Can You See Spoofing on the DOM? What Your Data Feed Shows

No: a DOM (depth of market, the ladder of resting bids and offers at each price) shows that size at a price shrank, never why, and spoofing is defined by why. You can work out how much was pulled rather than filled, but regulators prove intent with records that name the trader, and no retail feed carries them, not even CME's order-level data, which is anonymous.

Key takeaway

What a DOM can measure is pulled size: starting size minus remaining size minus contracts printed at that price, 400 of an illustrative 800-lot bid. What it cannot measure is spoofing, which CME Rule 575 and the Commodity Exchange Act define by the intent to cancel at entry. Regulators prove that intent from order-entry records that name every trader, while the CFTC states that "MBO data are not linked or linkable to an individual trader."

What counts as spoofing in US futures?

Spoofing is entering a bid or offer with the intent to cancel it before it executes, and it is illegal in US futures under both federal law and CME Group's rules. The test is the trader's intent at the moment of entry, not what later happened to the order.

Section 4c(a)(5)(C) of the Commodity Exchange Act, added by section 747 of the Dodd-Frank Act, defines spoofing as "bidding or offering with the intent to cancel the bid or offer before execution". CME's Rule 575 is set out in Market Regulation Advisory Notice RA2608-5, effective on trade date August 13, 2026, superseding RA2602-5; it is the latest notice we found as of October 2026. Rule 575.A bars entering "an order with the intent, at the time of order entry, to cancel the order before execution".

The CFTC's 2013 interpretive guidance requires "some degree of intent, or scienter, beyond recklessness," and holds that "even a single instance of trading activity can violate" the provision. One of its four examples is submitting or cancelling multiple bids or offers "to create an appearance of false market depth".

What does the DOM show when big orders disappear?

On an aggregated (market-by-price) feed, each DOM level shows one number: the total size resting at that price. When it drops, three flows are netted together (contracts that traded, orders cancelled, new orders that joined), and the ladder cannot tell you which was which.

The top-ranking spoofing guides we checked treat a large order that vanishes as price approaches as the mark of a spoof. CME's FAQ says a bona fide order that is "subsequently modified or cancelled due to a perceived change in circumstances does not constitute a violation of Rule 575". The primer on reading the DOM shows how the ladder is built, and what Level 2 depth data buys you covers the data itself.

The feed adds a second blind spot. ICE's note on streaming data and conflation states that "Conflation is generally defined by the combining of data in multiple messages to form one single message." Our inference: on a conflated depth feed, an order added and cancelled inside one interval can leave no trace while trades still print, and no retail futures platform we checked publishes its interval (the guide to conflation and throttling explains the mechanism).

How do you separate pulled size from filled size at one level?

Take the size at the start of the interval, subtract the size still resting at the end, then subtract the contracts printed at that price; the remainder is net pulled size. Prints come from time and sales or a footprint chart's volume at price, and the sum is easiest on a replay of recorded tick data, where depth and trades share timestamps.

A worked example with illustrative figures for one bid level:

At the start of the interval the bid shows 800 contracts.
At the end it shows 150.
Time and sales shows 250 contracts printed at that price.
Net pulled size is 800 - 150 - 250 = 400 contracts.
So 50% of the 800 was pulled, 31.25% filled and 18.75% still rests; of the 650 that left, about 62% left without trading.

The worksheet adds the two cases where the simple sum misleads.

Line	Formula	Contracts	Share of 800
Size before	DOM	800	100%
Size after	DOM	150	18.75%
Printed at that price	time and sales	250	31.25%
Net pulled	800 - 150 - 250	400	50%
Cancels if 100 joined unseen	800 + 100 - 250 - 150	500	n/a
Iceberg case: 800, 700 after, 600 printed	800 - 700 - 600	-500	n/a

Computed by Phoenix Technologies; method: net pulled = size before - size after - contracts printed at that price; all inputs illustrative.

Picture the level as one bar of 800 contracts cut into three blocks: 400 pulled, 250 filled, 150 resting. Beneath it sit two corrections. If 100 contracts joined unseen, cancels were really 500, so the residual is a lower bound. If the level falls only from 800 to 700 while 600 print, the residual is -500: at least 500 contracts arrived at the level during the interval.

Subtracting prints from the size drop gives net pulled size; a negative result means size was added, by an iceberg refill or new orders, and neither number reveals intent.

A negative residual means size was added, not pulled: new orders joined, or an iceberg order (a large order that displays only a small peak) refilled. As Zotikov and Antonov's paper on CME iceberg detection puts it, "When the peak is executed, the next part of the iceberg's hidden volume (tranche or refill) gets displayed in the LOB."

Does market-by-order data show who is spoofing?

No. Market-by-order (MBO) data shows each resting order in queue sequence with its own ID, so you can count adds and cancels exactly, but the ID is not a person. The CFTC's privacy impact assessment for Order Book On Demand: "MBO data are not linked or linkable to an individual trader."

The same document describes the exchange's order-entry data, which the CFTC receives and its Division of Enforcement relies on, as data that "identifies every trader that is active in the futures and options markets". Picture one 800-lot bid three ways. On a market-by-price feed it is one number, 800; on MBO it is a queue of five orders (illustratively 300, 200, 150, 100 and 50) with anonymous IDs; in the regulator's records each of those five carries the trader who sent it.

Order-level data separates adds from cancels, but only the regulator's records attach a trader to an order, and intent is inferred from that trader's history.

Heatmaps and order-tracking tools run on the anonymous middle view, so they can show an order arrive and vanish but never whose it was. A knowledge-base article from the broker EdgeClear says Rithmic's MBO "contains no customer identifiable information". The comparison of futures data feeds and Rithmic versus Tradovate cover which connections carry order-level depth.

What does a real spoof look like in CFTC cases?

In enforcement records a spoof is two sets of orders: genuine orders the trader wants filled on one side, and orders meant to be cancelled on the other, usually at or near the best price and often split into pieces. The genuine side is frequently the one that trades.

CME's textbook example places the large orders "at or near the best bid and offer prevailing in the market at the time", not far away. In the CFTC's 2019 order against Tower Research Capital, covering equity index futures from March 2012 to December 2013, the genuine orders were typically passive and only partly visible, and the CFTC states that "the traders often used an order splitter to enter several smaller, randomly-sized orders in an attempt to obscure their scheme". A one-giant-order filter would have missed it.

A CFTC order of September 9, 2025 covered E-mini S&P 500 (ES) and E-mini Nasdaq 100 (NQ) futures from May to December 2022: "His genuine orders were often aggressive, meaning they crossed the bid-ask spread and were immediately filled." His spoof contracts "outnumbered the contracts in his legitimate orders 5-to-1."

That refines the claim in our DOM primer that executed prints cannot be spoofed: the prints were real, but here they were the spoofer's own genuine orders, so following the tape does not keep you off the other side. A CFTC order of May 6, 2026 found about 50 occasions in 2019 where genuine orders sat in cash Treasuries or one Treasury future and the spoofs sat "in a correlated Treasury futures contract", mainly the Ultra U.S. Treasury Bond future.

Picture the sequence on a timeline, with illustrative timings. At 0 seconds a genuine 20-lot sell rests at the ask; at 1 second, bids totalling 100 contracts appear at and just below the best bid in random sizes (say 35, 25 and 40). At 3 seconds buyers lift the offer and the 20-lot fills; at 3.2 seconds the 100 bid contracts are cancelled. At the 5-to-1 ratio from the 2025 order, 100 of the 120 contracts shown, about 83%, were never meant to trade.

The spoof sits on the side opposite the order that trades, split into pieces near the touch, which is why a single vanishing block is a poor test.

Which order patterns look like spoofing but are legal?

Many patterns that make size vanish are legal. CME's Rule 575 FAQ allows cancelling a bona fide order when circumstances change, iceberg orders, protective stops, unequal two-sided markets and queue-position orders pulled as the market moves; what it prohibits is the intent to cancel at entry.

Icebergs. "The use of iceberg orders, in and of itself, is not considered a violation of Rule 575." CME's example of a violation is an iceberg on the bid while larger size is layered on the offer to push price into it.
Protective stops. Allowed if you intend them to fill when triggered, and they sit off the displayed book anyway, as the piece on stop hunting explains.
Unequal markets. 100 bid at 10 offered is allowed if both orders are bona fide.
Queue position. Resting orders to hold a place in the queue, then cancelling as conditions change, is allowed absent other signs of a misleading purpose. It is one ordinary, legal reason deep size flickers in ES and NQ.
Partial fills. A fill does not clear a spoof: "an execution does not automatically cause the order to be considered compliant with Rule 575".
Testing your feed. An order in a live product placed "for the purpose of verifying connectivity or checking a data feed" is not permissible. CME offers test products for that.

Picture these as a matrix of 8 rows and one verdict column: the five allowed patterns above, and three prohibited ones (an order entered with intent to cancel, an order placed to test a feed, and a spoof that partly filled). On a DOM, all eight can look identical.

Legal and illegal cancels draw the same picture on a ladder; only the trader's intent at entry separates them.

How do regulators detect spoofing, and how large are the fines?

Regulators work from exchange order-entry records that name the trader behind every order, and infer intent from that trader's own pattern of entries and cancels. The largest resolution cited here, against JPMorgan in September 2020, totalled $920.2 million.

CME lists 18 non-exhaustive factors for a possible Rule 575 violation, starting with "whether the market participant's intent was to induce others to trade when they otherwise would not". Others include the participant's order entry and cancellation activity, historical pattern, size relative to position and capital, and activity in related markets. By our reading, a DOM watcher can partly observe only 5 of the 18, all market-wide, and none says whose order it was. Neither CME nor the CFTC publishes its surveillance thresholds.

The table lists each CFTC resolution cited here, with amounts as the CFTC states them.

Respondent	CFTC order	Amount	Notes	Market and period
JPMorgan	September 29, 2020	$920.2 million	restitution, disgorgement and penalty	metals and Treasury futures, 2008 to 2016
Bank of Nova Scotia	August 19, 2020	$127.4 million	$77.4 million spoofing and false statements; $50 million separate swap dealer compliance and supervision action	gold and silver futures, more than eight years
Tower Research Capital	November 7, 2019	$67.4 million	restitution, disgorgement and penalty	equity index futures, 2012 to 2013
An Illinois company and its trader	September 9, 2025	$200,000	plus a 12-month trading ban	ES and NQ, 2022
A New York trader	May 6, 2026	$200,000	plus a one-month trading ban	Treasury futures, 2019

In the JPMorgan case, which the CFTC described in 2020 as its largest monetary relief to that date, traders placed hundreds of thousands of spoof orders that "intentionally sent false signals of supply or demand designed to deceive market participants". The Bank of Nova Scotia total is often quoted as a spoofing fine, but only $77.4 million of the $127.4 million, about 60.8%, settles the spoofing and false-statements action.

Drawn as bars on one baseline, JPMorgan's $920.2 million stands about 13.7 times Tower's $67.4 million and about 11.9 times the Bank of Nova Scotia's $77.4 million, which stacks under its $50 million compliance portion. The two individual orders of $200,000 barely leave the axis, yet each came with a trading ban.

The firm cases dwarf the two recent individual orders in dollars; those small cases cover E-mini trading in 2022 and Treasury trading in 2019, settled by CFTC orders in September 2025 and May 2026.

Should you trade off vanishing size on the DOM?

Treat vanishing size as information about how firm a level is, not as proof of a spoof. We found no peer-reviewed study testing whether following or fading pulled size on CME data pays after costs, and we found no vendor that publishes an accuracy figure for a spoofing indicator.

Pulled size still tells you something: a level that shed 400 of 800 contracts without trading was weaker than it looked, which matters for where you rest an order or a stop. Before you label a level:

If the residual is negative, size was added (an iceberg refill or new joiners): read it as absorption, not pulling.
If the residual is positive, you have a lower bound on cancels and nothing about intent.
If the pulled size sat near the best price while aggressive orders printed opposite, the shape matches the enforcement record, and is still legal when the orders were bona fide.
If your feed conflates depth, assume short add-and-cancel cycles never reach your screen.
If your contract has correlated cousins, as the Treasury futures did in the May 2026 order, the spoof may sit on the other ladder.
If you run an algo, make sure every order is one you would accept a fill on: Rule 575 applies whatever your prop firm allows, as the guide to algo trading rules sets out.

No regulator or exchange publishes what share of displayed depth in ES, NQ or any CME contract is spoofed. Any tool or post that puts a number on it is guessing.

Go deeper

Frequently asked questions

Is spoofing the same as layering?

Layering is usually used for one form of spoofing: stacking several orders at different prices to make one side of the book look deeper. The CFTC's 2013 guidance lists submitting or cancelling multiple bids or offers to create an appearance of false market depth as an example of spoofing. CME's iceberg example in RA2608-5 also describes layering larger quantities on the offer to push price into a hidden bid.

Can an individual retail trader be charged with spoofing?

Yes. Rule 575.A applies to any person, and the CFTC orders of September 2025 and May 2026 each named an individual trader, with a $200,000 penalty and a trading ban. Account size does not change the test, which is intent at entry.

Is it spoofing to cancel my limit order when price gets close?

Not if you entered it intending to trade and cancelled because conditions changed. CME's FAQ treats that as a legitimate cancel, and treats orders placed for queue position and later cancelled the same way, absent other signs of a misleading purpose. The question a regulator asks is what you intended when you clicked, not how often you cancel.

How long does an order have to rest to avoid looking like a spoof?

There is no minimum. CME's FAQ says the time an order is exposed may be a factor, but "there is no prescribed safe harbor." A resting order entered with intent to cancel is a violation whether it lived for a second or an hour.

Is reckless order entry treated as spoofing?

Under the Commodity Exchange Act, no: the CFTC reads the spoofing clause as requiring intent beyond recklessness. CME's Rule 575 is wider in places, because 575.D reaches messages sent with reckless disregard for the orderly conduct of trading. Rule 575.A, the spoofing clause itself, remains an intent rule.

Do Bookmap or ATAS spoofing indicators actually detect spoofing?

They detect orders that appear and disappear, which is not the same thing. We found no vendor that publishes an accuracy figure for a spoofing indicator, and the order-level data these tools display is anonymous, so they cannot attribute an order to a trader or an intent. Treat their flags as a map of pulled size.

Which version of CME Rule 575 guidance is current?

The latest notice we found as of October 2026 is RA2608-5, effective on trade date August 13, 2026, which supersedes RA2602-5. CME's filing says its substantive changes are a new Q&A 26 on network transmissions that break technical specifications or obstruct processing, plus two related examples. Check CME's current notice before relying on any FAQ answer.

Is a lopsided market, like 100 bid at 10 offered, a spoof?

Not by itself. CME's FAQ says participants "are not precluded from making unequal markets as long as the orders are entered for the purpose of executing bona fide transactions." If either order is entered with prohibited intent, the pair becomes a violation.