Spoofing Similarity Model

Elise Fleischaker Product Features

The Spoofing similarity model identifies various forms of market abuse that involve false or misleading order activity known as spoofing.

“Criminal laws are rarely struck down on grounds of vagueness;
vagueness is recognized to be necessary to make criminal laws effective.”
CFTC argument in the matter of: Panther Energy Trading LLC and Michael J. Coscia

Spoofing is a crime, but the word “spoofing” in a criminal context is relatively new. It did not appear in the first cases brought by the SEC and CME in 2001, for activity equivalent to a pit trader signaling a bid to buy and later refusing to acknowledge the fill. Those early spoofing-type cases were settled, and garnered little industry attention. The passage of Dodd-Frank codified spoofing, rulemaking followed, and the regulators are searching through years of data for an abusive trading practice that many would argue is ill-defined. The regulators appear to believe that their written guidance communicates their expectations for market participants, but at the same time describes the law as necessarily vague. Participants are now struggling to use the tools they have to apply this new broadly-defined rule to massive data sets.

This is where Neurensic and machine learning come into play. We are training machines with regulatory inquiry and case data in order to detect the complicated patterns causing so much angst. We offer no view on whether the regulatory definition of spoofing is right or wrong, or whether a trading pattern constitutes a violation. We simply offer tools that allow firms to visualize the risk of their trading activities in the context of past, current, and future regulatory action. Risk for us is a measure of the likelihood of regulatory attention.

The Neurensic Spoofing Similarity model has been trained by our data science team using regulatory inquiry data and machine learning techniques to detect various different patterns of spoofing activity including, but not limited to, the following:

Simple Spoofing

Simple spoofing involves placing a small order on one side of the book with the intent to trade (the intent side) followed by a large order or orders on the opposite side of the book (the spoof side) which are not intended for execution. See How Spoofing Works & Why It Is Illegal

Spoofing with Layering

Spoofing with layering is similar, but the orders placed on the spoof side are at multiple price levels, or layered, in the book. These orders are designed to create a false or misleading impression of liquidity and to entice market participants to execute against the intent side. Once filled, all spoof side orders are typically cancelled or modified to avoid execution.

Spoofing with Vacuuming

Vacuuming is a complex spoofing pattern involving significant open interest on both sides of the market where the cancellation of a large spoof order on the same side of the market as a smaller intent order is used to mislead participant into executing against the small order.

Collapsing of Layers

Collapsing of layers is a manipulative technique employed to circumvent pre-trade order size limits. This behavior involves a small order on the intent side, and a series of orders on the spoof side at many different price points. These spoof side orders are then modified to a single price point to create the appearance of large volume.   See Collapsing Example.


Flipping is a variation of spoofing that involves the switching, or flipping, of interest on one side of the market to the other at the same price point. More specifically, it is when a trader places a large order on the spoof side at or near the best bid or offer to create the false impression of market depth in order to induce participants to place orders on the same side at the same price point. The trader then cancels the spoof side orders and simultaneously flips from buy to sell (or vice versa) to execute against the other participants.

Spread Squeeze

This variation of spoofing is unique to instruments with spreads that are multi-tick wide. The behavior involves the placing of orders on the spoof side at successively higher or lower prices within the spread to squeeze it one direction, enticing other market participants to join or beat the newly established top of book. The trader then switches sides and executes against those participants. After execution, the spoof side orders are cancelled and the market returns to its previous state. The trader then uses the same squeeze technique on the opposite side to trade out of the established position at an advantageous price. Unlike other spoofing or layering scenarios the spread squeeze does not require orders of size.

Regulatory Links:

CME Group Exchange Rule 575 – Disruptive Practices Prohibited

Dodd-Frank Section 747 prohibiting Spoofing

ICE Canada’s Q&A on Disruptive Trading Practices