US crypto derivatives merchants need to leave customer funds alone, says CFTC