How Market Surveillance Catches Manipulation

Market surveillance is the monitoring of orders and trades to detect manipulation such as spoofing, wash trading and insider dealing. Exchanges, brokers and regulators run systems that flag unusual patterns. It is only as good as the response: JPMorgan paid over $920 million in 2020 after spoofing continued despite alerts flagged in 2014.

What surveillance looks for

• Spoofing: placing orders you intend to cancel to create a false impression of demand.
• Wash trading: trading with yourself to fake volume. See how to read crypto trading volume.
• Insider trading: trading before material news becomes public.
• Marking the close and ramping: pushing prices at key moments.

Figure: Common patterns surveillance systems flag.

Spoofing, illustrated

Suppose a trader wants to sell 10 futures contracts at a higher price. (Illustrative scenario.) The trader places large buy orders, totaling 500 contracts, just below the current price, with no intention of letting them fill. Other participants see apparent heavy demand and raise their bids. The trader sells the 10 contracts at the improved price, then cancels the 500-contract buy orders within seconds. Surveillance systems look for exactly this pattern: large orders placed and cancelled quickly on one side, combined with executions on the other side.

How it works

Systems compare each order and trade against patterns: order-to-cancel ratios, positions before news, trades between linked accounts. Alerts go to compliance teams, who investigate and refer cases to regulators.

Insider trading detection

To find possible insider trading, surveillance teams look for unusual trading before announcements, such as heavy buying of shares or options days before a takeover is announced. They compare the timing with lists of people who had access to the information and with links between accounts. Many insider trading cases begin with an alert generated by these systems after the news breaks, when regulators review who traded beforehand.

Who runs it

Exchanges watch activity on their own venues, brokers must monitor their clients’ orders, and regulators combine data across venues to spot patterns no single firm can see.

The JPMorgan case

Between 2008 and 2016, JPMorgan traders placed orders in precious metals and Treasury futures they never intended to execute, creating false impressions of supply and demand. The bank agreed in September 2020 to pay more than $920 million, the largest penalty ever imposed by the US Commodity Futures Trading Commission. In an earlier case, a UK trader pleaded guilty in 2016 to spoofing linked to the 2010 flash crash.

Spoofing and the flash crash

In 2016, a UK trader, Navinder Sarao, pleaded guilty in the US to spoofing in S&P 500 futures, activity that authorities linked to market conditions on the day of the May 2010 flash crash. The case showed that spoofing by a single trader could contribute to wider instability and prompted greater focus on order-level surveillance in futures markets. See what happened in the 2010 flash crash.

Crypto surveillance

Crypto markets have less consistent surveillance across venues, which is one reason regulators have been cautious. See how high-frequency trading changed spreads.

What it means for traders

Manipulation can distort prices you trade on; regulated venues with active surveillance reduce, but do not eliminate, that risk. See why exchanges halt trading in a stock and why best execution matters for traders.

Wash trading in crypto

In 2019, an analysis submitted to US regulators suggested that about 95% of reported spot bitcoin trading volume on unregulated exchanges was fake or non-economic, inflated by wash trading. Regulated venues and surveillance-sharing agreements were later a key condition for approving spot bitcoin ETFs, because regulators wanted assurance that the underlying market could be monitored. See how to read crypto trading volume.

Pump and dump schemes

In a pump and dump, organizers buy a thinly traded asset, promote it aggressively, often through social media, and sell once others pile in. Such schemes target small shares and crypto tokens. Surveillance looks for coordinated buying, sudden spikes in volume and promotional activity, and regulators pursue the organizers, though recovering investors’ losses is difficult.

How brokers fit in

Brokers must monitor their own clients’ orders for signs of abuse and report suspicious activity to regulators. A client repeatedly placing and cancelling large orders, or trading heavily before announcements, may trigger an internal review. For traders, this means unusual patterns can lead to questions from the broker, even when activity is innocent.

Market abuse rules in Europe

The EU’s Market Abuse Regulation, applied since 2016, prohibits insider dealing, unlawful disclosure of inside information and market manipulation, and requires firms to detect and report suspicious orders and transactions to regulators. Similar rules apply in the UK. The rules cover orders as well as completed trades, which matters for detecting spoofing, where the manipulation lies in orders that are never executed.

A complete audit trail

In the US, regulators built a consolidated audit trail that records orders, quotes and trades across exchanges and brokers, tagged to the customers behind them. It lets investigators reconstruct activity across venues, something individual exchanges could not do alone. The system’s scale and cost have drawn debate, but it gives regulators a far more complete picture than before.

Machine learning in surveillance

Surveillance systems increasingly use machine learning to spot unusual patterns among billions of orders, reducing false alerts and catching new forms of abuse. Human analysts still review the alerts and decide whether to escalate.

Social media and manipulation

Coordinated promotion on social media can move small shares and crypto tokens. Regulators monitor online activity alongside trading data to spot schemes that combine misleading posts with trading.

Common misreadings

• Assuming cancelled orders are always suspicious.
• Believing crypto markets are monitored as closely as major exchanges.

Penalties and deterrence

Enforcement ranges from warnings and fines to trading bans and criminal charges. The JPMorgan settlement of more than $920 million in 2020 combined penalties, restitution and disgorgement across several agencies. Large penalties aim to deter firms from tolerating abuse, while individual traders can face prison for serious manipulation. Regulators also fine firms whose surveillance systems fail to detect abuse, even when the firm did not profit, to push them to invest in better monitoring.

Front-running and conflicts

Surveillance also looks for front-running, when a firm or employee trades ahead of a client’s large order to profit from the expected price move. Brokers must keep client orders confidential and monitor staff trading. Conflicts are especially sensitive where a firm executes client orders against its own book, which is why best execution and surveillance rules work together. See why best execution matters for traders.

Surveillance and CFD providers

CFD providers must monitor client trading for abuse, even though trades do not take place on an exchange. A client trading share CFDs ahead of takeover announcements, for example, could be using inside information, and providers must report such suspicions. Providers also watch for clients exploiting pricing errors or latency, which may breach their terms even when not illegal.

Whistleblowers

Many manipulation cases come to light through insiders. US regulators run whistleblower programs that pay rewards for information leading to successful enforcement, and several large cases have started this way.

A short glossary

• Layering: placing several orders at different prices to create false depth.
• Marking the close: trading near the close to influence the closing price.
• Cross-market manipulation: trading in one market to profit in a related one, such as futures and shares.

What traders can do

Traders can protect themselves by trading on regulated venues and with regulated providers, being wary of social media tips promoting thinly traded assets and avoiding patterns of placing and cancelling large orders that could be mistaken for manipulation. Reporting suspicious offers or schemes to regulators helps them act sooner. Understanding how manipulation works also helps traders recognize when prices are moving for reasons unrelated to fundamentals, such as sudden spikes in obscure tokens on a single exchange, and to avoid being the last buyer in a pump. A healthy skepticism toward sudden, unexplained price spikes is one of the simplest available defenses against manipulation that ordinary retail traders have.

Frequently asked questions

Is high-frequency trading the same as spoofing?

No. High-frequency trading is legal and uses speed to trade; spoofing is the illegal placing of orders not intended to be executed.

Can retail traders be accused of manipulation?

Yes, if their activity fits patterns such as wash trading or spoofing, though most cases involve professional traders.

This article is educational content and does not constitute financial, investment, legal or tax advice. Digital assets are volatile and you may lose the amount you invest.

Sources

• JPMorgan to pay $920 million for manipulating precious metals, Treasury market (2008–2016; orders never intended to execute; surveillance flagged issues in 2014; largest CFTC settlement) — Fox Business / Reuters, September 2020
• Spoofing: QuickTake (Sarao guilty plea in 2016; link to the May 2010 flash crash) — Bloomberg
• 95% of Spot Bitcoin Trading Volume Is Fake (wash trading in crypto, 2019) — Bitwise via SEC filing
• Regulators release flash crash probe report ($4.1 billion sell program) — PlanAdviser / AP