The CFTC’s New Enforcement Policy and its Interplay with FERC Enforcement

On May 19, 2026, the Commodity Futures Trading Commission (“CFTC” or the “Commission”) Division of Enforcement issued a new staff advisory setting forth a revised policy for evaluating cooperation and self-reporting in enforcement matters (the “CFTC Policy”).¹ The CFTC Policy shares structural similarities with — but also differs in important respects from — the Federal Energy Regulatory Commission’s (“FERC”) longstanding Revised Policy Statement on Penalty Guidelines (the “FERC Penalty Guidelines”), which were issued on September 17, 2010, and remain in effect today.²

Because many market participants in the energy and commodities sectors are subject to the jurisdiction of both the CFTC and FERC, and because proactive compliance and self-reporting of violations can provide a significant potential reduction in penalties, it is helpful to compare the two agencies’ enforcement frameworks and highlight practical considerations for entities and individuals navigating self-reporting, cooperation, and penalty determinations.

Structural Framework: Rules-Based Versus Guidelines-Based Approaches

The most fundamental difference between the two policies lies in their overall structure. The CFTC Policy establishes a tiered framework organized around whether a party is eligible for a declination, cooperation credit, or a more limited penalty reduction. This assessment considers certain factors and, if all factors — voluntary self-report, full cooperation, timely and appropriate remediation, full restitution and/or disgorgement (if applicable), and a lack of aggravating circumstances — are satisfied, the CFTC Division of Enforcement will not recommend an enforcement action to the Commission. When a party falls short of declination eligibility (because, for instance, there are aggravating circumstances or because certain self-reporting criteria are not satisfied), the CFTC Policy provides specific percentage-based penalty reductions, although those recommended penalty reductions are capped at amounts ranging from 25 to 75 percent, depending on the facts.

By contrast, the FERC Penalty Guidelines employ a more detailed, quantitative methodology modeled on the U.S. Sentencing Guidelines. Under FERC’s approach, penalties are calculated by determining a base violation level, adjusting for the harm or risk of harm, and applying a culpability score that incorporates a wide variety of factors. The culpability score factors include credits for self-reporting, cooperation, compliance programs, acceptance of responsibility and resolving an enforcement matter through a settlement (i.e., without the need for a hearing or trial-type proceeding). The resulting penalty range is a mathematical calculation — it is the product of specific multipliers tied to the culpability score.³ Importantly, however, FERC retains the discretion to depart from the FERC Penalty Guidelines where it deems appropriate.⁴

Certain similarities and differences between the CFTC and FERC approaches deserve further attention.

Self-Reporting

Understandably, both the CFTC and FERC place significant value on voluntary self-reporting, in order to encourage regulated entities and companies to ensure that they self-police potential violations. But these two agencies define and reward voluntary self-reporting quite differently. Under the CFTC Policy, a self-report must be made voluntarily, in good faith, and before any known or reasonably anticipated imminent threat of disclosure through a whistleblower, the media, or other channels, or before any known or reasonably anticipated imminent threat of an investigation by an exchange, self-regulatory organization, or governmental entity. The party must disclose the misconduct within a reasonably prompt time after becoming aware of it and must report all material, non-privileged information in its possession or control.

The FERC Penalty Guidelines similarly reward self-reports made prior to an imminent threat of disclosure or government investigation and within a reasonably prompt time after becoming aware of the violation, providing a two-point reduction to the culpability score. Importantly, FERC’s self-reporting credit is considered separately from considerations related to cooperation, avoidance of trial-type hearing, and acceptance of responsibility credits. Before FERC, each factor carries independent value. FERC has also clarified that self-certifications — required disclosures made in response to a regulatory questionnaire — do not qualify for self-reporting credit, whereas a voluntary disclosure of a violation does. In other words, FERC does not accept the disclosure of a potential violation through the filing of a required form as a self-report worthy of credit on a civil penalty calculation.

The CFTC Policy does not appear to distinguish between self-certifications and self-reports in the same manner. However, it does require that the party must have timely fulfilled any statutory or regulatory obligation to provide related information to the CFTC after becoming aware of the misconduct.

Cooperation

Both agencies encourage and reward cooperation, although the degree of specificity in their requirements differs. The CFTC Policy defines “Full Cooperation” to include timely disclosure of all non-privileged relevant information, proactive cooperation (including identification of opportunities for the CFTC Division of Enforcement to obtain evidence not in the party’s possession), timely preservation and production of documents — including overseas documents and translations — and making officers, employees, and agents available for interviews. The CFTC Division of Enforcement will take into consideration the size, sophistication, and financial condition of the cooperating party when assessing the scope, quantity, quality, impact, and timing of cooperation.

Under the FERC Penalty Guidelines, a one-point credit is available for full cooperation, which requires that cooperation be both timely and thorough. To be timely, cooperation must begin essentially at the same time as the organization self reports, and to be thorough, it should include disclosure of all pertinent information known by the organization. FERC has also clarified that organizations will not lose cooperation credit for good-faith legal or factual arguments or good-faith objections to data requests.⁵

Remediation and Compliance Programs

Both agencies expect prompt remediation and investment in compliance infrastructure, but the weight assigned to these factors varies. The CFTC Policy requires “Timely and Appropriate Remediation,” which includes a thorough root-cause analysis of the misconduct and implementation of an effective compliance and ethics program calibrated to the size and resources of the organization and the risks associated with its business. The policy further specifies that an effective compliance program should include, among other elements, adequate resources, independent compliance personnel with access to senior leadership, a risk-based program, and ongoing testing and evaluation. The policy also requires appropriate discipline of employees responsible for misconduct and implementation of record-retention measures, including controls over the use of personal devices and ephemeral messaging platforms.

The FERC Penalty Guidelines provide a compliance credit of up to three points off the culpability score for organizations that had an effective compliance program at the time of the violation. FERC has agreed to provide partial compliance credit to organizations with effective but imperfect programs. As a practical matter, the FERC Office of Enforcement and Regulatory Accounting (“FERC Enforcement”) has largely declined to grant organizations full compliance credit except in rare instances where the entity caught the alleged violation early, made a complete self-report, and punished the offending employees.

The FERC Penalty Guidelines also set out seven factors for evaluating compliance programs, consistent with the four hallmarks in FERC’s 2008 Policy Statement on Compliance: active senior management engagement, effective preventive measures, prompt detection and voluntary reporting, and remediation of misconduct. The FERC Penalty Guidelines do not address root-cause analyses with the same specificity as the CFTC Policy, and FERC has clarified that compliance credit will not be automatically eliminated when senior-level personnel participated in, condoned, or were willfully ignorant of the violation, but senior-level involvement may result in additional culpability points against the entity in FERC’s civil penalty determination. Similar to FERC, the CFTC appears inclined to treat this sort of senior-level involvement as an aggravating circumstance, although the guidance from the agencies discussing senior-level involvement does not dovetail perfectly.

Penalty Reductions and Declinations

The penalty structures of the two agencies diverge considerably. As noted earlier, the CFTC Policy establishes a clear path to a declination — a decision by the CFTC Division of Enforcement not to recommend an enforcement action — when the prescribed factors are met (voluntary self-report, full cooperation, timely and appropriate remediation, and full restitution and/or disgorgement), and no aggravating circumstances preclude eligibility. Aggravating circumstances that may preclude eligibility include pervasive intentional or reckless misconduct by ownership or senior management, misconduct occurring over an extended period, recidivist misconduct, and particularly egregious aggregate harm. For parties ineligible for a declination, the reductions that can be recommended are capped based on the circumstances.

FERC’s framework does not contemplate declinations at all. Instead, the FERC Penalty Guidelines calculate a penalty range based on the base violation level, specific violation characteristics, and the culpability score. Self-reporting, cooperation, avoidance of trial-type hearings, and acceptance of responsibility can collectively reduce the culpability score by up to five points, which in turn reduces the penalty multiplier, but there is no FERC framework for declination. However, FERC Enforcement staff retain the discretion to close investigations or self-reports without sanctions and have done so in the past. This has the potential to effectively achieve a similar outcome to a CFTC declination, but it is largely subject to the discretion of FERC Enforcement.

A countervailing (i.e., more lenient) difference is that, at FERC, the reductions to proposed penalties are not subject to such stringent caps as those imposed by the CFTC; a culpability score of zero⁶ can reduce an organization’s base penalty by as much as 95 percent when combined with other mitigating factors, whereas there is no circumstance in which a proposed penalty would be reduced by more than 75 percent at the CFTC.

Individual Accountability

The CFTC Policy applies to both entities and individuals, though it acknowledges that some provisions may be inapplicable to individuals. The policy also emphasizes holding culpable individuals accountable as one of its stated objectives.

The FERC Penalty Guidelines are designed for application to organizations. FERC will determine the appropriate penalty for natural persons based on the facts and circumstances of the violation, using the FERC Penalty Guidelines for guidance. In recent FERC enforcement cases, civil penalties have been assessed to both the corporate entity and certain individuals. Penalties assessed against individuals normally range from one to five percent of the amount that is assessed against the corporate entity. But in certain cases with significant individual involvement, FERC has levied sizeable monetary penalties against individuals. FERC enforcement settlements are black box proceedings, so the actual penalties that individuals pay is not public information since most of these proceedings settle.

Note on the Department of Justice Corporate Enforcement and Voluntary Self-Disclosure Policy

In the spirit of summarizing recent updates and enforcement frameworks, it is notable that on March 10, 2026, the U.S. Department of Justice (“DOJ”) established a new Corporate Enforcement and Voluntary Self-Disclosure Policy (the “CEP”), which applies to all corporate criminal matters handled by the DOJ (except antitrust violations under 15 U.S.C. §§ 1–38).⁷ The CEP establishes a framework closely analogous to the CFTC Policy, offering a declination from prosecution when a company voluntarily self-discloses to an appropriate DOJ criminal component, fully cooperates, timely and appropriately remediates, and no aggravating circumstances are present. For “near miss” cases, the CEP provides for a non-prosecution agreement with a term of fewer than three years, no independent compliance monitor, and a penalty reduction of 50 to 75 percent off the low end of the U.S. Sentencing Guidelines fine range. In other cases, the maximum reduction is capped at 50 percent. The DOJ CEP defines voluntary self-disclosure, full cooperation, and timely and appropriate remediation in terms substantially similar to those used in the CFTC Policy, including requirements for root-cause analysis, implementation of an effective compliance and ethics program, appropriate employee discipline, and proper record-retention controls. Given the potential for parallel proceedings involving the CFTC, FERC, and the DOJ, energy and commodities market participants facing potential violations should consider the interplay among all three frameworks when developing a response strategy.

Practical Takeaways

In light of the CFTC’s new policy and the continued application of the FERC Penalty Guidelines, market participants in the energy and commodities sectors should consider the following:

First, early and voluntary self-reporting remains the single most important step a party can take to mitigate enforcement risk under all of the relevant frameworks.

Second, effective compliance programs serve a dual function. Under the CFTC Policy, they are a prerequisite for receiving the full benefit of cooperation credit, including a declination. Under FERC’s framework, they provide an independent, quantifiable credit against the penalty calculation. Market participants should regularly assess and update their compliance programs to meet the detailed criteria set forth by both agencies.

Third, cooperation must be proactive and thorough. Both agencies reward parties that go beyond mere responsiveness and affirmatively assist enforcement staff.

Fourth, the potential for parallel proceedings before the CFTC, FERC, and the DOJ underscores the importance of a coordinated response strategy. Conduct in the energy and commodities markets may implicate the jurisdiction of multiple federal agencies, and decisions about self-reporting and cooperation should be made with an understanding of how each agency’s framework will evaluate the party’s conduct.

¹U.S. Commodity Futures Trading Comm’n, New Division of Enforcement Policy Cooperation, (May 19, 2026). The revised policy rescinds the CFTC’s previously effective advisory Enforcement Advisory: Advisory on Self-Reporting, Cooperation, and Remediation (Feb. 25, 2025).

²Revised Policy Statement on Penalty Guidelines, 132 FERC ¶ 61,216 (2010).

³Notably, both the CFTC and FERC are subject to statutory caps on civil penalties. For instance, in the case of market manipulation claims, both the CFTC and FERC have statutory caps of $1,000,000 per day per violation. Both statutory caps are subject to modification by the Federal Civil Penalties Inflation Adjustment Act of 1990, as amended. As of 2025 (FERC has not released its amended provision for 2026), FERC’s maximum civil penalty stood at $1,584,648, Federal Register: Civil Monetary Penalty Inflation Adjustments, while the CFTC’s stood at $1,487,712, Inflation Adjusted Civil Monetary Penalties | CFTC. Under direction of the Trump administration, the Office of Management and Budget paused the calculations for 2026, leaving the 2025 numbers in place. M-26-026 Cancellation of Penalty Inflation Adjustments for 2026, Regarding the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015.

⁴In practice, when initiating a formal enforcement action through an Order to Show Cause and Notice of Proposed Penalties, FERC Enforcement has often erred towards the higher end of the potential penalty spectrum. 

⁵Notably, FERC Enforcement has often left the determination of what constitutes “good faith” up to the lead investigator assigned to a particular matter. In one recent matter that the authors are handling, FERC Enforcement threatened non-cooperation if a deposition witness refused to provide personal information that could have had no relevance to the investigation and that was not within FERC’s jurisdiction.

⁶To be clear, achieving a culpability score of zero at FERC can be difficult. Culpability scores start at 5 and then are modified by aggravating and mitigating factors. The resulting score range is from zero to ten.  As discussed above, self reporting, avoiding a trial, cooperating and having an effective compliance program can reduce the culpability score down to zero, but that requires avoiding any of the aggravating factors, including whether you have a previous enforcement issue, the size of your organization, whether you have senior level involvement in the alleged wrong-doing, and the like. 

⁷U.S. Dep’t of Justice, Corporate Enforcement and Voluntary Self-Disclosure Policy (Mar. 10, 2026).

This information is provided by Vinson & Elkins LLP for educational and informational purposes only and is not intended, nor should it be construed, as legal advice.