Market Surveillance And Integrity

Have you ever watched a stock price jump and then noticed the trades underneath looked “too coordinated” to be normal? That feeling is exactly what market abuse tools try to convert into evidence: observable trade and order behaviors that map to manipulation and other forms of misconduct.

Traders see the market as flow and liquidity; compliance teams see it as risk. Market surveillance sits in the gap. It needs categories that match how abuse actually shows up in the tape, not just labels from policy. This chapter gives you a practical way to recognize the main abuse types and the red flags that often come right before enforcement actions - so you can spot issues early, document what you saw, and act without guessing.

By the end, you will be able to use the Abuse Taxonomy Map to sort what you observe into the right abuse category, then translate that into concrete checks: what to pull, what patterns to look for, and how to avoid chasing noise. You will also walk through a realistic equities scenario using Leila’s trading and surveillance context, so the steps feel like work you could run tomorrow, not theory you could debate.

Why This Matters: categories and red flags that connect to real enforcement work

Regulators and exchanges do not enforce “bad intent” they cannot prove. They enforce conduct that produces a market impact inconsistent with fair trading, and they build that case from patterns in orders, executions, and communications. The problem is that many abuse patterns share surface similarities. A sharp price move can come from real news, broad sentiment shifts, or a liquidity event. A campaign of orders can look like aggressive trading to one reader and manipulation to another.

That is why categories matter. If you can name the abuse pattern you suspect using a consistent taxonomy, you stop mixing unrelated behaviors and you start building a tighter evidentiary thread. For traders, that means you can distinguish “I traded hard” from “my trading resembles layering” and adjust fast. For compliance and analysts, it means you can prioritize alerts that actually line up with conduct theories and reduce false positives.

This chapter’s topic - core manipulation and abuse categories and observable behaviors that often precede enforcement actions - solves a specific operational gap: turning vague alert descriptions into concrete trade-level evidence. You will learn how to map behaviors like spoofing, layering, wash trading, momentum ignition, and misleading conduct into a structured view you can use across venues and products. You will also learn what to check first when you get a suspicious pattern: order placement timing, order-to-trade ratios, price/size relationships, and whether the behavior repeats around key moments like auction opens or headline windows.

The practical payoff lands in two places. First, you reduce “wait and hope” compliance work: you move from receiving a vague alert to running a defined set of checks. Second, you help traders avoid accidental misconduct: when their own order logic creates a pattern that matches an abuse category, they can fix the behavior before it becomes a case.

How It Works: the Abuse Taxonomy Map and the behaviors behind each category

The Abuse Taxonomy Map works like a labeling system for what you see on the screen. You start with behavior - what orders and trades did - and you end with the most likely abuse category. You do not need to prove intent at this stage. You need to identify the conduct pattern strongly enough that an investigator can decide what to test next.

Use the map as a three-part filter: (1) trading mechanics, (2) market impact goal, and (3) behavioral signatures. Below are the core categories that show up most often in surveillance work, along with concrete signatures you can observe in standard order and trade data.

1. Fictitious or deceptive orders (spoofing, layering, and related tactics)

Look for orders that enter and cancel rapidly, especially when the trader places multiple price levels around the touch and does not execute those orders. The signature often includes an unusually high cancel rate, short order lifetimes, and a clear attempt to influence the visible order book without taking the other side.

2. Wash trades and matched trading (including self-trades and circular trading)

Watch for trades that occur at or near identical prices and sizes where the same participant appears on both sides, or where counterparties repeatedly match each other with no meaningful economic exposure. The signature includes repeated round-trip trading, low net position change, and patterns that look like “turning volume” rather than taking risk.

3. Momentum ignition and disruption (pump-and-dump variants, churn to distort, and similar conduct)

This category focuses on creating or amplifying short-term price movement to attract other participants, then exiting....