Spoofing and Manipulation in Futures: the Law, the Sarao and JPMorgan Cases, and CFTC Data

Spoofing is placing bids or offers with the intent to cancel them before they execute, so that other traders see supply or demand that is not really there and move prices in a direction the spoofer can profit from. In US futures markets it has been a specific offense since the Dodd-Frank Act of 2010, and the two cases that define it are the London trader Navinder Sarao, linked to the May 6, 2010 flash crash, and JPMorgan’s 2020 resolution of precious metals and Treasury spoofing for $920 million.

In short: cancelling orders is normal and legal. Most electronic orders are cancelled. What the law prohibits is the intent, when the order is entered, to cancel it before execution. Because intent is hard to see, regulators and exchanges build cases from patterns in order data: very large orders placed away from the best price, cancelled at extreme rates, timed against smaller genuine orders on the other side. The penalties can be severe, including prison, but enforcement volume has fallen sharply since its 2020 peak.

This is the professional-level version. For the order book and order types themselves, see futures trading hours and order types; for who polices the markets, see how futures markets are regulated.

The misconception: “cancelling lots of orders is spoofing”

High-frequency market makers cancel the great majority of the orders they send, because they constantly reprice quotes as the market moves. That is not spoofing. The CFTC’s 2013 interpretive guidance says orders, modifications or cancellations are not spoofing if “submitted as part of a legitimate, good-faith attempt to consummate a trade,” and that “a legitimate, good-faith cancellation or modification of orders (e.g., partially filled orders or properly placed stop-loss orders)” does not violate the provision. It also says a partial fill is not an automatic defence: if the intent at entry was to cancel the whole order, a partial fill does not cure it.

The line is the trader’s purpose at the moment of entry, which is why spoofing cases rest heavily on statistics, chat messages, emails and testimony from programmers.

The law

The statute

Section 747 of the Dodd-Frank Act, signed July 21, 2010, added “Disruptive Practices” to Section 4c(a) of the Commodity Exchange Act. CEA Section 4c(a)(5), codified at 7 U.S.C. 6c(a)(5), makes it unlawful to engage in any trading, practice or conduct on a registered entity that:

(A) violates bids or offers; (B) demonstrates intentional or reckless disregard for the orderly execution of transactions during the closing period; or (C) is, is of the character of, or is commonly known to the trade as, “spoofing” (bidding or offering with the intent to cancel the bid or offer before execution).

Subsection (C) is the anti-spoofing provision. The parenthetical became important in court: in United States v. Coscia (7th Circuit, August 7, 2017), the first criminal prosecution under the provision, the court rejected a vagueness challenge and treated the parenthetical as the definition of spoofing, not just an example.

The penalty

A knowing violation is a crime. 7 U.S.C. 13(a)(2) makes it “a felony punishable by a fine of not more than $1,000,000 or imprisonment for not more than 10 years, or both” to “knowingly” violate subsections (a) through (e) of Section 6c, and separately to manipulate or “corner” a commodity price. Prosecutors also routinely add wire fraud and commodities fraud charges under Title 18, which carry heavier maximum sentences.

The CFTC’s interpretation

The CFTC’s interpretive guidance and policy statement, Antidisruptive Practices Authority (78 Fed. Reg. 31890, May 28, 2013), sets out how the Commission reads the provision:

Spoofing requires intent “beyond recklessness.” Reckless trading is not spoofing.
A single instance can be a violation; no pattern is required.
It covers all bids and offers on registered entities, including pre-open periods and trading halts, but not requests for quotes or other authorised pre-trade communications.
Four non-exclusive examples of spoofing: submitting or cancelling bids or offers (i) “to overload the quotation system,” (ii) “to delay another person’s execution of trades,” (iii) “to create an appearance of false market depth,” and (iv) “with intent to create artificial price movements upwards or downwards.”

Exchange rules

Exchanges enforce their own versions. CME Group’s Rule 575, “Disruptive Practices Prohibited,” took effect September 15, 2014 across CME, CBOT, NYMEX and COMEX. Rule 575.A bars entering an order “with the intent, at the time of order entry, to cancel the order before execution or to modify the order to avoid execution.” CME’s Market Regulation Advisory Notice RA1405-5 says intent can be inferred where conduct “more likely than not” was intended to produce a prohibited result.

Spoofing versus manipulation

Spoofing is a narrower and easier case to prove than manipulation. A manipulation claim generally requires showing the trader caused an artificial price. A spoofing claim requires only the intent to cancel at entry; the government does not have to prove the price moved. That is why most modern order book cases are charged as spoofing, sometimes alongside attempted manipulation.

How spoofing works in an order book

The E-mini S&P 500 futures contract is $50 times the index, with a minimum tick of 0.25 index points, so one tick is worth $12.50 per contract (figures as stated in the CFTC’s Sarao complaint). The book below is a stylised illustration: prices and quantities are invented, but the structure follows the layering pattern described in that complaint.

Before layering. Best bid 6,000.00, best offer 6,000.25. The visible ten levels on each side hold 5,000 contracts bid and 4,900 offered. Buyers are 50.5% of visible depth, a balanced book.

The layer. A trader who wants to buy places four 500-lot sell orders at 6,001.00, 6,001.25, 6,001.50 and 6,001.75: three to six ticks above the best offer, deep enough that they are unlikely to trade, close enough to be seen.

Ask price	Genuine offers	With layer
6,000.25 (best)	400	400
6,000.50	440	440
6,000.75	470	470
6,001.00	490	990
6,001.25	500	1,000
6,001.50	510	1,010
6,001.75	510	1,010
6,002.00 to 6,002.50	1,580	1,580
Total visible offers	4,900	6,900

Now visible offers are 6,900 against 5,000 bids. Buyers fall to 42% of visible depth, and the layer alone is 29% of the offer side. The 2,000-lot layer has a notional value of about $600 million (2,000 x $50 x roughly 6,001).

The trade. Traders and algorithms that read book imbalance as a signal lean to the sell side. Suppose the market ticks down two ticks and the layering trader buys 300 contracts at 5,999.50. They cancel the layer; the imbalance disappears and the price drifts back to 6,000.00, where they sell. Profit: 300 x 2 ticks x $12.50 = $7,500, repeatable many times a day.

The risk the spoofer takes. If the market rallied four ticks and a 500-lot layer were filled, then reversed, the loss would be 500 x 4 x $12.50 = $25,000. Spoofing software is therefore built to keep the layer away from the touch and cancel it if the market approaches, which is exactly the fingerprint investigators look for.

Case 1: Navinder Sarao and the E-mini S&P 500

What the CFTC alleged

The CFTC filed its complaint against Nav Sarao Futures Limited PLC and Navinder Singh Sarao in the Northern District of Illinois on April 17, 2015 (Case 1:15-cv-03398), unsealed it on April 21, the day he was arrested in London, and alleged a scheme running from June 2009. The Department of Justice had filed a criminal complaint on February 11, 2015.

According to the complaint:

Sarao modified an off-the-shelf trading platform in 2009. He asked the vendor for a “cancel if close function, so that an order is canceled if the market gets close,” and for orders that would be “pulled if there are not x amount of orders beneath it.”
The resulting Layering Algorithm placed four to six “exceptionally large” sell orders, one tick apart, generally at least three or four ticks above the best offer, and moved them with the market so they stayed out of reach.
On the 12 “Example Price-Impact Days,” his layering orders averaged 504 contracts, against 7 for other traders; were modified an average 161 times each, against less than once; and were cancelled without execution over 99% of the time, against less than 49% for similarly sized orders placed by others. His sell-side orders were about 20% of the visible offer side and sometimes 40%.
He used the algorithm on at least 442 trading days and made about $40 million from E-mini trading over the period.

The complaint gives a time-stamped example from May 4, 2010. At 11:00:36.846 a.m. Central time, with the best offer at 1172.50, Sarao entered four 600-lot sell orders at 1173.25, 1173.50, 1173.75 and 1174.00, all within 0.002 seconds. The complaint says their notional value “exceeded $140 million.” The arithmetic checks: 600 x $50 x (1173.25 + 1173.50 + 1173.75 + 1174.00) = $140.8 million. The orders were modified 152 times to stay at least three ticks from the best offer and cancelled after about 12 minutes with no fills. He ran the algorithm 31 times that day, placed and cancelled 141 orders for 83,900 lots, traded 130,030 contracts, and made $876,823.

May 6, 2010

On the day of the flash crash, the complaint says Sarao switched the algorithm on at 11:17 a.m. Central time and left it running until 1:40 p.m., layering five orders for 3,000 contracts, then six orders for 3,600. Those orders represented “approximately $170 million to over $200 million worth of persistent downward pressure,” 20% to 29% of the entire sell side of the book, and were replaced or modified more than 19,000 times before he cancelled them at 1:40 p.m. Between 1:41 and 1:44 p.m., the E-mini fell 3%; at 1:45 p.m. it fell another 1.7% in 15 seconds, before rebounding within minutes.

The CFTC alleged that his conduct “contributed to” the order book imbalance that preceded the crash. It did not allege that he alone caused it, and the precise weight of his role remains debated.

How it ended

Criminal case. Sarao was extradited and, on November 9, 2016, pleaded guilty before Judge Virginia Kendall in the Northern District of Illinois to one count of wire fraud and one count of spoofing (DOJ case 1:15-cr-00075). He admitted at least $12.8 million in illicit gains. The court entered a consent forfeiture money judgment of $12,871,587.26. On January 28, 2020, after what both prosecutors and defence described as extraordinary cooperation, he was sentenced to time served plus a year of home detention, according to contemporaneous reports.
CFTC case. On November 17, 2016, Judge Andrea Wood entered a consent order in which Sarao admitted the complaint’s allegations. It imposed a civil monetary penalty of $25,743,174.52 and disgorgement of $12,871,587.26, a total of $38,614,761.78, plus permanent trading and registration bans. The penalty is exactly twice the disgorgement, and the disgorgement equals the criminal forfeiture.

What professionals took from it

Sarao was, in the complaint’s words, the “owner and sole employee and trader” of his company, using a modified off-the-shelf platform. The case showed that the data trail of order entry, modification and cancellation is enough to reconstruct intent years later, and that the visible depth many algorithms rely on can be manufactured.

Case 2: Michael Coscia, the first criminal conviction

Coscia, a high-frequency trader who ran Panther Energy Trading, was the first person criminally prosecuted under the anti-spoofing provision. A Chicago jury convicted him on November 3, 2015 of six counts of spoofing and six of commodities fraud over trading in 2011 that made him about $1.4 million, and on July 13, 2016 Judge Harry Leinenweber sentenced him to three years in prison, according to the DOJ. The Seventh Circuit affirmed on August 7, 2017 in United States v. Coscia, No. 16-3017. It held the statute was not unconstitutionally vague, found the evidence of intent sufficient (pointing to testimony from the programmer who built his algorithm), and upheld the commodities fraud count on the basis that his orders were “reasonably calculated to deceive.” The decision gave prosecutors the appellate footing for the bank cases that followed.

Case 3: JPMorgan’s $920 million resolution (September 2020)

On September 29, 2020, the CFTC, the DOJ and the SEC announced coordinated resolutions with JPMorgan Chase & Co. and two subsidiaries.

The conduct (per the DOJ release and the CFTC order). Between about March 2008 and August 2016, traders and salespeople on JPMorgan’s precious metals desk in New York, London and Singapore placed orders in gold, silver, platinum and palladium futures on COMEX and NYMEX “with the intent to cancel those orders before execution,” in “tens of thousands of instances.” Some traders also traded to trigger or defend barrier options the bank held. Between about April 2008 and January 2016, its US Treasuries desk spoofed Treasury futures on CBOT and Treasury notes and bonds in the cash market in “thousands of instances.”

The DOJ. JPMorgan entered a deferred prosecution agreement on a criminal information filed in the District of Connecticut charging two counts of wire fraud. It agreed to pay $920,203,609 in a criminal monetary penalty, criminal disgorgement and victim compensation, with credits for payments to the CFTC and SEC. The DOJ cited JPMorgan’s failure to fully self-disclose and its May 2015 guilty plea for foreign exchange misconduct, and declined to impose a monitor because of remediation, including hiring “hundreds of new compliance officers.”

The CFTC. The CFTC order imposed what it called the largest monetary relief in its history:

Component	Amount	Share
Civil monetary penalty	$436,431,811	47.4%
Restitution	$311,737,008	33.9%
Disgorgement	$172,034,790	18.7%
Total	$920,203,609	100%

The three components sum to exactly the DOJ’s total, which is the point of the crediting: the bank paid $920.2 million once, not twice.

The SEC. J.P. Morgan Securities LLC agreed to pay $10 million in disgorgement and a $25 million civil penalty over the cash Treasury trading.

The individuals. Trader John Edmonds pleaded guilty in October 2018 and Christian Trunz in August 2019. In August 2022 a Chicago jury convicted former desk head Michael Nowak and trader Gregg Smith of wire fraud affecting a financial institution, commodities fraud, attempted price manipulation and spoofing. On August 22, 2023, Judge Edmond Chang sentenced Smith to two years in prison and Nowak to one year and one day, according to the DOJ.

CFTC enforcement data

The CFTC’s annual enforcement releases show how the agency’s posture has changed. Figures are for fiscal years ending September 30, as reported by the CFTC.

Fiscal year	New enforcement actions	Monetary relief ordered	Notes
FY2020 (released Dec 1, 2020)	113, “the most enforcement actions filed in CFTC history”	$1,327,869,760	Included the JPMorgan spoofing resolution, “the largest spoofing penalties ever assessed”
FY2024 (released Dec 4, 2024)	58	Over $17.1 billion, a record	$12.7 billion from the FTX and Alameda settlement
FY2025 (report released in 2026)	13 (7 administrative, 6 civil injunctive)	Not stated as a total	1 case with manipulation, false reporting or spoofing as the primary violation

The FY2025 report frames the year as ending “an era of regulation by enforcement.” It describes a reorganised Division of Enforcement whose Complex Fraud Task Force handles “market manipulation, spoofing, wash trading, and other trade practice violations,” and says traditional markets “will receive equal scrutiny” alongside prediction markets. On the numbers, though, FY2025 brought fewer new cases than any year in the table by a wide margin. The FY2024 headline relief figure was dominated by a single non-spoofing case, so year-to-year totals say more about individual blockbuster settlements than about the underlying level of misconduct.

Exchange disciplinary actions under rules like CME Rule 575 continue regardless of the federal caseload, and are often the first line of enforcement for smaller cases.

How surveillance teams look for it

Both exchange market regulation departments and the compliance functions of trading firms run order-level surveillance. The metrics come straight from the cases:

Cancellation and modification rates of large orders compared with the same trader’s small orders and with the market. Sarao’s 99% versus under 49% is the textbook gap.
Order size relative to normal size in that product. 504 lots against an average of 7 stood out.
Distance from the touch. Orders consistently resting three or more ticks away, and moved as the price moves, look designed not to trade.
Opposite-side fills. The core pattern: a large visible order on one side, a smaller order on the other side that fills, then the large order is cancelled within seconds. Sarao’s complaint describes 2,000-lot buy orders placed one tick below his 169-lot sell order and cancelled in under a second as the sell order filled.
Communications. In the bank cases, chats and testimony from cooperating traders supplied the intent that statistics alone suggested.

Firms that trade at scale typically pre-clear algorithm designs with compliance, log the business purpose of cancel logic, and run post-trade alerts on these metrics.

What can go wrong for legitimate traders

Ambiguous intent. Iceberg orders, stop orders and market-making quotes all get cancelled. The CFTC guidance protects good-faith cancellations, but a trader whose cancel patterns resemble layering may still face an inquiry and has to explain the strategy.
Algorithms that drift. A parameter change can make a legitimate algorithm behave like a spoofing one. Exchanges hold the firm responsible for its systems.
Fast markets. In thin conditions, even honest large orders move prices. The protection is that liquidity can vanish in seconds, as on May 6, 2010, and circuit breakers and price limits exist partly for that reason.

The short version

Spoofing is entering orders you intend to cancel before execution, and since Dodd-Frank it has been a specific offence under CEA Section 4c(a)(5)(C), criminal when done knowingly. The CFTC reads it as requiring intent beyond recklessness and protects good-faith cancellations. Cases are built from order data: Sarao’s layering orders were about 70 times the market’s average order size and cancelled more than 99% of the time, and on May 6, 2010 they represented up to $200 million of sell pressure before the flash crash. JPMorgan paid $920.2 million in 2020 for eight years of spoofing on two desks, and two of its traders went to prison. CFTC enforcement peaked at 113 actions in FY2020 and fell to 13 new actions in FY2025, with only one primarily about manipulation or spoofing. This article describes the rules and the record; it is not legal advice.