This is not where S&P 500 spoofing happens.

Photographer: Tim Boyle/Bloomberg

Regulators Bring a Strange Spoofing Case

Matt Levine is a Bloomberg View columnist. He was an editor of Dealbreaker, an investment banker at Goldman Sachs, a mergers and acquisitions lawyer at Wachtell, Lipton, Rosen & Katz and a clerk for the U.S. Court of Appeals for the Third Circuit.
Read More.
a | A

On Monday, the Commodity Futures Trading Commission brought a case against Igor Oystacher and his firm, 3Red Trading LLC, for spoofing. Oystacher is a let-us-say colorful and controversial trader. Here is a Bloomberg article with some background, and here is the Wall Street Journal in February. He trades a lot of futures, but he is not what you'd call a high-frequency trader, since he doesn't use computer algorithms but just clicks his mouse really fast.  He has frequently been accused of spoofing, that is, putting in fake orders to deceive other traders about the state of the market so that he could trade on the other side, and the CFTC has been investigating him for years. So you'd think that, if the CFTC brought a case against him, it would be pretty convincing. But I am not so sure? 

Here's a thing that the CFTC says Oystacher did:

  • He was trading E-Mini S&P 500 futures contracts -- "the most popular equity index futures contract in the world," which lets traders bet on the direction of the stock market -- on the afternoon of January 6, 2014. 
  • At 2:01:47.256, the best bid to buy E-minis was 1823.75 (131 orders for 615 contracts), and the best offer to sell them was 1824.00 (9 orders for 34 contracts). 
  • Starting at 2:01:47.260, Oystacher put in two orders to sell 921 contracts at 1824.00. The CFTC calls these "spoof orders," because, it alleges, he never intended to trade on them.
  • Other traders then followed with orders to sell at 1824.00, apparently (on the CFTC's theory) spoofed by the illusion of supply created by Oystacher's orders. So within about 1/100th of a second of his orders -- by 2:01:47.271 -- another 21 orders to sell 43 contracts at 1824.00 showed up. Within the following 3/10ths of a second -- by 2:01:47.561 -- another 4 orders to sell 10 contracts showed up.
  • So at 2:01:47.561, there were a total of 36 separate orders to sell at 1824.00 (2 from Oystacher, 9 from people who were in the book before him and 25 from people who joined after him). Those orders were to sell a total of 1,008 contracts, but of those, 921 contracts came from Oystacher, 34 were in the book before him and only 53 joined the book after him. 
  • Then, a tenth of a second later, he sprung his trap:

At 02:01:47.667 a.m., market data reflects that Oystacher and 3 Red canceled their two spoof orders at $1,824.00, although they had been pending for about 400 milliseconds, and had not resulted in any fills. Market data indicates that 1 millisecond later, Defendants aggressively "flipped" and crossed the spread by placing a buy order for 264 contracts at a price of $1824.00. Because Defendants' flip order to buy would have been matched to their pending spoof orders to sell at the same price, the avoid orders that cross function in their trading platform automatically canceled their spoof orders.

  • That's maybe a little unclear. What happened is just that Oystacher put in a buy order at 1824.00, and his trading software automatically said, well, you can't trade with yourself, so if now you want to buy at 1824.00 first you'll have to cancel your sell order at 1824.00. So the software automatically canceled the sell order one millisecond before posting the buy order.
  • "Over the next four seconds, Defendants' aggressive flip order to buy 264 contracts was filled at a price of $1824.00." 

Right away, there are some weird things about this story, as a story of spoofing. The idea of spoofing is that Oystacher would put in a big sell order. Other people (or algorithms) would see that big sell order and think, ooh, there is a lot of selling pressure on this contract. They would rush to put in their own sell orders, which would push the price down. Oystacher would be lying in wait to buy the contract when the price went down: He'd quickly cancel his sell order and flip around to buy.

That's the theory. But the first oddity is: The price didn't go down! When Oystacher started doing whatever this was, the contract was 1823.75 bid, 1824 offered. He could have bought at 1824. Then he did this stuff, and he ... bought at 1824. He never moved the price!

Now, he couldn't have bought much at 1824 before this happened: At the start of that little story above, there were only 34 contracts offered at 1824. And at the end of the little story, there were 87 contracts offered at 1824. So he could buy 53 more contracts for 1824.00 than he could have by just putting in a buy order.

But the second oddity is: He didn't buy 87 contracts for 1824.00! He bought 264 contracts at that price, over the next four seconds. But 264 is more than 87. Specifically, 264 is 177 more than 87. Which means that Oystacher lured in sellers of 53 contracts at 1824.00 over 4/10ths of a second by putting in a big fake sell order at 1824.00 -- but then lured in sellers of 177 more contracts at 1824.00 over four seconds by putting in a big real buy order at 1824.00.

That just seems weird, no? Like, the CFTC theory has to be that the fake selling pressure created by Oystacher's fake sell order is what drove other real sellers to want to sell at 1824. But most of those sellers decided to sell at 1824 after Oystacher's sell order went away -- after he was visibly buying. Maybe there was some lag in the sellers noticing (four seconds though? ), or maybe this trade was partly spoofing and partly not. But it's weird, and it does not fit with any particularly clean story of spoofing. If Oystacher's plan was to create the impression of selling pressure to push down the price, that didn't work. And if his plan was to create the impression of selling pressure to attract lots of other sellers at the same price, that ... kind of only partially worked? Not as well as doing the opposite thing did?

A third oddity is how the story starts: "At 02:01:45.702 p.m., on January 6, 2014, Oystacher and 3 Red were long 130 E-Mini S&P 500 futures contracts." That's like a second and a half before the action described above, and those 130 contracts were worth about $11.9 million. So Oystacher was long $11.9 million worth of E-minis, and then he decided to spoof the price ... down? I mean, as we discussed, he didn't push the price down -- he didn't move the price at all -- but why would you even try to spoof the price down if you were long? In the classic case of spoofing, you are flat, you pretend to sell, you push the price down, you buy, you are long, you pretend to buy, you push the price up, you sell and voilà: You are flat again, with a profit generated by your manipulation. But you don't start long and push the price down so that you can buy more. Sure that makes it cheaper to buy, but it also makes your existing position worth less. Again this is not proof that Oystacher's trading wasn't spoofing -- if you are long and want to be longer, you might decide to manipulate the market to make your entry point cheaper -- but again it is weird.

Let's throw in one more oddity. This one is not in the CFTC's complaint; it comes from order and market data provided to me by a 3Red spokesman. Apparently, just before that 2:01:45.702 timestamp in the CFTC complaint -- just before Oystacher was long those 130 contracts -- he was short hundreds of contracts. But he also had an order to buy 921 contracts at 1824.00, with the market at 1824.00 / 1824.25, having fallen from 1824.50 / 1824.75 over the previous 20 seconds or so. Then, right around 2:01:45.700, someone (or someones) sold a lot of contracts, and all of the buy orders at 1824.00 -- Oystacher's bid for 921 contracts, and other bids for hundreds more -- got hit. So he bought at 1824.00, leaving him long 130 contracts and the new market at 1823.75 / 1824.00.

So Oystacher went from short 750+ contracts to long 130 contracts in an instant, as the price was falling. And a second and a half later, he put in an offer to sell 921 contracts -- the same 921 contracts that he'd just bought. Was that order fake, a spoof? Well, maybe. It's a question of intent. But it's imaginable that, if you found yourself having bought 921 contracts in a falling market, you might say, hmm, perhaps I should get rid of them.

But then Oystacher canceled that sell order half a second -- sorry, 4/10ths of a second -- later, and switched to buying more. Does that prove that the sell order was fake, a spoof? Well, maybe. It's a question of intent. The funny thing, though, is that his controversial sell order didn't seem to do much. Like I said: The price didn't go down, and not that many more sellers came in -- 25 more sell orders showed up, but they were small orders, for a total of just 53 contracts. Nor did that many buy orders disappear: Just before he put in his sell order, there were 131 buyers for 615 contracts at 1823.75, the best bid; just before he changed to a buy order, there were 110 buyers for 538 contracts. So the order book had weakened slightly in the intervening 4/10ths of a second, but it's not like his big sell order incited panic.

One possibility is that Oystacher saw that the market didn't look especially weak, and switched to being a buyer instead, betting that the price would go up. This story would not be about spoofing; it would be the opposite. In this story, Oystacher put in a big sell order, and then switched to being a buyer not because he saw tons of other sellers come in behind him, but because he saw so few sellers come in behind him (and so few buyers clear out in front of him). There weren't that many sellers at the current offer (other than him), and there were a lot of buyers at the current bid, so he figured the price would go up. This theory relies on Oystacher responding to market data very quickly -- in just 4/10ths of a second -- but, if you believe him, that is kind of his specialty. His clearing broker once "quoted Mr. Oystacher as saying that 'we are clicking in response to what we are seeing,' adding: 'If we click quicker than most, it is a skill.'" I suppose it is!

This story makes more sense of the fact that Oystacher bought 264 contracts over four seconds, rather than just the 87 contracts that were available when he switched sides. He didn't just take out the people who jumped in behind his big sell order -- as a spoofer would -- but instead stayed in the market for four seconds, buying more contracts as new sellers came to the market. Because he thought the price would go up.

Now, if you believe this story, then he was using his big sell order informationally: He wasn't just offering to sell 921 contracts because he had a deep fundamental belief that the contract was overvalued; he was also doing it to see what would happen. When nothing happened -- when the offer didn't trade, when the price didn't move -- he changed his mind. There are probably purists who would say, well, that's manipulative too, you should only offer to sell if you are sure that you want to sell. That is a minority view, but it is strongly held. I think it's reasonably clear that lots of people change their minds for lots of reasons, and that changing your mind because of what you see in the order book is perfectly legitimate. Indeed, that is why spoofing is illegal: because markets and regulators have decided that traders should be allowed to rely on the honesty of the order book in formulating their decisions.  If Oystacher put in an honest sell order, saw that there weren't a lot of other sellers, and switched to being a buyer because he thought the price would go up, that is totally legitimate.

Whew, sorry, we've spent a long time on that story about the E-mini trading on January 6, 2014! But it's one of only two detailed examples in the CFTC complaint. The other one is about natural gas futures trading on November 30, 2012, and it's not quite as weird. It's the same basic setup: Oystacher put in a big sell order, it didn't execute, and "less than 750 milliseconds" later, he cancelled the sell orders and put in buy orders at the same price. But here the price did move down (by one tick), and Oystacher was short rather than long at the beginning of the story. So this looks more classically like spoofing. But that doesn't mean that it is: While it's illegal to put in a big order that you don't intend to trade in the hopes of pushing the price down, it's legal to put in a big order and then cancel it when the price goes down.

The difference between those things is very subtle: It's just a matter of intent, and it's not easy to infer intent. In the spoofing case against Navinder Sarao -- you know, the flash crash guy -- prosecutors allegedly have e-mails showing that Sarao asked a programmer to build him a "cancel if close function" that would allow him to put in orders that would automatically cancel if they ever got close to executing. That sure sounds like evidence of  an intent not to execute! But there's no mention of e-mails or functions like that here, so the only way to infer Oystacher's intent is by looking at the pattern of his trades. If that gas trade looks like classic spoofing to you, you might see the E-mini trade as confirmation of the pattern. But if that E-mini trade seems like a very odd spoofing story, and more consistent with him changing his mind, then it's easy to read the gas trade as just Oystacher changing his mind too.

Those are the only two detailed examples, but the CFTC does have an argument from a broader pattern. It alleges that "Oystacher and 3 Red engaged in these manipulative and deceptive 'flips' during the relevant period and at least 1316 times" over 51 days in five different markets.  That sounds like a lot! But those 51 days are spread out over more than two years, and those 1,316 spoofing incidents took up a total of 15 minutes. Oystacher is apparently a frenetic trader, and the CFTC is accusing him of spoofing for, on average, less than two seconds per trading day.

Of course, you're not supposed to spoof at all! Spoofing for two seconds a day is two seconds too much! But, again, the question is intent, and whether there's a pattern that proves it. The CFTC seems to have selected those 1,316 incidents by just looking for cases where Oystacher placed big orders on one side of the market, canceled them within one second, "largely before they could execute," and immediately put in big aggressive (i.e. spread-crossing) orders on the opposite side. Is that spoofing, or just changing his mind quickly? Well, if he was doing that all day every day, you'd probably say he was spoofing: Why would you put in so many orders and cancel them all within a second? If he did it once in his life, you'd probably say he just changed his mind that one time. Doing it 1,316 times sounds like a lot, like a pattern. But for a guy who's frantically clicking his mouse all day, two seconds' worth of quick reversals like isn't necessarily a pattern.  Maybe he just changes his mind a lot.

There are two morals to this story. First: It's hard to prove spoofing, because it is hard to prove intent. People say that a lot. Sometimes you get the sense that they mean, like, poor prosecutors, it is so rough on them that they have to work hard to meet their burden of proof that this spoofer was spoofing. But it's worth taking seriously, not as a hurdle to cracking down on crooks, but as a genuine epistemological difficulty. It's hard to know what people intend! And it's weird to have a law where the same actions -- putting in an order, cancelling it, trading the other way -- are legal or illegal depending on what was going through Oystacher's mind in the relevant half-second. If he decided to buy before he put in a sell order: spoofing. If he decided to buy a quarter-second later: fine.

Second, though, it is also worth taking seriously all the people who keep accusing Oystacher of spoofing, even if he's not spoofing. Obviously people -- regulators, and also other traders in his markets -- are annoyed.  They saw a big sell order, they thought there was lots of selling pressure, they decided to sell, and then, boom, nope, there was a big buyer, and they were caught on the wrong side. That annoyance has very little to do with Oystacher's intent; people just don't like to be caught on the wrong side of a trade. And when it happens to them a lot, they start doubting the integrity of the market, where "integrity of the market" is a fancy way to say "their ability to make money."

So intent-based spoofing enforcement is a pretty blunt instrument. If requires a fairly hopeless inquiry into a trader's state of mind, with impossible precision down to the half-second. And with or without intent, the trader's counterparties will be equally aggrieved. You could imagine a more objective system -- just allowing spoofing, say, or conversely putting a limit or tax or delay on traders who change their minds -- that might work better. But even that wouldn't be fully satisfying, and you'd probably still want some enforcement for people who intentionally and deceptively game the system, whatever the system is. And then, too, you'd have the problem of figuring out what they intended.

  1. The CFTC calls it "3 Red" but everyone else seems to omit the space, so I will too. "They named it 3Red Group after the three red chairs they and another early employee used." 

  2. From the Wall Street Journal this week:

    In 2011, he and another trader founded 3Red, where he has since been the principal trader, according to the CFTC. Mr. Oystacher is a manual trader, but the firm also has teams that use computerized high-frequency trading strategies.

    Incidentally, if you like clicking your mouse really fast, have you played Bloomberg's trading game? It is not much like trading, but it is strangely addictive, and rewards mouse skills.

  3. Highlights include:

    • "The CFTC investigation started two years after 3Red got off the ground" (3Red started in late 2010).
    • "Prosecutors are investigating Oystacher for spoofing," and there is a federal grand jury in Chicago.
    • A $125,000 settlement with Intercontinental Exchange in June for "disruptive trading."
    • A $150,000 fine and one-month ban from CME in 2014 for placing orders without "the requisite intent to trade at the time of order entry."
    • A 30-day ban and several fines from Eurex against a trader known as "Mr. A.," who is apparently Oystacher.
    • Oh lord, and this, about his time at the Gelber Group:

      “He’s been talked about for years,” says John Lothian, a former Chicago futures broker who publishes an exchange-industry newsletter.

      Within Gelber, he earned nicknames like “Snuggles” and “The Pig,” although former colleagues say they aren’t sure why. He had down periods: After the 2010 Flash Crash, when the Dow Jones Industrial Average fell nearly 1,000 points before recovering, he told friends he lost significant money on a series of trades.

      He left Gelber in 2010. In 2013, the firm agreed to pay a $750,000 fine to the CFTC over orders in 2009 and 2010 that an unidentified trader entered and canceled, allegedly to affect the price of a stock-index future, a CFTC news release says. Gelber didn’t admit or deny the charges in accepting the settlement.

      As I've said before, if I worked with someone nicknamed Snuggles, I would obviously stop everything until I knew why he was called that. "Former colleagues say they aren't sure why," come on.

  4. I am summarizing pages 24 through 28 of the CFTC complaint.

  5. These numbers are extracted from the order book charts in paragraphs 79, 81 and 82 of the complaint. So first there were 9 orders for 34 contracts. Then he added two for 921, for a total of 11 orders for 955. Then (paragraph 81) by 2:01:47.271, there were  total of 32 orders to sell 998, of which 21 for 43 were new. Then (paragraph 82) there were 36 for 1008, of which 4 for 10 were new.

  6. From the complaint:

    Oystacher and 3 Red manually traded these futures markets, using a commercially available trading platform, which included a function called "avoid orders that cross." The purpose of this function is to prevent a trader's own orders from matching with one another. Defendants exploited this functionality to place orders which automatically and almost simultaneously canceled existing orders on the opposite side of the market (that would have matched with the new orders) and thereby effectuated their manipulative and deceptive spoofing scheme, as described below.

    I mean, that may be true, but there's nothing automatically nefarious about exploiting that functionality. Like, if he had some sell orders at 1824.00, and just changed his mind, and wanted to cancel those orders and quickly put in buy orders at 1824.00, and he knew that his software would automatically cancel the sells as soon as he put in the buys, why not make use of that fact? As opposed to manually cancelling the sells and then putting in the buys separately?

    Still, the CFTC really makes a meal of it. The complaint says things like "Defendants, with a single button push, were once again able to almost simultaneously place a new order and cancel an existing order at the same or better price." I mean, yeah, computers are magical, you can push a button that does a bunch of things at once.

  7. OR IS IT? Here's a sourcing note on that math, which you probably shouldn't read, because it is seriously boring and also strangely inconclusive. The CFTC says -- we'll get to it in a minute in the text -- that Oystacher started this story long 130 contracts (paragraph 79). Then it shows an order book with sell orders for 1,008 contracts (paragraph 82), 921 of which are his (paragraph 79). So that's 87 contracts (1,008 minus 921) available at the moment he "flips." Then he buys 264 contracts in the four seconds after "flipping" (paragraph 84). But (paragraph 86):

    After the immediate executions triggered by their flip, Defendants now possessed a long position of 218 with resting orders to sell 3,279 contracts. After fully executing these flip orders, Defendants held a long position of 393 contracts with resting orders to sell 3,278 contracts.

    Now, 218 (what he had) minus 130 (what he started with) is 88, not 87, so Oystacher somehow picked up an extra contract in the immediate executions. And 393 (what he had after four seconds) minus 130 is 263, not 264, so Oystacher somehow lost a contract (two?) in the subsequent four seconds. I am attributing these discrepancies to rounding error, or gremlins, and won't be discussing them further. But math is hard.

  8. The CFTC points out that in some other cases Oystacher's "flip" orders weren't all displayed: He would sometimes use "iceberg orders" to disguise how much he was buying. This was perfectly legal:

    An Iceberg Order, also known as a hidden quantity order, is an order type offered by certain designated contract markets on electronic trading platforms whose order quantities (i.e., number of contracts) are only partially visible in the Order Book to other market participants. During the relevant time, market participants were able to place buy or sell orders as iceberg orders in the NYMEX's natural gas and oil contracts, the COMEX's copper contract, and the CME's E-Mini S&P 500 contract.

    But the CFTC hints that being visible on one side and then "flipping" to being an iceberg on the other looks like spoofing. Meh, maybe.

    In any case, though, it seems that all of Oystacher's buy orders in this example were displayed. The CFTC never says otherwise, and notice the table in paragraph 85, which shows 197 contracts of open buy interest at 1824 after his initial "flip" trades. Presumably 177 of those were his.

  9. Like: The sellers were probably mostly algorithms. Plus the CFTC's theory is that it only took them 4/10ths of a second to notice when Oystacher's big sell order arrived, so it shouldn't have taken them 10 times as long to notice when it disappeared.

  10. "One contract is equal to $50 x the S&P 500 Index," says the CFTC, so 130 x $50 x 1824.00.

  11. See the charts in paragraphs 79 and 82, respectively.

  12. Here at Bloomberg View, John Arnold has argued in favor of spoofing as a way to "outsmart the front-running HFT algorithms."

  13. But see footnote 6 for what I think is a totally unsuccessful attempt to attribute nefarious intent to Oystacher's avoiding-self-trading software.

  14. See paragraph 55 and the accompanying table. Note that there are six rows in the table, but two of them are for different expiration dates of E-minis. The others are copper, crude, natural gas and the VIX.

  15. The alleged spoofing days run from December 2011 through January 2014 (see paragraph 52), so call it a bit more than two years, or a bit more than 520 trading days. There's a chart on page 18 with the "Mean Duration for Spoof Events"; by my math these average about 0.684 second per spoof event, or about 900 seconds -- 15 minutes -- total.

  16. The CFTC also does some clever data mining on the frequency with which these orders were cancelled. On page 29 of the complaint, there is a table with fill and cancellation rates for Oystacher's "spoof orders," which tended to get cancelled more than 99 percent of the time, and his "flip orders," which tended to get filled anywhere from 27.81 to 62.47 percent of the time. That seems suspicious: If you cancel 99 percent of one set of orders, then that does sound like you don't intend that set of orders to execute.

    But it's complete nonsense! The CFTC defines "spoof orders" to be, among other requirements, orders cancelled within one second. So of course they're mostly cancelled! The orders that weren't cancelled didn't make it into the data set! There's no a priori set of orders that you can look at and say, well, these are the ones he didn't intend to execute, and look, 99 percent of them didn't execute. Instead, the CFTC takes the orders that didn't execute and says, hey, these orders didn't execute.

    It is not good.

  17. Like I feel like that's what this means:

    “The history of CFTC litigation of manipulation claims under the pre-Dodd-Frank provisions demonstrates that proving intent can be very difficult for the government in trading cases,” said Aronow, the former CFTC enforcement chief. “While the spoofing provisions have yet to be tested through litigation, that history suggests that the government may face significant hurdles to success in litigated proceedings.”

  18. Consider also HTG Capital Partners, which is mad about alleged spoofing by some as-yet-anonymous traders in the Treasury futures market. This terrific Bloomberg visualization describes HTG's complaints about "flip" orders very similar to what the CFTC is going after here, and again the question is whether those orders were never intended to execute. "That's a high burden of proof in any market."

This column does not necessarily reflect the opinion of the editorial board or Bloomberg LP and its owners.

To contact the author of this story:
Matt Levine at

To contact the editor responsible for this story:
Zara Kessler at