Order-Book Spoofing: What It Looks Like in Live Data

Spoofing, as regulators define it, is bidding or offering with the intent to cancel the order before execution. The offence lives in the trader's intent. That is a critical point for anyone building or buying a detection tool, because intent is precisely the thing that market data cannot contain.

Enforcement history makes the standard concrete. The CFTC's order against JPMorgan Chase covered conduct spanning at least eight years and hundreds of thousands of orders, and carried $920.2 million in monetary relief — the largest the agency has imposed. Its order against Tower Research Capital found orders placed with intent to cancel before execution and required $67.4 million in restitution, disgorgement and penalties. In both cases the finding of intent rested on internal records, communications and trader testimony, not on the order book alone.

Every screen that runs on public market data is therefore a proxy. It identifies order-book behaviour that is consistent with spoofing. Whether it was spoofing is a question that requires evidence a market-data feed does not carry.

What a feed can see is the shape of the behaviour. Practitioner and academic accounts converge on roughly the same four components, and a pattern is only interesting when several appear together.

• ▶Disproportionate size — a resting order far larger than the venue's normal depth at that level, which by itself would move the price if it filled
• ▶Distance from the touch — placed close enough to be visible and to influence perception, far enough that it is unlikely to be hit
• ▶Cancellation before execution — pulled as price approaches, rather than filled; a high place-to-cancel ratio with near-zero fill rate is the core statistical signature
• ▶Price reaction and reversal — the book reacts to the order while it rests, and reverts once it is pulled

A large resting order that gets cancelled is, on its own, almost meaningless. Market makers cancel and re-place constantly; that is the job. Cancellation rates above 90% are normal for automated liquidity provision on most venues, and an inventory-managing market maker will pull size the instant its hedge moves.

There are also entirely legitimate reasons a large order appears and disappears. A desk working a parent order will place and pull child orders as its schedule and the prevailing spread change. A risk system will flatten quotes when volatility crosses a threshold. An iceberg's visible tip refreshes and vanishes by design.

This is why the useful unit of analysis is not the order but the episode: a cluster of placements on one side, with a measurable price response, followed by cancellation and reversion, repeated. One event is noise. A repeated pattern on the same pair, on the same side, at similar distances from the touch, is a signal worth attention — and still not a finding.

Layering is the multi-level variant: rather than one conspicuous wall, several orders are placed across adjacent price levels on one side of the book. The aggregate effect on perceived imbalance is the same, but no individual order looks unusual.

This is where a size-threshold screen fails and a shape-based one is needed. The observable is the ratio of one side's depth to the other across a band of levels, tracked over time, together with how quickly that imbalance decays when it is removed. Layered orders tend to leave together, because they were placed together.

Genuine imbalance builds and decays gradually as independent participants arrive and leave. Imbalance that appears and disappears as a block is behaving like one actor rather than many.

Recent academic work has applied sequence models to limit-order-book data to classify spoofing episodes, and to characterise which book states are most spoofable in the first place. The results are meaningful: models trained on order-book sequences outperform fixed-threshold rules, particularly on layering, where no single order crosses a threshold.

What none of this work claims is that the models observe intent. They learn the statistical shape of episodes that were labelled as spoofing, and they inherit the limitations of that labelling. A model trained on regulatory-enforcement cases has learned what caught spoofing looks like, which is not necessarily what spoofing looks like.

The practical consequence is that model output should be treated as a prior, not a verdict — a reason to weight a signal down, not a basis for any claim about a market participant.

The actionable use of spoofing screens is defensive and almost entirely about position sizing and order placement, not about identifying wrongdoing.

If elevated one-sided book imbalance is present on a pair, the depth you can see is less reliable than it looks. A stop placed just beyond a large visible wall is a stop placed at a level that may not exist when it is tested. A market order sized against displayed depth may fill far worse than the book implied. Both are ordinary execution mistakes made worse by treating displayed liquidity as firm.

The correction is unglamorous: size against depth you have seen persist rather than depth you can see right now; prefer limit orders when book imbalance is elevated; re-check depth after any large visible order disappears, because the level that mattered may have gone with it; and treat a sudden, one-sided depth change as a reason to wait rather than a reason to trade.

Vultax surfaces order-book imbalance and cancellation-pressure context inside the market-quality domain of Vi IQ. The reading is elevated or suppressed risk on a market, never an inference of intent, because the underlying data cannot support one. How the domain is computed is documented in the methodology.

The measurement is also bounded by feed fidelity. A screen can only assess order-book behaviour it actually received, and snapshot cadence and feed reliability differ substantially between venues.