High-Frequency Algorithmic Manipulation. Ramazan Gençay Simon Fraser University, Canada September 2017

Transcription

1 High-Frequency Algorithmic Manipulation Ramazan Gençay Simon Fraser University, Canada September 2017

2 Is the market on screen still the market? The answer is NO. Hit a button to buy or sell a stock and the market would move away from you.

3 High frequency trading During one millisecond (the time of one fast blink of the human eye is 100 milliseconds), a stock can experience about 500 quote changes and about 150 trades. E.g.: Markets show 10,000 shares of Exxon offered at $86 a share, a bunch of smaller sell orders together. Is it that someone at the back of the line had the ability to jump out of the queue - when the people in the front of the line sold their shares? Or something else? Trading reports do not necessarily separate out the exchanges. If a partial fill, you are not informed which exchanges missing shares had vanished from.

4 Is the current market a fair game?

5 Manipulation tricks in LOB (and getting punished for it) Market manipulation is nothing new and has been around for as long as markets have existed. Most methods rely on shifting perceptions about the marketplace, such as trade volumes, demand and supply on the order books, and other key determinants. Spoofing Layering Quote stuffing Momentum ignition

6 Spoofing & Layering Spoofing and layering are both forms of market manipulation whereby a trader uses visible non-bona fide orders to deceive other traders as to the true levels of supply or demand in the market. Some regulators use the terms spoofing and layering interchangeably Others, including FINRA, use layering to describe entering multiple non-bona fide orders at multiple price tiers, and spoofing to describe entering one or more non-bona fide orders at the top of the order book only. Both have been made expressly illegal in the United States under the Dodd Frank Wall Street Reform and Consumer Protection Act in 2010, and have been actively prosecuted.

7 Spoofing A trader enters a single visible order, or a series of visible orders, that either creates a new best bid or offer or adds significantly to the liquidity displayed at the existing best bid or offer. During the lifespan of that first order(s), or within a short time after it is cancelled, the same trader executes a trade on the opposite side of the market. The pattern is manipulative because the execution occurs at a more favorable price than the trader was likely to obtain in the absence of the first order(s). This is true regardless of whether the buy (sell) execution occurs at the pre-sequence best bid (offer) price, at the midpoint, or at the new best offer (bid) price set by the spoof order. In any of those scenarios, the trader is executed at price better than if he had hit the pre-spoof bid or had taken the pre-spoof offer.

8 Layering Layering is a variant of spoofing where the trader enters multiple visible orders on one side of the market at multiple price tiers, which cause the midpoint of the spread to move away from those multiple orders, and the same trader executes a trade on the opposite side of the market. Again, the pattern is manipulative because the execution occurs at a more favorable price than the trader was likely to obtain in the absence of the first orders.

9 Spoofing Flash Crash HFT and Flash Crash (DJIA) On May 6, 2010, the Dow Jones Industrial Average plunged by approximately 1,000 points. By early in the afternoon, the Dow was down more than 300 points. In the five minute span between 2:42 and 2:47 p.m., the Dow fell an additional 600 points.

10 E-Mini futures In the morning, the CME s order book for E-mini s reflected a divergence between buy-side depth and sell-side depth. By early afternoon, sell-side depth was more than twice as large as buy-side depth. As of 2:45 p.m., in reaction to the intense selling pressure, there were few buyers and little liquidity left in the market.

11 Sarao s manipulative activity allegedly contributed to the Flash Crash On April 21, 2015, five years after the incident, the U.S. Department of Justice charged Navinder Singh Sarao. He was found to have used a lightly modified version of commercially available trading software to place orders and cancel them in rapid succession from his suburban London house. Sarao traded a ton of E-mini futures during the flash crash -- "62,077 E-mini S&P contracts with a notional value of $3.5 billion" -- and made "approximately $879,018 in net profits" that day, or a profit of about 2.5 basis points on the notional amount. At one point Sarao's fake sell orders alone "were almost equal to the entire buy side of the Order Book". Over the course of the day, Sarao modified more than 20 million lots, whereas the rest of the market combined modified fewer than 19 million. Sarao s dynamic layering technique was allegedly one of the causes of the Flash Crash in which "investors saw nearly $1 trillion of value erased from U.S. stocks in just minutes."

12 9:20: a.m., Sarao placed the following four sell orders nearly simultaneously, starting three ticks (tick size is 0.25, represents $12.5) above the best ask of $1, (the average market order size was 7 lots) 500 lots at $ lots at $ lots at $ lots at $ By approximately 9:26: a.m., he modified the orders repeatedly and then canceled all four of them, without having executed any of them. The modifications have occurred when the market price was changing, so that his lowest offer typically remained three ticks above the best ask. While this dynamic layering cycle was active, the E-Mini price fell 39 basis points, and he bought 1,606 contracts and sold 1,032 contracts.

13 His use of the dynamic layering technique was particularly intense in the hours leading up to the Flash Crash. He used the technique continuously from 11:17 a.m. until 1:40 p.m. He began this cycle by placing the following five sell orders nearly simultaneously at approximately 11:17: a.m. 600 lots at $1, lots at $1, lots at $1, lots at $1, lots at $1, At approximately 1:13 p.m., he added a sixth sell order for 600 lots, bringing the total to 3,600 lots, bringing the total to 3,600 lots. The orders were replaced or modified more than 19,000 times before he canceled them, without having executed any of them, at approximately 1:40: p.m. At this point, the aggregate volume of his orders was nearly equivalent to the aggregate volume of the entire buy-side of the order book. During this time, his offers comprised 20-29% of the CME s entire E-mini sell-side order book, significantly contributing to the order book imbalance.

14 Quote Stuffing Quote-stuffing traders send in rapid orders and cancellations with the expressed purpose of slowing down the market. By placing a large number of quotes in any one stock, it is possible to create latency across all stocks of the NYSE. This would allow a party the power to generate latency on liquidity demand. (Research conducted by Nanex) When 6,000 replacement orders for one stock are crammed into a second, each order is valid for less time than it takes for the news of the order to reach anyone not at the exchange; no normal person can execute a trade against the phantom order, because it simply is not valid long enough.

15 (Nanex) Strong correlation between the quote rate and the delay (between CQS and OpenBook). Whenever the quote rate exceeds 20,000/second, a corresponding delay is seen. The higher or longer the quote rate exceeds 20,000/second, the greater the delay. If the average or base quote rate is around 10,000/second, then it only takes an additional 10,000 quotes/second to reach the magic 20,000 quotes/seconds where a corresponding delay is seen in NYSE quote from CQS. This 10,000 quotes/second can be in any stock or combination of stocks that NYSE sends quotes to CQS for. SEC fined the NYSE for sending a quote faster to their direct feed than the consolidated feed.

16 Why do HFTs stuff the market to slow themselves down? Some exchanges profit by selling higher-capacity feeds to HFT traders, which demotivates self-regulation that could prevent the quote stuffing. Although it was found that 74% of U.S. listed equity securities received at least one quote stuffing event during the 2010 Flash Crash, so far persecution of this type of market manipulation has not taken place.

17 Momentum ignition A trader aims to cause a sharp movement in the price of a stock by using a series of trades, which indicate patterns for high frequency traders, with the motive of attracting other algorithm traders to also trade that stock. The instigator of the whole process knows that after the somewhat artificially created rapid price movement, the price reverts to normal and thus the trader profits by taking a position early on and eventually trading out before it fizzles out.

18 Momentum ignition occurred on average is 1.6 times per day for stocks in the STOXX 600 during the third Quarter 2012, with almost every stock in the STOXX600 exhibiting this pattern on average once a day or more. The average price move is about 38 basis points but over 5% are more than 75 basis points, with some significantly higher. (The average spread on the STOXX600 which is approximately 8 basis points) The time of move to occur is approximately 1.5 minutes. (By a study conducted by Credit Suisse)

19 Other strategies Abusive Liquidity Detection (Pinging) is the use of fictitious orders to detect the existence of a buyer or seller with the intention of trading ahead of, rather than with, the buyer or seller. Quote manipulation is entering non-bona fide orders on visible markets in an attempt to change the best bid price and/or the best ask price and affect the price calculation at which a trade will occur with a dark order.

20 Statues and Regulations In the United States, the Securities and Exchange Commission (SEC) oversees trading in stocks, bonds, and options on those securities, while the Commodity Futures Trading Commission (CFTC) takes responsibility over trading in futures and similar products. Canada does not have a securities regulatory authority at the federal government level. Each province has its own securities regulator, relying on the work of two national self-regulatory organizations, the IIROC (Investment Industry Regulatory Organization of Canada) and the MFDA (Mutual Fund Dealers Association) for most aspects of regulation of the organizations' member firms and their employees. The provincial and territorial regulators work together to coordinate and harmonize regulation of the Canadian capital markets through the Canadian Securities Administrators (CSA).

21 There is long standing laws prohibiting manipulative trading practices on both securities and futures exchanges. These laws generally require that the practices be intentional and that they be successful in influencing prices or other trading on exchanges. The Dodd-Frank Wall Street Reform and Consumer Protection Act (2010) added prohibitions against particular disruptive trading practices in futures markets, with somewhat reduced requirements regarding intention and success (a specific prohibition against spoofing). IIROC (Canada) considers Layering, Quote stuffing, Quote Manipulation, Spoofing and Abusive liquidity detection as manipulative and deceptive activities.

22 NO specific definition for spoofing Four nonexclusive examples of possible spoofing behavior: Submitting or cancelling bids or offers to overload the quotation system of a registered entity; Submitting or cancelling bids or offers to delay another person s execution of trades; Submitting or cancelling multiple bids or offers to create an appearance of false market depth; Submitting or canceling bids or offers with intent to create artificial price movements upwards or downwards.

23 NO explanations on how intent to cancel orders should be determined Spoofing is defined as bidding or offering with the intent to cancel the bid or offer before execution. But how intent? The difficulty is that vast majority of limit orders submitted to exchanges are canceled. For stocks, there are at least 20 order cancellations for every trade from Jan. 3, 2012 through Sep. 30, For exchange-traded products, the ratio is more than 80 order cancellations for every trade.

24 Some cases in the world The US, Canada and France

25 Cases in the US Indictment, United States v. Coscia (U.S.), No. 1:14 cr (N.D. Ill., Oct. 1, 2014) Aleksandr Milrud (Sept. 2015) Indictment, United States v. Sarao (British), No. 1:15-cr (N.D.Ill., Sep. 2, 2015) Information, United States v. Milrud (Canada), No. 2:15-cr JLL (D.N.J., Sept. 10, 2015) Order, BriargateTrading, LLC and Oscher (SEC, Oct. 8, 2015) Order, Afshar (SEC, Dec. 3, 2015) Order, Athena Capital Research, (SEC, Oct. 16, 2014) Order, Visionary Trading LLC (SEC, Apr. 4, 2014) Complaint, SEC v. Taub and Shmalo, No. 2:16-cv (Dec. 12, 2016) SEC v. Lek Securities Corporation, et al., Civil Action No. 17-CV-1789 (March 10, 2017) Complaint, CFTC v. Oystacher, No. 15-cv-9196 (N.D. Ill., Oct. 19, 2015) UAE Residents Heet Khara and Nasim Salim (CFTC, Apr. 5, 2016) Press release PR Complaint, HTG Capital Partners, LLC, v. Doe(s), No. 15-cv-2129 (N.D. Ill., Mar. 10, 2015)

26 Indictment, United States v. Coscia (U.S.), No. 1:14 cr (N.D. Ill., Oct. 1, 2014) The first individual to be convicted under the 2010 anti-spoofing provision, disrupting commodity futures prices in a $1.6 million fraud scheme during three months in In the indictment of 2014, the defendant faced up to 25 years in prison and a $250,000 fine on each commodities fraud count, and 10 years and a $1 million fine for each spoofing charge. He was sentenced in 2016 to three years in prison and is currently incarcerated in a medium-security prison in New Jersey. Charged with both commodity fraud and spoofing, involving six episodes of trading futures on various commodities including gold, soybean meal, soybean oil, high-grade copper, Euro FX and Pounds FX currency futures. He crafted two HFT programs, Flash Trader and Quote Trader, to swindle other participants by placing orders through Chicago-based CME Group and London-based ICE Futures Europe at his New Jersey trading firm.

27 His strategy moved the markets in a direction favorable to him, enabling him to purchase contracts at prices lower than, or sell contracts at prices higher than, the prices available in the market before he entered and canceled his large-volume orders. He began by placing a buy order in the Euro FX market for 14 contracts at $ lower than any offer in the market. 11 milliseconds later he placed three large sell orders: 91 contracts at $1.4291, 99 at $1.4290, and 61 contracts at $ These quotes caused market prices to fall, and seven milliseconds later the buy order was filled. Six milliseconds later, he cancelled his sell orders. Then he reversed this process, placing a sell order for 14 contracts at $1.4289, higher than any other bid. He then entered four buy orders: 88 contracts at $1.4284, 88 contracts at $1.4286, 88 contracts at $1.4287, and 61 contracts at $ Nine milliseconds later, his sell order was filled, and five milliseconds after that he canceled his buy orders. This kind of roundtrip trades allegedly produced profits of approximately $175, sometimes $560, in less than one second.

28 His trading programs looked for market conditions under which his fraudulent trading strategy worked best. Price stability Low volume at the best prices Narrow bid-ask spread He also placed a ping order of one contract to test the market and ensure that market conditions would allow his fraudulent trading strategy to work well.

29 Indictment, United States v. Sarao (British), No. 1:15-cr (N.D.Ill., Sep. 2, 2015) The second individual to be convicted. Layered orders in the market for E-Mini S&P 500 futures contracts and made profits by repeatedly selling futures contracts only to buy them back at a slightly lower price, or by doing the opposite. Managing the risk that his layering orders might get hit. His layering orders were entered several steps away from the best bid or offer in the market. Although the universe of buy and sell orders in the E-Mini market can be much larger, traders in this market are able to see a visible order book comprising the 10 best prices on each side of the market. He typically placed his orders in the middle of the order book on the sell side, such as at levels 4 through 8. He allegedly worked with a programmer to develop software that would cancel the orders in the event of a trade or in the event of the market moving close to the levels of his orders. With the aid of an automated trading program, Sarao was able to eliminate his risk of unintentionally executing these orders by modifying and ultimately canceling them before execution.

30 Information at 4, United States v. Milrud (Canada) No. 2:15-cr JLL (D.N.J., Sept. 10, 2015) He was alleged to have orchestrated an extensive and sophisticated international layering and spoofing scheme that targeted U.S. securities markets and involved high-speed trading through numerous brokerage accounts. He entered non-bona fide orders at multiple price points to make it appear as if there is substantial interest on one side of the market, with the goal of inducing others to enter more aggressive orders in the same direction, which interact with an bona fide order by the same trader on the other side of the market.

31 From at least January 2013, he led and managed multiple groups of traders who engaged in layering. He recruited the groups of online traders, based primarily in China and Korea, to engage in layering and provided the traders with access to trading accounts and trading technology that allowed them to carry out the scheme. To facilitate this fraudulent practice, he worked with a gaming software company to develop hot keys that allowed his traders to quickly place and cancel multiple orders via their computers with only a few strokes of their keyboards.

32 In perpetrating this scheme, he undertook elaborate measures to evade detection. To minimize the probability that other market participants or regulators would notice the impact of this layering scheme on the stocks that were manipulated, he instructed his traders to trade only small quantities of relatively high-volume securities (generally, stocks with an average daily volume of at least one million shares per day); to manipulate a wide variety of stocks, executing only a small number of trades in any one stock on a given day; to restrain themselves from inflating or depressing the prices of the stock that they manipulated by more than a few pennies per trade.

33 He also met with the owner of an offshore brokerage firm (the Broker ) to explore the possibility of engaging in layering through an account at the Broker s offshore firm. During an August 27, 2014 meeting with the Broker, he explained that each of his traders used at least two accounts. In one account, each trader primarily placed multiple non-bona fide buy or sell orders in order to create the upward or downward pressure on the stock price. He described this aspect of the scheme as the dirty work. In a second account, each of traders primarily executed the bona fide or clean trades that is, purchases and sales of stocks at prices affected by the dirty work of the first account. Each trader s dirty and clean accounts were held at different clearing firms, to mask the illicit coordination between the two accounts. His traders access the dirty and clean accounts using different trader IDs (user names associated with the trading software that the traders utilized) and different computers at different IP addresses. They use multiple accounts, trader IDs, computers and IP addresses to shredding documents to make it difficult for anyone to uncover the scheme.

34 He also inserted multiple layers of middlemen at various stages of the scheme, to mask the true ownership of funds and the true control of various trading accounts that engaged in this manipulative scheme. He maintained remote access to all of his traders computers to monitor the traders compliance with the prescribed methods for avoiding regulatory scrutiny. If a trader failed to comply, the trader would be excluded from the scheme. In exchange for providing traders with access to trading accounts and trading technology and helping them maintain their anonymity and mask their fraudulent trading activity, Milrud received a share of the illicit trading profits obtained by hired traders. One of his trading groups generated profits of approximately one million dollars per month. He took particular care to avoid having his name associated with any of the trading accounts or funds connected to the scheme, and insisted on routing any funds transfers related to the scheme through multiple middlemen located in multiple countries. In soliciting the Broker s participation in the scheme, he proposed that, in transferring funds related to the scheme, the Broker use the services of the individual who brings Milrud suitcases filled with cash after Milrud wires funds to an offshore bank account to which that individual has access.

35 Order, Briargate Trading, LLC and Oscher (SEC, Oct. 8, 2015) Spoofing on the New York Stock Exchange (NYSE) with pre-open orders from Oct through Sep (The NYSE sets its opening price based on all existing orders, and it disseminates order imbalance before the opening.) Oscher used his Briargate account to place a series of large, non-bona fide orders on the NYSE prior to the opening of trading, which occurs at approximately 9:30 a.m. ET. Before the open, based on the existing orders for each stock, an opening imbalance of buy or sell orders could occur (or disappear) as market participants placed buy or sell orders. Approximately one hour before the open, the NYSE released the first of a series of messages called the Order Imbalance Message to paying subscribers to the NYSE s Order Imbalance data feed. At specified intervals before the open and throughout the trading day, the NYSE s Order Imbalance data feed disseminated real-time information concerning buy and sell imbalances in NYSE listed securities based on the anticipated opening price of the securities. The Imbalance Message included the side of the imbalance (buy or sell), the imbalance quantity (indicative of interest for which there was currently no contra (opposite side orders) at the reference price, which was the previous day s closing price), and beginning at 9:28 a.m., an indicative opening price (the price at which all the interest eligible to trade in the open of that security could be executed in full). Sophisticated market participants used this information to estimate the likelihood of an imbalance at a certain opening price. The NYSE updated the Imbalance Message based on all electronic interest eligible to trade in the open of that security. The NYSE relayed this information every five minutes between 8:30 a.m. and 9 a.m., every minute from 9 a.m. to 9:20 a.m., and every 15 seconds from 9:20 a.m. until the open or until 9:35 a.m. (whichever came first).

36 Once news of Briargate s non-bona fide orders was disseminated to the market, this information impacted the market s perception of the demand for the stock and often the price of the stock. When an Imbalance Message showed a buy imbalance for a stock, meaning traders were seeking to buy more shares than were offered for sale at the open, traders often expected that the stock s opening price on the NYSE will rise (relative to the reference price) to reflect the excess buyer demand, and that the stock s price will rise on other exchanges, and vice versa. Next, Briargate also sent orders in the same security but on the opposite side of the market to other exchanges that opened before the NYSE. Then prior to the NYSE opening, Oscher cancelled the non-bona fide NYSE orders and Briargate profitably unwound the positions it had acquired on other exchanges. During the Relevant Period, Oscher placed and cancelled non-bona fide orders in 242 instances with an average aggregate size of approximately 200,000 shares. These orders impacted the Imbalance Message that other traders received through their NYSE data feeds. Through this conduct, Respondents profited approximately $525,000.

37 Order, Afshar (SEC, Dec. 3, 2015) The first fraudulent scheme involved the mismarking of option orders to take advantage of the benefits that certain exchanges provide to non-professional, public retail investors. These exchanges, including the Chicago Board Options Exchange, the NYSE AMEX Options, the International Securities Exchange, and Nasdaq OMX PHLX ( PHLX ), require option orders from the accounts of public customers (not broker-dealers or market-makers) to be marked as either customer or professional. Orders marked customer have priority of execution over, and earn higher rebates and incur lower fees than, orders marked professional at the same price.

38 Mismarking of Options Orders for Execution Priority Options exchange rules provide that a non-broker-dealer that places more than 390 orders in options per day (on average) whether executed or not during any calendar month in a quarter will be designated as a professional for the next quarter. Conversely, a customer is a non-broker-dealer that does not exceed the 390-order threshold. Despite far exceeding the 390-order threshold for every quarter from October 2010 to December 2012, the Afshars accounts (in the names of FinelineTrading Group LLC and Makino Capital LLC) were able to continually place customer orders throughout this time period by alternating their trading on a quarterly basis between accounts. When one account was professional for an upcoming quarter, they switched their trading to the other account, which was designated as customer. They then switched back the following quarter. The customer and professional designations are supposed to apply to all accounts beneficially owned by the trader. However, the Afshars and Kenny accomplished this back-and-forth scheme through false representation that Afshar solely owned Fineline and that Kenny solely owned Makino, despite the fact that Afshar had an ownership interest in both companies.

39 Spoofing to generate liquidity rebates on the PHLX (rather than buy low and sell high) From May 2011 to December 2012, the spoofing scheme was designed to take advantage of the maker-taker program offered by an options exchange. Under the maker-taker program, an order that is sent to an exchange and executes against a subsequently received order generates a maker rebate from the exchange. The Afshars and Kenny carried out the scheme by using All-Or-None (AON) options orders hidden orders that must be executed in their entirety or not at all and placing smaller, non-bona fide displayed orders in the same option series and price as the AON orders, but on the opposite side. The smaller orders were not intended to be executed but instead were placed to alter the option s best bid or offer in order to induce, or spoof, other market participants into placing orders at the same price. Those orders from other market participants executed against the Afshars hidden AON orders, and any open displayed orders were then canceled. Because the executed AON orders existed before the orders sent by the spoofed counterparties, they were deemed to have added liquidity and generated rebates for the accounts of Fineline and Makino. Typically, the strategy was repeated on the opposite side of the market to close out the position. As a result of this manipulative trading scheme, the Afshars reaped over $225,000 in ill-gotten rebates.

40 Distinctions of Briargate and Afshar These two settled SEC actions did not involve traders allegedly spoofing on a particular exchange in order to move prices on that exchange. Briargate allegedly spoofed with pre-open orders on the NYSE, in order to moves prices on other exchanges. Afshar allegedly spoofed in order to profit from maker rebates when other traders executed trades against his hidden order, with the profit coming from rebates rather than better prices.

41 Order, Athena Capital Research, (SEC, Oct. 16, 2014) The SEC sanctioned a New York City-based high frequency trading firm for placing a large number of aggressive, rapid-fire trades in the final two seconds of almost every trading day during a six-month period to manipulate the closing prices of thousands of NASDAQ-listed stocks. This marks the first high frequency trading manipulation case. Athena Capital Research used an algorithm that was code-named Gravy to engage in a practice known as marking the close in which stocks are bought or sold near the close of trading to affect the closing price. Although Athena was a relatively small firm, it dominated the market in the last few seconds of a trading day for stocks. The massive volumes of Athena s last-second trades allowed Athena to overwhelm the market s available liquidity and artificially push the market price and therefore the closing price in Athena s favor. The manipulative trading occurred from June to December 2009 and made up more than 70 percent of the total NASDAQ trading volume of the affected stocks in the seconds before the market close. Athena was acutely aware of the price impact of its algorithmic trading, calling it owning the game in internal s. Athena agreed to pay a $1 million penalty to settle the SEC s charges.

42 With the helping hand of its Gravy strategy, Athena refined a method to manipulate the daily process, known as the Closing Cross, that NASDAQ uses to set the closing price of stocks listed on the exchange. Manipulating the closing process can increase market volatility (thereby frustrating the very purpose of the closing auction) and throw off critical metrics linked to the closing price of stocks. Athena s algorithmic strategies became also increasingly focused on ensuring that the firm was the dominant firm and sometimes the only one trading desirable stock imbalances at the end of each trading day. The firm implemented additional algorithms known as Collars to ensure that Athena s orders received priority over other orders when trading imbalances. These eventually resulted in Athena s imbalance-on-close orders being at least partially filled more than 98 percent of the time. Athena s ability to predict that it would get filled on almost every imbalance order allowed the firm to unleash its manipulative Gravy algorithm to trade tens of thousands of stocks right before the close of trading. As a result, these stocks traded at artificial prices that NASDAQ then used to set the closing prices for on-close orders as part of its closing auction.

43 Athena, however, did not want to push the price of the stocks it traded too much because it created certain trading risks, but also because Athena was concerned about scrutiny from regulators as result of its last second trading. NASDAQ issued an automated Regulatory Alert for Scrutiny on Expiration and Rebalance Days, which provided that Suspicious orders or quotes that are potentially intended to manipulate the opening or closing price will be reported immediately to FINRA. Athena s CTO forwarded this alert to Manager 1 and Manager 2 and wrote: Let s make sure we don t kill the golden goose. Athena s ability to predict with a higher degree of probability that it would get filled on almost every imbalance order it placed, removed a major element of uncertainty and allowed Athena to fine-tune its strategies to maximize its profits. As its Imbalance-Only Order submissions became more sophisticated, Athena was able to ramp up its trading from approximately 1,000-3,000 tickers traded per month during the final months of 2008 to 12,844 symbols in November 2009.

44 Accumulations They have a desired accumulation pattern which includes grabbing stock at the beginning a period of average price accumulation a crescendo at the end. Athena s trading in shares of EBAY stock on November 25, 2009, occurred as follows

45 Athena performed sophisticated quantitative analyses which it used to place Imbalance-Only Orders prior to 3:50 p.m. It called this strategy, Collars. Prior to 3:50 p.m., Athena began entering its Collars orders. 3:50:00 p.m. - NASDAQ issued its first Imbalance Message, which included a 224,638 Buy Imbalance for shares of EBAY. At the time, shares of EBAY were trading at $ :50: Athena placed a Sell Imbalance-Only Order for 224,638 shares at $.01, and simultaneously placed a buy order of 85,300 shares at $23.56 to begin its accumulation. 16,000 shares were filled almost instantly. Between 3:50: and 3:59: Athena placed over 140 limit orders to buy between 100 and 5800 shares of EBAY, purchasing an additional 64,000 shares. Milliseconds before 3:59:58, the National Best Offer for EBAY was $23.58, at which point, Gravy kicked in, consisting of the following buy orders: Time Order Price Quantity Exchange 15:59: $23. 11,200 BATS 15:59: $23. 22,400 BATS 15:59: $23. 33,600 BATS 15:59: $23. 5,600 NASDAQ 15:59: $23. 28,000 BATS 15:59: $23. 11,200 NASDAQ During this time, Athena bought 112,000 shares (for an average price of $23.594) which constituted over 71% of the entire market volume for EBAY stock in the final two seconds of trading, overwhelming available liquidity and driving up its price. 3:59: the National Best Offer moved up to $23.59, and at 3:59:59.963, it was $ :00: NASDAQ ran its Closing Cross auction. Athena s Sell Imbalance-Only Orders were filled by selling 233,979 shares for $23.61, $.03 or 13 bps, higher than the best offer in the milliseconds prior to Gravy.

46 Order, Visionary Trading LLC (SEC, Apr. 4, 2014). Two firms (Visionary and Lighespeed) and five individuals agreed to pay a combined total of nearly $3 million to settle the case. Joseph Dondero, a co-owner of New Jersey based Visionary Trading LLC, repeatedly used layering and spoofing to induce other market participants to trade in a particular stock. By placing and then canceling layers of orders, Dondero created fluctuations in the national best bid or offer of a stock, increased order book depth, and used the non-bona fide orders to send false signals to other market participants who misinterpreted the layering as true demand for the stock. Some of Dondero s trading involving posting bids in order to induce more aggressive bids that would then execute against hidden sell orders placed by Dondero.

47 New York-based brokerage firm LightspeedTrading LLC is charged with aiding and encouraging the registration violations, and its former chief operating officer is charged with failing to supervise one of the Visionary owners who shared with his coowners commission payments that he received from Lightspeed while he was simultaneously working as a registered representative in Lightspeed. (spoofing raises compliance risks for brokers) From May 2008 to November 2011, Visionary Trading and its four owners Dondero, Eugene Giaquinto, Lee Heiss, and Jason Medvin illegally received from Lightspeed a share of the commissions generated from trading by Visionary customers. Lightspeed aided and encouraged the violation by ignoring red flags that Visionary and its owners were receiving transaction-based compensation while Visionary and its owners were not registered as a broker or dealer or associated with a registered broker-dealer firm.

48 Complaint, SEC v. Taub and Shmalo, No. 2:16-cv (Dec. 12, 2016) The Securities and Exchange Commission charged two New Jersey-based traders with manipulating more than 2,000 NYSEand NASDAQ-traded stocks and reaping more than $26 million in profits from their successful trades between January 2014 and December 2015 with 23,000 market manipulation events (averaged more than 40 per trading day). Taub and Shmalo utilized dozens of accounts at various brokerage firms to carry out their scheme undetected, typically using two at a time to engage in a flurry of manipulative trading activity that usually lasted less than five minutes. They would use one account to buy a position in a stock, and then use a second account to place a series of small buy orders to walk up the price for the first account to sell its larger position into the market at an artificially high price for significant profits. In some instances before the first account purchased its position in a stock, they had the second account place a series of smaller sell orders to drive down the price of the stock, allowing the first account to buy its larger position in that stock at the artificially lowered price.

49

50

51

52

53 SEC v. Lek Securities Corporation, et al., Civil Action No. 17-CV-1789 (March 10, 2017) This case involves two schemes to manipulate the securities markets perpetrated by Avalon, a foreign trading firm. Fayyer (Avalon's disclosed principal) and Pustelnik (an undisclosed control person of Avalon and a former registered representative at LEK) directly participated in and assisted the manipulative schemes. The schemes were made possible through and with the participation and assistance of LEK, a U.S. broker-dealer based in New York, and Sam Lek, LEK's Chief Executive Officer. LEK and Sarn Lek provided Avalon with access to the U.S. securities markets to execute the schemes, and otherwise assisted in carrying out the schemes. Lek Securities also relaxed its layering controls after Avalon complained. Avalon was the highest-producing customer for Lek Securities in terms of trading commissions, fees, and rebates generated. Together, the layering and cross-market manipulation schemes orchestrated by Avalon through LEK generated illicit profits of more than $28 million. ($21 million from layering and $7 million from crossmarket manipulation)

54 The first manipulative trading scheme, known as "layering", involved manipulating the markets of U.S. stocks. Avalon placed "non-bona fide" orders to buy or sell stock with the intent of injecting false information into the marketplace about supply or demand for the stock. Avalon did this to trick and induce other market participants to execute against Avalon's bona fide orders (i.e., orders that Avalon did intend to execute) for the same stock on the opposite side of the market. By placing the non-bona fide orders, Avalon was able to manipulate the market for the stocks and thereby obtain more favorable prices on the executions of its bona fide orders than otherwise would have been available. Avalon engaged in hundreds of thousands of instances of layering in numerous securities from approximately December 2010 through at least September Avalon made millions of dollars in profits from the scheme.

55 The second manipulative trading scheme is referred to herein as the "cross-market manipulation", "cross-market scheme" or "cross-market strategy". Avalon bought and sold U.S. stock at a loss for the purpose of moving the prices of corresponding options, so that Avalon could make a profit by trading those options at artificial prices that they would not have been able to obtain but for the manipulation. Avalon's stock trades had no legitimate economic reason, and were intended to inject into the market false information about supply and demand in order to move the prices of corresponding options to artificial levels. Although the strategy involved taking a loss on the stock transactions, such losses were far outweighed by Avalon's significant profits from trading the corresponding options whose prices Avalon had manipulated. Avalon engaged in hundreds of instances of cross-market manipulation involving numerous stocks and options from at least August 2012 through at least December Avalon made millions of dollars in profits from that scheme.

56 Complaint, CFTC v. Oystacher, No. 15- cv-9196 (N.D. Ill., Oct. 19, 2015) From December 2011 through at least January 2014 (the "relevant period"), Oystacher and the company he owns and controls, 3 Red Trading LLC, intentionally and repeatedly engaged in a manipulative and deceptive spoofing scheme while placing orders for and trading futures contracts ("futures'') on multiple registered entities, creating the appearance of false market depth. Oystacher and 3 Red engaged placing large (at least doubling the number of contracts offered or bid at those price levels, or better) passive order(s) on one side of the market at or near the best bid or offer price, which were intended to be canceled before execution. They placed these orders through accounts owned by 3 Red to create the false impression of market depth and book pressure in a certain direction and induce other market participants into placing orders on the same side of the market and at similar price levels as the spoof orders. They would then cancel or attempt to cancel all of the spoof order(s) before they were executed and virtually simultaneously "flip their position from buy to sell (or vice versa) by placing at least one aggressive order on the other side of the market at the same or better price to trade with market participants that had been induced to enter the market by the spoof orders they just canceled. This strategy allowed them to buy or sell futures contracts in quantities and/or at price levels that would not have otherwise been available to them in the market, absent the spoofing conduct.

57 They used the "avoid orders that cross" functionality to place "flip" order(s) as aggressive order(s) which would simultaneously (within 5 milliseconds) cancel any opposite order(s) at the same or better price. (automatically canceled orders when 3 Red entered orders on the opposite side of the market. ) They often placing the aggressive flip orders as partially visible "iceberg" orders to maximize the likelihood they would be filled. The iceberg orders or reserve orders published only part of the total order, with the rest remaining hidden until the published portion is executed. This might have made the reacting orders less cautious than if the entire opposite-side order had been published. The disadvantage of hiding part of an order is that displayed volume will typically have priority. In this case, the hidden part of 3Red s order would not execute until other displayed interest at the same price.

58 Oystacher and 3 Red engaged in these manipulative and deceptive "flips" at least 1316 times Futures contract Trading days Spoofing incidents Spoof orders making up Flip Total # contract underlying spoof orders COMEX copper ,354 NYMEX crude oil ,204 NYMEX natural gas ,590 CFE VIX ,694 CME E-Mini S&P 500 June 2013 CME E-Mini S&P 500 Dec. 2013; Jan , ,425 Total 51 1,316 5, ,790

59 Spoof orders suddenly and dramatically increased the number of orders and contracts on that side of the market at those price levels, creating the appearance of sudden market depth and book pressure Futures contract Mean # of spoof orders per flip Mean # of spoof order contracts per flip Mean % by which spoof orders increased # of contracts at price level or better COMEX copper % NYMEX crude oil % NYMEX natural gas % CFE VIX % CME E-Mini S&P 500 June 2013 CME E-Mini S&P 500 Dec. 2013; Jan % %

60 The percentage of their orders in the one second period prior to flipping that were placed as iceberg orders to the percentage of the "flip orders" placed as iceberg orders in the spoof incident Futures contract % of iceberg orders placed within 1 second preceding flip at the same or better price % of iceberg orders placed during 5 ms after flip at the same or better price COMEX copper 0.24% 72.94% NYMEX crude oil 0.63% 96.60% NYMEX natural gas 0.19% 89.34% CFE VIX NA NA CME E-Mini S&P 500 June 2013 CME E-Mini S&P 500 Dec. 2013; Jan % 79.66% 0.00% 18.58%

61 The respective fill and cancellation rates between the passive spoof orders and aggressive "flip" order Futures contract Mean fill % - spoof orders Mean cancel % - spoof orders Mean fill % - flip orders Mean cancel % - flip orders COMEX copper 0.89% 99.11% 44.30% 55.70% NYMEX crude oil 1.87% 98.13% 69.83% 30.17% NYMEX natural gas 0.51% 99.49% 50.76% 49.24% CFE VIX 0.94% 99.06% 37.53% 62.47% CME E-Mini S&P 500 June 2013 CME E-Mini S&P 500 Dec. 2013; Jan % 99.83% 55.20% 37.90% 0.57% 99.43% 69.39% 27.81%

62 Natural Gas on November 30, 2012 At 8:02: a.m., Defendants were short 10 futures contracts in natural gas with additional pending order to sell 182 contracts. Beginning at 8:02: a.m., Defendants proceeded to place seven visible orders to sell a total of 103 contracts behind other resting orders at the existing best offer price of $ Defendants' seven spoof orders increased the visible market depth (measured in contracts offered) at the best offer price by more than 1100% compared to what was visible to market participants at that same price before Defendants placed these spoof orders.

63 After Defendants' spoof orders appeared in the order book, other market participants placed orders to sell, and a new best sell/offer price of $3.670 was established

64 The market for natural gas futures at 8:02: a.m., immediately before Defendants canceled their spoof orders, looked as right.

65 At 8:02: a.m., market data reflects that Defendants canceled their seven spoof orders at $3.671, although they had been pending less than 750 milliseconds, and none had resulted in any fills. Market data indicates that over the next three milliseconds, Defendants aggressively "flipped, and crossed the spread by placing two buy orders for a total of 50 contracts at a price of $ Because Defendants' flip orders to buy would have been matched against their pending spoof orders to sell at the same price, the avoid orders that cross function in their trading platform automatically canceled these spoof orders. In this example, Defendants were able to almost simultaneously place new order(s) and cancel existing opposite orders at the same or better price with a single button push. Over the next ten seconds, Defendants' aggressive flip orders to buy 50 contracts were filled with 39 contracts at $3.671 and 4 contracts at About a second after the last fill, Defendants canceled the remaining portion of one of the flip buy orders. After Defendants' flip orders were mostly filled and then partially canceled, the new lowest sell price was $ Use of the spoof orders in this instance enabled Defendants to purchase 43 contracts, most at a price not previously available.

66 E-Mini S&P 500 on January 6, 2014 At 2:0 I: p.m., Oystacher and 3 Red were long 130 E-Mini S&P 500 futures contracts, with additional pending orders to sell 3,279 contracts and orders to buy 124 contracts. Beginning at 2:01: p.m., Defendants proceeded to place two visible spoof orders to sell a total of 921 contracts behind other resting orders at the existing best offer price of $ Defendants' spoof orders increased the visible market depth (measured in contracts offered) at the best offer price by more than 2,700% compared to what was visible to market participants at that same price.

67 After Defendants' spoof orders appeared in the order book, other market participants placed similar orders to sell at $1,824.00, as shown right at 02:01: p.m.

68 The E-Mini S&P 500 futures market at 02:01: p.m., immediately before Oystacher and 3 Red canceled their spoof orders, looked as right.

69 At 02:01: a.m., market data reflects that Oystacher and 3 Red canceled their two spoof orders at $1,824.00, although they had been pending for about 400 milliseconds, and had not resulted in any fills. Market data indicates that 1 millisecond later, Defendants aggressively "flipped" and crossed the spread by placing a buy order for 264 contracts at a price of $ Because Defendants' flip order to buy would have been matched to their pending spoof orders to sell at the same price, the avoid orders that cross function in their trading platform automatically canceled their spoof orders. In this example, Defendants, with a single button push, were once again able to almost simultaneously place a new order and cancel an existing order at the same or better price. Over the next four seconds, Defendants' aggressive flip order to buy 264 contracts was filled at a price of$ After Defendants' flip order was filled, the new lowest sell price was $1, Use of the spoof orders in this instance enabled Defendants to purchase 264 contracts, most at a price not previously available. After the immediate executions triggered by their flip, Defendants now possessed along position of 218 with resting orders to sell 3,279 contracts. After fully executing these flip orders, Defendants held a long position of 393 contracts with resting orders to sell 3,278 contracts.

70 UAE Residents Heet Khara and Nasim Salim (CFTC, Apr. 5, 2016) Press release PR Between February 2015 and April 28, 2015, both, individually and in a coordinated fashion, regularly placed larger aggregate orders for gold and silver contracts on the Commodity Exchange, Inc. (COMEX) opposite smaller orders, and cancelled the larger orders after the smaller orders were executed. A federal court in New York issued a Consent Order imposing a permanent injunction against Heet Khara and Nasim Salim and prohibiting them from engaging in spoofing. The two defendants settled the charges for combined penalties of $2.69 million. Within a span of about 11 seconds on early February 18, Mr. Khara placed 212 offers to sell silver at prices between $ and $ per ounce, CFTC said. When this drove prices down to the level of smaller purchase orders he had placed, he cancelled all 212 of the offers to sell.

71 Complaint, HTG Capital Partners, LLC, v. Doe(s), No. 15-cv-2129 (N.D. Ill., Mar. 10, 2015) In addition to suits filed by government agencies, a private lawsuit was filed in the Northern District of Illinois by HTG Capital Partners, LLC. The complaint alleged that an unknown group of traders undertook spoofing transactions in the U.S. Treasury futures market on the Chicago Board of Trade. HTG claims that they was forced to expend substantial resources to detect and avoid the alleged spoofing. The trading occurred on the electronic CME Globex platform. The complaint describes the spoofing following a well-defined three phased pattern that demonstrates their spoofing intention: In the first phase, the Doe(s) would enter Deceptive Orders that they intended to cancel before execution (the build-up phase); they created the false appearance of market depth, which, in turn, caused unwitting market participants to react by entering buy or sell orders in the same direction as the false momentum. In the second phase, the Doe(s) canceled the Deceptive Orders they had entered during the build-up phase (i.e., the cancel phase). In the third phase, virtually simultaneous to the cancels, the Doe(s) would enter one or more orders in the opposite direction of the Deceptive Orders and at the same price, trading against the remaining available contracts at that price, thereby flipping the market (the flip phase).

72

73

74