The call from the Division of Enforcement is not the moment anything gets decided. By then most of what matters has been settled months earlier, by people who were not thinking about enforcement at all. Whoever wrote the record retention policy settled it, as did whoever set the threshold at which an alert becomes an open investigation. On 19 May 2026 the Commodity Futures Trading Commission's Division of Enforcement published CFTC Letter 26-15, a new policy on cooperation, and on its face the document is a schedule of penalty discounts. Read against the obligations a designated contract market already carries, it is narrower and more useful. It is a list of documents that have to exist before the phone rings, and a clock that somebody else starts.
One advisory replaced every policy that came before it
The policy is eight pages and does not hedge. It is effective immediately, it is the Division's exclusive policy on self-reporting, cooperation and remediation, and it supersedes all prior policies on those subjects. Footnote 2 names what it rescinds, the February 2025 Enforcement Advisory on Self-Reporting, Cooperation, and Remediation, including statements in the Division's own Enforcement Manual. Footnote 1 then sets the limit on all of it. The policy is internal guidance about what the Division will recommend, it does not bind the Commission, and it creates no rights enforceable by anyone.
That is not a technicality. In the CFTC press release announcing the advisory, Director of Enforcement David I. Miller called the document "a clear path to declinations." The promise is predictability, but the text binds nobody and the Commission remains free to land elsewhere.
Three doors, and the floor behind the middle one is higher
Part I is the declination path. The Division will not recommend an enforcement action where five things are true at once: a Voluntary Self-Report, Full Cooperation, Timely and Appropriate Remediation, Full Restitution and Disgorgement where applicable, and no aggravating circumstances. The aggravators are a closed set of four, introduced with the words "limited to": pervasive intentional or reckless misconduct by ownership or senior management, the same conduct over an extended period, recidivism, and particularly egregious aggregate harm.
Part II covers the party who did everything except qualify, either because a good-faith self-report failed the definition of a Voluntary Self-Report or because an aggravating factor bars the declination. A good-faith report that failed the voluntariness test earns a recommended reduction of at least 50 percent. An aggravating factor earns at least 25 percent. Both are capped at 75 percent. Part III is everyone else and the thinnest door, where credit is discretionary, available only after remediation and full restitution or disgorgement, and capped at no more than 25 percent, absent extraordinary circumstances.
Read the two floors next to each other and the policy says something counterintuitive. Being late is cheaper than being bad. A venue that cooperates completely but reports a week too late is promised a higher floor than one that reported perfectly on day one but whose senior management was involved. That is a deliberate choice about what the Division most wants to buy, and it shows up only in the arithmetic.
The definition of voluntary names the exchange first
The operational core is in Part IV, in the eight requirements that turn a report into a Voluntary Self-Report. Item 3 decides when the most valuable credit in the document stops being available. A report counts as voluntary only if it comes before any known or reasonably anticipated imminent threat that the matter will surface through a whistleblower or the media, and before any such threat of an investigation of the matter "by an exchange, self-regulatory organization, or state or federal governmental entity."
The word exchange appears in that role exactly once in the policy, and it is listed first. When Miller previewed the advisory in his remarks at NYU Law School on 31 March 2026, the same carve-out was described as "a Self-Regulatory Organization investigation" and the exchange was not named separately. The published text separates them, which makes a venue's compliance department a clock on everybody else's best outcome.
And the venue cannot choose not to start it. Commission Regulation 38.158(a) requires a designated contract market to maintain procedures under which compliance staff open an investigation upon the discovery or receipt of information indicating a reasonable basis for finding that a violation may have occurred or will occur. That is not discretionary. So the duty an exchange cannot decline is also the event that can move a participant out of Part I and into Part III, a swing from a possible declination to a cap of a quarter off. Neither document mentions the other, and the consequence lives in the overlap.
Twelve months on one side of the desk and no time at all on the other
Regulation 38.158(b) tells the exchange that an investigation is timely if it closes no later than twelve months after opening, and lists the factors that justify longer, among them complexity and the volume of documents. Twelve months is the regulatory definition of prompt on the exchange's side of the desk.
On the party's side there is no number. Item 4 requires disclosure within a reasonably prompt time after becoming aware of the misconduct, puts the burden of showing timeliness on the party, and says registrants should report at the earliest possible opportunity and not defer disclosure until a routine or periodic reporting date. Item 5 removes the usual reason for waiting, because all material non-privileged information must be reported even where the picture is incomplete and an internal investigation has only just begun. For a venue holding both roles, as exchange and as potential respondent, that produces one operational rule. The internal escalation deadline has to be shorter than the investigation deadline, and the notification decision cannot be an output of the investigation it is supposed to precede.
Full cooperation is mostly records architecture
The definition of Full Cooperation runs to eight items and very little of it is about attitude. It asks for identification of every individual involved regardless of seniority, attribution of information to specific sources where no privilege is breached, rolling updates during an internal investigation, and proactive disclosure of relevant information nobody asked for. It asks for overseas documents with their locations, custodians and authors. Its fifth item makes the party deconflict its own investigative steps with the Division's requests, including delaying interviews when asked, while the Division expressly does not direct the internal investigation. The seventh requires officers, employees and agents to be available for interview, former employees included.
Almost none of that can be built after an inquiry opens. Knowing which custodian held which document, listing everyone involved defensibly and having authority to interview a former employee are properties of a records system and a set of contracts. Regulation 38.153 already gives a venue authority to examine books and records kept by its members and by persons under investigation. The open question is whether that authority has been exercised often enough to be fast.
Remediation is graded against a programme, not an apology
The definition of Timely and Appropriate Remediation reads like a compliance manual because it is one. It opens with a root cause analysis, then lists what an effective compliance and ethics programme may include, among it independence and authority for the compliance function with meaningful access to senior leadership, and compensation and promotion structures that incentivise compliance. Two items go further than most readers expect. Discipline must reach both the people who committed the misconduct and those who failed in oversight. And record retention must cover personal devices and messaging applications, with ephemeral messaging platforms named explicitly.
One existing rule keeps this honest. Regulation 38.155(b) makes a designated contract market review the size and workload of its compliance staff annually, weighing volume increases and the number of new products to be listed. In a year when event contract certifications ran at roughly ten a business day, as we measured in our analysis of the certification record, that review is the first document the Division would ask for.
The order that attached a number went through the undefined exception
Part IV defines four terms precisely, with eight requirements for a Voluntary Self-Report, eight for Full Cooperation, six for remediation and three for restitution. The phrase that decides how far the Division may go beyond its own ceiling gets nothing. "Extraordinary circumstances" appears once in the policy, in Part III, with no definition and no examples. That is the clause the first published application used.
On 28 August 2026 the Commission settled charges against a White House teleprompter operator who had traded mention market contracts on the words the President would say, a matter we examined in our piece on the restricted list that did not cover him. The part that matters here is footnote 3 of the consent order in CFTC Docket No. 26-06, which cites the new policy by name, places the matter in Part III, and records a cooperation credit of "approximately 40-percent" off the civil monetary penalty. The footnote then says in its own words that the reduction is "above Part III's 25-percent-reduction ceiling absent extraordinary circumstances", granted for the extraordinary level of cooperation provided.
The recited facts explain why it landed in Part III at all. There was no self-report. When contacted by the Division, the respondent submitted to an interview almost immediately, provided documents, admitted that he had reviewed the speeches before trading, and accepted responsibility. That is cooperation without voluntariness, exactly the pattern Part III was written for, and it produced a result above the Part III cap. The order also carries a benefit the policy's menu does not contain: the 65,000 US dollar penalty is payable in instalments, 15,000 within thirty days and the balance over eighteen months, "given Respondent's extraordinary cooperation." The policy says nothing about payment terms.
Working the invisible baseline backwards
Every percentage in the policy is measured against "the Division's good-faith calculated penalty". The policy never says how that figure is reached and nothing requires it to be published, so a reader outside the room cannot check any discount against anything. The two mention market orders of summer 2026 are the closest thing to a data point. In Docket 26-06 the disgorgement figure is 107,539.02 US dollars and the penalty 65,000, which is 60.4 percent of the profit and so a reduction of 39.6 percent, consistent with the order's "approximately 40-percent" against a pre-credit penalty of roughly one times the unlawful gain. In the consent order against George Santos in CFTC Docket No. 26-05 of 31 July 2026, disgorgement was 17,569.98 US dollars and the penalty 17,500, or 99.6 percent of the disgorgement, with no percentage reduction stated anywhere.
Neither order says the baseline is one times the gain, and two individual matters are not a schedule for a firm. The narrower point holds anyway: the only publicly checkable anchor for the figure every discount is measured from comes from dividing one number in an order by another. The comparison matters for a second reason. Both orders acknowledge cooperation in nearly the same words, the earlier one recording that the Commission recognises Santos's cooperation in the underlying investigation. The later one adds one adjective, extraordinary, plus a footnote, a part number and a percentage, while the press release for the earlier matter quantifies nothing. Both were issued after 19 May 2026, so the policy governed both. As of 4 October 2026 there is no successor, the most recent letter in the staff series being CFTC Letter 26-28 of 1 October 2026, a no-action letter on an unrelated subject.
The exchange that helped got one sentence and no percentage
Here is the gap that matters most. The CFTC press release on the order closes with one line. "The CFTC appreciates the assistance of KalshiEX in this matter." That sentence is the entire published reward for a venue that helped investigate its own user, and that is no criticism of either party, because it is the behaviour the category should want described as normal.
But notice what the policy can and cannot do with it. All three parts price cooperation as a reduction to a penalty, which presupposes the cooperator is the respondent. A venue that assists in a matter where it is not charged has no penalty to reduce, so it earns nothing the document can measure. Miller's NYU remarks called the exchanges "a critical line of defense" and listed what the Commission expects of them, from surveillance to the duty to list only contracts not susceptible to manipulation, obligations sitting in the core principles at 7 U.S.C. section 7(d), while the cases run on 7 U.S.C. section 9(1) and Commission Regulation 180.1. The venue is structurally central to all of it and outside the credit architecture.
That is a Directive 02 problem before it is an enforcement problem. A venue that cannot describe, in plain language and in advance, how an alert becomes an investigation and how an investigation becomes a call to a regulator is asking users to trust a process it never wrote down. It is a Directive 05 problem too, because the jurisdiction that regulates next will ask for the written version, not the habit.
Six things a venue can settle before anyone calls
None of this needs a rule change or a budget cycle, and all of it is easier to decide in a quiet week.
- Name the person who decides whether to notify the Commission, and the deputy. One role, not a committee, able to act the same day.
- Connect the two clocks in writing, so that opening an investigation under Regulation 38.158(a) triggers a recorded notification decision within a stated number of days.
- Keep a one-page record map: which systems hold order, account, device and communication records, who the custodian of each is, and how long each is retained.
- Put personal devices and ephemeral messaging into the retention policy explicitly, then test a legal hold end to end before it is needed.
- Decide who may speak to the Division, and tell staff. Making former employees available is a contracting question before it is a legal one.
- Publish the escalation and notification policy. Cooperation that exists only as a habit is invisible to users and unprovable to a regulator.
The policy that landed on 19 May 2026 did not make cooperation more valuable. It made the price list visible while leaving out the baseline, the exception and the third-party case. A venue that reads it as a penalty schedule will read it once. A venue that reads it as a specification for what must exist on an ordinary Tuesday will find most of the work already required by part 38 and simply never written down. That is the kind of floor the responsible market commitment exists to put on paper before someone else writes a lower one.