2022 Supporting Statement 3038-0067

SUPPORTING STATEMENT FOR NEW AND

REVISED INFORMATION COLLECTIONS

Part 162 - Protection of Consumer Information under the Fair Credit Reporting Act

OMB CONTROL NUMBER 3038-0067

Justification

1. Explain the circumstances that make the collection of information necessary. Identify any legal or administrative requirements that necessitate the collection. Attach a copy of the appropriate section of each statute and regulation mandating or authorizing the collection of information.

On July 21, 2010, the President signed into law the Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111-203, 124 Stat. 1376 (2010) (“Dodd-Frank Act”). Title X of the Dodd-Frank Act, which is titled the Consumer Financial Protection Act of 2010 (“CFP Act”), amended a number of federal consumer protection laws enacted prior to the Dodd-Frank Act including, in relevant part, the Fair Credit Reporting Act, 15 U.S.C. 1681-1681x (“FCRA”) and the Fair and Accurate Credit Transactions Act of 2003, Pub. L. No. 108-159, 117 Stat. 1952, 1980 (2003) (“FACT Act”).

Specifically, section 1088 of the CFP Act set out certain amendments to the FCRA and the FACT Act directing the Commodity Futures Trading Commission (“CFTC” or “Commission”) to promulgate regulations that are intended to provide privacy protections to certain consumer information held by an entity that is subject to the jurisdiction of the Commission. Section 1088 amended section 214(b) of the FACT Act—which added section 624 to the FCRA in 2003—and directed the Commission to implement the provisions of section 624 of the FCRA with respect to persons that are subject to the Commission’s enforcement jurisdiction. Section 624 of the FCRA gives consumers the right to block affiliates of an entity subject to the Commission’s jurisdiction from using certain information obtained from such entity to make solicitations to that consumer (hereinafter referred to as the “affiliate marketing rules”).¹ Section 1088 also amended section 628 of the FCRA and mandated that the Commission implement regulations requiring persons subject to the Commission’s jurisdiction who possess or maintain consumer report information in connection with their business activities to properly dispose of that information (hereinafter referred to as the “disposal rules”).²

In addition, section 1088 amended the FCRA by adding the CFTC and the Securities and Exchange Commission (“SEC,” together with the CFTC, the “Commissions”) to the list of federal agencies required to jointly prescribe and enforce identity theft red flags rules and guidelines and card issuer rules. Thus, the Dodd-Frank Act provides for the transfer of rulemaking responsibility and enforcement authority to the CFTC and SEC with respect to the entities under their respective jurisdiction. Accordingly, the Commissions issued final rules and guidelines (hereinafter referred to as the “identity theft rules”)³ to implement new statutory provisions enacted by the CFP Act that amend section 615(e) of the FCRA and direct the Commissions to prescribe rules requiring entities that are subject to the Commissions’ jurisdiction to address identity theft.

2. Indicate how, by whom, and for what purpose the data would be used. Except for a new collection, indicate the actual use the agency has made of the information received from the current collection.

Under the affiliate marketing rules, the entities covered by the regulations are expected to prepare and provide clear, conspicuous and concise opt-out notices to any consumers with which such entities have a pre-existing business relationship. A covered entity only has to provide an opt-out notice to the extent that an affiliate of the covered entity plans to make a solicitation to any of the covered entity’s consumers. The purpose of the opt-out notice is to provide consumers with the ability to prohibit marketing solicitations from affiliate businesses that do not have a pre-existing business relationship with the consumers, but that do have access to such consumers’ nonpublic, personal information. A covered entity is required to send opt-out notices at the maximum of once every five years.

Under the disposal rules, the entities covered by the regulations are expected to develop and implement a written disposal plan with respect to any consumer information within such entities’ possession. The regulations provide that a covered entity develop a written disposal plan that is tailored to the size and complexity of such entity’s business. The purpose of the written disposal plan is to establish a formal plan for the disposal of nonpublic, consumer information, which otherwise could be illegally confiscated and used by unauthorized third parties. Under the rule, a covered entity is required to develop a written disposal plan only once, but may subsequently amend such plan from time to time.

Under the identity theft rules, entities covered by the regulation are required to develop and implement reasonable policies and procedures to identify, detect, and respond to relevant red flags for identity theft that are appropriate to the size and complexity of such entity’s business and, in the case of entities that issue credit or debit cards, to assess the validity of, and communicate with cardholders regarding, address changes.⁴ They are also required to provide for the continued administration of identity theft policies and procedures.

3. Describe whether, and to what extent, the collection of information involves the use of automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses, and the basis for the decision for adopting this means of collection. Also describe any consideration of using information technology to reduce burden.

Under the affiliate marketing rules, the required opt-out notices may be distributed to consumers electronically upon the consumer’s consent. A covered entity may distribute an electronic notice in two ways. First, a covered entity may reasonably expect that a consumer who uses the entity’s Internet web site to purchase or utilize the covered entity or its affiliate’s financial products and services will receive an electronic opt-out notice if such notice is clearly and conspicuously posted on the covered entity or its affiliate’s Internet web site. Second, a covered entity could send an opt-out notice via e-mail to a consumer. Further, the affiliate marketing rules also provide that a covered entity may provide an e-mail address or access to other electronic media as a reasonable means for the consumer to opt-out of an affiliate’s use of the consumer’s nonpublic, personal information for marketing purposes. This approach is only permissible under the rule if it is reasonable and simple.

With respect to the rules, generally, Commission regulations permit persons subject to recordkeeping requirements to keep their records electronically.

4. Describe efforts to identify duplication. Show specifically why any similar information already available cannot be used or modified for use for the purposes described in Item 2 above.

In adopting the regulations in Part 162, the Commission sought to avoid duplication of requirements imposed under other agencies’ rules. For example, the regulations in Part 162 are limited to entities under the Commission’s jurisdiction. Although substantially similar to regulations issued in 2007 by the Federal Trade Commission, the federal banking agencies, and the National Credit Union Association (collectively, the “Agencies”), the regulations in Part 162 do not apply to entities regulated by other agencies.

The type of information required to be collected under the regulations is not currently collected and is not available for public disclosure through any other source.

5. If the collection of information involves small business or other small entities (Item 5 of OMB Form 83-I), describe the methods used to minimize burden.

The requirements of these regulations are mandated by the FCRA and FACT Act vis-à-vis the Dodd-Frank Act and, therefore, the Commission does not grant any exceptions to small entities from the requirements at this time. The regulations do, however, provide substantial flexibility in several ways. For example, under the affiliate marketing rules, covered entities may consolidate their opt-out notices with other privacy notices required under other provisions of law (e.g., initial, annual and opt-out notices under the Gramm-Leach-Bliley Act). In addition, covered entities may extend the opt-out period in perpetuity so that such entities need not send opt-out notices every five years to consumers before an affiliate makes a solicitation. To further minimize the burden to small businesses or other small entities, the Commission has provided a model notice in Appendix A to Part 162, which covered entities can use in complying with the notice content requirements. The disposal and identity theft rules also provide flexibility for small businesses and other small entities. In particular, under the rules, each covered entity has the discretion to tailor its written disposal plan to fit the size and complexity of such entity’s business.

6. Describe the consequence to the Federal Program or policy activities if the collection were conducted less frequently as well as any technical or legal obstacles to reducing burden.

The FCRA and the FACT Act mandate, vis-à-vis the Dodd-Frank Act, that: (1) with respect to the affiliate marketing rules, entities subject to the Commission’s jurisdiction must provide opt-out notices to consumers with whom such entity has a pre-existing business relationship at most once every five years; and (2) with respect to the disposal rules, entities subject to the Commission’s jurisdiction must develop and implement a written disposal plan only once (as such original plan may be amended from time to time). With respect to the identity theft rules, less frequent collection would not be consistent with the intent of the rules, which is to require financial institutions and creditors to have reasonable policies and procedures to respond appropriately to any red flags that are detected.

The Commission is unaware of any technical or legal obstacles to reduce the burden to covered entities.

7. Explain any special circumstances that require the collection to be conducted in a manner:

• requiring respondents to report information to the agency more often than quarterly;

This question does not apply.

• requiring respondents to prepare a written response to a collection of information in fewer than 30 days after receipt of it:

This question does not apply.

• requiring respondents to submit more that an original and two copies of any document;

This question does not apply.

• requiring respondents to retain records other than health, medical, government contract, grant-in-aid, or tax records, for more than three years;

Commission regulation 1.31(b) expressly requires that books and records required to be kept by the Commodity Exchange Act (“CEA”) or Commission regulations be retained for certain specified periods. Other than with respect to oral communications, the shortest of these periods is five years from the date of creation.

• in connection with a statistical survey, that is not designed to produce valid and reliable results that can be generalized to the universe of study;

This question does not apply.

• requiring the use of a statistical data classification that has not been reviewed and approved by OMB;

This question does not apply.

• that includes a pledge of confidentiality that is not supported by authority established in statute or regulation, that is not supported by disclosure and data security policies that are consistent with the pledge, or which unnecessarily impedes sharing of data with other agencies for compatible confidential use; or

This question does not apply.

• requiring respondents to submit proprietary trade secrets, or other confidential information unless the agency can demonstrate that it has instituted procedures to protect the information's confidentiality to the extent permitted by law.

The rule does not involve submission of proprietary trade secrets or other such information to the Commission.

8. If applicable, provide a copy and identify the date and page number of publication in the Federal Register of the agency's notice required by 5 CFR 1320.8(d), soliciting comments on the information collection prior to submission to OMB. Summarize public comments received in response to that notice and describe actions taken by the agency in response to these comments. Specifically address comments received on cost and hour burden.

A copy of the Federal Register notice soliciting comments on this information collection (87 FR 43797, July 22, 2022) is attached. No relevant comments were received.

Describe efforts to consult with persons outside the agency to obtain their views on the availability of data, frequency of collection, the clarity of instructions and recordkeeping disclosure, or reporting format (if any, and on the data elements to be recorded, disclosed, or reported).

The Commission consulted with the Agencies, which earlier adopted substantially similar rules, in crafting Part 162. In addition, the Commission and its staff participate in an ongoing dialogue with representatives of the industry through public conferences, meetings, and informal exchanges. These various forums provide the Commission and the staff with a means of ascertaining and acting upon paperwork burdens confronting the industry. Further, as set forth above, the Commission affirmatively sought comments on the extension of information collection requirements described herein.

Consultation with representatives of those from whom information is to be obtained or those who must compile records should occur at least once every 3 years - even if the collection of information activity is the same as in prior periods. There may be circumstances that may preclude consultation in a specific situation. These circumstances should be explained.

No such circumstances are anticipated.

9. Explain any decision to provide any payment or gift to respondents, other than remuneration of contractors or grantees.

This question does not apply. The Commission has neither considered nor made any payment or gift to a respondent.

10. Describe any assurance of confidentiality provided to respondents and the basis for the assurance in statute, regulations, or agency policy.

The Commission does not provide respondents with an assurance of confidentiality beyond that provided by applicable law. The Commission fully complies with section 8(a)(1) of the CEA, which strictly prohibits the Commission, unless specifically authorized by the CEA, from making public “data and information that would separately disclose the business transactions or market positions of any person and trade secrets or names of customers.” The Commission has procedures to protect the confidentiality of a respondent’s data. These are set forth in the Commission’s regulations at Part 145 of the Code of Federal Regulations.

11. Provide additional justification for any questions of a sensitive nature, such as sexual behavior and attitudes, religious beliefs, and other matters that are commonly considered private. This justification should include the reasons why the agency considers the questions necessary, the specific uses to be made of the information, the explanation to be given to persons from whom the information is requested, and any steps to be taken to obtain their consent.

This question does not apply.

12. Provide estimates of the hour burden of the collection of information. The Statement should:

• Indicate the number of respondents, frequency of response, annual hour burden and an explanation of how the burden was estimated. Unless directed to do so, agencies should not conduct special surveys to obtain information on which to base hour burden estimates. Consultation with a sample (fewer than ten) of potential respondents is desirable. If the hour burden on respondents is expected to vary widely because of differences in activity, size or complexity, show the range of estimated hour burden, and explain the reasons for the variance. Generally, estimates should not include burden hours for customary and usual business practices.

• If the request for approval covers more than one form, provide separate hour burden estimates for each form and aggregate the hour burdens in Item 13 of OMB Form 83-I.

• Provide estimates of annualized cost to respondents for the hours burdens for collections of information, identifying and using appropriate wage rate categories. The cost of contracting out or paying outside parties for information collection activities should not be included here. Instead, this cost should be included in Item 13.

See Exhibit A.

Staff estimates that approximately 291 CFTC-regulated entities subject to Part 162 are newly formed each year,⁵ and that there are currently approximately 4,129 existing CFTC-regulated entities that are potentially subject to Part 162,⁶ for a total of 4,420 entities [291 entities + 4,129 entities].

Affiliate Marketing Rules

The burden for the affiliate marketing rules consists of the burden for (1) preparing and sending opt-out notices, (2) monitoring the opt-out notice process, and (3) addressing consumer questions and concerns about opt-out notices, and adjusting customer records. The Commission estimates that each notice sent will add .01 burden hours, that each entity will send approximately 100 opt-out notices (for a total of 1 hour [.01 hrs × 100 notices] per covered entity and an aggregate of approximately 4,420 hours [4,420 entities × 1 hr] for all entities at a total cost of $442,000 [4,420 entities × $100/hr⁷]). The remaining burden for affiliate recordkeeping is estimated to be approximately 3.5 hours per covered entity, for a total additional burden of 15,470 hours [4,420 entities × 3.5 hrs] at a total cost of $1,547,000 [15,470 hours × $100/hr].

Disposal Rules

The burden for the disposal rules consists of the burden of (1) developing disposal plans, (2) revising and updating disposal plans on an ongoing basis, and (3) conducting regular reviews of a disposal plan as necessary or advisable. The Commission estimates that each covered entity will have a burden of approximately 5.9 hours, for a total of 26,078 hours [4,420 entities × 5.9 hrs] at a total cost of $2,607,800 [26,078 hours × $100/hr].

Identity Theft Rules

Because the requirements of the identity theft rules only apply to financial institutions or creditors that offers or maintains one of more covered accounts the burden of the identity theft rules consists of the burden of (1) determining if an entity is required to have an identity theft prevention program (“Program”) under the identity theft rules, and (2) if required, (a) creating and updating a Program that is approved by the board of directors, an appropriate committee thereof, or a designated senior management employee, (b) periodic staff reporting to the board of directors on compliance with the identity theft rules, and (c) training of staff to implement the Program. CFTC staff estimates of time and cost burdens represent the one‑time burden of complying with the identity theft rules for newly‑formed CFTC-regulated entities and the ongoing costs of compliance for current CFTC-regulated entities. As detailed further below, the Commission estimates that the burden under the identity theft rules for all respondents (i.e., newly-formed CFTC-regulated entities and current CFTC-regulated entities) is 12,704 burden hours at a total cost of $1,270,400.

Identity Theft Rules Burden for Newly-formed CFTC-Regulated Entities

Each of the 291 newly-formed entities would bear the initial one-time burden of determining whether they are subject to the requirements of the identity theft rules. Staff estimates that each new entity would incur a burden of 2 hours to conduct an initial assessment, and that this initial assessment would result in a cost of $200 [2 hrs × $100/hr] to each entity. This would result in a total burden of 582 hours [291 entities × 2 hrs] at a total cost of $58,200 [582 hrs × $100/hr] for all entities.

Of the 291 newly-formed entities, staff estimates that approximately 30 would be required to have a Program under the identity theft rules.⁸ Staff estimates that each of these entities would incur an additional initial burden of 29 hours to develop and obtain board approval of a Program and to train the staff of the financial institution or creditor, and that this would result in costs of $2,900 [29 hrs × $100/hr] for each entity. This would result in a total burden of 870 hours [30 entities × 29 hours] at a total cost of $87,000 [870 hrs × $100/hr] for all entities.

Thus, the total initial estimated burden under the identity theft rules for all newly formed CFTC-regulated entities is 1,452 hours [582 hrs + 870 hrs] at a total cost of $145,200 [$58,200 + $87,000].

Identity Theft Rules Burden for Existing CFTC-regulated Entities

CFTC staff estimates that each of these entities will also be required to spend 2 hours to periodically review their accounts to determine if they are required to have a Program under the identity theft rules, resulting in an annual cost of $200 [2 hrs × $100/hr] to each entity. This would result in a total burden of 8,258 hours [4,129 entities × 2 hrs] at a total cost of $825,800 [8,258 hrs × $100/hr] for all entities.

CFTC staff estimates that there are approximately 402⁹ CFTC-regulated entities that are required to have a Program. Staff estimates that each of these entities would incur an annual burden of 4 hours to prepare and present an annual report to the board, and an annual burden of 2 hours to periodically review and update the Program (including review and preservation of contracts with service providers, as well as review and preservation of any documentation received from service providers), and that this would result in costs of $600 [6 hrs × $100/hr] for each entity. This would result in a total burden of 2,412 hours [402 entities × 6 hrs] at a total cost of $241,200 [2,412 hrs × $100/hr] for all entities.

Thus, the total ongoing annual estimated burden under the identity theft rules for existing CFTC regulated entities is 10,670 hours [8,258 hrs + 2,412 hrs] at a total cost of $1,067,000 [$825,800 + $241,200].

13. Provide an estimate of the total annual cost burden to respondents or recordkeepers resulting from the collection of information. (Do not include the cost of any hour burden shown in Items 12 and 14).

• The cost estimate should be split into two components; (a) a total capital and start-up cost component (annualized over its expected useful life) and (b) a total operation and maintenance and purchase of services component. The estimates should take into account costs associated with generating, maintaining, and disclosing or providing the information. Include descriptions of methods used to estimate major costs factors including system and technology acquisition, expected useful life of capital equipment, the discount rate(s), and the time period over which costs will be incurred. Capital and start-up costs include, among other items, preparations for collecting information such as purchasing computers and software, monitoring, sampling, drilling and testing equipment, and record storage facilities.

• If cost estimates are expected to vary widely, agencies should present ranges of cost burdens and explain the reasons for the variance. The cost of purchasing or contracting out information collection services should be a part of this cost burden estimate, agencies may consult with a sample of respondents (fewer than ten), utilize the 60-day pre-OMB submission public comment process and use existing economic or regulatory impact analysis associated with the rulemaking containing the information collection, as appropriate.

• Generally, estimates should not include purchases of equipment or services, or portions thereof, made: (1) prior to October 1, 1995, (2) to achieve regulatory compliance with requirements not associated with the information collection, (3) for reasons other than to provide information or keep records for the government, or (4) as part of customary and usual business or private practices.

The rules involve no new start-up or operations and maintenance costs.

14. Provide estimates of the annualized costs to the Federal Government. Also provide a description of the method used to estimate cost, which should include quantification of hours, operational expenses (such as equipment, overhead, printing and support staff), and any other expense that would not have been incurred without this collection of information. Agencies may also aggregate cost estimates from Items 12, 13, and 14 in a single table.

It is not anticipated that the rules will impose any additional costs to the Federal Government.

15. Explain the reasons for any program changes or adjustments reported in Items 13 or 14 of the OMB Form 83-I.

The estimated total annual burden has decreased from 59,459 to 58,090 hours (a reduction of 1,369 burden hours) to reflect the Commission’s current estimate of the number of respondents subject to the requirements of Part 162. This updated burden estimate reflects the total burden hours from the affiliate marketing rules (Subpart A), the disposal rules (Subpart B), and the identity theft rules (Subpart C).

16. For collection of information whose results are planned to be published for statistical use, outline plans for tabulation, statistical analysis, and publication. Provide the time schedule for the entire project, including beginning and ending dates of the collection of information, completion of report, publication dates, and other actions.

Not applicable.

17. If seeking approval to not display the expiration date for OMB approval of the information collection, explain the reasons that display would be inappropriate.

Not applicable.

18. Explain each exception to the certification statement identified in Item 19, “Certification for Paperwork Reduction Act Submissions,” of OMB Form 83-I.

Not applicable.

Attachment A

OMB Control Number 3038-0067

Part 162 -Protection of Consumer Information under the Fair Credit Reporting Act

Burden Estimates¹⁰

1. Regulation(s)	2. Estimated Number of Respondents	3. Estimated Number of Reports by Each Respondent	4. Estimated Average Number of Burden Hours per Response	5. Annual Number of Burden Hours per Respondent (3 × 4)	6. Estimated Average Burden Hour Cost	7. Total Average Hour Burden Cost Per Respondent (5 × 6)	8. Total Annual Responses (2 × 3)	9. Total Annual Number of Burden Hours (2 × 5)	10. Total Annual Burden Hour Cost of All Responses (2 × 7)
Affiliate Marketing Rules (Third-Party Disclosure)	4,420	100	.01	1	$100	$100	442,000	4,420	$442,000
Affiliate Marketing Rules (Recordkeeping)	4,420	1	3.5	3.5	$100	$350	4,420	15,470	$1,547,000
Disposal Rules (Recordkeeping)	4,420	1	5.9	5.9	$100	$590	4,420	26,078	$2,607,800
Identity Theft Rules (Recordkeeping) (Compliance Review) (Existing Entities’ Identity Theft Programs)	4,129 402	1 1	2 6	2 6	$100 $100	$200 $600	4,129 402	8,258 2,412	$825,800 $241,200
Identity Theft Rules (Recordkeeping) (Compliance Review) (New Entrants’ Identity Theft Programs)	291 30	1 1	2 29	2 29	$100 $100	$200 $2,900	291 30	582 870	$58,200 $87,000
Totals								58,090	$5,809,000

1 The affiliate marketing rules are found in Part 162, Subpart A (Business Affiliate Marketing Rules) of the CFTC’s regulations. 17 CFR Part 162, Subpart A.

2 The disposal rules are found in Part 162, Subpart B (Disposal Rules) of the CFTC’s regulations. 17 CFR Part 162, Subpart B.

3 The CFTC’s identity theft rules are found in Part 162, Subpart C (Identity Theft Red Flags) of the CFTC’s regulations. 17 CFR Part 162, Subpart C.

4 The CFTC understands that CFTC-regulated entities generally do not issue credit or debit cards, but instead may partner with other entities, such as banks, that issue cards on their behalf. These other entities, which are not regulated by the CFTC, are already subject to substantially similar change of address obligations pursuant to other federal regulators’ identity theft red flags rules. Therefore, the CFTC does not expect that any CFTC-regulated entities will be subject to the related information collection requirements in the identity theft rules, and accordingly, the CFTC estimates that there is no hour burden related to this information collection.

5 Based on a review of new registrations filed with the CFTC in 2019, 2020, and 2021, CFTC staff estimates that approximately 1futures commission merchant (“FCM”), 54 introducing brokers (“IBs”), 161 commodity trading advisors (“CTAs”), 137 commodity pool operators (“CPOs”), and 6 swap dealers (“SDs”) are newly formed each year, for a total of 359 entities. CFTC staff also has observed that approximately 50 percent of all CPOs are dually registered as CTAs, thus half of the 137 CPOs or 68 CPOs are excluded from the calculation. Based on these observations, CFTC has determined that the total number of newly-formed covered entities is 291 (accounting for 137-68 CPOs that are also registered as CTAs). There were no newly registered retail foreign exchange dealers (“RFEDs”) or major swap participants (“MSPs”).

6 This is the number of entities registered with the Commission as FCMs, IBs, CPOs, CTAs, SDs, and RFEDs (or in multiple of such categories) as of July 13, 2022.

7 The costs in this supporting statement were determined using an average salary of $100 per hour. The Commission believes that this is an appropriate salary estimate for purposes of the regulation. In support of this determination, the Commission notes that the salary estimate is based upon May 2021 Bureau of Labor Statistics’ findings of National Occupation Employment and Wage Estimates, United States, including the mean hourly wage of an employee under occupation code 23-1011, “Lawyers,” that is employed by the “Securities, Commodity Contracts, and Other Financial Investments and Related Activities Industry,” which is $102.14; the mean hourly wage of an employee under occupation code 11-3031, “Financial Managers,” in the same industry, which is $98.64; and the mean hourly wage of an employee under occupation code-13-1041, “Compliance Officers,” in the same industry, which is $44.59. The Commission also notes that, the Commission took the foregoing data and then increased its hourly wage estimate in recognition of the fact that some respondents may be large financial institutions whose employees’ salaries may exceed the mean wage. The Commission also observes that the Securities Industry and Financial Markets Association’s Report on “Management & Professional Earnings in the Securities Industry – 2013” estimates the average wage of a compliance attorney or compliance staffer (including chief compliance officers and directors of compliance) in the United States at only $53.71 per hour. The Commission recognizes that some respondents may hire outside counsel with expertise in the various regulatory areas covered by the regulation and that outside counsel may be able to leverage its expertise to substantially reduce the number of hours needed to fulfill a requested assignment. While the Commission is uncertain about the billing rates that these respondents may pay for outside counsel, the Commission believes that such counsel may bill at a rate of several hundred dollars per hour. Any determination to use outside counsel, however, is at the discretion of the respondent.

8 Of the total 291 newly-formed entities, staff estimates that all of the FCMs and SDs are likely to carry covered accounts, 10 percent of CTAs and CPOs are likely to carry covered accounts, and none of the IBs are likely to carry covered accounts, for a total of 30 newly-formed financial institutions or creditors (1 FCM, 23 CPOs and CTAs (accounting for 137-68 CPOs), and 6 SDs) carrying covered accounts that would be required to comply with the requirements of § 162.30.

9 Of the total 4,420 current CFTC-regulated entities, staff estimates that all of the FCMs, SDs, and RFEDs are likely to carry covered accounts, 10 percent of CTAs and CPOs are likely to carry covered accounts, and none of the IBs are likely to carry covered accounts, for a total of approximately 402 existing financial institutions or creditors (108 SDs, 58 FCMs, 4 RFEDs, and 232 CPOS and CTAs (accounting for 1254-67 CPOs)) carrying covered accounts that would continue to be subject to the requirements of § 162.30.

10 Numbers may not foot due to rounding.

6