Chapter 22 Quiz: Trade Surveillance — Spoofing, Layering, and Front-Running Detection

16 questions. Select the best answer for each multiple-choice question. For short-answer questions, write 2–4 sentences.

Question 1

Under Section 6(c)(5)(C) of the Commodity Exchange Act (as amended by Dodd-Frank § 747), which element is essential to establishing that a spoofing violation has occurred?

A. The order must have been placed at a price better than the prevailing best bid or offer. B. The trader must have profited from the activity. C. The order must have been placed with the intent to cancel before execution. D. The order must have caused a measurable price movement of at least 10 basis points.

Correct answer: C

Explanation: The Dodd-Frank spoofing prohibition is explicitly an intent-based offense. The statute prohibits bidding or offering "with the intent to cancel the bid or offer before execution." Profit (B) and price impact (D) are relevant to demonstrating the pattern but are not statutory elements. Order price relative to the best bid/offer (A) is not an element of the offense.

Question 2

Navinder Sarao's spoofing activity in E-mini S&P 500 futures contributed to the events of 6 May 2010, commonly known as:

A. The European Sovereign Debt Crisis B. The Knight Capital Incident C. The Flash Crash D. The Volcker Rule Implementation Event

Correct answer: C

Explanation: The Flash Crash of 6 May 2010 saw the Dow Jones Industrial Average fall nearly 1,000 points in minutes before partially recovering. Sarao's layered spoofing orders in E-mini S&P 500 futures at the CME were identified by US authorities as contributing factors. The Knight Capital Incident (B) was a 2012 algorithmic trading malfunction; the European Sovereign Debt Crisis (A) was a macroeconomic event.

Question 3

A trader places three sell orders at successively higher price levels — each representing 500 lots — within a two-minute window, and then cancels all three orders within 90 seconds after the market price moves downward by 8 basis points. The trader simultaneously executes buy orders at the lower price. This pattern is most accurately classified as:

A. Spoofing only, because the orders were placed with intent to cancel B. Layering, because multiple orders were placed at different price levels in a coordinated pattern C. Marking the close, because the trading was concentrated in a short period D. Quote stuffing, because multiple orders were submitted rapidly

Correct answer: B

Explanation: While this pattern shares the intent element of spoofing, the defining feature of layering is the placement of orders at multiple price levels on the same side of the book to create the appearance of deep artificial liquidity. The three orders at different price levels (not a single large order) make this layering specifically. Marking the close (C) applies to end-of-session concentration; quote stuffing (D) refers to message volume, not order book structure.

Question 4

Which of the following is the primary regulatory provision governing market manipulation in the European Union?

A. MiFID II Article 17 B. EMIR Article 11 C. Market Abuse Regulation (EU) 596/2014, Article 12 D. Capital Requirements Regulation (EU) 575/2013, Article 92

Correct answer: C

Explanation: EU MAR Article 12 provides the core definition of market manipulation, covering transactions or orders that give false or misleading signals as to supply, demand, or price, as well as dissemination of misleading information. MiFID II Article 17 covers algorithmic trading obligations; EMIR Article 11 covers clearing; CRR Article 92 covers capital requirements.

Question 5

Front-running by a broker-dealer in the United States is primarily regulated under:

A. FINRA Rule 5270 and Sections 9 and 10(b) of the Securities Exchange Act of 1934 B. The Bank Secrecy Act and FinCEN guidance C. The Investment Advisers Act of 1940, Section 206 D. Dodd-Frank Section 619 (the Volcker Rule)

Correct answer: A

Explanation: FINRA Rule 5270 specifically prohibits front-running of block transactions. Sections 9 and 10(b) of the Securities Exchange Act broadly prohibit manipulative trading and fraud in connection with securities trading, which front-running violates. The Investment Advisers Act (C) applies to investment advisers, not broker-dealers. The Volcker Rule (D) restricts proprietary trading by banking entities but does not specifically address front-running.

Question 6

In the context of front-running detection, what is the purpose of analyzing post-execution reversals of proprietary positions?

A. To confirm that the proprietary trader had a legitimate hedging rationale B. To identify whether the proprietary position was closed at a profit shortly after the client order moved the market — consistent with having taken the position to benefit from the anticipated price impact C. To determine whether the front-running was conducted through electronic or voice channels D. To calculate the order-to-trade ratio for the relevant instrument

Correct answer: B

Explanation: Post-execution reversal analysis examines whether the proprietary trader — who bought ahead of a large client buy order — then sold their position shortly after the client order executed and moved the price up. This sale (reversal) captures the profit from the price impact of the client order, confirming the front-running economic motive. It is a critical component of the evidence structure at Level 2 of the investigation framework.

Question 7

"Marking the close" manipulation is particularly relevant in which market context?

A. Early morning pre-market trading sessions with limited liquidity B. Central bank intervention operations in foreign exchange markets C. Instruments whose settlement, benchmark, or NAV calculation depends on closing prices — such as index options near expiry, fund NAV dates, or index rebalancing events D. Markets with circuit breakers that halt trading when prices move beyond set limits

Correct answer: C

Explanation: Marking the close targets closing prices because those prices are used in a wide range of financial contract settlements (index futures, equity options), portfolio valuations (NAV), and benchmark calculations. The manipulation is economically rational when the trader holds positions whose value depends on the closing price. Pre-market sessions (A) and central bank operations (B) are not the primary context; circuit breakers (D) are a price stability mechanism, not a manipulation vector.

Question 8

Quote stuffing differs from spoofing primarily because:

A. Quote stuffing involves orders in multiple instruments simultaneously, while spoofing is single-instrument B. Quote stuffing's primary harm is degrading competitors' market data processing capacity by generating extreme message volumes, rather than creating false price signals through order book imbalance C. Quote stuffing is not regulated under EU MAR, while spoofing is D. Quote stuffing only affects equity markets; spoofing affects futures markets

Correct answer: B

Explanation: Quote stuffing generates massive order/cancellation volumes to overwhelm the exchange matching engine and impair rivals' ability to process market data in real time — a latency-based competitive harm. Spoofing (and layering) create false price signals through the apparent order book balance. Both are potentially captured by MAR Article 12 (C is incorrect). There is no instrument-class distinction between the two practices (A and D are incorrect).

Question 9

Modern pump-and-dump schemes have evolved significantly from their historical form. Which provision of EU MAR specifically addresses manipulation conducted through social media and online information dissemination?

A. MAR Article 7 (definition of inside information) B. MAR Article 12(1)(c) — dissemination of information through the media, including the internet and social networks, that gives false or misleading signals as to financial instruments C. MAR Article 17 (disclosure of inside information) D. MAR Article 19 (managers' transactions)

Correct answer: B

Explanation: MAR Article 12(1)(c) explicitly extends the market manipulation definition to the dissemination of false or misleading information through media channels, including the internet and social networks. This was a deliberate legislative response to the rise of online investment promotion fraud and social media manipulation schemes. Articles 7 and 17 relate to inside information disclosure; Article 19 concerns managers' transactions reporting.

Question 10

A trader holds a large long position in crude oil futures. They also purchase deeply out-of-the-money call options on crude oil. They then buy crude oil aggressively in the spot market to push the price above the options' strike price. This is an example of:

A. Front-running B. Spoofing C. Cross-asset manipulation D. Marking the close

Correct answer: C

Explanation: Cross-asset manipulation involves manipulating one instrument (crude oil spot) to generate profit in a related instrument (crude oil call options). The trader incurs a cost in the spot market (buying aggressively may push prices but costs more) that is outweighed by the profit on the now in-the-money call options. This is a classic cross-asset manipulation structure.

Question 11

Which of the following BEST describes the order-to-trade ratio (OTR) and its limitation as a standalone manipulation detection metric?

A. OTR measures the size of orders relative to the average market order size; it is limited because small orders can still manipulate markets B. OTR measures the number of orders submitted per executed trade; its limitation is that legitimate market-makers also have high OTRs because they continuously quote and cancel orders as markets move C. OTR measures the time between order placement and execution; it is limited because fast execution is also characteristic of high-frequency market-making D. OTR measures the ratio of buy orders to sell orders; it is limited because traders frequently hedge by trading both sides

Correct answer: B

Explanation: OTR is the ratio of orders placed to orders executed. It is a key manipulation indicator because manipulators place many orders they never intend to execute. However, legitimate market-makers also have high OTRs because their business model requires continuous quoting and repricing — they cancel and replace orders constantly as market conditions change. This makes OTR alone insufficient; it must be combined with other metrics and segmented by trader function.

Question 12

Under EU MAR Article 16 and UK MAR Article 16, firms that detect suspected market manipulation are required to:

A. Immediately suspend the trader and report to the police B. Submit a Suspicious Transaction and Order Report (STOR) to the relevant national competent authority upon forming reasonable suspicion — without waiting for certainty of manipulation C. Conduct a full internal investigation and only report if the investigation confirms manipulation D. Notify the exchange where the manipulation occurred and allow the exchange to report to regulators

Correct answer: B

Explanation: MAR Article 16 establishes a reporting obligation triggered by "reasonable suspicion," not by proof of manipulation. Firms must submit a STOR (called a STR — Suspicious Transaction Report — in some EU member state terminologies) promptly upon forming reasonable suspicion. Waiting for certainty (C) violates the obligation. The reporting goes to the national competent authority (FCA in the UK; relevant EU NCA for EU firms), not the police (A) or the exchange (D) directly — though exchange surveillance teams may make parallel reports.

Question 13

Navinder Sarao used trading software that was specifically configured to:

A. Execute trades faster than any human could, enabling him to beat other market participants on speed B. Automatically reprice his large layered sell orders to maintain them just above the best ask price, avoiding accidental execution while maintaining the appearance of significant sell-side depth C. Simultaneously trade on multiple exchanges to exploit arbitrage between E-mini S&P 500 futures prices D. Aggregate client orders and front-run them using the firm's proprietary capital

Correct answer: B

Explanation: A critical feature of Sarao's manipulation was the automatic repricing of his spoof orders. His software was configured to maintain his large sell orders at a price just above the prevailing best ask — close enough to look like serious selling interest, but automatically moving upward if prices rose to keep the orders out of execution range. This configuration demonstrated sophisticated intent because it was specifically designed to maximize the price signal while minimizing execution risk.

Question 14

Which of the following would most likely generate a FALSE POSITIVE layering alert on a well-designed trade surveillance system?

A. A trader who consistently places 5 sell orders at different price levels, cancels them all within 30 seconds of a downward price move, and then buys at the lower price — repeated 40 times over 6 weeks B. An index fund manager executing a VWAP algorithm to acquire a large equity position, placing and repricing orders throughout the session as the VWAP benchmark adjusts C. A trader who sends a message to a colleague saying "I'll jam it for you, just be ready to buy" D. A trader whose order-to-trade ratio is 85:1, significantly above both the market average and their own historical average, over a sustained period

Correct answer: B

Explanation: A VWAP execution algorithm places and reprices orders throughout the session as the market moves, generating order/modification/cancellation patterns that superficially resemble layering. However, the intent is legitimate execution of a genuine investment decision. Options A, C, and D all represent signals of genuine manipulation: repeated pattern with position benefit (A), explicit communications suggesting coordination (C), and sustained anomalous OTR (D).

Question 15

The "three-phase" layering pattern detection model used in this chapter looks for which sequence?

A. Phase 1: Position accumulation → Phase 2: News release → Phase 3: Position liquidation B. Phase 1: Concentrated order placement at multiple price levels on one side → Phase 2: Price movement in the direction consistent with the artificial imbalance → Phase 3: Cancellation of the layered orders after genuine trades are executed on the opposite side C. Phase 1: Quote stuffing to slow competitors → Phase 2: Layered order placement → Phase 3: Front-running of resulting price movement D. Phase 1: Pre-market positioning → Phase 2: News catalyst → Phase 3: Marking the close at month-end

Correct answer: B

Explanation: The three-phase layering model captures the economic logic of the manipulation: create false order book depth (Phase 1), wait for the false signal to move the price (Phase 2), cancel the false orders once the genuine trade has been executed at the artificially moved price (Phase 3). The cancellation in Phase 3 is the defining confirmation — if the orders executed instead of cancelling, the trader would be a genuine participant, not a manipulator.

Question 16

A senior compliance officer reviewing a trade surveillance program notes that the system generates 500 alerts per week but only 3 to 5 of those result in STORs. She concludes that the false positive rate is approximately:

A. 99%, which is acceptable because any genuine manipulation case is worth the review burden B. 1%, which indicates the system is too conservative and is missing manipulation C. 99%, which should trigger a review of detection thresholds and rule calibration — excessive false positives risk desensitization of analysts and are operationally unsustainable D. The false positive rate is irrelevant because the obligation is to review every alert

Correct answer: C

Explanation: A 99% false positive rate — 495–497 non-actionable alerts per week — is not operationally sustainable and creates the serious risk of alert fatigue: analysts who process hundreds of low-quality alerts begin to dismiss them reflexively, increasing the likelihood of missing genuine manipulation cases. Industry best practice aims for false positive rates that are manageable within available analyst capacity, typically through machine learning triage, risk-based threshold calibration, and differentiated alert populations by trader type. Answer A is partially correct in noting that genuine cases are important but ignores the operational and desensitization risks. Answer D is incorrect: the obligation is not to review every low-quality alert equally; it is to detect genuine cases, which requires managing alert quality.

Answers: 1-C, 2-C, 3-B, 4-C, 5-A, 6-B, 7-C, 8-B, 9-B, 10-C, 11-B, 12-B, 13-B, 14-B, 15-B, 16-C