Spoofing in Fixed Income Markets: What Does it Look Like?
A recent prosecution for spoofing in the U.S. Treasuries market (USA vs. Natwest Markets) shows that spoofing in the Fixed Income markets looks very similar to Spoofing in other exchange-traded asset classes.
Based on publicly available market data, sourced by Nasdaq (NTS) as part of its service, we discuss market examples and how these orders impacted the order book.
If you have been involved in Fixed Income trading and its surveillance in recent years, you will have observed the increasing focus of regulators in this market. And with the strong growth in bond trading volumes on electronic platforms, it is not surprising that spoofing is in the spotlight.
In recent years, we have seen several successful prosecutions by regulators for manipulation of Fixed Income markets:
- JFSA vs. Citi (2019) – $1.2mm
- AMF vs. Morgan Stanley (2019) – $22mm
- CFTC vs. Rivoire (HSBC) (2019) – $192mm
- European Commission vs. BOA et al. (2019) – $14mm
And that sequence of regulatory actions continues with USA vs. Natwest Markets.
This case is particularly interesting as it involved spoofing of:
- The cash market (U.S. Treasury Notes) across a range of trading platforms.
- CME listed futures contracts for the 5-year U.S. Treasury note, 10-year note, and 30-year bond, as well as the Ultrabond contract.
- A manipulative strategy that used the close price correlation between the Treasury Notes and the Futures - the Trader spoofed the Futures contracts in order to achieve an outcome in the related cash bonds.
The publicly available judgment only provides limited information on the actual spoofing. Whilst only the regulators have the full data that led to the prosecution, using publicly available CBOT market data that is integrated into the NTS service, we can make the following general observations on how two of the spoofing examples impacted the market:
Example 1 - Spoofing in 10-year Treasury Future
| Time | 10 Seconds Later | 25 Milliseconds Later | 3.6 Seconds Later | |
|---|---|---|---|---|
| Spoofing Details | Iceberg Order to Buy 100 contracts (2 contracts disclosed) at $125.406 | Spoof Order to Sell 1,000 contracts at $125.421875 | Buy order for 100 contracts trades out in full | Sell order for 1000 contracts deleted |
| Market | At time of order entry Best Bid was $125.406 with 150 contracts | At time of order entry Best Ask was $125.421875 with 211 contracts | ||
| Impact | “Genuine” order entered at existing Best Bid - small increase in disclosed buy volume at Best Bid | Spoofing order increased weight of sell orders at Best Ask by more than 5 times | Spoofing order appears to draw in other sellers that execute against buy order |
From the above example, the following is of note:
- The “genuine” buy order was entered at the existing Best Bid.
- The “spoofing” sell order was also entered at the existing Best Ask but was significantly larger in volume than the existing volume at that price.
- The time interval between the entry of the ‘genuine’ order and ‘spoofing’ order was approximately 10 seconds, and between the execution of the trade and the deletion of the ‘spoofing’ order was approximately 3.6 seconds. Given the speed with which markets move, these could be regarded as relatively “long” time intervals.
Example 2 - Spoofing of Related Products – Ultrabond Future vs. 30-year U.S. Treasury Bonds
| Time | During Next | 3.1 | Seconds | |
|---|---|---|---|---|
| Spoofing Details | Spoof Order to Buy 210 Future contracts at $149.59375 | Trader sells 2 million Treasury bonds (cash) | Buy order for 210 contracts deleted | |
| Market | At time of order entry Best Bid was $149.59375 with 235 contracts. Order increases volume on Best Bid to 445 contracts. At time of order entry Best Ask was $149.625 with 19 contracts. | Trades execute against Best Ask at $149.625. Best Bid increases to $149.625. Best Ask increases to $149.65625. | Best Ask at $149.625 at time of deletion | |
| Impact | Order entered at existing Best Bid. Following order, the market is relatively heavily Bid (445 contracts) vs. sell side (19) | Spoofing order appears to draw in other buyers that execute against market sell orders – creating a shift upwards of the Best Bid and Ask |
From the above example, the following is of note:
- The “spoofing” Buy order was entered at the existing Best Bid. It has the effect of approximately doubling the volume at Best Bid to 445 contracts.
- At the time of the “spoofing” Buy order, the sell side of the order book was relatively “thin” at 19 contracts.
- It would appear that the entry of the Spoofing buy order at the Best Bid and its impact on the order depth at that price had the impact of shifting that Futures market higher. At or around that time, the Trader then sold related cash Bonds.
- There is a 3.1 second time window between entering a “spoofing” order in the Futures market, executing a trade in the opposite direction in the related Bond (cash) market, and then removing the spoofing order.
Nasdaq provides a range of alerts and tools to support customers in their monitoring of spoofing:
- NTS alert portfolio includes several spoofing alerts which cover the spectrum of different spoofing devices. With the appropriate parameter setting, NTS expects that the above “Example 1” in the Futures contract would be identified by one or more of these alerts, including the “Orderbook Imbalance” alert.
- With regards to spoofing of related products (Example 2), this is a focus of Nasdaq’s Research & Innovation project.
- In 2021, NTS tested with customers a Beta version of the Orderbook Imbalance alert that identified potential spoofing or manipulation between a Government Bond and related Futures contracts. NTS is now focused on “productizing” that alert. (If you would like more information, please contact your Account Manager.)
- NTS provides the “Depth” view, which visualizes the impact of a Trader’s orders on the order book. It was this investigation tool that enabled NTS to detail and visualize the “Signature of Spoofing.”
Spoofing in the Fixed Income markets is very similar to spoofing activities across other exchange-traded asset classes. Increased regulatory oversight is moving the needle in spotting this manipulation, but institutions should also consider automated surveillance technology to safeguard their business.
Other Topics
Banking Bonds Market Surveillance Stocks US Markets
Michael O'Brien
Nasdaq
Michael O'Brien is the Head of Product Management for the Sell-side & Buy-side Technology business at Nasdaq.
Read Michael's Bio