Layering is a spoofing-family pattern in which multiple non-bona fide orders are placed at different price levels to create apparent one-sided pressure, often while the actor seeks an execution or benefit on the other side. Terminology and legal elements vary by regime.
In plain terms — Instead of one misleading order, several orders form visible “layers” in the book. Their number and later cancellation do not by themselves prove manipulative intent.
Multiple price levels
Orders appear at several prices on one side of the order book. Size, spacing, distance from the best quote, timing, modifications, and how the layers move with the market can all matter. There is no universal number of orders or cancellation-rate threshold that turns activity into layering.
Legitimate strategies can quote multiple levels to provide liquidity, manage inventory, or split an order. The analytical question is whether the displayed orders were bona fide and realistically exposed to execution.
Apparent one-sided pressure
The layers can make supply or demand look stronger and may alter another participant's view of order-book imbalance. Quoted depth is not executed volume. Even executed volume does not prove independent genuine interest when accounts or counterparties are linked.
Other traders may react by moving quotes, crossing the spread, or cancelling their own orders. That response can be relevant evidence, but it can also be caused by news, low liquidity, or ordinary quote updates.
Opposite-side trade
A common surveillance pattern looks for a bona fide order or execution on the opposite side that benefits from the apparent pressure. The actor may obtain a better price, accelerate a fill, or influence a related instrument.
The link may involve the same account, related accounts, coordinated actors, multiple venues, or an underlying instrument and its derivative. Public book data usually cannot establish beneficial ownership or coordination.
Removal of the layers
The displayed orders are often cancelled after the opposite-side execution or when they approach the front of the queue. This sequencing can support the hypothesis, especially when repeated, but cancellation remains normal market behaviour and is not proof by itself.
EU Delegated Regulation 2026/788 expressly describes multiple or large orders away from the touch on one side, execution on the other side, and removal of orders not intended for execution as a pattern usually known as layering and spoofing. The regulation treats it as a non-exhaustive indicator for further analysis, not an automatic finding.
Evidence and distinction from spoofing
Spoofing is the broader order-intent concept; layering usually emphasises several orders across several price levels. In practice, authorities and venues may use the labels differently or together.
Surveillance combines nanosecond- or millisecond-level order events where available, participant identifiers, queue position, fills, cancellations, opposite-side benefit, positions, related products, communications, and algorithm logic. It tests market making, hedging, fragmented execution, risk limits, and technical errors before classification under the rule for that market, instrument, venue, jurisdiction, and date.
Common mistake — Reading a deep order book or a cluster of cancellations as evidence of genuine liquidity or, at the opposite extreme, as proof of layering. Both conclusions require more context.
Sources
- EUR-Lex — Commission Delegated Regulation (EU) 2026/788 — updated EU indicators expressly describe a multi-level order pattern usually known as layering and spoofing.
- EUR-Lex — Market Abuse Regulation, consolidated text as of 5 June 2026 — Article 12 and Annex I establish the EU framework for false or misleading signals and order-based indicators.
- FINRA — Potential Manipulation Report — defines the layering surveillance pattern, including multiple baiting levels, an opposite-side execution, and cancellation.
- FINRA — 2024 Annual Regulatory Oversight Report: Manipulative Trading — covers cross-market, cross-product, customer, and algorithmic surveillance considerations.
- CFTC — Interpretive Guidance and Policy Statement on Disruptive Practices — explains intent, good-faith cancellation, market context, and examples involving multiple bids or offers in the US derivatives perimeter.
- EUR-Lex — Markets in Crypto-Assets Regulation, Article 91 — provides the relevant EU manipulation framework for crypto-asset orders, transactions, and behaviour.
- ESMA — Guidelines on supervisory practices to prevent and detect market abuse under MiCA — risk-based supervision and data considerations for crypto-asset market abuse.