It's heartening to see the two market regulators converge here: when the Securities Exchange Commission released its innovation exemption last month, departing Commissioner Hester Peirce said peer-to-peer smart contract trading doesn't need an exemption at all. And last week the SEC proposed custody rules that would let state trust companies hold crypto for investment advisers and funds and even let advisers hold the keys themselves when no qualified custodian will. Both regulators seem to have settled on “your keys, your coins” as federal policy (sorry, Noah Doe).

Vaults: So the trade itself can get out of the CFTC's reach. The interface used to make it might not. Reg CTX treats an "offer" of leverage very broadly: it can live in a platform’s terms of service and attach to "all transactions available on an exchange." Question IV.B.iii in the ANPR asks whether offering access to onchain "vaults" through "the same exchange interface in which retail customers may purchase crypto assets" counts as an offer of leverage. It's an open question with a lot of money riding on it. Coinbase lets customers borrow USDC against their crypto through Morpho and lend USDC into Morpho vaults curated by Steakhouse Financial, which helps fund those same loans. Both sit in the same app where those customers buy crypto. It's hard to find a more literal match for "the same exchange interface."

Code Tests and Audits: For smart contracts that run "without human intervention or discretion," the Commission asks whether to require "pre-deployment testing, formal verification, audit, or fail-safe mechanisms." Code audits are notoriously low-signal, with many of the largest crypto exploits coming from smart contracts that have been audited. A formalized structure for evaluating smart contract code may be useful, but it feels more like a bit of regulatory box to check than anything that will improve crypto market functioning. That said, advancements in LLM coding capabilities and improvements to fuzzing and formal verification techniques may make this impactful down the line.

Proof of Reserves: The proposed rules describe proof of reserves as a third-party auditor attesting that reserves "are sufficient to cover all liabilities to its customers," and asks about versions using "innovative applications of blockchain technologies." We believe that this should go in the rule, and the blockchain version is a superior solution to traditional audits. Reserves sit onchain where anyone can see them, and liabilities can be committed to a Merkle tree so that not only proof of reserves, but proof of solvency can be demonstrated.

A Regulated Onchain Exchange: This is the big one. Section V.B of the ANPR asks whether the Commission should "confirm that a CAM (or DCM) may use a blockchain system as its matching and execution layer." Put that next to the testing questions and it is our view that you can almost see a compliant Hyperliquid, with an onchain order book behind an FCM-gated, KYC'd door for U.S. users. The price of admission is probably transparency. A regulator can't formally verify a signed binary, and Hyperliquid's node software is still distributed that way. We believe that a compliant instance might involve open-sourcing the code.

Refreshing as it is, it is our view that this ANPR is a consolation prize. Congress had the chance to put market structure into law with the CLARITY Act and fumbled it in the Senate. What we got instead isn't even a proposed rule yet. It's an advance notice from a Commission with exactly one commissioner, and anything an agency writes can be erased by the next administration.

Still, a body of thoughtful work like this makes it harder for the next administration to pretend the market structure questions are simple, or that crypto exchanges are flagrant rule breakers. With luck, it drags the fight out of cable news and back into boring boardrooms with bad coffee. Comments are due 60 days after Federal Register publication, so if you have opinions about vaults, liens, or proof of solvency, now is the time to file them.

Selig closed his speech on a high note: "Satoshi's technological revolution has transformed global financial markets. If America can embrace this paradigm shift and get the right regulations in place, we can usher in a golden age like those that followed the transformative technologies of the past."

The government is here to help. For once, the help mostly consists of letting you keep your own keys.