Spoofing Detection and Market Abuse Signals
Spoofing is generally the practice of placing orders with intent to cancel before execution in order to create a misleading impression of supply or demand. It is not defined by a cancellation alone. Market makers cancel continuously as prices, inventory, and risk change. A quantitative surveillance model must identify a sequence of intent consistent behavior, then escalate candidates for review rather than pronounce guilt.
The raw material is order-level audit data: account or firm identifier where permitted, order IDs, modifications, executions, and the contemporaneous book. Aggregated depth cannot reliably associate a large displayed order with its subsequent cancellation. Build deterministic event replay first; order book reconstruction covers the necessary state controls.
The behavioral sequence
A canonical candidate has four stages:
- A large order appears near the touch and shifts displayed imbalance.
- The opposite-side order, or a related account’s order, executes.
- The large order is cancelled or reduced before meaningful execution.
- Price or liquidity reverts after its removal.
| Feature | Interpretation | Important control |
|---|---|---|
| Size / normal depth | Potentially misleading visibility | Instrument liquidity |
| Distance to touch | Ability to influence perception | Spread and tick size |
| Resting duration | Brief display may be suspicious | Message latency |
| Executed fraction | Near-zero fill supports candidate | Queue position |
| Opposite-side trading | Potential beneficiary | Account linkage |
| Post-cancel reversal | Temporary pressure signature | Market-wide move |
Large cancellation rates alone are a bad detector. During volatile news, legitimate liquidity providers cancel and reprice together. Condition every statistic on volatility, time of day, spread, and market-wide order-flow pressure.
A transparent scoring model
Start with interpretable scores so investigators can reconstruct why an alert fired:
def spoof_score(size_z, life_ms, executed_frac, opposite_qty, reversal_bps):
short_lived = max(0, 1 - life_ms / 2_000)
unfilled = 1 - min(1, executed_frac)
return (1.2 * size_z + 1.0 * short_lived + 1.5 * unfilled
+ 0.8 * opposite_qty + 0.6 * max(0, reversal_bps))
The production version should use robust within-symbol percentiles, not global raw thresholds. It should also aggregate repeated episodes over an account-day: intent is more credibly inferred from a persistent pattern than a single order in a chaotic market.
Causality and false positives
Order-book imbalance predicts short-horizon movement even when nobody manipulates it. The model must distinguish a quote that caused a perception from one that reacted to an already moving market. Measure incremental imbalance after the suspicious add and compare its impact with matched controls from the same symbol and regime.
Related tactics complicate labels: layering spreads multiple levels, while momentum ignition uses executed trades to provoke a move. Hidden liquidity, reserve orders, and auction activity can make a displayed cancellation look deceptive when it is not. The auction should be modeled separately; see auction mechanics.
Governance matters as much as accuracy
| Control | Purpose |
|---|---|
| Immutable raw messages | Reproducible evidence |
| Versioned feature code | Explain alerts historically |
| Human case review | Avoid automated legal conclusions |
| Threshold calibration | Control false-positive workload |
| Retention and access policy | Handle sensitive identities |
Use labels from completed investigations carefully: they are scarce, delayed, and selected. An anomaly model can prioritize review, but a high score is not proof of intent or a trading signal to exploit. For execution, treat rapid depth withdrawal as a liquidity-risk input alongside adverse selection.
Review workflow
Each alert should include a replayable book view, exact raw messages, matched-control statistics, and linked trading. That evidence helps reviewers separate responsive liquidity provision from behavior requiring a formal investigation.
Key takeaways
- Spoofing is a contextual intent question, not “large order then cancel.”
- Order-level, sequence-accurate data is required for defensible surveillance.
- Score complete patterns: display, opposite-side benefit, cancellation, and reversal.
- Match controls by volatility and market regime to contain false positives.
- Keep models auditable and use human review for all enforcement conclusions.