Blog Image


Gio Kevanishvili Consultancy Blog

Truth about new Market Integrity Regulations in Europe.

PRIVACY VS. SURVEILLANCE – Managing conflicting regulations in Germany and other privacy-sensitive jurisdictions.

Financial Crime, Market Abuse Regulation, Uncategorised Posted on Tue, July 30, 2019 22:18:50

On June 27th 2019, we were one of the three speakers in the Webinar regarding the current regulatory situation concerned with conflicts between Surveillance (e.g. MiFiR, MAR, etc.) and Privacy (GDPR). The Webinar was organized by Truphone and A-Team Insight. A link to Webinar:

Truphone Link:

A Team Insight Link:

Entering Orders without Intention of Executing Them / Layering / Spoofing – Manipulation Techniques via Order Book

Market Abuse Regulation Posted on Thu, February 02, 2017 17:59:38

Order Book is a great tool for traders and investors which
is normally offered by many trading platforms and exchanges. It gives
participants information about the current liquidity provided by market makers
on buy and sell sides. In other words, by looking at the order book’s different
price levels, one can easily understand that it is a place where demand meets
supply. In the center, there is a market price highlighted – this is the price
where the deal happens at that second, where the demand just met the supply.
The following figure (© Interactive Brokers) visualizes it very well:

When interpreting the order book information it is important
to have in mind two perspectives: Market Maker Perspective and Price Taker
Perspective. Market Makers are large financial institutions that are obliged to
prove liquidity to the market in other words they are the sell side. On the
other hand, we have price takers, hedge funds, pension funds, prop firms,
retail traders and investors – the buy side.

As one can see, in the center there is a column of Price, on
the left hand side of price column we have Bid Size column and on the right
hand side we have Ask Size column. Bid Size column in yellow and particularly
numbers 1, 3 and 15 show number of lots that someone wants to buy (Market Maker
Perspective) at the respective price level. It is quite normal to see
increasing bid size the more below we go. This is also logical, the lower the
price, the higher the demand. On the right hand side, there is a column of Ask
Size in Green which shows offers in other words, supply, in other words, limit
sell orders. In this case the ask size or supply size increases the higher the
price, as more participants want to sell
at a lucrative prices(Market Maker Perspective). In the center, one can see a
blue cell “1 @ 165.45”, this is the last market trade or the last
matching between demand and supply for 1 lot (1 lot = 100 Units of the stock).
In addition to this, in the price column, one can see a price of 165.46 in
yellow, this is the best bid and the one in green 165.52 is the best offer, in
other words, the spread for this instrument is 6 basis points or 6 cents. This
also means, that you as a price taker can only buy at 165.52 and sell at
165.45. During the trading day and from broker to broker the spread width can
vary to 1 cents or even to zero and in some very extreme cases there can be an
inverted spread where offer is less than bid.

So, how can this great tool be used by “bad
guys” to manipulate others’ psychology and thus behavior and thus market
price? In order to answer this question, we should also explain one more thing:
If you look at the Bid Size and Ask Size Columns, right underneath you will
notice total bids of 22 and total offers of 12. Your interpretation should be
that buyers want to buy 22 hundred stocks and sellers want only 12 hundred to
sell. There is obvious misbalance here you would think, as there is much more
demand than the supply, thus, logically the price should go up. “Well,
then I am in”. If you are an “unsuspecting investor” you would very
likely buy this security not waiting till those large orders actually get

This is exactly the interpretation what gets
manipulated. Namely, what perpetrators a.k.a. manipulators do is that they send
a huge order on one side of the order book, which creates misbalance and thus
misleading interpretations. Misleading Interpretations might and some are
creating a “chain effect” – where multiple participants get enticed
into the scheme and they actually do not wait till the large orders are
executed but they enter the market for themselves. This increasing activity
pushes the price in one direction. The perpetrators – owners of those large
orders, use this opportunity to enter the market on the opposite direction (with
now improved prices), cancel their original large orders and leave the stage
with nearly risk free profits.

There are different techniques how this can be
done. One of the simplest is the scenario called Fictitious Orders a.k.a.
“entering orders without an intention to execute them”. Another very
much similar scenario is Spoofing. The third and the most complex one is called

Fictitious Larger Orders. This scenario
as well as two other includes three major steps: Build-Up, Un-Winding and
Cancellation. During Build-Up stage of Fictitious Orders Scenario, a
perpetrator (probably with a relatively large trading account or at least large
buying power for example a prop trader) sends a very large limit buy order. If
we take the above example with 22 on Bid side and 12 on the Ask Side, Let’s say,
that the perpetrator bids 1000 lots of the instrument @ 165.41 (below
the best bid, in other words, below spread
The top level of the book is instantly updated with Bid Size of 1022 and Ask
Size of 12. The more participants see this misbalance the better it is for the
manipulator as it is more likely that more people will interpret this
misbalance as follows: “hmm…increase in demand, this is probably a hedge
fund having some upgrade or earnings news on this stock, I want to join the
party” and buy in. The more market buy orders, the higher the pressure on
price as the more existing liquidity will be consumed and the price will
eventually move up (chain effect). The manipulator is waiting for just that
moment. He will sell this security (either because he had a position
previously, or sells short) or in other words, “un-wind” the original
direction. In the last stage he either completely cancels the initial large
order or he modifies it so that it is not any more significant or relevant
(e.g. modifying the quantity from 1000 lots to 1 lots only, or modifying the
price so below that market will never reach it).

In order for this scenario to work, obviously,
there has to be several assumptions met: 1. The instrument should be followed
by number of participants and order book should be available to all of them. 2.
Initial Large Order should be large as compared to the average daily volume on
the market of the security e.g. stock ABC trades 100 000 units on average every
day. At least 25% of this average daily volume should be regarded as
“enough” to have some effect (at least short term intra-day) on the
market price. The higher the original order obviously the higher the odds.
Logically, from here, such manipulators with large trading accounts (let’s say
from 1 000 000 €) would aim at thinly traded securities and low caps e.g. a
stock priced at 5 € and ADV of 200 000 units per day. Theoretically, such an
account has all means to manipulate this kind of relatively illiquid markets as
the total buying power largely exceeds the amount which would be needed to fill
in day’s average volume and thus consume all daily liquidity. 3. If short
selling restrictions apply like in some countries within EU, then this account
should have a position to be able to unwind.

Spoofing. This scenario is nearly the same as the
scenario described above with one hook. This is typically being done by a
“fast” trader e.g. an ALGO or some other automated trading system.
What a “fast” ALGOs can do is send a very large order within
(in our example, this would be e.g. a 1000 lots Limit Buy @ 165.50) and
take them down before spread manages to adjust itself so that the large order
is hit. The effect of the spoofing is smaller in terms of basis points and more
short term oriented than that of the scenario above. Hence why, the activity of
spoofing is means more frequent sending and canceling/modifying the large order
than in the case of the scenario. This scenario can however entice not only
other ALGOs but also other carefully monitoring traders of order book.

Layering. Layering
like spoofing is more likely executed by “fast” traders than not.
Here is why: Layering is a smarter way of doing both of the scenarios above.
The manipulator decides to mask his activity by splitting the large order into
smaller sized but still significant layers of multiple orders. If we go back to
our example, the manipulator would split the 1000 lot limit buy into 10 layers
of 100 lots and send first 100 lot at the level of 165.50, the next at 165.49,
etc.. till the tenth layer at 165.40. Order book after these layered would
obviously look like more busy with built up demand on the left hand side. The
rest of the story is known. Other price takers interpret the change in the
order book as positive, act on it, which in turn leads price to go up.
Originator of the Layered Orders cancels all or some of the layers and sells
the security for improved prices.

All of the three scenarios can be done in different
combinations of actors, instruments (underlying vs. Derivative), exchanges e.g.
either by a single trading account in a single instrument or by multiple
trading accounts (but the same party) in the single instrument or in a
cooperated manner by different parties in a single instrument or in a
cooperated manner by different parties in multiple correlated securities(Cross
Product/Market). These possibilities make these scenario very hard for
compliance to fully cover and have surveillance for.

One of these possibilities would be the following scenario: One
of the three prop traders (with cumulative buying power of few million dollars)
has a levered long position in the CFDs (Contracts for Difference exactly
replicates the price of the underlying but is a OTC instrument mainly designed
for retail traders) with an underlying of a Stock ABC. He is not happy with the
recent price performance of their position and asks his friends whether they
could help. His plan is that the two of them should at the same time send large
limit buy orders in the underlying stock during the last 15 minutes before the
close (most active periods on the exchange are openings and closings), hoping,
that other participants would see the potential increase in buying for this
security, which in turn would lead them to actually jump on the train and move
prices of the underlying stock higher. This upwards move, would automatically
be reflected on the CFD price too (also, if this was a call option or some
certificate with 10x leverage even better). The trader with a levered position
in the derivative would just be waiting for this moment to close his levered
positions for better prices. After he is flat, he would ask his friends to
cancel their original large orders and would thank them.

In this case, we are dealing with a combination of pre-arranged
spoofing/layering amongst multiple parties during the closing period (thus,
potentially with a “marking the close” impact) involving multiple
correlated instruments and exchanges(Cross Product/Cross Market Manipulation). In
other words, this example is a combination of number of other market
manipulation scenarios. If you think about it for a moment, then you will be
soon realizing that there can be not only many different combinations of this
type but also many different combinations of combinations.

The reality of the trading surveillance world as of now is
that the surveillance programs available tackle each and every scenario
separately but not in a combined way, in other words, no surveillance system I
am aware of can nowadays link different scenarios to each other and analyze all
possible combinations of human behavior. Having said that, it seems to me that
even with such an increased regulatory scrutiny and surveillance programs,
white collar criminals unfortunately still can be optimistic about their

If you are interested to hear more about this, please, let us know. Via our trainings on Market Abuse you can get to know the methodology.

Kind Regards,

GK Consultancy

Wash Trades – What should Compliance Officers know about!

Market Abuse Regulation Posted on Sat, January 14, 2017 20:01:50

Wash Trades is one of market manipulation scenarios according to new market abuse regulation (MAR) and related regulations by European Securities and Markets Authority (ESMA). This is however not the only scenario which is illegal according to MAR but also other scenarios like Improper Matched Trades, Pre-Arranged Trades and Painting the Tape. There are some differences between these similar scenarios and this is what we will explain in this article. All of these have one thing in common, namely, the reason why they are regarded illegal: In all these cases, trading volume for the day and product is manipulated without actual change of beneficial ownership and in the misleading way resulting in attraction of new traders/investors.

The Origin: Everything starts with trade matching and the way it works. As it is known, in order for trade to take place on the exchange, there should be someone willing to buy and someone willing to sell. As these two sides are provided, deal is set and trade is taking place.

Wash Trades: Sometimes, however, it happens that the buyer is the same as the seller. In other words, the buyer matches against own orders. These cases are also called “Crossed Trades”. There can be different motivation behind this unnatural type of matching. One of the most common is human error, a trader mistakenly buys a security which he didn’t intend to buy and he then has to close his position. Another reason can be hedging -buying from one account and selling from another, yet other reasons can be related to poor liquidity and technical order matching problems on the exchange. The last but not least cause can be market manipulation intent. In other words, the manipulator knows that by buying and at the same time selling the very same security, he most likely will not lose much money (but the commissions) but what he can achieve is to artificially increase the volume in the “sleeping” security. This might in turn trigger other traders or investors interest in this security, as they see increasing volume (a lot of investors have screening conditions for unusual volume for the day). The fact that the volume has been falsely manipulated which can in turn lead to false interpretations is illegal and thus the practice of wash trades is illegal too. The way compliance can detect these type of trades are fairly straight forward: Every time, same trading account or same client executes two or more different trades in the same security during a 5 minute (or less) time window where two or more trades have the following conditions: Different sides, same (or very similar e.g. 0,01%) price, same quantity (or very similar e.g. 0,01%), then you have it – the real wash trade.

Pre-Arranged Trades: This scenario is similar to Wash Trades scenario with one major extra feature. The wash trades are “pre-arranged” among two or more different traders/parties. For example, Party A agrees with Party B on coordinated buying and selling of the same security. At first, Party A sends market buy orders for 100 units the security ABC, whilst Party B at the same time sends market sell orders (either position closure or short selling) for the same security and same amounts. If they coordinate well (exactly at the same time) and if the security is not very liquid, the chances are good that they match with each other. They can then repeat this as many times as they can afford themselves in terms of lost commissions. What can be the rationale: They might have larger positions in these security and they might want to create some artificial activity. Or if not they themselves, someone else (friend, wife, business partner) might have a position in the security and thus might be interested in attracting additional inflow. The challenge for compliance users is to differentiate normal trades from “pre-arranged” trades as crossing of the trade is part of the business. For this matter, compliance officers should concentrate on the repetitive behaviour by the same parties. In other words, it is not enough to have one matched trade between two parties (even if it is same time, same price and same quantity). It is far stronger argumentation to show that the same parties have consistently(during the same day or over multiple days) matched between each other and achieved a significant trading volume share as compared to the average volume (e.g.25%). Thus, the alarm should be triggered only when two or more parties matched against each other at least 2 times during the day and at least 3 times during a week.

Improperly Matched Trades: This is a combination of two violations – wash trades with non-best execution. A trade is improperly matched when the matching price is “off-market” and it does not matter whether the trader has profited from the deviation or not. The fact that it is “off-market” and that the buyer is the same as seller is enough to set as illegal scenario for market participants. Behind off-market matching can be one person who matches against himself (for example in an illiquid security) or a group of traders who match between each other. It is worth to mention, that such deviations from market prices for the regulated markets are extremely rare. The motivation for perpetrators behind this scenario is twofold: 1. Invite additional Inflow by artificially increasing traded volume and create the impression of unusual activity 2. Profiting from “Off-Market” feature.

Painting the Tape: If Wash Trades or Pre-Arranged or Improperly Matched trades are taking place during the very sensitive periods of the trading such as Opening, Closing or Fixing, then this might easily lead to significant price jumps: Unusually Increasing Volume => False Interpretation => Additional Market Trades => Price Jumps. These cases are called Painting the Tape. It is called “painting the tape” as this price jump “paints the tape” in a way which is not a real replication of true demand/supply interaction. In other words, the price jump is not normally followed through by additional volume as smart money does not follow these tricks of perpetrators and thus the price jump fails soon after its origination (normally in the same trading session or right during the next one).

One last point that compliance officers should know is that there is and always will be a trade-off – Coverage and Investigation Workload. In other words, the less strict the detection thresholds are the more possible cases are covered but also the more cases need to be investigated and thus more time invested in the investigation. The Golden Medium should be found case by case, everyone for themselves. This is the inherent risk/benefit nature of the industry and compliance should learn to accept and live with it.

Kind Regards,

Gio Kevanishvili Consultancy

MADII/MAR July 2016 Fever

Market Abuse Regulation Posted on Fri, May 13, 2016 13:07:26

Market Abuse Directive II or also known as Market Abuse Regulation is coming into force on 03.07.2016. All trading activity and participants are directly or indirectly affected by the new “big brother” rules.

The idea of this new regulation is to increase market integrity and thus investors’ trust in European financial markets. European Securities and Markets Authority (ESMA) is shooting the MAR bullet at the markets with the aim to reduce insider dealing and market manipulation cases in the markets.

ESMA has been very generous in terms of what needs to be in scope of automatic surveillance.

1. From 03.07.2016 not only confirmed misconduct in financial markets but also an attempt to manipulate or act on insider information will be subject of punishment.

2. Not only Regulated Markets but also all OTC trading as well as Cross Market/Cross Product Manipulations between OTC and Regulated Markets are part of automatic surveillance scope.

3. ESMA states in the Final Report that the specific example scenarios provided in the relevant consultation papers is only a part of possible market misconduct patterns. In other words, ESMA has provided only a non-exclusive list of market misconduct indicators.

European Market Players are running out of time to meet the 03.07. deadline. Will they meet the new MAR requirements? If yes, to what extent? What happens if they fail to be compliant? How strict will ESMA act in terms of financial fines and punishments? Will it be as generous as the scope of the new regulation?…These are some of the questions which are preparing decent amount of stress and fear in many compliance departments at the moment.

Out of our observation of the ongoing processes and actions taken by the different European banks and financial institutions it seems that there will probably be hardly any market player which will be able to prove it has full MAR coverage and full automatic MAR surveillance by the deadline.

We expect that there will be very little share (under 10%) of those who have correctly identified for them most relevant MAR scenarios and who have succesfully implemented automatic tools to ensure required level surveillance.

Thus, a great bulk of EU market players will still be not fully compliant with the ESMA’s new regulations on 03.07.2016. The times that will come after July of this year will definitely be a great challenge for those non-compliant ones. It will also be very interesting to see how ESMA reacts to these gaps.

As for the reasons of this poor level of preparation, there are multiple of those. Some examples would be: 1. ESMA failing to determine exclusive list of all scenarios and all ingredients as well as details which would be easy to follow and higher level of clarity in scope 2. Banks and FIs started late or very late to worry about the July deadline, maybe partialy because they expected ESMA to define more details and clearer scope. 3. Vendors which were in a position to provide automatic surveillance tools saw this delay in the demand of automatic coverage and this resulted in the late start of developments of such tools. 4. OTC trading is still not the subject of public disclosure. This means, the OTC market volumes are unknown and will stay so till MiFiR comes into force. Without having a clear idea on OTC market volumes, it is very hard if not impossible to automatically detect market misconduct.

Having said that, we do expect that most of the becoming MAR compliant will only happen after July 2016… They say this summer will be very hot..


Gio Kevanishvili Consultancy