Spoofing and Layering: Intent to Cancel Before Execution

Key Takeaways

• Spoofing and layering market manipulation involves placing orders with no intent to trade in order to move the NBBO and then executing on the other side at a more favorable price.
• The Dodd-Frank Act explicitly prohibited spoofing in 2010; Michael Coscia became the first person convicted criminally under the statute in 2015, receiving three years in prison.
• Many investors confuse high cancellation rates with spoofing; intent to cancel before execution, not the cancellation itself, is what makes the practice illegal.
• Understanding spoofing helps investors recognize that order book depth can be fabricated and should not be read as firm committed liquidity.

What It Is

Section 747 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (2010) added a specific prohibition on spoofing in the Commodity Exchange Act. The statute defines spoofing as "bidding or offering with the intent to cancel the bid or offer before execution."

The parallel prohibition in securities markets flows from the anti-manipulation rules in Section 10(b) of the Securities Exchange Act of 1934, Rule 10b-5, and FINRA Rule 2020 (manipulative and deceptive practices). Exchange rules (NYSE Rule 5210, Nasdaq Rule 2020, CME Rule 575) prohibit disruptive trading practices.

Layering is a pattern involving a visible "layer" of non-bona-fide orders on one side of the book. The trader places these layered orders to move the NBBO or tighten the near-side quote, executes a trade on the opposite side at a more favourable price, then cancels the layered orders.

The Intuition

Every quote contributes information about supply and demand. Algorithmic trading strategies, from market makers to institutional execution algorithms, build a view of the market by reading the order book. A spoofer exploits this information channel by injecting false signals.

The key element is intent. Cancelling orders is a normal and legal part of market-making and execution strategy. What turns a cancellation into spoofing is the ex-ante intent not to trade. That makes enforcement a question of proving state of mind, and regulators have built cases using message-level order data, quote-to-trade ratios, and patterns of behaviour across time.

How It Works

A stylised layering pattern on a single security:

1. The trader wants to buy 100 lots at a better price than the current offer.
2. The trader places large sell orders at, say, 3, 4, and 5 ticks above the best offer. These are the "layers."
3. Market participants observing the heavy displayed sell interest perceive downward pressure and adjust their quotes: offers widen, bids move lower.
4. The trader hits the newly lower bids with a small buy order or captures liquidity at the lower offer that appears as spreads move.
5. The layered sell orders are cancelled before any of them are executed.
6. The trader has acquired 100 lots at a price that the original book would not have provided.

A momentum ignition spoof inverts the pattern: the trader places large buy orders to trigger trend-following algorithms to buy, then sells into that flow while cancelling the layered buy orders.

The illegality is not in placing and cancelling orders. It is in the intent not to trade at the time the order was placed. Regulators prove intent through quote-to-trade ratios (very high cancel rates on the spoofed side, very high fill rates on the opposite side), order-size asymmetry, timing patterns, and internal communications.

Worked Example

Michael Coscia case (CFTC and DOJ, 2013-2017). Coscia was a trader at Panther Energy Trading. In 2013 the CFTC fined him 2.8 million dollars for spoofing across several CME products and the ICE Futures Europe market during 2011. In 2015, he became the first person convicted under the Dodd-Frank anti-spoofing statute in federal court; the Seventh Circuit affirmed in 2017. He was sentenced to three years in prison and the case established that Section 747 is constitutional and sufficiently specific to support criminal prosecution.

Navinder Singh Sarao case (CFTC and DOJ, 2015-2020). Sarao was a London-based futures trader who placed large layered sell orders in the CME E-mini S&P 500 futures from his home. The CFTC and DOJ alleged his activity contributed to the May 6, 2010 Flash Crash, in which the Dow Jones Industrial Average dropped roughly 9 percent within minutes before recovering. Sarao pleaded guilty in 2016 to one count of wire fraud and one count of spoofing, and in 2020 received a sentence of one year home incarceration after providing cooperation. His flagged orders totalled thousands of contracts, cancelled in milliseconds before execution.

Both cases established the template regulators now use: granular message-level data, pattern analysis, cross-venue reconstruction, and public prosecution.

Common Mistakes

1. Assuming high cancellation rates equal spoofing. Market makers cancel most of their orders. A bid posted to capture flow that never arrives is cancelled and replaced thousands of times a day. Cancellation alone is not spoofing. Intent is.

2. Confusing layering with iceberg orders. An iceberg (or reserve) order displays a small slice of a larger total and is a legitimate order type on most exchanges. Layering displays multiple orders on a side the trader never intends to execute. The two are mechanically and legally different.

3. Treating all momentum ignition as manipulative. Aggressive order placement intended to execute is legal, even if it triggers follow-through from other algorithms. Momentum ignition becomes manipulative only when the initial orders are placed without intent to trade.

4. Ignoring spoofing in options and crypto. Enforcement has expanded from futures to cash equities, options, and, in regulated contexts, crypto derivatives. The legal test is the same: intent-to-cancel-before-execution, in a market covered by federal anti-manipulation statutes.

5. Overlooking the civil-criminal distinction. The CFTC can bring civil enforcement under Section 747. DOJ can bring criminal charges under the same statute or under wire fraud (18 U.S.C. 1343). The same conduct can produce both.

Frequently Asked Questions

Q: What are spoofing and layering in simple terms? Spoofing is placing a large order with no intention of letting it fill, in order to fool other participants into thinking there is genuine supply or demand. Layering stacks multiple such orders at different prices on one side to push the quote, then executes on the other side before canceling everything.

Q: How do spoofing and layering affect investment decisions? They distort the order book signals that algorithmic strategies and institutional traders use. An investor reading the book to gauge supply and demand at a price level may be reading manufactured data designed to trigger a trade in the spoofer's favor.

Q: What is a real-world example of spoofing and layering? Navinder Singh Sarao layered large sell orders in CME E-mini S&P futures from his home. The CFTC alleged his activity contributed to the May 6, 2010 Flash Crash, when the Dow dropped roughly 9 percent in minutes. Sarao pleaded guilty and received one year of home incarceration.

Q: How can investors protect against spoofing effects? Treat displayed order book depth with skepticism, especially in the minutes before major news events. Do not anchor entry or exit decisions solely on large order blocks that appear and disappear quickly without printing.

Q: How is spoofing different from legitimate order cancellation? Canceling orders is a normal and legal part of market making and execution strategy. Spoofing requires proving the trader intended at the time of order placement not to execute. Cancel rates alone are not spoofing; regulators must prove state of mind using message patterns, timing, and communications.

Sources

1. US Congress. "Dodd-Frank Wall Street Reform and Consumer Protection Act, Section 747." https://www.congress.gov/bill/111th-congress/house-bill/4173/text
2. CFTC. "Anti-Spoofing Guidance and Interpretive Order." https://www.cftc.gov/sites/default/files/idc/groups/public/@lrfederalregister/documents/file/2013-12365a.pdf
3. US Department of Justice. "United States v. Michael Coscia: High-Frequency Trader Sentenced." https://www.justice.gov/opa/pr/high-frequency-trader-sentenced-three-years-prison-disrupting-futures-market-first-federal
4. US Department of Justice. "United States v. Navinder Singh Sarao: Plea Agreement." https://www.justice.gov/opa/pr/futures-trader-pleads-guilty-illegally-manipulating-futures-market-connection-2010-flash

Disclaimer

This article is educational content only and is not financial advice. Nothing here is a recommendation to buy, sell, or hold any security. Consult a licensed advisor before making investment decisions.