Layering

Layering is placing multiple orders at several consecutive price levels with no intention of trading them, building an apparent wall of depth that pushes the price toward a genuine order on the other side.

Also called stacking, multi-level spoofing. Observed in equities, futures, options, crypto derivatives. One of the order-book manipulation techniques. 15 enforcement actions in the library.
Updated 2026-09-07

How does layering work?

Layering solves a presentation problem. A single order for six thousand contracts in a book that normally shows a few hundred at each level is conspicuous — to other traders, and to the surveillance system watching the venue. Spread the same insincere interest across four price levels and it stops looking like an anomaly and starts looking like a market with genuine underlying support.

The sequence has four steps.

1. Place the genuine order. A modest order on the side the trader actually wants to transact — say, a sell order just above the current offer.

2. Build the stack. Post buy orders at four or five consecutive prices below the market, each of ordinary-looking size, together representing far more demand than the book usually carries. None of them is intended to trade.

3. Let the imbalance work. Participants reading displayed depth — and the automated strategies that key off it directly — see broad support beneath the market. Market makers raise their quotes to avoid selling into apparent buying pressure. The price drifts up.

4. Fill and dismantle. The genuine sell order executes at the improved price, and the entire stack is cancelled, usually within milliseconds and usually all at once.

The tell is in step four. Genuine orders at different prices have different reasons to exist and therefore different lifetimes. A stack that arrives together and leaves together was never four decisions; it was one.

A worked example with real numbers

Take a mid-cap stock trading at 20.03, with a penny tick and a book that normally carries about 400 shares per level. A trader wants to sell 300 shares.

Displayed bid depth in the top four levels went from roughly 1,600 shares to roughly 10,800 — a sevenfold increase — while displayed offers were unchanged. Without the stack the realistic fill was 20.03. With it, the fill came at 20.04.

300 shares × $0.01 improvement = $3.00

Three dollars. The number is deliberately unimpressive, because it shows what the strategy actually is: a machine for harvesting one tick, thousands of times. At 400 cycles a day across several names, it is $1,200 a day and roughly $300,000 a year — and it requires posting and cancelling something like 1.5 million shares of displayed interest that never trades. That ratio is what surveillance sees.

Why is layering illegal?

Layering is illegal for exactly the reason spoofing is: the orders are not offers. A displayed limit order communicates a willingness to trade at that price. Nine thousand shares of displayed demand that the sender intends to withdraw before anyone can hit it communicates something false about the state of supply and demand, and it does so to every participant reading the book.

In futures and commodities the prohibition is express. Section 4c(a)(5)(C) of the Commodity Exchange Act makes it unlawful to bid or offer with the intent to cancel before execution. The statute names spoofing, and layering falls within the definition without difficulty: each order in the stack is individually a bid placed with intent to cancel.

In securities there is no bespoke provision, and cases are brought under Exchange Act § 9(a)(2) — transactions creating apparent active trading to induce others to buy or sell — and under § 10(b) with Rule 10b-5. Because most equity layering is done by or through registered firms, FINRA rules do a great deal of the work: Rule 2020 prohibits manipulative devices, and Rule 5210 requires that published quotations be bona fide. A FINRA action can reach a firm’s supervisory failures as well as the trader’s conduct, which is often where the larger penalty lands.

Criminal exposure runs through 18 U.S.C. § 1348 and, where communications support it, wire fraud.

One point of law is worth stating precisely, because it is frequently misunderstood: neither the statute nor the rules require proof that the price moved, that anyone was deceived, or that anyone lost money. The offence is complete at placement, and it turns on what the trader intended then.

Which real enforcement actions have alleged layering?

This library holds 15 enforcement actions tagged layering. The table shows the largest by civil penalty together with the most recently filed. Every row links to a page carrying the regulator's own release and, where one was published, the complaint.

All 15layeringactions →

How does layering get detected?

The analytics are those used for spoofing, with one addition that matters: layering is detected by coincidence in time across price levels.

Surveillance systems group a participant’s orders into episodes and ask whether the stack behaves as one object. Four orders placed within the same few milliseconds at four consecutive prices, and cancelled within the same few milliseconds of each other, are not four independent trading decisions. The joint timing is the signature, and it is very hard to produce accidentally.

Around that sit the standard measures: order-to-trade ratio, order lifetime distribution, and the conditional probability of cancellation on one side given a fill on the other. Cross-market data is particularly important here, because layering is frequently distributed across venues or accounts specifically so that no single venue sees the whole stack.

• Simultaneous placement of orders at three or more consecutive price levels on the same side, followed by simultaneous cancellation.
• The whole stack cancelled within a narrow time window of a fill on the contra side, repeated across sessions.
• Aggregate displayed size on one side that is many multiples of the trader's median daily executed volume in that product.
• Stack placement that consistently begins one or two ticks behind the touch — close enough to shift displayed imbalance, far enough to reduce fill risk.
• Orders entered through several accounts or venues whose combined effect only becomes visible when the data is joined.

Investigators also look at what the layered orders would have cost if they had filled. A stack the trader could not have funded, or that would have breached their own risk limits had it executed, is powerful evidence that execution was never contemplated.

What penalties does layering actually attract?

The numbers below are computed from this site's own case records at build time, not quoted from a secondary source. They change whenever a new action is added to the library.

What are the red flags?

• Depth appearing across several price levels at once and vanishing together, without any of it trading.
• A book that shows broad, deep support which evaporates the moment the price approaches it.
• Displayed size that grows steadily on one side while every print goes off on the other.
• A firm whose gross displayed liquidity in a name dwarfs its actual position or turnover in that name.

Inside a firm, the useful control is not a cancellation-rate threshold — market makers will breach any threshold you set — but a co-timing test: alert when three or more orders from one account at adjacent prices are placed within a short window and cancelled within a short window, and count how often that episode is followed by a contra-side fill. That statistic is close to zero for legitimate strategies and conspicuously non-zero for layering.

What layering is not

It is not posting size. A trader who genuinely wants to buy 9,000 shares and posts them across four levels has done nothing wrong, including if they later cancel because the market moved.

It is not two-sided quoting. Market makers post stacks on both sides continuously. Layering is one-sided by construction, because its purpose is to create an imbalance.

It is not iceberg or hidden order usage. Concealing genuine size is expressly permitted by venue rules. Displaying size you do not have is the opposite thing.

Frequently asked questions about layering

What techniques are related to layering?

• Spoofing — Spoofing is placing orders a trader intends to cancel before execution, to create a false impression of supply or demand and move the price toward a smaller genuine order on the other side.
• Momentum ignition — Momentum ignition is entering a burst of aggressive orders designed to trigger other participants' momentum strategies, creating a price move the initiator then trades against.
• Quote stuffing — Quote stuffing is flooding a trading venue with order messages in order to slow down the processing of market data, so that competing participants act on prices that are already stale.
• Wash trading — Wash trading is buying and selling the same asset with no change in beneficial ownership and no market risk, so that a trade prints publicly and creates a false impression of activity or price.

Terms defined on this page

Order Book · Depth · Book Imbalance · Bona Fide Order · Order To Trade Ratio · Phantom Liquidity

Sources

1. Commodity Exchange Act § 4c(a)(5)(C) — Cornell Legal Information Institute
2. FINRA Rule 5210 — publication of transactions and quotations — FINRA
3. CFTC Interpretive Guidance on Disruptive Practices — Federal Register
4. SEC Rule 10b-5 — Electronic Code of Federal Regulations

Reviewed September 7, 2026. Every statute link points at the primary text. If something here is wrong, tell us — corrections are logged in public.