Spoofing and Layering in Futures: Proving Intent Beyond Canceled Orders

A futures spoofing whistleblower can expose orders placed with the intent to cancel before execution, creating false supply or demand to influence other traders. Layering spreads that false interest across several price levels. The trader wants the market to react to orders the trader plans to withdraw. If you know why those orders appeared, which trades they helped fill or what happened to the surveillance alerts, you may see the scheme from inside the desk.

Spoofing Intent at Order Entry Versus Cancellation

The central question is what the trader intended when placing the bid or offer. The Commodity Futures Trading Commission’s disruptive-trading guidance directs attention to that intent, the market context and the trader’s pattern of activity, including how orders filled.

A cancellation log records what the system did. The surrounding orders, fills and instructions help explain what the trader meant to do. An instruction to withdraw an order as the market approaches it, paired with a genuine trade benefiting on the opposite side, can make the purpose visible.

Partial fills belong in that examination. The guidance explains that an order intended for cancellation can still be spoofing when part of it fills. What the trader planned at entry still matters after that partial execution.

One spoofed order can be enough, the Commission says. Repeated sequences can make that intent easier to see, especially when the same cancellation follows the same favorable fill. The useful story connects the decision, the displayed order and the trade it served.

Genuine Orders on the Opposite Side of the Book

Spoofing uses apparent buying or selling interest to help genuine orders on the opposite side of the book. Large bids can make buying interest look stronger while the trader actually wants to sell. Large offers can suggest selling pressure while the trader wants to buy.

The Commodity Futures Trading Commission’s spoofing alert identifies rapidly placed and canceled orders near the best bid or offer, especially when opposite-side orders fill. It also identifies repeated, simultaneous placement and cancellation of same-size orders. Both manual and automated trading can produce these patterns.

That apparent liquidity is information other people trade on. In its E-mini S&P order, the court described market participants comparing buying and selling interest and automated systems responding to those imbalances. Someone reading the book may see a reason to sell precisely because another trader has manufactured the appearance of sellers.

We see the unfairness in that arrangement: the other participant makes a real trade against an invented picture of the market. The canceled order has already done its work.

Futures Layering and the Evidence in Order Modifications

In futures layering, order modifications provide evidence of how apparent market depth moves as prices change. A layering program can place large orders at successive prices and keep moving them away from execution while leaving their apparent supply or demand visible.

The order book matters because it presents quantities at different prices. The E-mini S&P order describes a book that aggregated individual orders at each price level. Other participants saw the volume without ordinarily being able to identify the individual orders making it up. A set of coordinated orders could therefore influence how they read the balance of the market.

The modifications preserve the illusion. As the best offer moves, the layers move too, maintaining their distance from a trade. The later cancellation is the end of a sequence that began with placement and continued through those price changes.

The trader’s position supplies the commercial reason for doing it. In the admitted E-mini conduct discussed below, genuine trades benefited from artificially depressed or inflated prices, and the trader could use the orders to exit an existing position. The evidence connects the false interest with the exposure the trader actually wanted to buy, sell or close.

What Evidence Is Required to Prove Fraud?

Evidence of futures spoofing connects order-entry intent to the order sequence, the genuine trades and the people directing them. Code, order messages, fills, communications and surveillance records answer different parts of that question.

Code and instructions show planned behavior. The useful detail is what the program was told to do when an order approached execution, when a genuine order filled or when the trader switched the strategy off. A programmer’s correspondence can explain why a cancellation feature was requested. The cases below connect those instructions to the trading that followed.

Orders and fills show the sequence. Markets, contracts, precise timestamps and trader identifiers connect the displayed activity with the trades. The Commission’s alert specifically identifies Tag 50 identifiers among the useful details. We examine the genuine order alongside the larger opposing orders, including the visible quantity, amendments, partial executions and the point at which the other orders disappeared.

Communications show the desk’s explanation. An electronic chat celebrating a fill can explain why large bids appeared moments earlier. Instructions to a programmer can explain why the layers kept retreating. The connection between the message and the event gives those words their force.

Surveillance records show notice and response. An alert, an exchange inquiry and an internal report each carry a different part of the story. The activity identified, the recipients and the response connect the warning to the people responsible for acting on it. That inquiry reaches the supervision of the desk as well as the purpose of individual orders.

The trading records extend beyond completed transactions. The industry’s recordkeeping framework covers filled, unfilled and canceled orders and specified communications leading to execution. For someone in operations or compliance, the orders that disappeared can be as important to the reconstruction as the trades that remained.

Panther Energy’s Algorithm Put the Genuine Trade First

Panther Energy Trading’s alleged strategy used large, short-lived orders to help smaller orders trade. In its July 2013 settlement order, the Commodity Futures Trading Commission alleged that the firm and its owner used an algorithm designed to place and cancel orders before execution across energy, metals, interest-rate, agricultural, stock-index and currency futures.

The order’s crude-oil example starts with a small sell order at the best offer. The algorithm then allegedly placed larger bids at progressively higher prices. Those bids suggested strong buying interest, encouraging someone else to buy the smaller sell order.

Once the sell order filled, the program allegedly canceled the large bids and reversed direction. It entered a small buy order alongside larger sell orders intended for cancellation. The strategy sought to profit from the genuine trades on either side of the cycle.

The Commission put the alleged net profits at approximately $1.4 million. It ordered Panther and its owner to return that amount and pay an equal civil penalty. The algorithm allegedly made money on the smaller trades while using the larger orders to move everyone else.

The Layers That Kept Moving Away

Nav Sarao Futures Limited PLC’s owner admitted the allegations and findings in the November 2016 civil consent order. His E-mini S&P layering program repeatedly moved large sell orders to keep them away from execution while influencing the market’s view of supply.

The Commodity Futures Trading Commission’s earlier complaint quoted his explanation to the trading-platform provider:

The distance from the best offer was part of the design. The consent order records requests for automatic cancellation as orders approached execution and for withdrawal of the remaining quantity after a small fill. Those instructions show the purpose behind the movement in the order book.

On May 6, 2010, the layering orders were modified more than 81,000 times, with only 81 lots resulting in executed trades. Busy moving. Barely trading. The order found that the conduct contributed to an extreme imbalance in the E-mini S&P order book that day.

The court ordered the owner personally to pay a civil penalty of $25,743,174 and return $12,871,587 in trading profits. An insider who understands the requested features can explain a pattern that a cancellation total leaves unexplained.

JPMorgan’s Precious Metals and Treasury Futures Orders

JPMorgan’s alleged spoofing connected false displayed interest to genuine fills across precious metals and Treasury futures. The Commodity Futures Trading Commission’s September 2020 settlement described gold, silver, platinum, palladium, Treasury note and Treasury bond futures trading, with desk heads and sales personnel among those involved in the alleged conduct.

The visible order size could conceal the size of the genuine trade. In a silver-futures example, the CFTC alleged that a trader entered a genuine order to sell 20 lots, displaying five at a time through an iceberg order. The trader then placed a 100-lot bid on the other side. The genuine sell order filled, and the trader canceled the bid less than a second later.

An iceberg order displays only part of the quantity available to trade. In that example, the apparent buying interest and the visible selling interest told a different story from the trader’s intended sale. Both the displayed size and the full genuine order explain the sequence.

The Commission also alleged that desk communications described what the trading was doing. After one trader used layered bids to obtain a sell-side fill, a senior trader told the desk head:

The message joined the bids to the sale. That is the connection we look for between the market data and the people watching it from inside the business.

Precious Metals Spoofing and Ignored Surveillance Alerts

The Commission alleged that J.P. Morgan Securities failed to act adequately on warnings of precious metals spoofing. The order said the firm’s surveillance system lacked the ability to identify spoofing effectively before 2014. A newer tool followed, but the Commission alleged that internal alerts, exchange and regulatory inquiries, and a trader’s internal allegations still failed to produce adequate investigation and a stop to the conduct.

A policy banning spoofing was already in the compliance manual. We see the absurdity: a ban on paper, warnings inside the firm, and a desk the Commission alleged kept spoofing. For a surveillance employee, the response to an alert can be part of the evidence.

Treasury Futures Spoofing and Internal Compliance Reports

Internal compliance reports show what reached the people responsible for the Treasury futures desk. J.P. Morgan Securities’ manual required personnel to report suspected or known fraudulent activity and market manipulation internally. The Commission’s allegations covered supervision of both the precious-metals and Treasuries desks.

The Treasury trading examples make the connection to fills explicit. The Commission alleged that one trader placed a genuine order to sell 100 Treasury bond futures contracts, then layered 1,800 lots of bids on the opposite side. The sell order filled, and the trader began canceling the bids immediately afterward.

The Commission ordered a $436,431,811 civil penalty across the JPMorgan respondents. Its order put the financial benefit from the alleged scheme at $172,034,790, which it also required them to give up. Those amounts put a price on the pattern the order messages and desk chats describe.

What Surveillance Can See

Surveillance software identifies patterns for people to investigate. A 2024 working paper for a World Federation of Exchanges research project, An Analysis of Market Manipulation Definitions Around the World, describes analysts examining activity flagged by automated systems. It also explains that traditional systems depend on predefined patterns and struggle to identify new ones.

That gives an insider’s account a particular value: someone who knows the program’s instructions or the desk’s communications can explain the purpose behind the pattern. We connect that explanation to the orders and fills.

The same paper reviews evidence from Canadian equity markets that spoofing increases volatility and reduces price efficiency. The harm reaches people making real trading decisions from the prices and interest they see. The false order can disappear while the trade it induced remains.

Voice Brokers Can Carry the Same False Interest

Voice-brokered swap spoofing puts the intent question into the broker’s conversations. In its May 2023 HSBC Bank USA settlement order, the Commodity Futures Trading Commission alleged that the U.S. dollar swap desk’s supervisor gave a voice broker bids and offers he intended to cancel, seeking to control prices on the broker’s screen.

In one conversation described in the order, the broker offered to withdraw an offer because he understood the trader did not want it executed. The trader confirmed that understanding. The broker’s communication and the screen movement supply the evidence connection that code and order messages can supply in an automated futures strategy.

The Commission ordered HSBC Bank USA to pay a $45 million civil penalty for swap misconduct, including spoofing, and recordkeeping failures. The swap-spoofing allegations concerned bids and offers the desk’s supervisor intended to cancel.

What a Futures Spoofing Whistleblower Can Bring

A futures spoofing whistleblower can be a trader, programmer, surveillance employee or another market participant who sees the conduct. The Commodity Futures Trading Commission expressly welcomes information from people outside the company, including market participants who observe someone else’s trading. An insider may explain the instruction behind an order, while an outside participant may identify the repeated pattern and the trades it induced.

The CFTC Whistleblower Program can pay eligible whistleblowers 10% to 30% of qualifying monetary sanctions collected. We assess the evidence and the award opportunity with you.

International market participants can also qualify: the Commission has announced awards to recipients outside the United States. If you work on a desk abroad, we can assess how the trading you know fits the program.

You Know Why the Orders Were There

If you know the strategy behind the cancellations or the story behind the alerts, speak with our whistleblower experts about the trading you saw. We connect the market sequence with the decisions inside the desk and bring in commodities fraud whistleblower lawyers who understand spoofing evidence. We stay beside you as your case develops, with the purpose of those orders at the center of it.