Trade surveillance
High-impact market manipulation tactics in the U.S.: Red flags for modern surveillance teams
Douglas Moffat
•
Senior Vice President, Americas
September 4, 2025
Market manipulation in the United States remains one of the most actively enforced areas of securities regulation. The SEC and CFTC continue to pursue cases involving spoofing, layering, wash trading, and other forms of misconduct, often backed by increasingly sophisticated data analysis and cross-market surveillance capabilities.
For compliance teams at firms operating in or connected to U.S. markets, this enforcement posture creates a clear expectation: surveillance systems must be capable of detecting not just textbook manipulation patterns, but also the evolving tactics that bad actors use to avoid detection.
In this blog, we examine some of the highest-impact market manipulation tactics currently under regulatory scrutiny in the U.S., the red flags they generate, and what modern surveillance teams should be doing to stay ahead.
Spoofing, the act of placing orders with the intent to cancel before execution, remains one of the most prosecuted forms of market manipulation in the U.S. The Dodd-Frank Act explicitly prohibits spoofing, and the CFTC and DOJ have pursued both criminal and civil cases against individuals and firms.
Layering, a related tactic, involves placing multiple orders at different price levels to create the illusion of supply or demand, then cancelling them once the market moves in the desired direction.
While spoofing has been illegal since 2010, the methods used have become more sophisticated. Traders may use algorithms to place and cancel orders at speeds that are difficult to detect manually, or spread activity across multiple venues to obscure the pattern. Recent enforcement actions have also targeted firms for failing to detect spoofing by their own traders, even where the firm itself was not complicit in the misconduct.
Surveillance systems should be calibrated to detect high order-to-trade ratios, particularly where cancellations cluster around specific price movements, patterns of order placement on one side of the book followed by rapid cancellation after a fill on the opposite side, and cross-venue activity where orders are placed on one exchange to influence prices on another.
Wash trading involves executing trades where there is no genuine change in beneficial ownership, typically to create the appearance of market activity or to manipulate reported volumes. While most commonly associated with cryptocurrency markets, wash trading remains a concern in traditional securities and derivatives markets as well.
The SEC has brought enforcement actions against firms and individuals for wash trading in both equity and options markets. In some cases, the activity was used to inflate trading volumes to attract investor interest or to trigger volume-based fee rebates. The CFTC has similarly pursued wash trading in futures markets, particularly where it was used to create misleading price signals.
Key indicators include trades where the same entity or related entities appear on both sides of the transaction, unusual volume spikes that are not correlated with news, earnings, or market events, and patterns of self-matching, particularly through different accounts or sub-accounts controlled by the same beneficial owner.
Pump and dump schemes involve artificially inflating the price of a security through misleading statements or coordinated buying, then selling at the inflated price. While this is one of the oldest forms of market manipulation, the methods of execution have evolved significantly.
Social media platforms, messaging apps, and online forums have become key vectors for pump and dump activity. The SEC has brought cases involving coordinated campaigns on platforms such as Twitter/X, Discord, and Telegram, where individuals promoted stocks to retail investors before selling their own positions. The meme stock phenomenon of 2021 brought renewed regulatory attention to this area, and the SEC has since increased its focus on social media-driven manipulation.
Surveillance should look for unusual price and volume movements in thinly traded securities, correlation between social media activity and trading patterns, and concentrated buying followed by rapid selling, particularly by accounts with a history of similar activity.
Front-running involves trading ahead of a known pending order, typically by a broker or market participant with access to non-public order flow information. While distinct from insider trading, it shares the characteristic of exploiting an informational advantage at the expense of other market participants.
The SEC has pursued front-running cases involving both traditional broker-dealers and electronic trading firms. In some cases, firms were found to have inadequate information barriers, allowing traders to access or infer information about pending client orders. The growth of algorithmic and high-frequency trading has added complexity, as front-running-like behaviour can be embedded in execution logic that is difficult to audit.
Key indicators include trades executed shortly before large client orders in the same direction, patterns of profitable trading ahead of block trades or significant order flow, and communication between trading desks and client-facing teams that may indicate information leakage.
As markets become more interconnected, manipulation increasingly spans multiple venues and asset classes. A trader might, for example, manipulate the price of an underlying security to profit from a derivative position, or use activity in one market to influence prices in another.
Both the SEC and CFTC have highlighted cross-market manipulation as a priority enforcement area. The Consolidated Audit Trail (CAT) was designed in part to give regulators better visibility into cross-venue trading patterns, and firms are increasingly expected to demonstrate that their own surveillance systems can detect cross-market activity.
Surveillance should be capable of correlating activity across different asset classes and venues, identifying positions in derivatives that would benefit from price movements in the underlying, and detecting patterns where trading in one market appears designed to influence prices in another.
The tactics described above share a common thread: they are becoming more sophisticated, more fragmented across venues and products, and harder to detect with static, rules-based surveillance models.
For compliance teams, several practical steps can help strengthen detection capabilities. First, surveillance systems should be calibrated to the specific risk profile of the firm’s trading activity, including the products traded, venues used, and client base served. Generic, out-of-the-box alert parameters are unlikely to be sufficient.
Second, firms should invest in cross-market and cross-product surveillance capabilities. Regulators increasingly expect firms to detect manipulation that spans multiple venues or asset classes, and siloed monitoring creates blind spots.
Third, alert thresholds and detection logic should be reviewed and updated regularly, based on enforcement trends, emerging typologies, and changes in trading behaviour. A surveillance system that was well-calibrated two years ago may no longer be fit for purpose.
Finally, firms should ensure that escalation and investigation workflows are robust. Detecting a potential manipulation pattern is only valuable if it is followed by timely, documented investigation and, where appropriate, reporting to regulators.
Market manipulation in the U.S. is not a static problem. The tactics evolve, the technology changes, and regulators adapt their enforcement approach accordingly. For compliance teams, the challenge is to stay ahead of both the misconduct and the regulatory expectations.
The firms that invest in intelligent, adaptable surveillance systems, supported by knowledgeable compliance staff and a culture of proactive risk management, will be best positioned to detect, investigate, and report manipulation before it becomes an enforcement issue.
If your firm is looking to strengthen its surveillance capabilities for U.S. markets, get in touch with eflow to learn how our platform supports trade surveillance, transaction reporting, and regulatory compliance across multiple jurisdictions.
