The Flash Crash was a wonderful horrible event. The horror, for some, was the extreme price movements. Another horror is the question: "What caused the Flash Crash?" This question is often asked and answered with the assumption that there is a single cause or simple narrative. I blame Occam's Razor—or a misunderstanding of it: "The simplest explanation is usually the correct one." Financial markets are complex and a non-false answer to the question what caused X, is often long, complex yet still incomplete. This is unpalatable to many and others reject it using a rule of thumb that favors parsimonious explanations.
Yesterday, a guy was accused of manipulating the S&P 500 futures market and even though the criminal complaint said that this activity "contributed to the Flash Crash," many have inflated this claim to "some guy caused the Flash Crash." (Though at least one headline seems obviously facetious). I think the word "contributed" implicitly supports the no-single-cause view and the CTFC is more careful in their complaint saying:
"Defendants' actions contributed to an extreme order book imbalance int he E-mini S&P market. This order book imbalance contributed to market conditions that caused the E-mini S&P price to fall 361 basis points."
The CFTC complaint includes more interesting details than the Justice Department complaint does.
How Spoofing Might Work
What follows is a not-realistic but not-too-unrealistic example of an order book for the E-mini futures contract to show how spoofing could work. So here is an order book:
Can you guess what price the next trade will take place at? Likely, it will be at 1170.00 or 1170.25—though not necessarily. Suppose the inside market evaporates (say, because of spoofers canceling or the anticipation of news) then the price could gap up or down. Predicting whether the next trade is at the offer price or bid price is difficult. The book illustrated here is evenly balanced between buy and sell orders—gut instinct would say there is an equal chance of an up or down move. We would discover the momentary price of the futures contract if someone places a limit order to buy for 1170.25 or to sell at 1170.00. The order book changes as new orders come in and other orders are modified or canceled.
Suppose a series of trades like this (read @ as "contracts trade at"): 15 @ 1170.25, 5 @ 1170.25, 5 @ 1170.00, 245 @ 1170.00, 400 @ 1170.00. The order book now looks like:
Now that the order book in no longer balanced a common belief is that the next trade is more likely to be lower. The idea behind spoofing is that placing large orders to sell in the order book will make people believe price will decrease and cause them to sell. Such an imbalance in the order book is thought to have contributed to the Flash Crash. But how many people will trade based on an order book imbalance?
Why Spoofing Might not Work
Firstly, it seems clear that this guy’s strategy—spoofing or not—worked since this guy allegedly made an enormous amount of money. But it should work for some of the people some of the time, and not for a large enough portion of the market to contribute to a crash. An assumption about who were victims of the spoofing is key to many people's judgments about spoofing. If high frequency traders are the victims, it seems it would be the ones who try to provide liquidity not the type allegedly trying to anticipate orders.
The traditional view of a market maker is a firm trying to make the bid-ask spread. So if a firm called Special Sauce Trading, LLC sold 5 contracts at 1170.25 and bought 5 for 1170.00, then that firm has revenue of a quarter of a point on 5 contracts: 5 * $12.50 = $62.50 less commissions, other fees and costs. A nice business, but for that to happen the firm would have had to be second in the queue on the offer side and first in queue on the bid side. Place in the queue is important for capturing the bid ask spread because the S & P 500 futures contracts (unlike Eurodollars) use a FIFO matching algorithm (see here and here).
Suppose the next changes in the order book are a trade: 20 @ 1170, and the following new orders and cancelations: 1170 bid for 100 contracts canceled, 1170 bid for 20 contracts canceled, 1170 bid for 200 contracts canceled, new offer of 20 contracts at 1170.25.
Why were all those bids canceled? One explanation is this: Before when the order book was the same on both sides, some of the orders were resting at each price to ensure a place in the front of the queue. But if you pay 1170.00 when there are less than 350 other bids at 1170.00 and 980 offered, what is the probability of selling at 1170.25? Suppose Weak Sauce, LLC bought at 1170 and then placed an order to sell at 1170.25. The firm would be last in the queue to sell at 1170.25 and would only capture the bid ask spread if new orders to buy came in at a much faster rate than new orders to sell. The alternative to selling at the offer is to sell at the bid price and scratch the trade, but now there is a greater possibility that the bids will evaporate before Weak Sauce decides to offer at 1170.00 In this example, the other market makers canceled the orders to buy but left in orders to sell at 1170.25 because selling at this price is good: now that there are only 30 contracts on the bid side, a seller at 1170.25 would could now bid 1170.00 and be only 30 contracts away from the front of the queue. Now that the 1170.00 bid is only 30 contracts a new sell order of 50 @ 1170.00 would result a new offer price of 1170.00, the highest bid would be 1169.75 and Weak Sauce would likely take a loss.
There are a number of academic papers that try to figure out how to calculate the probability that the next trade will be at the offer price (or bid) using the state of the order book. The math is complex, and it in unclear whether it works, but the idea is the same as the instinct of a naïve trader: use order book information to predict price direction. If manual traders and computer models both sell if the order book is heavy with sell orders, then a series of large orders to sell above the offer price could beget selling. But if market makers are entering orders to get a queue position then they will be on the look out for other orders that get canceled early and often and hard to understand why they would be deceived by fake orders.
It is unclear how much the bid ask spread contributes to the profitability of all the trading trategies in S & P 500 futures. It is clear that everyone has thought about trying to make money from the bid ask spread or reducing execution costs by attempting to sell at the offer or buy at the bid. It is the group reducing execution costs that I believe (without evidence) is more likely to be a victim of spoofing.
Legal Spoofing and Things That Look Like Spoofing.
Instead of entering a large fake order to get prices to move, it is legal in equity markets to place a large order but only show a small portion of it so that the market doesn't react. Maybe it is a stretch to call it spoofing, but it is meant to be deceptive. Instead of the intending to moving a price the intent is not to move it. It is hard to argue against these types of orders since a buyer could just enter a series of small orders, but it does interfere with an estimation of the queue size making market makers even more carful when using order book information. The allegations against the spoofer, is that he had software that automatically canceled the orders once they were within a few ticks of the best price and never took real risk. Still there is a legitimate strategy in which orders are placed far away from the market waiting for the rare fat finger trade that temporarily sweeps the order book and temporarily drives prices higher or lower. The question of manipulation could be determined by the cancel algorithm, context of related orders, price and size.
If repeated modification of orders that don't get filled looks like spoofing, much off the alleged widespread spoofing might be legitimate strategies. One class of market participant repeatedly modifying orders a couple of ticks from the best bid/offer might be firms attempting to arbitrage price difference between the S&P 500 futures and the $SPY or the a basket representing the index. These orders may be canceled/updated frequently since they are tied to other prices.
Rampant Spoofing, or is this One Big Spoof Spoof?
The arbitrage strategy raises another question: Could you spoof the $SPY ETF market with orders in the futures market? If so, how would regulators catch this? It seems difficult to impossible to catch subtle spoofing that is a small part of a large complex inter-market strategy. Some people believe this spoofing is widespread, but if this belief is widespread people would be cautious making spoofing less effective.
Some spoofing is easily identifiable. According to the criminal complaint, the spoofer repeatedly entered fake orders for either 188 or 289 contracts. That is pretty dumb. Orders like these are screaming to be noticed. Any higher frequency data analyst should be on the look out for bread crumbs like this, and more complex ones. Would-be spoofers could identify his spoofing and ride his illegal coattails. In this scenario there would not be many spoofers since they only need one guy to do the dirty work. Why would spoofing be widespread if you could reap the rewards without taking the legal risk?