Market Manipulation: When Legal Trades Look Criminal

Spoofing is the practice of entering large orders on one side of the market with the intent to cancel them before execution, creating a false impression of supply or demand that moves the price in the direction that benefits the spoofer's actual position on the other side.

A spoofer who wants to buy at a lower price enters a large number of sell orders below the current market price, creating the appearance of significant selling pressure. Other market participants who observe the order book see what appears to be genuine supply and adjust their bids downward. The spoofer then cancels the sell orders before they can be executed and buys at the artificially lower price created by the phantom supply. Layering is a variation of spoofing that uses multiple price levels and repeated cycles of order entry and cancellation to create a more sustained false impression.

The first federal criminal conviction for spoofing was obtained against Michael Coscia in United States v. Coscia, 866 F.3d 782 (7th Cir. 2017), which established that the anti-spoofing provision of the Dodd-Frank Act, prohibiting bidding or offering with the intent to cancel before execution, is not unconstitutionally vague. The conviction confirmed that high-frequency trading strategies involving systematic order cancellation can constitute criminal market manipulation when accompanied by the required intent. An attorney who handles securities and commodities enforcement and spoofing defense cases can evaluate whether the government's evidence of manipulative intent is distinguishable from legitimate order management practices.

Pump and dump schemes have migrated from penny stocks to cryptocurrency markets and social media platforms, and the jurisdictional framework for prosecuting them depends on whether the manipulated instrument qualifies as a security under federal law.

A classic pump and dump involves promoters who accumulate a position in a thinly traded security, artificially inflate the price through promotional campaigns that contain material misrepresentations, and sell their holdings into the artificial price increase at the expense of retail investors who bought based on the misleading promotion. When the underlying instrument is a registered security or an unregistered security under federal securities law, the SEC has jurisdiction. When the instrument is a commodity or a commodity futures contract, the CFTC has jurisdiction. The classification of specific cryptocurrencies as securities or commodities is actively litigated and determines which regulatory framework applies to manipulation of their prices.

Social media coordination presents its own jurisdictional question because the promoters may be retail investors without a pre-existing position who coordinate to drive prices higher for collective benefit, which the SEC has argued constitutes manipulation even when individual participants have no fraudulent intent. An attorney who handles criminal securities and financial fraud and cryptocurrency manipulation defense cases can evaluate whether the specific instrument at issue is classified as a security or commodity and which regulatory framework governs the alleged manipulative conduct.

Market manipulation investigations often begin with regulatory surveillance flags generated by exchange-level monitoring systems rather than with complaints from identified victims. A trader who receives an inquiry from FINRA or an exchange about their trading activity in a specific security during a specific period may already be the subject of an active SEC or CFTC investigation that preceded the inquiry by months. The inquiry itself is frequently the first indication the trader receives that their activity has attracted regulatory attention, by which point the government has already assembled significant trading data.

Market manipulation defenses attack either the artificiality element, the intent element, or the causal connection between the alleged conduct and any price movement, and the defense strategy depends on which of these elements is least supported by the government's evidence.

The legitimate business purpose defense argues that the trading activity the government characterizes as manipulative had a genuine economic rationale unrelated to price artificiality. A market maker who enters and cancels orders as part of normal market-making activity, a hedger who executes large transactions to adjust risk exposure, and a portfolio manager who trades aggressively at month-end to rebalance holdings each have legitimate business explanations for trading patterns that superficially resemble manipulation. The strength of the defense depends on whether contemporaneous communications, trading system records, and compliance documentation corroborate the legitimate purpose explanation.

The lack of artificiality defense challenges whether the trading actually moved prices away from what would have prevailed without the defendant's trading, which requires economic expert testimony about the counterfactual market price. Manipulation requires that the artificial price actually affected the market, and when independent market forces during the same period can explain the observed price movement, the causal connection between the defendant's trading and the price is weakened.

Trading algorithms that execute strategies involving rapid order entry and cancellation can produce trading patterns that match the observable characteristics of spoofing without any subjective intent to manipulate, creating a significant gap between what the algorithm does and what the law requires.

The anti-spoofing provisions require proof that the trader acted with the intent to cancel orders before execution, and an algorithm that was designed to minimize market impact through aggressive order cancellation may operate consistently with the anti-spoofing prohibition's intent requirement even if the programmer did not specifically intend manipulative effects. Regulators have taken the position that the intent of the algorithm is the intent of the person who designed it and deployed it, which means a quant who designed an order management algorithm with knowledge that it would systematically enter and cancel orders to move prices has the required intent even if they were not monitoring each individual order.

Compliance review of algorithmic trading strategies before deployment is the most reliable mechanism for identifying exposure before a surveillance flag converts a trading strategy into an investigation. An attorney who handles SEC investigations and algorithmic trading manipulation defense cases can evaluate whether a proposed algorithm's order management behavior creates manipulation exposure under the specific statutory language and regulatory guidance applicable to the markets where the algorithm will operate.

The private civil action for market manipulation under Section 9(e) of the Securities Exchange Act requires proof that the defendant acted willfully, which is a significantly higher scienter standard than the SEC's civil enforcement standard and the CFTC's recklessness standard. A trader who faces parallel SEC civil enforcement, CFTC civil enforcement, DOJ criminal prosecution, and a private class action for the same trading conduct faces four proceedings with four different scienter standards, four different discovery timelines, and four different calculation methodologies for the alleged damages or disgorgement.

Market manipulation is any trading conduct that creates artificial prices or trading volume that does not reflect genuine supply and demand, in violation of Section 9 of the Securities Exchange Act for securities or the Commodity Exchange Act for futures and commodities. It differs from aggressive trading in the element of artificiality: a trader who responds to market conditions, even aggressively, is not manipulating the market; a trader who creates false price signals to benefit from the artificial movement they created is. The distinction is the trader's purpose, which must be established by circumstantial evidence including trading patterns, timing, and communications.

Spoofing is the practice of entering orders with the intent to cancel them before execution to create a false impression of market supply or demand. It is prohibited by the Dodd-Frank Act's addition to the Commodity Exchange Act and by Section 9(a)(2) of the Securities Exchange Act. The first federal criminal conviction for spoofing was affirmed in United States v. Coscia, 866 F.3d 782 (7th Cir. 2017). Spoofing harms other market participants who make trading decisions based on the false order book depth the spoofer creates and then cancels. Criminal penalties reach ten years in federal prison per count under 18 U.S.C. § 1348.

Jurisdiction depends on the instrument. The SEC has jurisdiction over manipulation of securities, including stocks, bonds, options on securities, and securities-based swaps, under the Securities Exchange Act. The CFTC has jurisdiction over manipulation of commodity futures, options on futures, and commodity swaps under the Commodity Exchange Act. When a manipulation scheme affects both markets, both agencies can investigate and pursue civil enforcement simultaneously. The DOJ can pursue parallel criminal charges regardless of which agency has primary civil enforcement jurisdiction. The classification of specific instruments, particularly cryptocurrencies, as securities or commodities determines which framework applies. An attorney who handles securities regulations and multi-agency enforcement matters can evaluate which agencies have jurisdiction over the specific instruments and conduct at issue.

Market surveillance systems operated by national securities exchanges, FINRA, and the SEC's market analytics units monitor trading in real time and generate alerts when trading patterns match the statistical signatures of known manipulation schemes. Spoofing is detected by monitoring the ratio of order cancellations to executions within defined time windows. Pump and dump is detected by correlating promotional activity with price and volume spikes followed by selling. Wash trading is detected by identifying transactions between related accounts. When a surveillance alert is generated, exchange staff review the underlying trading data and refer cases meeting defined thresholds to the SEC or CFTC for formal investigation.

Yes. Market manipulation can be prosecuted criminally under 18 U.S.C. § 1348, the Sarbanes-Oxley criminal securities fraud statute, which carries up to 25 years in federal prison, and under the commodity fraud provisions of 18 U.S.C. § 1348 applicable to futures and commodity manipulation. The DOJ and the relevant civil enforcement agency frequently coordinate their investigations, with the DOJ presenting criminal charges after the civil investigation has assembled the underlying trading evidence. A trader who receives a civil investigation subpoena from the SEC or CFTC should treat the inquiry as presenting potential criminal exposure regardless of whether criminal charges have been mentioned.

The primary defenses challenge the three elements of market manipulation: artificiality, intent, and causation. The legitimate business purpose defense argues that the trading had a genuine economic rationale unrelated to price manipulation. The lack of artificiality defense uses economic expert testimony to show that the observed price movement was caused by independent market forces rather than the defendant's trading. The lack of intent defense attacks the evidence of manipulative purpose, arguing that the trading pattern resulted from automated systems, risk management decisions, or market-making obligations rather than a scheme to create artificial prices. An attorney who handles stock manipulation and SEC enforcement defense matters can evaluate which elements of the government's case are weakest given the specific trading records and communications.