SEC Phase 1 study materials
SEC Phase 1 study resources

Large Visible Orders, Fast Cancels, Opposite-Side Fills

SEC Phase 1 · Put your knowledge to work in context.

All case studies

Large Visible Orders, Fast Cancels, Opposite-Side Fills

Over three weeks, a proprietary trader at a broker-dealer entered 1,200 large visible orders on the bid for a small-cap stock, canceled 97% of them within 200 milliseconds, and simultaneously executed 150 smaller buy orders on the offer. The pattern appears in the firm's automated surveillance report. When questioned, the trader said: 'I was providing liquidity and managing risk; the cancels were normal.' The firm's written supervisory procedures require review of order-to-trade ratios above 50:1 and escalation of any pattern suggesting manipulation. The trader's ratio is 8:1 overall but 120:1 during the final 30 minutes of trading. The compliance officer must determine whether this is spoofing or legitimate market making.

1. What factors distinguish spoofing from legitimate market making in this fact pattern? Apply them.

Read the worked answer

Spoofing requires intent to cancel before execution to induce others. Factors: (1) order size relative to the stock's liquidity; (2) cancellation speed and rate - 97% within 200 ms is extreme; (3) order-to-trade ratio - 120:1 in the last 30 minutes; (4) opposite-side executions timed after the visible orders; (5) lack of a bona fide market-making or hedging rationale. Legitimate market making produces fills and manages inventory; it does not rely on near-total cancellation. The trader's claim of 'managing risk' fails because the pattern was repeated and profitable only if other participants reacted to the visible orders. The pattern suggests layering or spoofing.

2. What supervisory and reporting obligations does the firm have once the pattern is confirmed?

Read the worked answer

The firm must escalate under its written supervisory procedures, preserve records, and conduct an investigation. It should consider reporting to the regulator if required, cooperate, and remediate supervision. It should review the trader's prior activity, P&L, and communications; place the trader on leave or restrict access; and assess whether the firm's surveillance thresholds were adequate. If the firm finds a violation, it should take disciplinary action and consider disgorgement.

3. How should the firm handle the trader's claim that the cancellations were 'normal'?

Read the worked answer

The trader's 'normal' claim should be tested against objective data: compare his cancellation rates to peers, his fill rates, and whether the orders were at the best bid or offer. 'Normal' for a market maker is not a defense if the intent was to mislead. The firm should ask for a written explanation, interview the trader, and review whether the orders were entered to create a false appearance of demand. If the explanation is not credible, the firm should treat it as a manipulation case.