Spoofing enforcement since 2015, charted

This library holds 103 enforcement actions tagged spoofing or layering, filed between 2013 and 2026. Activity peaked between 2017 and 2020, the CFTC brought five times as many as the SEC, and the median disclosed penalty is $700,000 against a total of just over $2 billion — a distribution dominated almost entirely by a handful of institutional settlements.

Published 2026-06-10 · 9 min read

Everything in this post is computed from this site’s own case records, which are compiled from the primary releases of the issuing regulators. The underlying data is downloadable at cases.json, and the full list is at the spoofing and layering facet pages.

The figures below cover actions tagged with either technique, because regulators charge them together routinely and separating them would be an artefact of our tagging rather than of the conduct.

The shape of the record

103 actions, filed between 2013 and 2026.

The pattern is a clear rise into 2019 and a decline afterwards. Before drawing any conclusion from that, four things have to be said, and they matter more than the numbers.

Filing dates are not conduct dates. An action filed in 2019 typically concerns trading from several years earlier. The peak reflects when a wave of investigations completed, not when the conduct happened.

Coverage begins in 2015 for SEC litigation releases and 2013 for CFTC actions. The two 2013 records are CFTC matters only. Earlier years are not comparable and are excluded rather than shown as zeros.

The most recent year is always incomplete, both because the year is in progress and because actions concerning recent conduct have not been brought yet.

Sweeps distort everything. A single multi-defendant action can move a year substantially.

Given all four, the honest reading of the decline after 2020 is: we do not know what it means. It is consistent with the anti-spoofing provision having deterred the conduct, with investigative attention moving elsewhere, and with a reporting lag that has not yet caught up. This data cannot distinguish between them, and anyone confidently telling you which is going beyond it.

The agency split

CFTC   86 actions   (83%)
SEC    17 actions   (17%)

Five to one, and the reason is statutory rather than about where spoofing occurs.

Futures have an express anti-spoofing provision: 7 U.S.C. § 6c(a)(5)(C) prohibits bidding or offering with intent to cancel before execution. The regulator need not prove that the price moved or that anyone lost money. The offence is complete at placement.

Securities have no equivalent. Cases run through Exchange Act § 9(a)(2) and Rule 10b-5, which requires characterising the order as a deceptive device. That is a harder argument, and the gap in the record reflects it.

The asset class breakdown says the same thing from another angle:

futures       71
commodities   46
crypto        12
equities       8
fx             4

Actions carry several asset classes, so these do not sum to 103. Futures and commodities dominate overwhelmingly. Equity spoofing exists and is charged, frequently by FINRA rather than the SEC, and FINRA coverage in this library is partial — see sources.

The money

Sixty of the 103 actions disclose a civil penalty. Across those:

Look at those three rows together. The largest single action accounts for roughly 85% of the total, and the median is $700,000 — four orders of magnitude below it.

The largest is the HSBC cross-market matter, which is tagged cash versus derivatives schemes alongside the order-book conduct and involves substantially more than spoofing. The separate HSBC spoofing action records $45 million; the Deutsche Bank matter records $30 million.

This is why this site reports medians rather than averages, and why the penalty distribution chart is a box plot. The mean penalty across these 60 actions is about $34 million, and it describes nothing: no action is remotely near it.

The forty-three actions with no disclosed penalty are not zero-penalty actions. Many are matters at the filing stage where relief has not been determined, and the Sarao 2015 record is an example — the later action carries $38 million.

Criminal parallels

34 of 103 actions — roughly a third — reference a parallel criminal proceeding.

That is high relative to most techniques in this library, and it should be read as a floor rather than an estimate. This library’s DOJ coverage is partial, because the department’s filtered news listing is not accessible to automated clients. Criminal matters enter these records mainly through the criminalParallel flag on the civil action, so cases prosecuted without a civil counterpart are largely absent.

The criminal parallel chart carries the same caveat for every technique.

Procedural status

unknown    52
judgment   23
filed      19
settled     7
dismissed   1
appealed    1

The large unknown category deserves an explanation rather than a gloss. Status is extracted from the language of the release, and many releases — particularly CFTC orders — describe an outcome in terms our classifier does not map cleanly. Those records are marked unknown rather than guessed at.

That is a limitation of this dataset and we would rather state it than smooth it over. Records carrying reviewed: false have not been checked by a person, and every case page says so.

One dismissed action and one on appeal, out of 103. Both are recorded, and both would appear prominently on their own pages if a reader landed there — the editorial policy requires it.

What this data cannot tell you

How much spoofing there is. These are enforcement records. The relationship between enforcement and conduct depends on a detection rate that is unknown and unknowable from this data.

Whether spoofing has declined. The post-2020 fall in filings is consistent with deterrence, with shifting priorities, and with reporting lag.

Whether penalties are appropriate. Penalty size correlates strongly with the respondent’s size, and institutional settlements bundle supervision failures that individual matters do not have.

Anything about venues. The venue chart counts mentions in releases, which measures surveillance reach rather than where conduct occurs. A venue with good surveillance that refers cases appears more often, not less.

Getting the data yourself

Everything above is reproducible. cases.json contains every record with its technique tags, dates, agency, monetary fields and a link to the primary source. The data pages carry the eight charts with CSVs and stated methodologies.

How this compares to the rest of the library

Spoofing and layering together are 103 of the 1,961 actions in this library — about 5%. That is a smaller share than most people expect, and the comparison is instructive.

Insider trading and paid stock promotion each have far more records. Unregistered distributions has hundreds. Order-book manipulation is the technique family that attracts the most technical attention and by no means the most enforcement.

The reason is straightforward once stated. Order-book manipulation requires infrastructure, market access and a sustained strategy, which restricts the population of people who can do it. Promotion schemes require a company, a story and an audience. The addressable market for the second is considerably larger.

There is a second effect worth naming. Order-book cases are made from data that exists whether or not anyone is looking. Promotion cases are made from complaints, filings and payment records that surface only when somebody looks. That difference shapes which conduct gets found, in ways this data cannot disentangle from how often each occurs.

What a single year looks like up close

Aggregate counts hide how lumpy this is. Take 2019, the peak year at 18 actions.

Those eighteen are not eighteen independent investigations concluding in the same twelve months. They include multi-defendant sweeps, matters where a filing release and a resolution release both appear as records, and actions against several individuals arising from one firm’s conduct.

Our case index counts actions, not schemes. Aggregating them as though each represented distinct misconduct overstates the picture, and the effect is largest exactly where the counts are highest — because the years with the most filings are the years with the most sweeps.

This is why the actions per year chart carries the caveat about multi-defendant sweeps directly on the page, and why we would rather show you a lumpy series with an explanation than a smoothed one without.

If you want to check any of this

Every figure in this post can be recomputed from cases.json in a few lines. The technique tags are in the techniques array, the filing date is dateFiled, the penalty is penaltyUsd, and the criminal flag is criminalParallel.

Two things to watch if you do.

Do not sum across technique pages. A case tagged with three techniques appears in three facets. Summing facet counts double-counts, which is why this site never presents such a total.

Do not add penalty and disgorgement. They are different things stored in different fields. Disgorgement returns the gain; the penalty is punitive. Adding them and calling the result a fine overstates it, and it is the most common error made with this kind of data.

If you find an error, the corrections process is the fastest route to fixing it, and corrections are logged publicly.

Techniques referenced

• Spoofing — Spoofing is placing orders a trader intends to cancel before execution, to create a false impression of supply or demand and move the price toward a smaller genuine order on the other side.
• Layering — Layering is placing multiple orders at several consecutive price levels with no intention of trading them, building an apparent wall of depth that pushes the price toward a genuine order on the other side.
• Quote stuffing — Quote stuffing is flooding a trading venue with order messages in order to slow down the processing of market data, so that competing participants act on prices that are already stale.
• Momentum ignition — Momentum ignition is entering a burst of aggressive orders designed to trigger other participants' momentum strategies, creating a price move the initiator then trades against.
• Cash versus derivatives schemes — A cash versus derivatives scheme establishes a large derivative position and then trades the smaller underlying market at a deliberate loss, in order to move the reference price the derivative settles against.

Cases referenced

Reviewed June 10, 2026. Spotted an error? Tell us.