Key takeaways
- Spoofing is placing orders you intend to cancel before execution to mislead others about supply or demand; layering does the same with multiple orders at several price levels.
- Both are illegal: the US Dodd-Frank Act explicitly bans spoofing in futures, securities law prohibits manipulation, and the EU Market Abuse Regulation lists them as manipulative practices.
- Landmark cases include Navinder Sarao (linked to the 2010 Flash Crash), Michael Coscia (the first criminal spoofing conviction) and multi-hundred-million-dollar bank settlements.
- Surveillance looks for a pattern: large visible orders on one side, a small execution on the other, then rapid cancellation — repeated over time.
- Intent is the dividing line: market makers cancel most orders legitimately, so documented quoting logic and controls are essential.
What are spoofing and layering?
Spoofing is placing orders you intend to cancel before they execute, to mislead other traders about supply or demand. Layering is a variant that stacks multiple such orders at several price levels on one side of the book. Both aim to move the price so the manipulator can trade profitably on the other side.
A typical spoofing sequence takes seconds or less:
- The trader places a small genuine order to sell above the market.
- They place large buy orders below the best bid, making demand look stronger.
- Other participants and algorithms react, and prices tick up.
- The small sell order fills at the higher price.
- The large buy orders are cancelled before they can execute.
Repeated hundreds of times a day, small gains add up — and so does the evidence.
Figure 1: A layering sequence in four steps
How spoofing moves prices
Spoofing works because order book information matters. Many algorithms use order book imbalance — the balance of visible buy and sell interest — to predict short-term price moves. A spoofer exploits that signal by creating fake imbalance, nudging prices and other algorithms in the direction they want.
This is why our guide to order book imbalance warns that imbalance signals can lie. Legitimate participants pay twice: once when they trade at manipulated prices, and again when they widen spreads to protect against the risk.
The legal framework
In the US, Dodd-Frank (2010) amended the Commodity Exchange Act to ban spoofing explicitly in futures and commodities markets, and securities laws prohibit manipulative trading in equities. In the EU and UK, the Market Abuse Regulation lists placing orders with no intention to execute as market manipulation.
| Jurisdiction | Main rule | Applies to |
|---|---|---|
| United States | Commodity Exchange Act §4c(a)(5)(C), as amended by Dodd-Frank | Futures, options on futures, commodities |
| United States | Securities Exchange Act §9(a)(2), §10(b), Rule 10b-5 | Equities, options |
| EU / UK | Market Abuse Regulation (MAR), Article 12 and Annex I | Instruments traded on EU/UK venues |
| Exchanges | Venue rulebooks (e.g., CME Rule 575) | Members and market participants |
US prosecutors have also used wire fraud and commodities fraud statutes in criminal spoofing cases, which carry heavier penalties.
Landmark enforcement cases
Key cases shaped the law: Michael Coscia became the first person criminally convicted under the anti-spoofing provision; Navinder Sarao’s spoofing in E-mini futures was linked to the 2010 Flash Crash; and large banks paid hundreds of millions of dollars to settle spoofing charges in precious metals and Treasury futures.
- Michael Coscia (2015): first criminal conviction under Dodd-Frank’s anti-spoofing provision, for algorithmic spoofing in futures.
- Navinder Sarao (2016 plea): a London-based trader whose layering in E-mini S&P 500 futures was cited as contributing to the May 2010 Flash Crash.
- Igor Oystacher and other futures cases: CFTC actions establishing patterns regulators look for.
- Bank settlements: major banks settled spoofing cases in metals and Treasury futures for amounts ranging from tens of millions to hundreds of millions of dollars.
Enforcement in 2025–2026
Spoofing enforcement continued in 2025 but at a smaller scale. Recent CFTC actions included a $200,000 settlement for E-mini spoofing, while the agency also dismissed some contested cases and shifted more resources toward crypto. Exchange disciplinary actions remained steady, with lower aggregate penalties.
Trends practitioners should note:
- Individual settlements in the hundreds of thousands of dollars, often with trading bans.
- Some dismissals of contested CFTC cases, showing that intent remains hard to prove.
- Exchange-level discipline — CME and other venues continue to bring their own cases.
- Cross-market spoofing, where orders in one market move prices in a related market, is a growing focus of surveillance.
How surveillance detects spoofing and layering
Surveillance systems flag a recognisable pattern: large visible orders concentrated on one side of the book, a price move in their direction, an execution by the same trader on the opposite side and rapid cancellation of the large orders. Repetition across days, order-to-trade ratios and communications turn alerts into cases.
Typical detection conditions:
- Concentration: the trader’s orders form a large share of visible depth on one side.
- Price pressure: prices move in the direction implied by that depth.
- Opposite-side execution: the trader fills an order on the other side.
- Cancellation: the large orders are cancelled shortly after the fill.
- Reversion: prices fall back once the fake depth disappears.
- Repetition: the pattern recurs, ruling out coincidence.
Firms are expected to run their own surveillance under MAR, FINRA rules and exchange requirements, not just rely on regulators.
Figure 2: From order data to a spoofing case
Related practices: quote stuffing and momentum ignition
Quote stuffing floods a venue with orders and cancels to slow competitors or obscure the book. Momentum ignition uses aggressive orders to trigger other traders’ stops or algorithms, then trades against the move. Both are treated as potential manipulation, depending on intent and effect.
MiFID II limits order-to-trade ratios on EU venues, partly to deter quote stuffing. Momentum ignition is harder to prove because aggressive trading is often legitimate; surveillance focuses on whether the trader profited from a move their own orders created.
Grey areas for market makers
Market makers cancel the vast majority of their orders as they update prices, so cancellation alone is not evidence of spoofing. The legal test is intent at the time of placing the order. Firms protect themselves with documented quoting logic, pre-trade controls, surveillance of their own algorithms and clear policies on order placement.
Good practice for algorithmic firms:
- Document how each strategy places, modifies and cancels orders, and why.
- Test algorithms for behaviour that could look manipulative before deployment, as required by MiFID II RTS 6.
- Run self-surveillance with the same patterns regulators use.
- Keep communications compliant — chats are often the decisive evidence in spoofing cases.
- Review deep, quickly cancelled orders on the opposite side of fills, especially in thin markets.
Frequently asked questions
What is the difference between spoofing and layering?
Spoofing usually involves one or a few large orders placed with no intention of execution. Layering uses multiple orders at different price levels on one side of the book to create a false impression of depth. Layering is generally treated as a form of spoofing.
Is spoofing illegal?
Yes. In the US, the Dodd-Frank Act made spoofing in commodity and futures markets explicitly illegal in 2010, and securities laws prohibit manipulative trading. In the EU and UK, the Market Abuse Regulation treats spoofing and layering as market manipulation. Penalties include fines, trading bans and prison.
How is spoofing detected?
Surveillance systems look for patterns: large orders that move the visible book, a trade executed on the opposite side, then quick cancellation of the large orders. Repetition, order-to-trade ratios, timing and communications all build the case.
Is cancelling orders spoofing?
No. Most orders in electronic markets are cancelled, especially by market makers updating quotes. Spoofing requires intent to cancel before execution when placing the order. Regulators look at patterns and evidence of intent, not cancellation alone.
What penalties apply to spoofing?
Penalties range from fines and disgorgement to trading bans and criminal sentences. Recent individual CFTC settlements have been in the hundreds of thousands of dollars, while large bank cases have reached hundreds of millions, and criminal cases have resulted in prison terms.
Sources and further reading
- CFTC Release 9118-25 (spoofing settlement) — Commodity Futures Trading Commission, 2025
- What is layering? (detection conditions and case list) — Trillium Surveyor knowledge base
- Market manipulation and microstructure — Cornerstone Research, 2026
- Regulation (EU) No 596/2014 on market abuse (MAR) — European Union, 2014
Svetlana Berezhnova is a co-founder of Westernpips and has been a trader since 2007. She has been with the company from its very beginning and is an expert in high-frequency trading and latency-sensitive trading software.
This article is for educational purposes and describes market structure; it is not investment, legal or tax advice. Statistics are attributed to their original sources, which should be consulted for methodology and limitations.
