Enforcement by year and agency

The jump from 111 records in 2013 to 225 in 2015 is the SEC litigation source starting in 2015, not enforcement. Across 2,530 records, crypto grew from 2.2% to 8.4% of records, spoofing clustered in 2017 to 2020, Rule 105 fell after two same-day batches in 2013 and 2014, and 2025 cannot be read.

Published 2026-10-04 · 9 min read

Enforcement counts by year invite a story: a rise, a peak, a decline. Before telling one, this post measures where each of the library’s sources starts and stops, because in this library the sources, not the regulators, decide most of what a year-by-year chart looks like. What survives that test is shorter than the raw chart.

The finding

The library holds 2,637 records. Ten SEC records and 97 AMF France decisions are dated 2004 to 2012 and are left out of the year series; 2,530 records filed from 2013 to 2026 are used. Three things hold up.

1. The rise from 2013 to 2015 is a coverage artefact. The count goes from 111 in 2013 and 145 in 2014 to 225 in 2015. The SEC litigation-release source begins in 2015, and it supplied 110 of those 225. Without it the counts are 111, 145 and 115. From 2015 to 2024 the totals stay between 163 and 252 with no sustained trend: 1,114 records in 2015 to 2019 and 947 in 2020 to 2024.
2. Three technique shifts are visible in more than one way of counting: crypto assets rising from 2.2% to 8.4% of records between the two five-year windows, spoofing and layering concentrated in 2017 to 2020, and Rule 105 offering shorts falling sharply after 2014. Each rests on batches of same-day filings, shown below with and without them.
3. Insider trading and Ponzi schemes show no wave. Their shares of the library are about the same in both windows. Their yearly counts move around but do not trend.

What cannot be read from the data: the apparent collapse in 2025 and 2026, any difference between agencies in how many cases they bring, and any reason behind any shift.

How it was measured

A script, scripts/analysis/enforcement-waves.mjs, reads the 2,637 case files and prints every number below. The year is the year of the filing date (dateFiled), which is the date of the order, release or notice, not the year of the conduct; for the AMF France it is the date of the sanctions committee’s decision, a different kind of date from a release date. For SEC settled administrative orders it is also usually the resolution date. A record counts once under each tag it carries, so technique groups overlap, and 372 of the 2,530 records carry no technique tag at all (399 untagged across the whole library; see What reading every record found). Shares use all records filed that year as the denominator, tagged or not. Asset class is a separate field: “crypto” is any record whose assetClass contains crypto, whatever technique it carries. “Spoofing or layering” is the union of those two tags, which is the pairing the earlier spoofing post used.

As of 2026-10-05. The figures were recomputed after three changes to the inputs. The corrections of 2026-10-04 to statuses, money and the criminal-parallel flag do not touch anything this post uses, so filing-year counts did not move. That day the record of the CFTC’s 29 January 2018 announcement of spoofing actions lost its technique tags, and one SEC record (Mmobuosi) lost its insider-trading tag. On 2026-10-05 the AMF France (French market regulator) was added as a sixth regulator with 209 decisions, 112 of them dated 2013 or later. That raised every year’s total and every share denominator (2,418 records became 2,530), added 65 insider-dealing and 13 spoofing or layering records to the series, and moved every share in the windows. It did not change the SEC, CFTC, ASIC, OSC or FCA counts, nor the Ponzi, crypto, paid-promotion and Rule 105 counts.

The ingest source of an SEC record is read from the address of its primary document: a litigation-release page, an administrative-proceedings order or an administrative law judge decision. The ingest scripts and DECISIONS.md say where each source starts. The rest of this section is the result of reading them.

Where each source begins and ends

• SEC litigation releases start in 2015. The ingest script and the sources page both say so. This is the library’s largest source, 1,209 records. Before 2015 there are none; 2013 and 2014 SEC records come from administrative orders (130 of 149) and administrative law judge decisions (19).
• SEC administrative proceedings run from 2013 but are a smaller share of SEC records once litigation releases arrive: 91% of SEC records in 2013 and 85% in 2014, then between 12% and 36% in each later year. The source covers orders that find misconduct, and only those whose text scored a technique are kept, so it is a slice of the SEC docket, not all of it.
• SEC administrative law judge decisions are 56 records, 47 of them filed from 2013 to 2018 and 9 since. Only decisions with a finality order are recorded, so the source is thin after 2019. This source cannot show a trend.
• The CFTC runs from 2013 and gives 338 records.
• ASIC gives 113 records. The ingest is set to start in 2013, but the earliest ASIC record is dated 8 October 2014, so there are none for 2013 and the first nine months of 2014. We did not find out why.
• The FCA (48 records) and the OSC (69) never exceed 10 in a year, and the OSC has none in 2024 and none in 2026; its latest record is dated 22 October 2025. Together ASIC, FCA and OSC produce between 10 and 23 records in each full year, 2013 to 2025. They are too small to compare year by year.
• The AMF France gives 209 records, 112 of them filed from 2013 on, at 1 to 13 a year (the last is dated 20 May 2026, so 2026 has one). Its source is the sanctions committee’s decision pages, found through the regulator’s sitemap from 2004, and the decisions are in French. Its dates are decision dates, not release dates, so its year counts are not strictly like-for-like with the others. It is too small to read year by year, but 119 of its 209 records (65 of the 112 from 2013 on) are insider dealing, so it adds mainly to the insider-trading group.
• Not in the library at all: DOJ (the ingest reads only a rolling feed, and there are no DOJ records), FINRA (its robots file asks crawlers not to read the disciplinary pages, so they are not collected), CIRO and the other Canadian regulators. The agencies of the 2,530 records are SEC (1,860 in all), CFTC, ASIC, OSC, FCA and AMF France. Any statement about “enforcement” here means those six.

Latest dates. Every record was ingested in September or early October 2026. The latest filing date is 4 September 2026 for the SEC, 28 August 2026 for the CFTC, 22 May 2026 for ASIC, 27 January 2026 for the FCA. 2026 is therefore a partial year of about eight months and is not compared with full years.

The 2025 and 2026 drop is not interpretable. Records fall from 198 in 2024 to 124 in 2025. The CFTC falls from 22 to 4 and SEC administrative proceedings from 56 to 14, while SEC litigation releases fall from 101 to 80. The last SEC administrative record is dated 22 May 2026, more than three months before the last SEC litigation record. This could be a real fall in published cases, a source whose latest pages were not fully collected, or a change in what each regulator publishes. We have not checked the CFTC and SEC indexes against the library for those months, so we cannot say which. Treat 2025 and 2026 as unreliable until that is done.

Taking the SEC litigation source out gives a series that does not have this break: 111, 145, 115, 104, 116, 132, 90, 97, 76, 68, 100 and 97 records for 2013 to 2024. That like-for-like series is flat to falling and noisy; it is smaller than the full one because it leaves out the largest source, so it is not a measure of enforcement either.

By agency

Between 2015 and 2019 and between 2020 and 2024 the counts were: SEC 832 and 702, CFTC 141 and 129, ASIC 39 and 54, OSC 35 and 18, FCA 17 and 12, AMF France 50 and 32. Each fell except ASIC, though only the SEC and CFTC have enough records to be worth reading. Within the SEC both sources fall: administrative proceedings from 238 to 193 and litigation releases from 557 to 509. The CFTC’s series peaks at 42 in 2018 and 37 in 2019, then eases to 32, 26, 24, 25 and 22. Nothing in the data shows why.

SEC records also change in kind over the years: the share that are litigation releases is between 62% and 69% in 2015 to 2018 and between 64% and 86% afterwards, so a technique that is brought mainly as an administrative order loses weight in the later shares whatever the SEC did. That is why the technique shares below are also given within a single source.

Techniques over time

For every figure the denominator is all records filed in that window (1,114 for 2015 to 2019, 947 for 2020 to 2024). The windows are used because each source is running throughout, but a share built on all records still moves when the source mix does.

Crypto assets: the clearest rise

The library has 113 records with crypto as an asset class (SEC 67, CFTC 39, OSC 6, FCA 1). Three are dated before 2017. The share goes from 2.2% (24 of 1,114) in 2015 to 2019 to 8.4% (80 of 947) in 2020 to 2024, and the yearly count peaks at 26 in 2023. A rise appears with a single source too: among SEC litigation releases alone it goes from 1.3% (7 of 557) to 4.5% (23 of 509), and the 95% ranges (0.6 to 2.6 and 3.0 to 6.7) do not overlap. Six of the 26 records for 2023 were filed on one day (22 March 2023), the paid-promotion batch described below; without that day 2023 is 20, still the highest year. The count falls to 12 in 2024, 6 in 2025 and 2 in 2026, in the same years in which the whole library falls, so those last values cannot be read.

Forex as an asset class (53 records, 26 of them CFTC) is stable by comparison: 1.9% and 2.1% across the windows, 0 to 8 records in a year.

Spoofing and layering: a cluster, not a steady rise

There are 114 records filed from 2013 on, 73 of them CFTC and 13 AMF France. Counts are 2, 5, 8 and 5 for 2013 to 2016, then 13, 17, 18 and 16 for 2017 to 2020, then 4, 9, 4, 5, 4 and 4. The share of all records falls from 5.5% to 4.0%, which is a comparison between a window containing the peak and one that does not, and so is not a trend in itself. Within the CFTC records alone, spoofing and layering is 42% of 2017 records, 33% of 2018, 43% of 2019 and 34% of 2020, against 8% in 2021.

One day carries part of the peak: on 29 January 2018 eight spoofing records share a filing date, with consecutive CFTC release numbers 7682-18 to 7689-18. A ninth record on that date, cftc-three-banks-spoofing-2018 (release 7681-18), is an announcement that summarises the actions rather than an additional action, and after the 2026-10-04 corrections it carries no technique tag, so it is not counted in any group here. Without the eight, 2018 is 9 and the peak is 2019 at 18. The 2017 to 2020 shape stands with or without them: 64 of the 114 records were filed in those four years.

For context, the CFTC’s anti-spoofing provision is 7 U.S.C. § 6c(a)(5)(C), which prohibits bidding or offering with the intent to cancel before execution. The copy of the statute on the Legal Information Institute site, which was opened for this post, carries an amendment note saying Public Law 111-203, section 747 added paragraphs (5) to (7), which is the Dodd-Frank Act of 2010. The library’s first CFTC records are from 2013, so it cannot show what happened between that enactment and 2013, and it does not show whether the 2017 to 2020 cluster follows from the provision. That would need a source about investigations, and none was used.

Rule 105: two batches, then a trickle

Rule 105 of Regulation M restricts short sales before a public offering followed by purchases in it. The library has 85 records, all SEC: 25 filed in 2013, 33 in 2014, 9 in 2015 and between 0 and 6 in each year since. Forty-three of the 85 (51%) are on two days: 23 on 16 September 2013 and 20 on 16 September 2014, each run with consecutive SEC release numbers (for example D. E. Shaw, Deerfield and Antipodean Advisors). Without those two days the series is 2, 13, 9, 1, 2, 1, 0, 0, 1, 1, 5, 6 and 1 for 2013 to 2025. The share of SEC administrative proceedings carrying the tag falls from 47% in 2013 and 43% in 2014 to 15% in 2015, between 0% and 4% from 2016 to 2022, and 6% in 2023 and 11% in 2024. The tag is almost wholly an administrative-order tag: only 3 SEC litigation releases carry it.

The same-day filings are a fact of the record. Whether they reflect a coordinated effort is something a regulator statement would have to say, and none was used. The eCFR copy of 17 CFR § 242.105, also opened for this post, lists its source history as adopted in 1997 and amended in 2004 and 2007, then in 2018, 2021 and 2024, so the rule text did not change between 2007 and the batches. The list shows no amendment between 2007 and those batches or in the years after them until 2018; it says nothing about why the filings clustered or stopped. it is also the group that lost no tags in the audit.

Paid stock promotion: two spikes

Sixty-six records, 65 of them SEC. The yearly counts are 11 in 2017 and 12 in 2023 against 1 to 8 in the other years. Each spike has a batch: 7 records on 10 April 2017 (for example Corenman) and 6 on 22 March 2023 (including Lohan and Paul). Without them the two years are 4 and 6, and the series is a flat 1 to 8 a year. The share is 2.8% and 3.4% in the two windows, which is no change. This group lost half its tags in the audit, so it is also the one whose counts depend most on how the tag is judged.

Insider trading and Ponzi schemes: no wave

Insider trading is 694 records from 2013 on (65 of them AMF France), 27.6% of records in 2015 to 2019 and 26.5% in 2020 to 2024. Ponzi schemes are 474, 17.1% and 19.5%. Both are inside the sampling range of each other (about plus or minus 3 points). By year the Ponzi count runs 28 to 52 a year from 2015 to 2025 with a peak of 52 in 2023 (24.4% of records), and insider trading 39 to 68 with a low of 39 in 2021 (23.9%). Insider trading shares of 39.5% in 2025 and 52.8% in 2026 look like a wave but are not: the count (49, then 47 for part of a year) is in line with earlier years, and the share rises because the other sources shrink. The CFTC supplies 109 of the 474 Ponzi records (23%), and 2013 and 2014 insider trading is low (13 and 26 records) because the SEC’s records in those years rest on administrative orders only; the AMF France adds 8 and 5.

The table gives shares of all records by year.

The 2013 and 2014 rows rest on SEC administrative orders (plus the CFTC and the smaller regulators) and 2025 and 2026 on a shrunken denominator; the middle years are the comparable ones. Spoofing here is the union of its two tags and the spoofing group’s yearly counts for 2013 and 2014 (2 and 5) are under 10, as are most of the cells in the paid-promotion and crypto columns, so a single record moves them.

What this does not show

• Selection. These are cases regulators chose to bring and publish, then kept by the library’s reading of what they charge. A change in a share is a change in the library’s records, not necessarily in the underlying conduct, in detection, or in how many cases were brought. No claim here is about how much manipulation occurred.
• No cause. Nothing in this post says why any shift happened, and none is attributed to an administration, a policy or a rule. The two legal facts above come from the statute and rule pages; neither is a statement about enforcement priorities.
• Coverage is uneven by design. The SEC litigation source starts in 2015, the ASIC records in October 2014, and DOJ, FINRA and CIRO records are absent. FINRA is the main enforcer of order-book conduct in US equities, so the spoofing and layering group is mostly futures and a thin set of SEC matters and AMF France decisions. The 2025 and 2026 drop is unresolved.
• Batches. A single day supplied 23, 20, 8, 7 and 6 records in the groups above. The result is stated with and without them, and the conclusion survives for crypto and for the 2017 to 2020 spoofing cluster, but a different batch day could move any small group.
• Small groups. ASIC, FCA, OSC and AMF France are under 40 records a year combined; Rule 105, paid promotion and crypto cells are mostly under 10.
• Mixed dates. The AMF France’s dates are decision dates and the others are release or order dates, so a year’s total adds two kinds of event.
• Filing year, not conduct year. A 2019 filing usually concerns earlier trading, and the library’s duplicates (one matter can appear as an SEC order and a litigation release, and multi-respondent records are counted once) are not removed.
• Checked by AI agents, not lawyers. The first 2,428 records were compared with primary documents on 2 and 3 October 2026 by Claude AI agents working from written instructions, with samples re-read, and no lawyer reviewed them. The 209 AMF France records, added on 5 October 2026, were each written by an AI agent reading the French decision and marked reviewed that day; they have had a single reading, with no sampled second read yet. This analysis was also prepared by an AI agent, and its figures were recomputed a second way, but a mistake in a tag or date would carry through. If you find one, use the error link on the case page.

Techniques referenced

• Spoofing — Spoofing is placing orders a trader intends to cancel before execution, to create a false impression of supply or demand and move the price toward a smaller genuine order on the other side.
• Paid stock promotion — Paid stock promotion is publicising a security in exchange for compensation, which is lawful only if the fact of payment, the payer and the amount are fully disclosed under Securities Act Section 17(b).
• Rule 105 offering shorts — Rule 105 offering shorts are short sales of a stock in the restricted period before a follow-on offering is priced, followed by a purchase of that stock in the offering, which Regulation M Rule 105 prohibits whatever the trader intended.
• Insider trading — Insider trading is dealing in securities on material non-public information in breach of a duty of trust or confidence, which exploits a true signal others cannot see rather than injecting a false one into the price.
• Ponzi schemes — A Ponzi scheme pays returns to earlier investors from later investors' money rather than from genuine profits, which is investment fraud with no market involvement and no price to manipulate.

Cases referenced

Reviewed October 4, 2026. Spotted an error? Tell us.