Spoofing represents an attempt to deceive the market into thinking that an instrument has more interest, liquidity or depth by placing large orders on one side for the purpose of causing traders to execute smaller orders on the opposite side. Once the intended orders are filled, the larger orders are deleted.
The Spoofing Model in TT Score analyzes and scores clusters that contain only manual trading or a mix of both automated and manual trading. Trading events that originate only from automated sources are scored separately by the Automated Spoofing Model.
TT Score detects a variety of spoofing patterns, including:
TT Score computes a cluster score based on how similar the activity in the cluster matches trading activity that has drawn regulatory attention in other situations.
Higher scores indicate the trading activity within a cluster is more likely to risk regulatory concern. A company's risk monitors can use these scores to prioritize resources for investing which users' trading activity poses the most regulatory risk.
For the spoofing pattern, each cluster is assigned a risk score on a sliding scale between 0-100. This score represents the probability that spoofing occurred during the duration of the cluster's trading activity.
Based on TT Score best practices, clusters that score over 75 are deemed to be “high risk” and should be the primary focus of users during their compliance reviews.
The Scorecard Metrics section measures the following statistics related to abusive messaging:
Use the Cluster Scorecard to get a closer look at the activity that triggered the spoofing score. The chart at the bottom of the scorecard can give you visual clues about the spoofing pattern. For example, the chart in the following scorecard for a cluster with a high spoofing score shows a potential flipping pattern.
In this example:
Note: The green diamond above the fill is an "imbalanced fill indicator" that marks where a trader receives a fill on the opposite side of the majority of their working volume.
The chart shows activity based on order volume over time, but does not show the order prices and liquidity. Looking at the prices for the potential spoofing orders can help you determine whether the trader was placing those orders far off the market in an attempt to deceive traders. From the Cluster Scorecard, you can click Market Replay to show how the orders interacted with the market at the various price levels.
In this example, you can see when the trader begins submitting numerous Buy orders to create the illusion of buy-side pressure. As you continue replaying the market activity, you can observe the state of the market and the trader's activity at every point in time.
The chart on the Cluster Scorecard may also show "imbalanced fill" and "market flip" indicators to help easily identify when the potential spoofing occurred.
The imbalanced fill indicator is a green diamond above a fill that indicates where the trader had an imbalance between the bid and offer and was filled on orders on the small side of the imbalance.
The market flip indicator shows where a trader quickly flipped from offering to bidding (or vice versa) at the same price. The triangle indicator is either red (flipped short) or blue (flipped long).