Layering

The legal definition

In US futures markets, the Commodity Exchange Act defines spoofing as bidding or offering with the intent to cancel the bid or offer before execution. The CFTC's interpretive guidance on disruptive practices lists several forms spoofing includes, one of which is submitting or cancelling multiple bids or offers to create an appearance of false market depth: that is layering. The CFTC also states that a spoofing violation requires intent beyond recklessness, so careless or poorly designed order placement is not spoofing under that provision. Other jurisdictions have their own market abuse rules with comparable prohibitions.

The pattern usually described

• Several orders stacked on consecutive price levels on one side, close to but not at the best price.
• A smaller order on the opposite side, at or near the best price, which is the order the trader actually wants filled.
• Other participants react to the apparent depth; the small order fills.
• The stacked orders are canceled together within moments of that fill, often before price reaches them.

What a chart can and cannot observe

Suppose offers of 150 contracts appear at three consecutive prices, three to five ticks above the best ask, while a 20-lot bid rests at the best bid. The bid fills; within a fraction of a second the three offers disappear without a single trade at their prices. Aggregated depth records the appearance and the disappearance at each level. An order-by-order feed adds each order's lifetime and whether it was canceled or traded. Neither records why.

The same sequence has ordinary explanations. A market maker filled on one side often pulls or reprices quotes on the other to manage inventory; an algorithm can reprice every level at once after a price change; a hedger may withdraw orders when a related market moves. Regulators investigate intent with account-level data that chart readers do not have.

In Senzoukria

The heatmap's 'Colour mode' setting has a 'Pulls tint (%)' control, whose hint reads 'Liquidity pulled without trading — cancellations, spoofing.', and which is computed from changes in the aggregated book rather than observed order by order. On Rithmic's order-by-order feed, the Liquidity tracker splits what each price level did over the last 30 seconds into size withdrawn and size executed. The heatmap's Liquidity lens records the life of each displayed level, with its net increases, net decreases and trades at the level, and notes that aggregated quantities do not identify individual orders, cancellations or intent. No display in the application flags layering or spoofing.

Common mistakes

• Calling every stack of pulled offers layering. Requoting and inventory management produce the same picture every day.
• Trading on the belief that displayed size is fake and will vanish: some walls are executed and hold.
• Reading pulls on a slow snapshot feed, where orders that lived for seconds can look as if they flickered.