TT Score

Reviewing Clusters Using Cluster Views

Reviewing Clusters Using Cluster Views

The method for reviewing clusters for problematic trading activities are unique to each type.

Spoofing

Use the Cluster Scorecard to get a closer look at the activity that triggered the spoofing score. The chart at the bottom of the scorecard can give you visual clues about the spoofing pattern. For example, the chart in the following scorecard for a cluster with a high spoofing score shows a potential flipping pattern.

  1. Cancels working Sell orders and begins submitting several Buy orders to create the impression of volume on the Buy (spoof) side.
  2. Starts submitting Sell orders (intent side) to take advantage of movement on the Buy side.
  3. Cancels working Buy orders when the Sell orders are executed.

The chart shows activity based on order volume over time, but does not show the order prices and liquidity. Looking at the prices for the potential spoofing orders can help you determine whether the trader was placing those orders far off the market in an attempt to deceive traders.

From the Cluster Scorecard, you can click Market Replay to show how the orders interacted with the market at the various price levels.

  1. The price ladder shows the prices and liquidity in the market during the potential spoofing activity.
  2. The trader first cancels several Buy orders (spoofing side) and submits a large Sell order (intent side).
  3. Several executions occur quickly for the Sell order, giving the trader fills at the desired price.
  4. Pressing Play would then show the trader canceling all of the Buy side orders, as shown in the Cluster Scorecard chart.

Abusive Messaging

Use the Cluster Scorecard to get a closer look at the activity that triggered the abusive messaging score. The Cluster Statistics and Scorecard Metrics sections of the scorecard show the:

  • Time duration of the cluster
  • Total number of messages sent
  • Percentages for different message rates

The chart at the bottom of the scorecard can give you visual clues about the abusive messaging pattern. For example, the chart in the following scorecard is for a cluster with a high percentage of high-rate messages over a very short time period.

  1. In just over one-tenth of a second, the trader submitted over 600 order messages, 98.3% of which were considered to be submitted at a high rate.
  2. The meter indicates this cluster has a risk score of 100.
  3. The trader repeatedly submitted the same type of order.
  4. The exchange times indicated the messages were sent in micro-second intervals.
  5. The Burst Chart shows that for the first six-tenths of a second, the trader submitted messages at a rate of well over 15,000 messages per second.

Wash Trading

Use the Cluster Scorecard to get a closer look at the activity that triggered the wash trading score. The Cluster Scorecard shows activity that could constitute a wash trade.

  1. Fills were executed on opposite sides of the market for the same order quantity.
  2. The two transactions were executed within the same millisecond.
  3. The two transactions were executed by the same trader ID.

Momentum Ignition

When investigating Momentum Ignition clusters with TT Score, you should focus on the:

  • Number of distinct price levels used by aggressive orders.
  • Quantity filled on the aggressive orders.
  • Quantity filled on the opposite, or profit-taking, orders.

For example, if the Igniter Price Levels and the Ignites (Vol) metrics display large values, this indicates that the trader may have been attempting to ignite a price movement in a particular direction (buy or sell) in order to mislead other market participants or to create an artificial price. The Opp. Side (Vol) is a good indicator of whether or not the trader received advantageous fills on orders opposite the igniter orders that the trader would not have otherwise received without intentionally or recklessly sparking the price movement.

The order audit trail data on the Statistics Scorecard can then be used to verify all of the order information and the timing of the activity that was identified as potential Momentum Ignition.

The activity can then also be replayed on the Market Ladder Replay tool and viewed on the Macro Chart.

Pinging

Use the Cluster Scorecard to get a closer look at the activity that triggered the pinging score, focusing on the audit trail:

  • Review the audit trail for the creation of a series of small new orders at various price levels followed almost immediately by cancel events.
  • Look for a change in trader behavior once the small orders begin to fill immediately after order entry. Specifically, look for larger aggressively priced orders being entered on the opposite side of the market (as the small orders) as soon as the small orders get filled. The use of a hyper-marketable limit order or a market order could be indicative of aggressive orders.
  • Look in the audit trail to see if that aggressive order was filled and was followed by an even larger order on the same side of the market as the original small orders were placed.
  • Compare the fill price of the final large order to that of the fill of the last small ping order. If the final large order filled at a better price than the original small ping orders, then it is likely that an abusive pinging occurred.