Market abuse

Market abuse is the legal umbrella for insider dealing, unlawful disclosure of inside information, and market manipulation under the EU Market Abuse Regulation (MAR). The rules also prohibit attempted insider dealing and attempted manipulation. For a surveillance quant, the distinction determines what to reconstruct. An insider-dealing alert starts with what the person knew and used. An order-based manipulation alert starts with the signal the person’s orders conveyed to other traders. EU MAR, Articles 1–2 and 14–15

A fictional manufacturer whose shares trade on an EU regulated market learns that its largest customer has terminated a contract. An employee reads the signed termination notice and uses it to sell shares in the manufacturer before the news reaches the public. Assume the loss is large enough that a reasonable investor would likely use it in an investment decision. The fact is precise, non-public and relates to the issuer. On those facts, the sale illustrates insider dealing under EU MAR. A sale before bad news would prompt a reviewer to look for evidence of access and use, such as who received the notice and how the sale decision was made. EU MAR, Articles 7–9

The employee could also use the notice to cancel a buy order placed before they learned the news. Article 8 covers that use even if the buy never executes. If the employee instead shares the notice outside the normal exercise of their work, profession or duties, the disclosure itself can be unlawful even if the recipient never trades. The separate article on insider trading liability explains the U.S. duty-based framework. EU MAR, Articles 8, 10 and 14

Consider two fictional accounts trading an EU-listed stock. In each of three episodes, account A posts two large buy orders at different price levels, executes a sell on the other side of the order book, then cancels both bids unfilled. If the trader placed those bids without intending to execute them, to make demand look stronger while trying to sell, that illustrates the pattern known as layering or spoofing. Article 12 covers orders that give or are likely to give misleading signals about supply, demand or price. EU MAR, Article 12 and Annex I(A)(f) · Delegated Regulation (EU) 2016/522, Annex II, Section 1, point 5(e)

Account B also posts and cancels two large bids in each episode. A public reference price drops in each case, and the account withdraws its now-stale bids without an opposite-side fill. Both accounts cancelled six of six selected bids. The middle event gives the reviewer a different hypothesis to test in each case. EU MAR, Annex I(A)

Article 12 also covers conduct such as manipulating a benchmark or spreading a rumour likely to mislead the market when the person knew or should have known the rumour was false or misleading. EU MAR, Article 12(1)

An alert can identify repeated opposite-side fills and cancellations. A review can check the sequence against order IDs, account attribution, fills and reference prices, then look for evidence of why the quotes were withdrawn. An aggregate book snapshot can show vanished depth. The order records can identify which bids disappeared, and communications surveillance can help establish the reason. To see how exchange messages and book states line up, work through the public Market making with Python and public data.

Under EU MAR Article 16, trading venue operators and people professionally arranging or executing transactions have detection and reporting duties for suspicious orders and transactions that could involve insider dealing, manipulation or an attempt at either. These can include cancellations and amendments. A suspicious transaction and order report (STOR) goes to the competent authority without delay once reasonable suspicion forms. An alert is a prompt to review the facts. A STOR records the suspicion and the evidence behind it. A finding of a breach follows a separate legal assessment. EU MAR, Article 16 · Delegated Regulation (EU) 2016/957, Articles 1 and 5–6