For purposes of this section, the following terms are defined as follows:

Examinations expert is defined as a Nationally recognized accounting and auditing firm with substantial expertise in audits of futures commission merchants, risk assessment and internal control reviews, and is an accounting and auditing firm that is acceptable to the Commission; and

Self-regulatory organization means a contract market (as defined in § 1.3) or a registered futures association under section 17 of the Act. The term “self-regulatory organization” for purpose of this section does not include a swap execution facility (as defined in § 1.3).

Each self-regulatory organization must adopt rules prescribing minimum financial and related reporting requirements for members who are registered futures commission merchants or registered retail foreign exchange dealers. Each self-regulatory organization other than a contract market must adopt rules prescribing minimum financial and related reporting requirements for members who are registered introducing brokers. The self-regulatory organization's minimum financial and related reporting requirements must be the same as, or more stringent than, the requirements contained in §§ 1.10 and 1.17, for futures commission merchants and introducing brokers, and §§ 5.7 and 5.12 of this chapter for retail foreign exchange dealers; provided, however, that a self-regulatory organization may permit its member registrants that are registered with the Securities and Exchange Commission as securities brokers or dealers to file (in accordance with § 1.10(h)) a copy of their Financial and Operational Combined Uniform Single Report under the Securities Exchange Act of 1934 (“FOCUS Report”), Part II, Part IIA, or Part II CSE, as applicable, in lieu of Form 1-FR; provided, further, that such self-regulatory organization must require such member registrants to provide all information in Form 1-FR that is not included in the FOCUS Report Part II, Part IIA, or Part CSE provided by such member registrant. The definition of adjusted net capital must be the same as that prescribed in § 1.17(c) for futures commission merchants and introducing brokers, and § 5.7(b)(2) of this chapter for futures commission merchants offering or engaging in retail forex transactions and for retail foreign exchange dealers.

In addition to the requirements set forth in paragraph (b)(1) of this section, each self-regulatory organization that has a futures commission merchant member registrant must adopt rules prescribing risk management requirements for futures commission merchant member registrants that shall be the same as, or more stringent than, the requirements contained in § 1.11.

Each self-regulatory organization must establish and operate a supervisory program that includes written policies and procedures concerning the application of such supervisory program in the examination of its member registrants for the purpose of assessing whether each member registrant is in compliance with the applicable self-regulatory organization and Commission regulations governing minimum net capital and related financial requirements, the obligation to segregate customer funds, risk management requirements, financial reporting requirements, recordkeeping requirements, and sales practice and other compliance requirements. The supervisory program also must address the following elements:

Adequate levels and independence of examination staff. A self-regulatory organization must maintain staff of an adequate size, training, and experience to effectively implement a supervisory program. Staff of the self-regulatory organization, including officers, directors, and supervising committee members, must maintain independent judgment and its actions must not impair its independence nor appear to impair its independence in matters related to the supervisory program. The self-regulatory organization must provide annual ethics training to all staff with responsibilities for the supervisory program.

Ongoing surveillance. A self-regulatory organization's ongoing surveillance of member registrants must include the review and analysis of financial reports and regulatory notices filed by member registrants with the designated self-regulatory organization.

High-risk firms. A self-regulatory organization's supervisory program must include procedures for identifying member registrants that are determined to pose a high degree of potential financial risk, including the potential risk of loss of customer funds. High-risk member registrants must include firms experiencing financial or operational difficulties, failing to meet segregation or net capital requirements, failing to maintain current books and records, or experiencing material inadequacies in internal controls. Enhanced monitoring for high risk firms should include, as appropriate, daily review of net capital, segregation, and secured calculations, to assess compliance with self-regulatory organization and Commission requirements.

On-site examinations. (A) A self-regulatory organization must conduct routine periodic on-site examinations of member registrants. Member futures commission merchants and retail foreign exchange dealers must be subject to on-site examinations no less frequently than once every eighteen months. A self-regulatory organization shall establish a risk-based method of establishing the scope of each on-site examination; provided, however, that the scope of each on-site examination of a futures commission merchant or retail foreign exchange dealer must include an assessment of whether the registrant is in compliance with applicable Commission and self-regulatory organization minimum capital, customer fund protection, recordkeeping, and reporting requirements.

A self-regulatory organization other than a contract market must establish the frequency of on-site examinations of member introducing brokers that do not operate pursuant to guarantee agreements with futures commission merchants or retail foreign exchange dealers using a risk-based approach, which takes into consideration the time elapsed since the self-regulatory organization's previous examination of the introducing broker.

A self-regulatory organization must conduct on-site examinations of member registrants in accordance with uniform examination programs and procedures that have been submitted to the Commission.

Adequate documentation. A self-regulatory organization must adequately document all aspects of the operation of the supervisory program, including the conduct of risk-based scope setting and the risk-based surveillance of high-risk member registrants, and the imposition of remedial and punitive action(s) for material violations.

In addition to the requirements set forth in paragraph (c)(1) of this section, the supervisory program of a self-regulatory organization that has a registered futures commission merchant member must satisfy the following requirements:

The supervisory program must set forth in writing the examination standards that the self-regulatory organization must apply in its examination of its registered futures commission merchant member. The supervisory program must be based on controls testing and substantive testing, and must address all areas of risk to which the futures commission merchant can reasonably be foreseen to be subject. The supervisory program must be based on an understanding of the internal control environment to determine the nature, timing and extent of the controls and substantive testing to be performed. The determination as to which elements of the supervisory program are to be performed on any examination must be based on the risk profile of each registered futures commission merchant member.

All aspects of the supervisory program, including the standards pursuant to paragraph (c)(2)(iii) of this section, must, at minimum, conform to auditing standards issued by the Public Company Accounting Oversight Board as such standards would be applicable to a non-financial statement audit. These standards would include the training and proficiency of the auditor, due professional care in the performance of work, consideration of fraud in an audit, audit risk and materiality in conducting an audit, planning and supervision, understanding the entity and its environment and assessing the risks of material misstatement, performing audit procedures in response to assessed risk and evaluating the audit evidence obtained, auditor's communication with those charged with governance, and communicating internal control matters identified in an audit.

The supervisory program must, at a minimum, have standards addressing the following:

The ethics of an examiner;

The independence of an examiner;

The supervision, review, and quality control of an examiner's work product;

The evidence and documentation to be reviewed and retained in connection with an examination;

The sampling size and techniques used in an examination;

The examination risk assessment process;

The examination planning process;

Materiality assessment;

Quality control procedures to ensure that the examinations maintain the level of quality expected;

Communications between an examiner and the regulatory oversight committee, or the functional equivalent of the regulatory oversight committee, of the self-regulatory organization of which the futures commission merchant is a member;

Communications between an examiner and a futures commission merchant's audit committee of the board of directors or other similar governing body;

Analytical review procedures;

Record retention; and

Required items for inclusion in the examination report, such as repeat violations, material items, and high risk issues. The examination report is intended solely for the information and use of the self-regulatory organizations and the Commission, and is not intended to be and should not be used by any other person or entity.

A self-regulatory organization must cause an examinations expert to evaluate the supervisory program and such self-regulatory organization's application of the supervisory program at least once every three years.

The self-regulatory organization must obtain from such examinations expert a written report on findings and recommendations issued under the consulting services standards of the American Institute of Certified Public Accountants that includes the following:

A statement that the examinations expert has evaluated the supervisory program, including the sufficiency of the risk-based approach and the internal controls testing thereof, and comments and recommendations in connection with such evaluation from such examinations expert;

A statement that the examinations expert has evaluated the application of the supervisory program by the self-regulatory organization, and comments and recommendations in connection with such evaluation from such examinations expert; and

The examinations expert's report should include an analysis of the supervisory program's design to detect material weaknesses in an entity's internal control environment;

A discussion and recommendation of any new or best practices as prescribed by industry sources, including, but not limited to, those from the American Institute of Certified Public Accountants, the Public Company Accounting Oversight Board, the Institute of Internal Auditors, and The Risk Management Association.

The self-regulatory organization must provide the written report to the Commission no later than thirty days following the receipt thereof. The self-regulatory organization may also provide to the Commission a response, in writing, to any of the findings, comments or recommendations made by the examinations expert. Upon resolution of any questions or comments raised by the Commission, and upon written notice from the Commission that it has no further comments or questions on the supervisory program as amended (by reason of the examinations expert's proposals, considerations of the Commission's questions or comments, or otherwise), the self-regulatory organization shall commence applying such supervisory program as the standard for examining its registered futures commission merchant members for all examinations conducted with an “as-of” date later than the date of the Commission's written notification.

The supervisory program must require the self-regulatory organization to report to its risk and/or audit committee of the board of directors, or a functional equivalent committee, with timely reports of the activities and findings of the supervisory program to assist the risk and/or audit committee of the board of directors, or a functional equivalent committee, to fulfill its responsibility of overseeing the examination function.

The initial supervisory program shall be established as follows. Within 180 days following the effective date of this section, or such other time as the Commission may approve, the self-regulatory organization shall submit a proposed supervisory program to the Commission for its review and comment, together with a written report that includes the elements found in paragraphs (c)(2)(iv)(A)(1) and (3) of this section from an examinations expert who has evaluated the supervisory program. The self-regulatory organization may provide the Commission a written response to any findings, comments or recommendations made by the examinations expert. Upon resolution of any questions or comments raised by the Commission, and upon written notice from the Commission that it has no further comments or questions on the proposed supervisory program as amended (by reason of the considerations of the Commission's questions or comments or otherwise), the self-regulatory organizations shall commence applying such supervisory program as the standard for examining its members that are registered as futures commission merchants for all examinations conducted with an “as-of” date later than the date of the Commission's written notification.

The examinations expert's report, the self-regulatory organization's response, as well as any information concerning the supervisory program or any review conducted pursuant to the program that is obtained by the examinations expert, is confidential. Except as expressly provided for in this section, such information may not be disclosed to anyone not involved in the review process.

Any two or more self-regulatory organizations may file with the Commission a plan for delegating to a designated self-regulatory organization, for any registered futures commission merchant, retail foreign exchange dealer, or introducing broker that is a member of more than one such self-regulatory organization, the function of:

Monitoring and examining for compliance with the minimum financial and related reporting requirements and risk management requirements, including policies and procedures relating to the receipt, holding, investing and disbursement of customer funds, adopted by such self-regulatory organizations and the Commission in accordance with paragraphs (b) and (c) of this section; and

Receiving the financial reports and notices necessitated by such minimum financial and related reporting requirements; provided, however, that the self-regulatory organization that delegates the functions set forth in this paragraph (d)(1) shall remain responsible for its member registrants' compliance with the regulatory obligations, and if such self-regulatory organization becomes aware that a delegated function is not being performed as required under this section, the self-regulatory organization shall promptly take any necessary steps to address any noncompliance.

If a plan established pursuant to paragraph (d)(1) of this section applies to any registered futures commission merchant, then such plan must include the following elements:

The Joint Audit Committee. The self-regulatory organizations that choose to participate in the plan shall form a Joint Audit Committee, consisting of all self-regulatory organizations in the plan as members. The members of the Joint Audit Committee shall establish, operate and maintain a Joint Audit Program in accordance with the requirements of this section to ensure an effective and a high quality program for examining futures commission merchants, to designate the designated self-regulatory organizations that will be responsible for the examinations of futures commission merchants pursuant to the Joint Audit Program, and to satisfy such additional obligations set forth in this section in order to facilitate the examinations of futures commission merchants by their respective designated self-regulatory organizations.

The Joint Audit Program. The Joint Audit Program must, at minimum, satisfy the following requirements.

The purpose of the Joint Audit Program must be to assess whether each registered futures commission merchant member of the Joint Audit Committee self-regulatory organization members is in compliance with the Joint Audit Program and Commission regulations governing minimum net capital and related financial requirements, the obligation to segregate customer funds, risk management requirements, including policies and procedures relating to the receipt, holding, investment, and disbursement of customer funds, financial reporting requirements, recordkeeping requirements, and sales practice and other compliance requirements.

The Joint Audit Program must include written policies and procedures concerning the application of the Joint Audit Program in the examination of the registered futures commission merchant members of the Joint Audit Committee self-regulatory organization members.

Adequate levels and independence of examination staff. A designated self-regulatory organization must maintain staff of an adequate size, training, and experience to effectively implement the Joint Audit Program. Staff of the designated self-regulatory organization, including officers, directors, and supervising committee members, must maintain independent judgment and its actions must not impair its independence nor appear to impair its independence in matters related to the Joint Audit Program. The designated self-regulatory organization must provide annual ethics training to all staff with responsibilities for the Joint Audit Program.

Ongoing surveillance. A designated self-regulatory organization's ongoing surveillance of futures commission merchant member registrants over which it has oversight responsibilities must include the review and analysis of financial reports and regulatory notices filed by such member registrants with the designated self-regulatory organization.

High-risk firms. The Joint Audit Program must include procedures for identifying futures commission merchant member registrants over which it has oversight responsibilities that are determined to pose a high degree of potential financial risk, including the potential risk of loss of customer funds. High-risk member registrants must include firms experiencing financial or operational difficulties, failing to meet segregation or net capital requirements, failing to maintain current books and records, or experiencing material inadequacies in internal controls. Enhanced monitoring for high risk firms should include, as appropriate, daily review of net capital, segregation, and secured calculations, to assess compliance with self-regulatory and Commission requirements.

On-site examinations. A designated self-regulatory organization must conduct routine periodic on-site examinations of futures commission merchant member registrants over which it has oversight responsibilities. Such member registrants must be subject to on-site examinations no less frequently than once every eighteen months. A designated self-regulatory organization shall establish a risk-based method of establishing the scope of each on-site examination, provided, however, that the scope of each on-site examination of a futures commission merchant must include an assessment of whether the registrant is in compliance with applicable Commission and self-regulatory organization minimum capital, customer fund protection, recordkeeping, and reporting requirements. A designated self-regulatory organization must conduct on-site examinations of futures commission merchant registrants in accordance with the Joint Audit Program.

The Joint Audit Committee members must adequately document all aspects of the operation of the Joint Audit Program, including the conduct of risk-based scope setting and the risk-based surveillance of high-risk member registrants, and the imposition of remedial and punitive action(s) for material violations.

The Joint Audit Program must set forth in writing the examination standards that a designated self-regulatory organization must apply in its examination of a registered futures commission merchant. The Joint Audit Program must be based on controls testing and substantive testing, and must address all areas of risk to which the futures commission merchant can reasonably be foreseen to be subject. The Joint Audit Program must be based on an understanding of the internal control environment to determine the nature, timing and extent of the controls and substantive testing to be performed. The determination as to which elements of the Joint Audit Program are to be performed on any examination must be based on the risk profile of each registered futures commission merchant.

All aspects of the Joint Audit Program, including the standards required pursuant to paragraph (d)(2)(ii)(G) of this section, must, at minimum, conform to auditing standards issued by the Public Company Accounting Oversight Board as such standards would be applicable to a non-financial statement audit. These standards would include the training and proficiency of the auditor, due professional care in the performance of work, consideration of fraud in an audit, audit risk and materiality in conducting an audit, planning and supervision, understanding the entity and its environment and assessing the risks of material misstatement, performing audit procedures in response to assessed risk and evaluating the audit evidence obtained, auditor's communication with those charged with governance, and communicating internal control matters identified in an audit.

The Joint Audit Program must have standards addressing those items listed in paragraph (c)(2)(iii) of this section.

The initial Joint Audit Program shall be established as follows. Within 180 days following the effective date of this section, or such other time as the Commission may approve, the Joint Audit Committee members shall submit a proposed initial Joint Audit Program to the Commission for its review and comment, together with a written report that includes the elements found in paragraphs (d)(2)(ii)(I)(1) and (d)(2)(ii)(I)(3) of this section from an examinations expert who has evaluated the Joint Audit Program. The Joint Audit Committee members may also provide to the Commission a response, in writing, to any of the findings, comments or recommendations made by the examinations expert. Upon resolution of any questions or comments raised by the Commission, and upon written notice from the Commission that it has no further comments or questions on the proposed Joint Audit Program as amended (by reason of the considerations of the Commission's questions or comments or otherwise), the designated self-regulatory organizations shall commence applying such Joint Audit Program as the standard for examining their respective registered futures commission merchants for all examinations conducted with an “as-of” date later than the date of the Commission's written notification.

Following the establishment of the Joint Audit Program, no less frequently than once every three years, the Joint Audit Committee members must cause an examinations expert to evaluate the Joint Audit Program and each designated self-regulatory organization's application of the Joint Audit Program. The Joint Audit Committee members must obtain from such examinations expert a written report, and must provide the written report to the Commission no later than forty-five days prior to the annual meeting of the members of the Joint Audit Committee to be held in that year pursuant to paragraph (d)(2)(iii)(A) of this section. The Joint Audit Committee members may also provide to the Commission a response, in writing, to any of the findings, comments or recommendations made by the examinations expert. The examinations expert's written report must include the following:

A statement that the examinations expert has evaluated the Joint Audit Program, including the sufficiency of the risk-based approach and the internal controls testing thereof, and comments and recommendations in connection with such evaluation from such examinations expert;

A statement that the examinations expert has evaluated the application of the Joint Audit Program by each designated self-regulatory organization, and comments and recommendations in connection with such evaluation from such examinations expert;

The examinations expert's report on findings and recommendations issued under the consulting services standards of the American Institute of Certified Public Accountants and should include an analysis of the supervisory program's design to detect material weaknesses in an entities internal control environment; and

A discussion and recommendation of any new or best practices as prescribed by industry sources, including, but not limited to, those from the American Institute of Certified Public Accountants, the Public Company Accounting Oversight Board, the Internal Audit Association and The Risk Management Association.

The examinations expert's report, the Joint Audit Committee's response, as well as any information concerning the supervisory program or any review conducted pursuant to the program that is obtained by the examinations expert, is confidential. Except as expressly provided for in paragraphs (d)(2)(ii)(G) or (d)(2)(ii)(H) of this section, such information may not be disclosed to anyone not involved in the review process.

The Joint Audit Program must require each Joint Audit Committee member to provide to its risk and/or audit committee of the board of directors, or a functionally equivalent committee, with timely reports of the activities and findings of the Joint Audit Program to assist the risk and/or audit committee of the board of directors, or a functionally equivalent committee, in fulfilling its responsibility of overseeing the examination function.

Meetings of the Joint Audit Committee. (A) No less frequently than once every year, the Joint Audit Committee members must meet to consider whether changes to the Joint Audit Program are appropriate, and in considering such, in meetings corresponding to the written report obtained from an examinations expert pursuant to paragraph (d)(2)(ii)(I) of this section, the Joint Audit Committee members must consider such written report, including the results of the examinations expert's assessment of the Joint Audit Program and any additional recommendations. The Commission's questions, comments and proposals must also be considered. Upon written notice from the Commission that it has no further comments or questions on the Joint Audit Program as amended (by reason of the examinations expert's proposals, considerations of the Commission's questions, comments and proposals, or otherwise), the designated self-regulatory organizations shall commence applying such Joint Audit Program as the standard for examining their respective registered futures commission merchants for all examinations conducted with an “as-of” date later than the date of the Commission's written notification.

In addition to the items considered in paragraph (d)(2)(iii)(A) of this section, the Joint Audit Committee members must consider the following items during the annual meeting:

The role of the Joint Audit Committee and its members as it relates to self-regulatory organization responsibilities;

Developing and maintaining the Joint Audit Program for all designated self-regulatory organizations to follow with no exceptions;

Coordinating self-regulatory organization responsibilities with those of independent certified public accountants, the Commission and other regulators and self-regulatory organizations (e.g., the Securities and Exchange Commission, the Financial Industry Regulatory Authority, and others, as the case may be for futures commission merchants subject to regulation by multiple regulators and self-regulatory organizations);

Coordinating and sharing information between the Joint Audit Committee members, including issues and industry concerns in connection with examinations of futures commission merchants;

Identifying industry regulatory reporting issues and financial and operational internal control issues and modifying the Joint Audit Program accordingly;

Issuing risk alerts for futures commission merchants and/or designated self-regulatory organization examiners on an as-needed basis as issues arise;

Issuing an annual examination alert for certified public accountants and designated self-regulatory organization examiners;

Responding to industry issues;

Providing industry feedback to Commission proposals; and

Developing and maintaining a standard of ethics and independence with which all examination units of the Joint Audit Committee members must comply.

Minutes must be taken of all meetings and distributed to all members on a timely basis.

The Commission must receive timely prior notice of each meeting, have to right to attend and participate in each meeting and receive written copies of the reports and minutes required pursuant to paragraphs (d)(2)(ii)(J) and (d)(2)(iii)(C) of this section, respectively.

The plan referenced in paragraph (d)(1) of this section shall not be effective without Commission approval pursuant to paragraph (h) of this section.

Any plan filed under this section may contain provisions for the allocation of expenses reasonably incurred by designated self-regulatory organizations among the self-regulatory organizations participating in such a plan.

A plan's designated self-regulatory organizations must report to:

That plan's other self-regulatory organizations any violation of such other self-regulatory organizations' rules and regulations for which the responsibility to monitor or examine has been delegated to such designated self-regulatory organization under this section; and

The Director of the Division of Swap Dealer and Intermediary Oversight of the Commission any violation of a self-regulatory organization's rules and regulations or any violation of the Commission's regulations for which the responsibility to monitor, audit, or examine has been delegated to such designated self-regulatory organization under this section.

The Joint Audit Committee members may, among themselves, establish programs to provide access to any necessary financial or related information.

After appropriate notice and opportunity for comment, the Commission may, by written notice, approve such a plan, or any part of the plan, if it finds that the plan, or any part of it:

Is necessary or appropriate to serve the public interest;

Is for the protection and in the interest of customers;

Reduces multiple monitoring and multiple examining for compliance with the minimum financial rules of the Commission and of the self-regulatory organizations submitting the plan of any futures commission merchant, retail foreign exchange dealer, or introducing broker that is a member of more than one self-regulatory organization;

Reduces multiple reporting of the financial information necessitated by such minimum financial and related reporting requirements by any futures commission merchant, retail foreign exchange dealer, or introducing broker that is a member of more than one self-regulatory organization;

Fosters cooperation and coordination among the self-regulatory organizations; and

Does not hinder the development of a registered futures association under section 17 of the Act.

After the Commission has approved a plan, or part thereof, under paragraph (h) of this section, a self-regulatory organization delegating the functions described in paragraph (d)(1) of this section must notify each of its members that are subject to such a plan:

Of the limited scope of the delegating self-regulatory organization's responsibility for such a member's compliance with the Commission's and self-regulatory organization's minimum financial and related reporting requirements; and

Of the identity of the designated self-regulatory organization that has been delegated responsibility for such a member; provided, however, that the self-regulatory organization that delegates, pursuant to paragraph (d) of this section, the functions set forth in paragraphs (b) and (c) of this section shall remain responsible for its member registrants' compliance with the regulatory obligations, and if such self-regulatory organization becomes aware that a delegated function is not being performed as required under this section, the self-regulatory organization shall promptly take any necessary steps to address any noncompliance.

The Commission may at any time, after appropriate notice and opportunity for hearing, withdraw its approval of any plan, or part thereof, established under this section, if such plan, or part thereof, ceases to adequately effectuate the purposes of section 4f(b) of the Act or of this section.

Whenever a registered futures commission merchant, a registered retail foreign exchange dealer, or a registered introducing broker holding membership in a self-regulatory organization ceases to be a member in good standing of that self-regulatory organization, such self-regulatory organization must, on the same day that event takes place, give electronic notice of that event to the Commission at its Washington, DC, headquarters and send a copy of that notification to such futures commission merchant, retail foreign exchange dealer, or introducing broker.

Nothing in this section shall preclude the Commission from examining any futures commission merchant, retail foreign exchange dealer, or introducing broker for compliance with the minimum financial and related reporting requirements, and the risk management requirements, as applicable, to which such futures commission merchant, retail foreign exchange dealer, or introducing broker is subject.

In the event a plan is not filed and/or approved for each registered futures commission merchant, retail foreign exchange dealer, or introducing broker that is a member of more than one self-regulatory organization, the Commission may design and, after notice and opportunity for comment, approve a plan for those futures commission merchants, retail foreign exchange dealers, or introducing brokers that are not the subject of an approved plan (under paragraph (h) of this section), delegating to a designated self-regulatory organization the responsibilities described in paragraph (d) of this section.