Depth of Market: Order Book Structure, Spoofing, and Order Cancellation

Abstract. The depth of market (DOM) is the real-time queue of resting buy and sell orders at each price level, displayed to market participants and used to assess liquidity and competition. Spoofing, the placement and rapid cancellation of orders with no intent to execute, exploits DOM visibility to create false impressions of size, while pulled orders are cancelled liquidity that traders study to infer intent and opportunity. Understanding DOM mechanics reveals how order visibility can be manipulated, why cancellation patterns matter, and what constraints exist on detecting genuine market disruption.

The Depth of Market and Order Book Visibility

The depth of market is a real-time snapshot of the order book: every resting limit order at each price level, ranked by time priority ^[1]. The DOM displays the size (number of contracts or shares) at each price, the prices themselves, and often the order IDs and timestamps of individual orders. A trader looking at the DOM of a highly liquid equity or futures contract sees not one best bid and one best ask, but a stack of orders behind the best price, creating "depth." In equity markets, the best bid and ask are protected under market-wide trading rules ^[2], while the full DOM is typically visible only to market participants with direct exchange connections or professional data feeds.

The DOM serves three mechanical functions. First, it shows available liquidity at each price, allowing a market taker to estimate execution costs for a given order size. Second, it reveals the distribution of interest across price levels, signalling where professional and retail traders have concentrated orders. Third, it acts as the primary artefact through which market makers compete, since the speed, size, and persistence of resting orders communicate market intention.

What Resting Size Reveals

Resting size, the quantity of orders sitting at a given price level, encodes several types of information. The most straightforward is execution capacity: if a trader wants to buy 10,000 shares at a given limit price, a DOM showing only 2,000 shares at the best bid means the trader's order will be partly filled, with the balance going to the next price level. This is order-book-based price discovery.

Resting size also signals conviction. A market maker placing 1,000 contracts at a price and leaving them there for seconds or minutes is communicating that they believe that price is fair. A sudden jump in resting size at a price level before a price move, without any intermediate trades, may indicate that informed traders are placing orders ahead of news or hedging positions. Practitioner convention holds that large resting orders near-the-money in options signal hedging activity rather than directional trading intent ^[3].

However, resting size is ambiguous. The same 10,000-share bid can represent a genuine willingness to buy at that price, or it can be a "layering" order placed as a signal to other traders with no intention of execution. The size visible on the DOM cannot, by itself, distinguish between these cases until the order either executes or is cancelled.

Spoofing: The Mechanics and Appearance

Spoofing is the placement of orders with the intent to cancel them before execution, typically with the goal of creating a false impression of demand or supply ^[4]. The act itself is straightforward: a trader places a large order on one side of the market, watches the DOM expand, observes how other traders respond (often by placing their own orders), and then cancels the spoof order before it executes.

The spoof creates two effects on the DOM. First, the visible size increases at a price level, which mechanical trading algorithms and human traders may interpret as genuine liquidity. Second, the large order may trigger price movement if executed against, or it may cause other traders to place orders on the opposite side. For example, a trader might place a large sell order a few ticks above the current price, causing the DOM to show substantial supply above the market. If other traders see this and decide to buy less or sell more, prices move in the direction the spoofer intended. The spoofer then cancels the order and profits from the position they established before placing the spoof.

What does spoofing look like in the data? The signature pattern is an order that appears on the DOM, draws a response from other market participants (visible as new orders placed at nearby prices or executions on the opposite side), and then is cancelled without executing or executing a trivial fraction of its posted size. Repeated cancellations of large orders at the same price level or the same side of the book amplify the signal. Execution data shows orders with fill rates far below 1 percent, or zero fills across hundreds of cancellations. The timing is also revealing: spoof orders are typically held for seconds to minutes, exactly long enough to influence prices, then withdrawn.

The SEC and CFTC have prosecuted spoofing cases with these exact characteristics. In the Navinder Sarao case, the CFTC found that Sarao used automated trading software to place and rapidly cancel large orders in E-mini S&P 500 futures contracts, creating what the agency called a "layering" strategy ^[5]. His orders would appear on the DOM, other traders would place orders in response, and he would cancel his orders and profit from the price movement. The orders were rarely filled, and the pattern repeated thousands of times.

Why Pulled Orders Matter

A pulled order is an order that is cancelled after being placed but before being fully filled. Every order placed on an exchange can be pulled: a market maker might cancel an order if news arrives, a trader might withdraw a limit order if the market has moved away, or a bank might pull a large order after it has achieved its desired price effect.

Pulled orders matter for two reasons, one informational and one regulatory.

Informationally, pulled orders reveal what traders do not commit to. If a trader places a 5,000-contract order at a price, watches the market move against them, and cancels the order instead of trying to execute at a worse price, the cancellation signals that they were not genuinely willing to transact at the original price. This is data about trader intent. Algorithmic traders exploit cancellation patterns: if a particular price level sees orders placed and cancelled repeatedly without execution, algorithms learn that those orders are unreliable and discount them when making their own trading decisions. Professional traders study cancellation rates at each price to understand which DOM entries are "real" liquidity and which are noise.

Regulationally, the ability to pull orders is fundamental to detecting market manipulation, and simultaneously a loophole through which manipulation can occur. Regulators distinguish between orders placed with genuine intent to transact and orders placed for other purposes. An order with genuine intent can be pulled due to changed conditions or a better opportunity, which is legal. But an order placed with the intent never to execute, placed purely to affect other traders' decisions, is a violation even if it is pulled before execution.

The challenge is that intent is unobservable from the order itself. A trader who places an order and cancels it can claim they changed their mind, which is legal. The regulatory standard instead examines patterns. If a trader places hundreds of orders and cancels all but a tiny fraction, if the orders are consistently placed on one side of the market (creating layering), if they are cancelled in response to price movement in a particular direction, or if they are cancelled immediately after achieving a visible price effect, regulators infer that the orders were not placed with intent to execute. The Dodd-Frank Act explicitly prohibits spoofing ^[6], and the SEC and CFTC have broad authority under general anti-manipulation rules to prosecute cases where orders are used deceptively.

A Worked Example: Sarao and E-mini Spoofing, 2009-2014

Navinder Sarao, a proprietary trader in London, used automated trading software to place and cancel orders in E-mini S&P 500 futures contracts traded on the CME Group exchange. Between 2009 and 2014, he placed approximately 3.5 million orders and cancelled roughly 98 percent of them without executing ^[5]. The cancelled orders typically remained on the DOM for only a few seconds, and they were concentrated on one side of the book: Sarao would place large sell orders when he held a net long position, driving prices down, then cancel the orders and cover his short exposure at the lower prices.

The DOM impact was real. His orders created visible supply pressure that other traders saw and responded to, placing their own sell orders. The cumulative effect of these orders was to move prices in the direction Sarao desired. By the time prices had moved, his spoof orders were already cancelled, leaving no record of execution, only the transaction tape showing that other traders had been moved to sell.

The CFTC and SEC prosecuted the case by examining execution rates, order timing, and correlation with price movement. Sarao's orders had execution rates of approximately 0.3 percent across the entire period, far below the market norm. Orders were typically cancelled within seconds of placement. The timing of cancellations correlated closely with price movement: cancellations accelerated when prices moved in the desired direction. These patterns, repeated thousands of times, provided evidence of intent.

Sarao was ordered to pay millions in restitution and was charged criminally, though he cooperated with prosecutors and avoided extended imprisonment ^[5]. The case established that spoofing, even when conducted via automated algorithms rather than manual intervention, is prosecutable under anti-manipulation statutes and the Dodd-Frank spoofing prohibition.

Limitations and Unresolved Questions

Detection remains difficult at scale. The Sarao case involved extreme patterns (98 percent cancellation rate) that stood out to regulators. Many spoofing schemes may be far subtler: a trader who cancels 70 percent of orders, who times cancellations to be less obviously correlated with price movement, or who distributes spoofing across multiple accounts or venues may evade detection. Regulators examine millions of orders daily, and the computational task of distinguishing manipulation from legitimate order management is unsolved ^[7]. Algorithmic traders routinely place and cancel large numbers of orders in pursuit of optimal execution; their cancellation rates may be high without any manipulative intent.

Intent is inherently ambiguous. Regulators infer spoofing intent from patterns, but patterns alone cannot prove state of mind. A trader might genuinely place large orders expecting to execute, then cancel them when the market moves and the order becomes uneconomical. This is legal. The same action, cancellation after price movement, could also be spoofing. The regulatory standard requires "substantial evidence" of deceptive intent, but the line between aggressive order management and market manipulation remains contested ^[8].

DOM visibility varies across asset classes and venues. Equities market participants see the full consolidated tape under Regulation SHO and the consolidated price-feed rules ^[2]. Futures markets are fragmented, and depth data varies by exchange; some venues display full book depth to all subscribers, others show only the best bid and ask. This variation means that the effectiveness of spoofing, and the ability to detect it, differs by market. A spoof that is obvious in a transparent equity market may be harder to identify in a less transparent futures or options market.

Incentives to hide in the noise remain strong. Technology that allows order cancellation in microseconds also allows new orders to be placed just as quickly. A trader can layer orders, cancel them, and place new ones in fractions of a second, exploiting the time lag between when other traders see the DOM and when they can act. Conversely, machines that are good at detecting layering patterns are also good at obscuring them. The arms race between detection and evasion is ongoing and asymmetric: manipulators only need to find one profitable strategy, while regulators must detect all of them.

Summary

The depth of market is a structured, real-time display of liquidity that enables both efficient price discovery and market manipulation. Resting size shows available execution capacity and, sometimes, trader intent, but size alone cannot reveal whether orders are genuinely held or will be pulled. Spoofing exploits DOM visibility by placing large orders that influence other traders' decisions, then cancelling before execution, leaving prices moved but orders unfilled. Pulled orders matter both because they convey information about which resting liquidity is reliable and because cancellation patterns are the primary forensic evidence for detecting market manipulation.

The regulatory response, prosecuting spoofing as deceptive and a violation of anti-manipulation rules, treats cancellation patterns as evidence of intent. However, the boundaries remain fuzzy: aggressive but legal order management and prohibited market manipulation can be visually identical. Effective enforcement depends on detecting statistical anomalies across vast order volumes, a task that improves as surveillance technology improves but will always be imperfect.

Key Definitions

Depth of Market (DOM): The real-time list of all resting limit orders at each price level, showing the quantity available at each price, ranked by time priority.

Spoofing: The placement and cancellation of orders with the intent to create a false impression of supply or demand, or to induce other traders to place orders, without intent to execute.

Order Cancellation (or Pulling): The withdrawal of a resting limit order before it is fully filled.

Layering: A spoofing technique in which a trader places multiple orders on the same side of the market, all intended to be cancelled, to create the appearance of strong demand or supply.

Execution Rate: The percentage of an order's posted quantity that actually executes before the order is cancelled or expires.

Intent to Execute: The regulatory standard for distinguishing legitimate orders from manipulative ones; orders placed with genuine willingness to transact at the specified price are presumed legal, while orders placed for other purposes are presumed manipulative.

References

1. CME Group, "Market Data: Depth of Book Feed Documentation", CME Group Exchange Rules and Documentation. (https://www.cmegroup.com/trading/market-data)

2. U.S. Securities and Exchange Commission, "Regulation SHO", SEC Rules and Regulations. (https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&company_type=fed)

3. Practitioner convention as cited in options market-making literature; exact attribution unavailable.

4. U.S. Commodity Futures Trading Commission, "Spoofing and Layering", CFTC Educational Materials and Anti-Manipulation Rules. Name citation only.

5. U.S. Commodity Futures Trading Commission and U.S. Department of Justice, "United States v. Navinder Singh Sarao", enforcement action and sentencing documents, 2016.

6. U.S. Congress, "Dodd-Frank Wall Street Reform and Consumer Protection Act", Section 747 (Spoofing Prohibition), 15 U.S.C. § 78o(c)(5)(C). (https://www.govinfo.gov/content/pkg/PLAW-111publ203/pdf/PLAW-111publ203.pdf)

7. SEC Division of Trading and Markets, "Regulatory Issues Raised by the Use of Electronic Communications Networks", SEC Staff Report. Name citation only.

8. Legal scholarship on market manipulation intent standards; exact sources unavailable.

Educational research on historical data only. Not investment advice, not a signal, and never a performance promise. Past results do not predict future performance. Every reference is link-verified before publication and every paper is re-audited weekly against the library's editorial standard.

Last reviewed by the PropLedger research pipeline: 2026-10-26. Educational research on historical data, not financial advice.