Spoofing is the placement of one or more non-bona fide orders with an intention to cancel before execution, usually to create a misleading impression of supply, demand, or price and benefit other trading. Exact legal elements and scope depend on the applicable regime.
In plain terms — An order is shown to influence what others see, not because the trader genuinely intends to trade it. Cancellation alone does not prove that intention.
Entering the order
The order is executable but alleged to be non-bona fide: the trader intends to cancel it before execution rather than genuinely seek a fill. Size, distance from the best bid or offer, lifetime, modification, and fill history may be relevant, but no single threshold identifies spoofing.
Traders routinely cancel legitimate orders when prices move, risk changes, inventory is filled elsewhere, or a strategy updates. Under the CFTC's guidance, a good-faith cancellation or modification is not automatically a spoofing violation; intent and surrounding facts matter.
Apparent pressure
The displayed order may make one side of the order book look heavier and induce participants or algorithms to change quotes or trade. Displayed depth is not executed volume, and neither measure by itself establishes genuine independent interest.
A large visible order can also be a genuine attempt to trade. The analyst asks whether the order was realistically exposed to execution and how it behaved as the market approached it.
Trading on the opposite side
A common pattern pairs the displayed pressure with an order intended to trade on the opposite side at a more favourable price. Time-aligned order and trade records can show whether the same participant or a connected account obtained that execution or another measurable benefit.
Opposite-side trading strengthens a hypothesis but does not replace proof of identity, linkage, and intent. Cross-account, cross-venue, or cross-product activity may require data that a public chart does not contain.
Cancellation or removal
The non-bona fide order is often cancelled after the other-side execution or as the risk of a fill increases. A partial fill does not automatically make the remaining order legitimate or manipulative. Sequence, repetition, exposure to execution, and the trader's conduct before and after the event are assessed together.
EU Delegated Regulation 2026/788 describes updated non-exhaustive indicators that include placing multiple or large orders away from the touch on one side, executing on the other, and removing orders not intended for execution. It notes that the pattern is usually known as layering and spoofing; an indicator is not a verdict.
Evidence and boundary
Professional surveillance can combine order-level timestamps, additions, modifications, cancellations, fills, participant identifiers, positions, opposite-side benefit, repetition, communications, and algorithm logic. It also tests ordinary order management, hedging, market making, and technical failures.
The final classification depends on market, instrument, venue, jurisdiction, date, and the elements of the relevant rule. If only public data are available, describe the observable pattern and report it; do not infer a person's intent or guilt from a cancellation ratio or screenshot.
Common mistake — Treating every cancelled large order as spoofing. Cancellation is normal market activity; the issue is whether the order was entered without bona fide intent and used as part of a supported manipulative sequence.
Sources
- CFTC — Interpretive Guidance and Policy Statement on Disruptive Practices — explains intent, legitimate cancellation, partial fills, market context, and trading patterns under the US derivatives provision.
- EUR-Lex — Commission Delegated Regulation (EU) 2026/788 — updates EU indicators and expressly describes an order-and-execution pattern usually known as layering and spoofing.
- EUR-Lex — Market Abuse Regulation, consolidated text as of 5 June 2026 — Article 12 and Annex I provide the relevant EU market-manipulation framework and non-exhaustive indicators.
- FINRA — 2024 Annual Regulatory Oversight Report: Manipulative Trading — surveillance considerations for non-bona fide orders, opposite-side trading, multiple products, and platforms.
- FINRA — Potential Manipulation Report — describes pattern exceptions for layering and cross-market quote spoofing without equating an exception with a final finding.
- EUR-Lex — Markets in Crypto-Assets Regulation, Article 91 — covers orders, transactions, and behaviour capable of giving false or misleading signals in the EU crypto-asset perimeter.
- ESMA — Market integrity — official context for prevention, detection, and supervisory convergence in EU markets.