Five patterns are prohibited on essentially every regulated market, and an execution engineer needs to recognise them for two reasons: to avoid building one by accident, and to notice when the book is being worked against them.
What are the main types of market manipulation?
- Front running. Trading ahead of a client order you know is coming, in the same direction. The tell is sequence: a proprietary or personal trade immediately before a large client order in the same instrument and direction.
- Spoofing. Entering orders with no intention of executing them, to move the price. The tell is a large resting order that is cancelled without filling, followed by a trade on the other side.
- Layering. Spoofing with structure: several orders stacked at successive price levels on one side, to manufacture the appearance of depth.
- Wash trading. Buying and selling with yourself, creating volume that transfers no beneficial ownership. The tell is a matched pair with the same ultimate owner on both sides and no net position change.
- Quote stuffing. Flooding the book with orders and cancellations to slow other participants' processing. The tell is a message rate wildly out of proportion to any executed quantity.
Advertisement
Worked example: spotting layering in a message log
Run the detection pass on one stated sequence. A single participant's messages in a share quoting 100 at ₹250.10 bid against 100 at ₹250.20 offered:
| Time (s) | Action | Side | Size | Price (₹) |
|---|---|---|---|---|
| 0.050 | New order | Buy | 5,000 | 250.05 |
| 0.052 | New order | Buy | 5,000 | 250.00 |
| 0.054 | New order | Buy | 5,000 | 249.95 |
| 0.210 | Trade | Sell | 800 | 250.25 |
| 0.240 | Cancel | Buy | 15,000 | all three |
Four measurements, and each one is a line of code against a message log. Fill rate on the posted side: 0 of 15,000, so zero per cent. Quoted-to-traded ratio: 15,000 posted against 800 executed, 18.75 to one. Time on book: 190 milliseconds, from the first placement at 0.050 to the cancellation at 0.240. Side asymmetry: every posted order was a buy and the only execution was a sell. No single measurement proves intent, and each has an innocent explanation available: a liquidity provider legitimately cancels constantly, and a market maker legitimately trades on the opposite side to its quotes. The four together are the classic layering signature, because genuine buying interest that survives 190 milliseconds and then vanishes entirely, having sold on the other side in between, is difficult to explain as anything else.
What should an execution engineer log and monitor?
The engineering discipline that falls out of this is worth stating plainly. Log every message with a timestamp, an order id and the side, because none of the four measurements above is computable from fills alone. Set your own algorithm's cancel rate as a monitored metric rather than an emergent property, since an aggressive re-quoting loop can produce a spoofing-shaped log with nobody having intended anything. And keep the surveillance rule and the execution rule in the same review: a scheduling change that improves slippage by half a basis point and triples the cancel rate is not obviously an improvement.
Every function built in this Core section has its full graded counterpart, hidden tests included, in this module's code pack, QD2.01.json, eight exercises running the exact formulas above against LOB-shaped and volume-profile-shaped fixtures built from the synthetic-lob dataset's own generative recipe, on both India-flavored and US-flavored scenarios.