Spoofing in Trading: What the Law Names and What It Does Not

A trader places a large bid, the book fills in around it, and the bid disappears before anything trades against it. Read one way that is spoofing, a criminal offence. Read another way it is a change of mind, which is what the cancel button on every platform exists for.

The published explanations rarely separate the two. They describe the shape of the conduct, say it is illegal, and leave the reader to assume that seeing the shape is the same as seeing the offence. It is not, and the statutes are where the difference is written down.

This page reads what the two texts say: what each calls the conduct, what each requires before it is unlawful, which markets each reaches, and what a cancelled order type can establish on its own.

One Regime Names It, the Other Describes It Without a Name

Section 6c of title 7 of the US Code sets out three disruptive practices, and forbids all of them where the trading happens at a registered entity or under the rulebook of one. The third is written as conduct that is, or has the character of, or is known in the trade by the name spoofing, and the statute supplies its own short definition in brackets: an order entered while the person entering it means to withdraw it before it can be filled.

That bracket does a great deal of work. It puts a piece of market slang into federal law, fixes its meaning, and makes the meaning turn on what the trader intended rather than on what the book looked like.

Article 12 of Regulation 596/2014, the market abuse text published for the United Kingdom on legislation.gov.uk, reaches the same conduct by another route and never prints the word.

It describes orders placed to a trading venue, including their cancellation or modification, by any means of trading including algorithmic and high frequency strategies, where the result is to make genuine orders harder for others to pick out or to create a misleading signal about supply, demand or price. All of it sits under the heading market manipulation.

So a reader asking whether spoofing is illegal gets a clean answer in one jurisdiction and, in the other, an answer that requires reading a general manipulation provision and recognising the conduct inside it. Across the five readable comparables consulted for this page, the European and UK regulation is not mentioned once.

The Element Is the Intent to Cancel, Not the Cancellation

Cancelling an order is not an offence in either text. Both regimes assume orders are withdrawn constantly, which is why the wording had to attach to something else.

The US provision attaches to a state of mind. The order has to have been entered by someone who already meant to pull it, and meant to pull it before it could trade. A trader who places a real bid and withdraws it two seconds later because the news changed has done nothing the paragraph describes, however similar the two look in a recording of the book.

Article 12 attaches to consequences instead. The behaviour has to give or be likely to give a false or misleading signal about supply, demand or price, or secure a price at an artificial level, and the listed routes include making genuine orders harder to identify or overloading the book.

It then goes further than the US paragraph in one direction: the person may show that the behaviour had legitimate reasons and conformed to an accepted market practice, which takes it out of the definition.

The practical consequence is the same in both places. What is on the screen starts an inquiry and never concludes one.

Both Texts Attach to a Venue, and a Dealt CFD Account Is Not One

This is the part that decides whether either provision has anything to do with the reader, and the part general explanations leave out.

The US paragraph applies where the trading happens at a registered entity, or falls under the rulebook of one. That means an exchange or a comparable body registered with the Commodity Futures Trading Commission. Article 12 is anchored the same way, to orders placed to a UK, Gibraltar or EU trading venue.

Neither wording describes a bilateral contract for difference dealt with a broker that is the counterparty to the trade. Where the broker fills the order internally rather than routing it onward, there is no central book that other participants are reading, so no genuine orders for anyone to be misled about in the sense either text uses.

How that filling works, and why it changes what a quote represents, is covered in our page on how a broker executes your order.

That does not leave such an account unregulated. Conduct rules, best execution obligations and the authorisation of the broker still apply, and manipulation of the underlying market a CFD references is reachable through the venue where the underlying trades. The narrower point is that the depth window on a retail platform is generally a dealer feed rather than a venue order book, which our page on depth of market sets out in full.

Why a Pulled Order Proves Nothing On Its Own

Several widely read pages carry a section on identifying spoofing, built around the visual signature: size appearing at a level, resting long enough to be noticed, and vanishing as price approaches. The signature is real. What it cannot supply is either of the things the two texts turn on.

It cannot supply intent, because a book records quantities and prices rather than reasons. It cannot supply identity, because a public feed aggregates size at a price without saying whose it is. Two orders identical on the screen may come from a market maker adjusting a quote, a hedger whose exposure changed, an algorithm reacting to a correlated instrument, or a person doing what the statute prohibits.

Even the richest public view stops short. Depth of book quotes carry no attribution, as our page on Level 2 market data explains, so the limitation holds at every level of the retail data stack.

Anyone reading a book therefore has an inference, and one that ordinary behaviour also produces. Treating it as a finding is the error this page exists to name.

What the Evidence Consists Of, and Who Holds It

The gap between what a screen shows and what a case needs becomes concrete when you look at what a regulator asks a member of the public to supply. The whistleblower alert of the Commodity Futures Trading Commission wants the contract and the market named, timing given precisely, and the Tag 50 identifier supplied.

Tag 50 is the identifier an exchange assigns to the person or automated system entering an order. It exists because the trade went to an exchange, and it connects a sequence of entries and cancellations to one operator rather than to an anonymous quantity.

That is the shape of the evidence: order level records, timestamped finely enough to sequence entries against fills, each carrying an identity. None of it reaches a public data feed. It sits with the venue, the clearing member, and the regulator that can compel it.

The same asymmetry applies to concealment that is entirely lawful. An iceberg order hides size deliberately and is published in venue order type documentation, a reminder that a book showing less than the whole truth is a normal condition rather than a sign of anything.

Layering Is Named Beside Spoofing and Is in Neither Text

Layering is usually described as several orders placed at different price levels on one side of the book, so that the apparent depth pushes price toward the other side, where the real trade waits. Spoofing, in the same accounts, is the single large order doing that job.

That split is market usage. The US paragraph does not print the word layering, and neither does Article 12. So the distinction is a convention among practitioners and writers, not a line either statute draws, and a reader who expects to find layering defined in law will not find it there.

Where a Report Goes, and What It Has to Contain

The Commodity Futures Trading Commission runs a whistleblower programme under which a person can become eligible for awards and certain protections by identifying violations of the Commodity Exchange Act connected to spoofing. It states that insider status is not required, and that participants observing conduct from the outside are often well placed to identify it.

The route is a Form TCR, the tip, complaint and referral form, submitted with supporting material where it exists. The alert also records the penalty in the United States: a federal crime carrying up to ten years of imprisonment for each violation.

Read with the venue question in mind, that settles who the programme is for. It covers the commodities and derivatives markets the Commission oversees. A client of an offshore broker, filled internally on a contract for difference, is not trading in one of them, and the identifiers the form asks for do not exist for that trade.

The equivalent question in the United Kingdom sits with the Financial Conduct Authority, which supervises the market abuse regime and receives reports of suspicious orders and transactions from regulated firms. One point is worth knowing while reading Article 12: legislation.gov.uk records that the regulation is repealed by the Financial Services and Markets Act 2023, with that change not yet applied to the published wording.

Questions Readers Ask About Spoofing

Before You Conclude You Have Seen Spoofing

Four checks separate a suspicion from something worth acting on, and each is answerable from documents rather than from the screen.

First, establish which book you were watching. If the depth came from a dealing broker rather than from a central venue, neither provision describes what you saw, whatever the shape of it.

Second, establish which regime that venue sits in, because the question changes: intent in the US text, effect and the absence of a legitimate reason in Article 12.

Third, ask whether you hold anything beyond the pattern. Without timestamps at order level and an identifier tying entries to one operator, the observation is not the kind of evidence either regime is built to weigh.

Fourth, if the market is one the Commission oversees and the third answer is yes, the reporting route above applies. If any earlier answer went the other way, the honest conclusion is that you saw a cancellation, which is a thing markets do all day.