The CFTC Told Crypto Front-Ends They Don't Need to Register. Read the Ten Conditions First.

On 17 September 2026 the CFTC's Market Participants Division issued Staff Letter 26-25, and the headline wrote itself: crypto apps can now put regulated derivatives in front of users without registering as brokers. That is roughly true and substantially misleading. The relief exists. It also requires a qualifying provider to sign an undertaking making itself jointly and severally liable for violations of the Commodity Exchange Act, and to file a notice consenting to the Commission's jurisdiction to investigate and act against it.

That is registration's exposure without registration's status. Whether it is a good trade depends entirely on what a given firm was trying to avoid.

What the letter actually grants

The grant is narrow and specific. MPD states it will not recommend that the Commission take enforcement action against a qualifying provider of passive software for failing to register as an introducing broker, or against that provider's relevant personnel for failing to register as associated persons. That is the entire relief. It is not a licence, not an exemption written into the rules, and not a statement that the underlying activity is outside the CEA.

The letter, signed by MPD Director DJ Hennes, extends on substantially the same terms relief the division had granted to a single firm six months earlier: Staff Letter 26-09, issued to Phantom Technologies on 17 March 2026. The move from one named firm to a class is the actual news. Notably, the September letter is written generically enough that it is not limited to crypto applications, even though the original request came from a self-custodial wallet.

The covered software is described in terms of what it does not do. It does not take custody of customer assets, does not generate buy or sell signals, and does not exercise discretion over order routing. What it may do is display market data and aggregate position information, present the products a registrant offers, and pass user orders through to that registrant - including orders in event contracts and perpetual contracts, which is why this landed as a crypto story.

The ten conditions are the price

Ten enumerated conditions attach. Three of them change how a product has to be built, not merely how it is papered.

• The joint-and-several liability undertaking. The provider agrees to be jointly and severally liable for violations of the Act and Commission regulations, and consents to the Commission's jurisdiction to investigate and bring enforcement against it for those violations. A registered introducing broker is liable for its own conduct. Under this relief, an unregistered provider takes on liability alongside the registrants it routes to. The relief removes a registration obligation and adds an exposure that registration would not have created.
• Independent access at onboarding. Users must be onboarded as direct members of a designated contract market or as customers of a registered FCM or IB, and must retain the ability to reach that registrant independently of the provider. In product terms: the customer relationship cannot be yours. You cannot be the only door.
• Advertising discipline as if registered. The provider must adopt and enforce policies reasonably designed to comply with Commission and NFA rules on communications with the public, as though it were a registered IB, and may not run promotions that would require NFA pre-approval under NFA Compliance Rule 2-29.15. Growth marketing, referral incentives and performance claims are the things a consumer app reaches for first, and they are the things this condition constrains.

The remaining conditions cover a filed notice of reliance, compliant recordkeeping, and conflict-of-interest and risk disclosures to users. Individually unremarkable; collectively they describe an entity that keeps books, files notices, polices its own marketing and answers to the Commission. That is most of what registration asks for.

So what is genuinely saved? Registration itself, and what follows from it: NFA membership and its fees, the Series examination and fitness requirements for associated persons, and the branch-office and supervisory apparatus that comes with being a registrant. Those are real costs, particularly for a small engineering team. They are just not the costs most commentary implied were being waived.

Why staff relief is not a rule

This is the part that does not survive being compressed into a headline, and it is the reason to read the letter rather than the coverage.

A no-action letter is a statement by a division of the agency about what it intends to recommend. By its own terms it binds the division that issued it and is not binding on the Commission. It is not a rule: it went through no notice-and-comment process, it is not codified, and it creates no private right of action, so it is no defence against a private plaintiff or a state regulator pursuing a different theory. It can be withdrawn. And this one carries a built-in end date - the letter states the position lasts only until a Commission rule or guidance on when software developers must register takes effect.

The industry counter-argument deserves a fair hearing, because it is not weak. It runs: the CLARITY Act stalled, Congress has not delivered a statutory perimeter, and an agency willing to act by letter is better than an agency waiting for a bill that may never pass. Firms build on no-action relief routinely; relief is rarely yanked without warning; and a division position that has now been granted twice, to a named firm and then to a class, is a reasonably durable signal of agency thinking.

That is true as far as it goes, and it is a fair description of how the market will in fact behave. But the two instruments are not substitutes and the difference shows up precisely when it hurts. A statute or a codified rule survives a change of Commission composition, constrains a future enforcement division, and is reviewable. A staff letter does none of those things, and its explicit sunset means the most likely way it ends is not revocation but replacement - by a rule whose terms nobody has seen. A firm that has restructured its onboarding flow and signed liability undertakings in reliance on 26-25 has made permanent product decisions against a temporary position.

Who the conditions are actually built for

Read the conditions as a specification and they describe a particular kind of company: one with a legal entity that can execute an undertaking, a compliance function that can write and enforce marketing policy, records systems that survive inspection, and a business model that tolerates users reaching the registrant without going through it.

That is a wallet company with a front-end and a corporate structure. It is not a protocol, not an anonymous development collective, and not a DAO. The entities that most loudly wanted registration relief - the ones whose whole argument is that there is nobody to register - are structurally unable to satisfy conditions that require a someone to sign, file, adopt policies and accept jurisdiction. The relief is unusable by design for the hardest cases.

This is consistent with the direction of the Senate's own drafting, where the proposed control test for non-decentralised finance turns on who holds the keys. Both instruments are converging on the same move: find the party with operational control, and attach the obligations there. Staff Letter 26-25 does it by making the obligations the price of the relief rather than by defining the perimeter - which is faster, and which is why it is also less durable.

Sources: CFTC Staff Letter 26-25 (17 September 2026) and Staff Letter 26-09 (17 March 2026), both published at cftc.gov; the Lowenstein Sandler Crypto Brief of 17 September 2026; and contemporaneous coverage from Decrypt, Cointelegraph, Securities.io, Unchained, PYMNTS and Cryptobriefing. Anyone acting on this relief should read the letter itself rather than any summary of it, including this one.