How to detect spoofing (or layering)?

With trading in today's world being characterized by order books that constantly change at the millisecond, trade surveillance analysts (from asset managers, brokers, exchanges and authorities) do not have an easy task in identifying spoofing situations.

Many spoofing/layering schemes are not seamless (i.e., do not follow perfect textbook spoofing/layering patterns), as: i) the manipulator, while spoofing, can simultaneously place/modify/cancel other orders to confuse the trade surveillance system/analysts; ii) in a liquid market, other traders simultaneously place/modify/cancel orders, making it harder to isolate/identify the manipulative pattern.

For example, if we are looking to detect typical patterns of layering (where there are multiple price steps from the manipulator), an alert can be set to be triggered whenever:

• A market participant (A) places a buy (sell) order that is immediately executed against an order of another market participant (B) at the best ask (bid); and
• The market participant A has at least X sell (buy) orders with Y different price steps that were placed before market participant B’s sell (buy) order was placed.

However, a solid trade surveillance system should go beyond the seamless spoofing/layering cases and should have alerts for whenever a market participant has the following behaviors:

• High ratio of cancelled orders to executed orders; 
• High ratio of modified orders to executed orders; 
• High share of the total orders;
• High share of the total cancelled orders; 
• Cancelled orders with prices close to the best bid/ask; 
• Cancelled orders shortly after being placed;
• Orders placed in both sides of book, usually large orders on one side (which may be the spoof orders) and small orders on the other side (which may be the tradable orders).

Thus, surveillance systems may have alerts for the above mentioned indicators. However, this is just a preliminary approach. Afterwards, as those indicators are not sufficient by themselves to say that someone has spoofed, trade surveillance analysts need to verify whether:

• The alleged spoof orders drove other market participants to change the prices of their orders;  
• The alleged spoofer managed to trade at more favorable conditions due to such change in market prices; 
• There is evidence that the alleged spoofer never had the intention to execute the alleged spoof orders.