Seven common market abuse scenarios monitored through trade surveillance

KEY TAKEAWAYS

• Regulators expect firms to proactively detect and investigate suspicious trading behavior, requiring surveillance programs that translate risk into observable, data-driven indicators.
• Structured surveillance scenarios transform market abuse typologies into measurable patterns, leveraging order, execution, counterparty, position, and event data to identify potential manipulation.
• Effective market abuse detection increasingly relies on cross-market and cross-product analytics

This article was written by Mike Googe and Zoravar Bakshi, BTCA product managers at Bloomberg.

Introduction

Market abuse can take many forms and often involves subtle patterns across orders, trades, and market data. Regulators expect institutions to operate surveillance programs that can identify and explain behavior which may indicate manipulation, misuse of information, or unfair treatment of clients, as introduced in part one of this blog series.

To meet these expectations, trade surveillance systems apply rules, models, and analytics to detect potential market abuse. This article outlines common market abuse scenarios monitored through trade surveillance, explains what each scenario represents, and describes how organizations typically monitor these behaviors in practice.

Spoofing and layering

What is spoofing?

Spoofing and layering are closely related forms of order-based market manipulation that involve the placement of non-bona fide orders to create a misleading impression of supply or demand.

Spoofing typically involves placing visible orders with no genuine intention of execution, often at prices away from the current financial market, to influence other participants’ behavior or the market price. These orders are usually canceled once they have achieved their intended effect, while the manipulator executes trades on the opposite side of the book through smaller or more carefully placed orders.

What is layering?

Layering is a related technique in which multiple non-bona fide orders are placed at different price levels on one side of the order book to create an artificial impression of market depth or sustained interest. As the financial market moves toward the targeted price level, the layered orders are canceled and the manipulator trades on the opposite side at more favorable prices.

While the mechanics differ, both behaviors rely on misleading order book signals rather than genuine trading interest.

How surveillance systems monitor for spoofing and layering

Market abuse surveillance systems typically look for patterns such as:

• Large visible orders, or multiple orders across price levels, that are placed and canceled quickly without execution, particularly when positioned away from the best bid or offer
• Repeated sequences where order placement on one side of the book is followed by executions on the opposite side
• High ratios of order volume to executed volume for a particular account, trader, or instrument, compared with historical norms or peer behavior
• Changes in visible order book depth that coincide with order entry from the same account or group of related accounts
• Behavior that occurs around price-sensitive moments, such as just before benchmark calculations, auctions, or quote updates
• Recurring patterns within or across trading days that suggest systematic rather than incidental behavior

Monitoring often combines order book data, timestamps, trading intervals, cancellation rates, order amendments, and subsequent trading activity to identify patterns that may indicate spoofing or layering rather than legitimate order entry and withdrawal.

Wash trading

What is wash trading?

Wash trading occurs when the same party, or parties acting in concert, appear on both sides of a transaction. This results in trades that do not create genuine changes in ownership but can give the impression of liquidity, volume, or interest in a security or derivative. Wash trades have been addressed in multiple regulatory frameworks as a form of manipulative or deceptive practice.

How surveillance systems monitor for wash trading

Surveillance analytics for wash trading often focus on:

• Trades where the beneficial owner or related accounts are on both the buy and sell side
• Back-to-back or circular trading among a small group of accounts with no clear economic purpose
• Repeated patterns where the same accounts trade with each other at similar prices and volumes
• High volumes of offsetting trades that begin and end positions without net exposure, particularly when they occur in illiquid instruments

Monitoring usually requires account and client identifiers, counterparty information, and position data to identify when trading flows do not result in meaningful changes in exposure.

Insider trading

What is insider trading?

Insider trading involves dealing in a financial instrument while in possession of material, nonpublic information (MNPI) that, if disclosed, would likely influence the price of that instrument or related instruments. Insider trading undermines confidence in financial markets by providing unfair advantages to those with privileged information at the expense of other participants.

How surveillance systems monitor for insider trading

Insider trading is primarily monitored through pattern analysis rather than single data points. Surveillance systems typically:

• Compare trading activity to the timing of price-sensitive events such as earnings releases, corporate actions, credit rating changes, or major announcements
• Flag unusual profits, sudden changes in trading frequency, or significant position builds in the period before a public event
• Link trading accounts to insiders, employees, connected persons, or individuals with known access to confidential information, where this information is available
• Examine sequences where trading in one instrument anticipates news in an economically-related instrument, such as derivatives or securities of a parent company

Effective monitoring usually requires integration of reference data, corporate events, news, watch or restricted lists, and internal lists of persons with access to inside information.

Front-running

What is front-running?

Front-running occurs when a participant trades based on advance knowledge of a client order or another internal transaction that is likely to impact market prices. By entering their own orders first, the individual may achieve a better price, while the client or principal trade is executed at a less favorable level. This behavior can breach both conduct rules and fiduciary obligations.

How surveillance systems monitor for front-running

Surveillance monitoring for front-running usually focuses on:

• Trades in the same or related instruments executed shortly before a large client order, particularly when the trader has access to order flow information
• Patterns where personal or proprietary trading takes place ahead of client flows and then reverses after the client order is filled
• Unusual profits associated with trading just before large, price-moving orders from clients or internal desks
• Behavior that repeatedly occurs around known client trading windows or order submission times

Monitoring often relies on linking client orders, internal desk orders, and personal account dealing records, and reviewing the sequence and timing between them.

Cross-market manipulation

What is cross-market manipulation?

Cross-market manipulation occurs when activity in one financial market is intended to influence the price or conditions in another financial market. Examples include trading a derivative to affect the price of an underlying security or submitting orders in a lit financial market to influence pricing in a related dark pool.

How surveillance systems monitor for cross-market manipulation

Surveillance typically reviews:

• Correlated patterns across venues, including futures, equities, and OTC markets
• Behavior that creates price signals in one financial market followed by trading in another
• Coordinated order submission and cancellation across related financial markets
• Activity that exploits structural differences across financial markets such as liquidity, transparency, or trading hours

These reviews often require aligned timestamps and consolidated cross-venue datasets.

Cross-product manipulation

What is cross-product manipulation?

Cross-product manipulation involves using one financial instrument to influence the price or perception of another instrument with an economic relationship. Examples include trading futures to influence an ETF, or trading cash bonds to affect related credit derivatives.

How surveillance systems monitor for cross-product manipulation

Monitoring for this behavior often uses:

• Price and volume linkages across related instruments
• Patterns where activity in one product precedes a profitable move in another
• Sequences of orders that appear designed to exploit pricing relationships or benchmark calculations
• Cross-product modeling that maps economic relationships between instruments

How Bloomberg can help

Bloomberg’s BTCA provides multi-asset trade surveillance across complex and less standardized asset classes.

BTCA provides preconfigured and customizable surveillance scenarios across all asset classes, including fixed income, FX, derivatives, and OTC structures, while also connecting behaviors across assets for the detection of indirect market abuse. The service enables firms to apply consistent monitoring frameworks across financial markets, asset classes, and trading behaviors.

BTCA brings trade surveillance into the Terminal-native service the front-office already uses, supporting shared workflows between compliance and trading teams. By operating within a common data and analytics environment, firms can streamline alert review and investigation processes.

Conclusion

Market abuse surveillance depends on the ability to translate regulatory requirements into observable patterns within trading data. Scenarios such as spoofing, layering, wash trading, insider trading, and front-running provide structured ways to interpret behavior that may require review. By understanding how these scenarios appear, institutions can design surveillance approaches that link activity to risk indicators, support investigations, and align with supervisory expectations.

The next part of this blog series examines the challenges that shape trade surveillance programs and the key considerations organizations assess when reviewing market abuse surveillance capabilities. Part one outlines trade surveillance fundamentals.