Orders they never meant to keep.

A record penalty for orders that were never meant to trade

On 29 September 2020, the CFTC settled charges against JPMorgan Chase & Co., JPMorgan Chase Bank, N.A., and J.P. Morgan Securities LLC for a manipulative and deceptive scheme that ran from at least 2008 through 2016. The total: $920,203,609, the largest resolution the Commission had ever imposed in a spoofing case.¹

Across two desks, precious metals and U.S. Treasuries, numerous JPMorgan traders placed orders for futures contracts they intended to cancel before execution. The point of those orders was never to trade. It was to create a false impression of supply or demand that would nudge the market, so that the trader's genuine order on the other side would fill at a better price. The Commission reached the conduct under the full span of its anti-manipulation and anti-spoofing authority: the Commodity Exchange Act's prohibitions on spoofing, on manipulation and attempted manipulation, and on employing a manipulative or deceptive device, together with the Commission's Regulations 180.1 and 180.2.

The Commission put precise numbers on the conduct: the scheme benefited JPMorgan by $172,034,790 and inflicted $311,737,008 in losses on other market participants. A separate charge landed on J.P. Morgan Securities for failing to diligently supervise the traders who did it, in violation of Regulation 166.3, for the better part of a decade. The trades touched gold, silver, platinum, and palladium futures on COMEX and NYMEX, and Treasury note and bond futures on the Chicago Board of Trade, all exchanges owned by CME Group.

This study treats the case as what it really is: not a story about whether spoofing is wrong, which was never in doubt, but a complete anatomy of how a definitional, repetitive, surveillable form of market abuse survived for eight years inside one of the most sophisticated institutions in the world. It walks the mechanism and the dated episodes, which show the technique was stable, discussed, and in one instance practiced by the head of the desk, and then lifts each failure into the discipline it violated: why intent is a property of a sequence rather than an order, so a control that judges orders one at a time is structurally blind; why a surveillance scenario calibrated never to fire is not a control; why surveillance that reports into the business cannot catch the business; why a monitoring program is only as good as the order and communications data it can reconstruct; and how a prohibited technique becomes normalized into the ordinary way a desk works. The closing sections carry the lesson forward into markets now dominated by machines that react in microseconds, and surveillance, and trading, increasingly run by models of their own.

What spoofing actually is

A futures order book is a public ledger of intentions. Bids and offers stack up at each price, and traders read that stack as a signal: heavy buying interest below the market suggests support, heavy selling above it suggests resistance. The whole mechanism depends on one assumption, that the orders are real, meaning the trader is willing to have them filled. Price discovery, the core function of a market, is nothing more than participants acting on what the book appears to tell them about supply and demand.

Spoofing weaponizes that assumption. The spoofer places large orders on one side of the book with no intention of letting them execute. Their only job is to be seen. Other participants, including the automated systems that now dominate these markets and react in microseconds, read the apparent imbalance and move the price. The moment the spoofer's real order on the opposite side fills, the large orders are cancelled, often within a second, their work done. The spoofer has, in effect, lied to the market about how much supply or demand exists, profited from the reaction, and erased the evidence before anyone could trade against it.

Layering is the same idea at scale: multiple spoof orders stacked at several price levels to make the false pressure look deep and durable, not a single large order that might be dismissed as a fat finger, but a convincing wall of apparent interest. JPMorgan's traders used both techniques, and the order's examples show layering as the house style on the precious metals desk in particular.

It is worth being precise about why this is treated as fraud rather than aggressive trading, because the line is genuinely subtle and the whole case turns on it. A trader who places a large, genuine order and then cancels it because the market moved has done nothing wrong; cancellation is a normal, constant feature of honest trading. What makes a spoof a spoof is that the order was never meant to trade at the moment it was placed. The deception is not in the cancellation; it is in the original act of displaying to the market an interest the trader did not have, in order to induce others to move the price. The order is a false statement about the trader's own intentions, broadcast to everyone reading the book, and relied upon by them. That is the classic structure of fraud, a knowing misrepresentation of a material fact, intended to be relied upon and in fact relied upon to the victim's detriment, expressed not in words but in orders.

Anatomy of a spoof

Consider a trader who wants to sell. They place a small genuine sell order. Then, below the market, they stack large buy orders they never intend to honor. The book now looks hungry for the contract. Buyers step in, the price ticks up, and the genuine sell fills at the improved price. The large buy orders vanish. The entire sequence can play out in seconds, and from the outside the only visible trace is a set of large orders that appeared and disappeared without ever trading.

The order's examples track this shape with striking consistency. A genuine order on one side; a larger spoof, or a layered stack of them, on the other; the genuine order fills; the spoof is cancelled, in several documented instances less than a second after execution. The sub-second cancellation is the fingerprint. An order placed to trade is not pulled the instant the opposite side fills; an order placed to deceive is.

The consistency of the shape is itself important, and it foreshadows the control lesson that dominates the rest of this study. The conduct is not improvisational. It follows a template: genuine order, opposing wall, induced move, fill, immediate cancel. A template is precisely the kind of thing a well-designed surveillance system detects, because it recurs with measurable features, the ratio of cancelled to executed volume, the timing between the opposite fill and the cancellation, the geometric arrangement of layered orders at successive price levels. Everything about the mechanism that makes it effective as a deception also makes it, in principle, visible as a pattern. The question the case forces is why a pattern this templated ran for eight years without the pattern being seen, and the answer is not that it was cleverly hidden. It is that the firm was not looking at the unit of behavior where the pattern lives.

Who pays for a phantom bid

Spoofing is sometimes dismissed as victimless, a trader shaving a tick here and there. The CFTC's figures say otherwise. The scheme transferred value out of the market by inducing other participants to trade at prices that reflected demand that did not exist. Those participants, from pension funds and asset managers hedging in Treasuries to counterparties and other dealers trading precious metals, lost $311.7 million. JPMorgan kept $172 million of it. The gap between the two numbers is itself telling: the harm inflicted was larger than the gain captured, because a false price signal distorts trades across the whole book, not only the ones on the other side of the spoofer's genuine order.

There is a deeper cost that does not fit on a chart. Markets work because participants trust that the book means what it says. Every spoof is a small withdrawal from that trust. Run the withdrawal for eight years, at the scale of a global bank whose quotes anchor the gold and Treasury markets, and the damage is to the signal itself. When enough participants suspect the book is being gamed, they widen their own quotes, trade less, or pull back, and liquidity thins for everyone. That erosion of confidence is the reason regulators treat spoofing not as a private dispute between counterparties but as an injury to the market as an institution.

This is also why the gap between the $172 million gained and the $311.7 million lost is not an accounting curiosity but a structural feature of the harm. A spoof does not merely transfer money from the trader on the other side of the genuine order; it poisons the price that every participant trading in that window relies on. The induced move is real for everyone, so everyone who transacts at the distorted price bears a piece of the cost, while the spoofer captures only the slice that accrues to its own genuine order. Manipulation of a public price signal is inherently a negative-sum activity: it destroys more value in aggregate than the manipulator extracts, because the distortion radiates outward to trades the manipulator was never party to. That is the economic case, independent of any moral one, for pricing the penalty well above the gain.

Eight years, two desks, numerous traders

What distinguishes this case from a rogue-trader story is its breadth. This was not one person on one afternoon. The Commission documented a pattern sustained across two distinct desks, precious metals and U.S. Treasuries, involving numerous traders, spanning at least 2008 to 2016. The conduct was not confined to a single product, a single trading style, or a single office; it was a way of working that recurred across years, instruments, and people.

Duration and breadth are what turn a set of bad trades into an institutional failure. A one-off spoof is an individual's misconduct. A spoofing practice that survives eight years, migrates across two desks, and is used by multiple traders including, as the record shows, the person running one of the desks, is something the environment permitted. It means the pattern was either invisible to the firm's controls or visible and tolerated. The order finds elements of both, and that is the uncomfortable finding beneath the headline number. It is also why the second charge, the supervision charge, carries as much weight as the first.

The distinction between an individual's misconduct and an institutional failure is not merely rhetorical; it is the line that determines where liability and remediation should fall. When a single trader devises a scheme and conceals it from honest colleagues and functioning controls, the right response is to remove the trader and ask whether the controls could reasonably have caught a concealed act. When a technique spreads across desks and years and is discussed and practiced openly, the controls are not the victim of concealment; they are part of the failure, because an environment that lets a prohibited technique become common has a control problem by definition. The breadth of the JPMorgan conduct moves it decisively into the second category. The right question is therefore not "how did these traders fool the firm" but "what about the firm's design allowed this to become ordinary," and that question points at surveillance design, at supervisory independence, and at culture, which are the subjects of the sections that follow.

The episodes, and who knew

The order does not rest on statistics. It walks through dated episodes, and read in sequence they do two things: they show the technique was stable across years, and they show it was known, discussed, and practiced at the level that was supposed to police it. The most damaging detail is not any single trade. It is who was in the room.

Three of these entries should stop a compliance officer cold. In 2008, a spoofing result was reported up to the desk head. In 2009, a successful spoof was discussed and approved by a second trader and a salesperson. And in 2014, the head of the Precious Metals Desk did not merely tolerate the technique, he used it himself to work a genuine gold order. When the conduct a supervision program exists to detect is being reported to, approved by, and executed by the supervisors, the program has not merely missed a pattern. It has been inverted. The 2011 silver episode adds a further dimension: the spoofing was used to serve a client, facilitating a hedge fund's sale of 1.6 million ounces, which means the deception was woven into the ordinary business of filling customer orders, not reserved for the desk's own book.

The span of the dated episodes, 2008 at one end and 2016 at the other, is itself a finding worth dwelling on. Eight years is not a lapse; it is a tenure. Over that period the firm will have run countless control reviews, surveillance upgrades, supervisory certifications, and regulatory examinations, and the technique survived all of them. Each of those touchpoints was an opportunity for the pattern to be surfaced, and each passed without surfacing it. A failure that persists through that many opportunities to catch it is not a gap that a single better control would have closed; it is a systemic blindness, and the rest of this study is an attempt to locate precisely where the blindness lived, because "JPMorgan should have caught it" is true but useless. The useful question is which specific control, designed which specific way, would have seen a pattern this templated, and why the ones the firm had did not.

The line was intent

Spoofing is unusually hard to police because the act, placing and cancelling an order, is something every legitimate trader does constantly. Orders are cancelled for a hundred honest reasons: the market moved, the hedge changed, the view flipped, a better price appeared elsewhere. The law does not forbid cancelling. It forbids placing an order you already intend to cancel, for the purpose of deceiving others. The entire offense lives in a mental state at a single instant: the intent, at the moment of order entry, not to let the order trade.

That is why the Commission charged the conduct under several overlapping provisions, each capturing a different facet of the same behavior. The anti-spoofing provision of the Commodity Exchange Act reaches the bidding-or-offering-with-intent-to-cancel directly. The manipulative-device and false-signal prohibitions of Regulation 180.1 reach the deception. The price-manipulation provisions and Regulation 180.2 reach the effect on price. Layered together, they let the Commission describe the conduct as spoofing, as a manipulative and deceptive scheme, and as manipulation and attempted manipulation of price, all at once.

Because intent must be inferred, the proof is circumstantial by necessity, and it is built from exactly the features the episodes display: the consistent placement of large orders opposite small genuine ones, the sub-second cancellations timed to fills, the repetition of the shape across years. None of these is conclusive alone. Together, repeated hundreds of times, they are overwhelming. That is the evidentiary lesson of the case: you cannot catch a spoof by proving a single order was a lie. You catch it by showing that the orders, taken together, could only have been placed to deceive.

There is a subtlety here that matters for how a firm should think about its own controls. The law requires intent, which sounds like a mental state inaccessible to any monitoring system, and firms sometimes use that to argue that spoofing is intrinsically hard to detect in advance: how can software read a trader's mind. But the regulator does not read minds either. It infers intent from objective, recorded features of the order flow, and those features are exactly what a surveillance system can measure. The practical consequence is that the thing the law treats as subjective, intent, is operationalized through entirely objective signals, and a firm that says "we cannot surveil for intent" has confused the legal element with the evidence for it. The evidence is in the data. The CFTC built its case from the firm's own order records. A firm has the same records in real time, and the question is only whether it chose to compute from them the same inferences the regulator later did.

Intent is a property of a sequence, not an order

The single most important control lesson in the case is also the simplest to state and the easiest to get wrong: the unit a surveillance system reasons about determines what it can possibly see. A spoof is invisible at the level of the individual order, because every individual order in a spoof is, on its face, a perfectly ordinary order. A large buy order is legal. Cancelling it is legal. Placing a small sell order is legal. There is no single message in the sequence that a control inspecting messages one at a time could flag, because nothing about any one of them is anomalous. The illegality exists only in the relationships among them, and relationships are not visible to a system whose unit of analysis is the message.¹

This is a specific and generalizable failure of control design, and it has a name worth keeping: the wrong unit of analysis. A control can be perfectly implemented, well-resourced, and diligently run, and still catch nothing, if it is examining the wrong object. A surveillance system built to ask "is this order anomalous" will answer no, correctly, for every order in a spoof, and will therefore never raise an alert, no matter how many spoofs pass through it. To catch the conduct, the system has to ask a different question entirely: "does this sequence of orders, considered together with the fills and price moves around them, form the signature of a deception." That is a question about a pattern, and it requires the system to assemble orders, cancellations, executions, and price movements into a single object, the episode, and evaluate that object as a whole. The difference between a surveillance program that catches spoofing and one that does not is very often not sophistication or budget. It is whether the unit of analysis is the order or the episode.

The features that define the episode are known and computable, which is what makes the failure so stark. The order-to-trade ratio, the proportion of a trader's order volume that is cancelled rather than executed, is a first-order screen: a trader whose cancelled volume dwarfs their executed volume on one side while their genuine fills cluster on the other is displaying the arithmetic signature of spoofing. Cancellation latency, the time between the opposite-side fill and the cancellation of the wall, is a second: sub-second cancellations timed to fills are the fingerprint the episodes repeatedly show. Layering geometry, the arrangement of multiple orders at successive price levels that appear and vanish together, is a third. The correlation between phantom order pressure on one side and a trader's genuine positions and fills on the other is a fourth, and the most probative, because it directly links the deception to the benefit. None of these requires reading a trader's mind. All of them are arithmetic over order-lifecycle data the firm already holds. A surveillance program that computes them is looking at the episode. A program that does not is looking at the order, and will see nothing, for as long as the conduct continues.

A surveillance scenario calibrated never to fire is not a control

There is a failure mode subtler than looking at the wrong unit, and it is the one most likely to be hiding inside a firm that believes it has fixed the first problem. Suppose a firm does run sequence-level surveillance. It has a spoofing scenario, a layering scenario, order-to-trade ratio monitoring, cancellation-timing alerts. The box is ticked; the scenario exists. It can still catch nothing, if the parameters and thresholds that govern when it fires are set so loosely that the actual conduct slides underneath them. A spoofing scenario whose minimum order-size threshold is above the sizes the desk actually spoofs, or whose cancellation-window is tuned so tight that a one-second cancel does not qualify, or whose alerting threshold on order-to-trade ratio is set so high that a career of spoofing never crosses it, is a scenario that exists on the control inventory and fires on nothing. It will pass an audit that asks "do you surveil for spoofing," and it will sleep through every spoof.¹

This is its own distinct problem, and a treacherous one, because a miscalibrated scenario is in some ways worse than a missing one. A missing scenario is at least visible as a gap: a surveillance coverage review that lists the manipulation types the firm monitors will show the absence. A scenario that exists but is tuned never to trigger manufactures false confidence. The control appears on the inventory, the regulator sees it documented, the surveillance team reports that spoofing is covered, and everyone believes the firm is protected by something that will, in practice, remain silent through exactly the conduct it was built to catch. Whether a surveillance scenario works is determined not by its existence but by its calibration, and calibration is precisely the dimension that quietly degrades over time, because the path of least resistance when a scenario generates too many alerts is not to investigate them but to raise the threshold until the noise stops, which also raises it past the signal.

Alert health is the real measure

The honest way to know whether a surveillance scenario is a real control is not to confirm that it exists but to examine its alert health: is it firing at all, and when it fires, are the alerts being triaged to meaningful conclusions or closed in bulk. A scenario that produces zero alerts over years is not evidence of a clean book; it is a prompt to ask whether the scenario could fire on the conduct if the conduct were present. A scenario that produces thousands of alerts all closed as no-action is not evidence of diligence; it is a prompt to ask whether the threshold is so loose that it has become noise, which trains the team to dismiss it. The right diagnostic is to inject the known signature, the actual sizes, timings, and geometries of documented spoofing, and confirm that the firm's live scenarios would have generated an alert and that the alert would have been escalated rather than closed. This is the surveillance analogue of the most basic test in any safety-critical system: feed it the thing it is supposed to catch and verify that it catches it. A firm that has never done this does not know whether its spoofing surveillance is a control or a decoration, and for eight years JPMorgan's, whatever its configuration, functioned as the latter.

When the supervisor is the spoofer

Alongside the manipulation charges, the Commission found that J.P. Morgan Securities violated Regulation 166.3 by failing to supervise its traders diligently. This is the quiet center of the case, and the part most firms can actually act on. For a pattern this definitional, large orders stacked opposite genuine ones and pulled the instant they did their work, to persist for eight years means the controls that should have surfaced it did not function. A spoof is, almost by design, a surveillance target: it leaves a distinctive, repetitive signature in the order data. If a firm's monitoring cannot see that signature over eight years, it is not monitoring for it.

But the episodes reveal a failure that runs deeper than a mis-tuned scenario, and it is the failure that no amount of surveillance technology alone can fix. The conduct was not concealed from the supervisory structure; it was reported to a desk head in 2008, approved in conversation by a trader and a salesperson in 2009, and in 2014 performed by the head of the Precious Metals Desk himself. When the people to whom misconduct is supposed to be escalated are the people practicing it, the escalation path does not lead to a stop; it leads to a participant. This is the structural problem of supervisory independence, and it is the single most important governance lesson of the case: a control function that reports into, or defers to, the business it is supposed to police cannot police the business when the business is the problem.

Why surveillance must sit outside the desk

The reason independence is not a nicety but a structural requirement follows directly from the episodes. Imagine the most sophisticated sequence-level surveillance in the world, correctly calibrated, firing a clean alert on the desk head's 2014 gold spoof. For that alert to produce a consequence, it has to be reviewed by someone with the authority and the incentive to act on it against the desk head. If the surveillance function reports up through the trading business, or if its alerts on a senior trader are routed to that trader's own management for disposition, the alert dies at the desk, because the people who would have to act on it are the people it implicates. The technical control and the organizational control are therefore inseparable: a perfect detector wired into a captured escalation path detects and then does nothing. This is why market-abuse surveillance, like other second-line functions, has to be organizationally independent of the first-line business, with its own reporting line to a control authority that does not sit under the desks it monitors, and with the standing to escalate over the head of an implicated supervisor. The JPMorgan episodes are the case study in what happens without it: the detector, whatever its state, was pointed at a structure in which the subjects of surveillance were among its overseers, and the result was eight years of a pattern that was, at times, being approved by the very people who should have stopped it.

The generalization reaches well beyond trading surveillance. Any firm deploying automated controls over a revenue-generating activity faces the same question: does the control function have the independence, the reporting line, and the authority to act on what the control finds, even when what it finds implicates senior members of the business. A control that can see everything and act on nothing is not a second line of defense. It is an instrument the first line can ignore, and the JPMorgan supervision finding is, at bottom, a finding that the firm's second line could not reach the conduct because the conduct sat where the second line did not have the independence to go.

You cannot surveil what you cannot see

Beneath the unit-of-analysis problem and the calibration problem sits an even more basic dependency: surveillance can only reason about the data it actually has, assembled in a form that lets the pattern emerge. Sequence-level spoofing detection requires complete order-lifecycle data, every placement, modification, and cancellation, with accurate timestamps, linked to the executions and the price moves around them, and ideally joined to the trader's genuine positions and to the communications in which the conduct was discussed. If any of that data is missing, fragmented across systems that do not reconcile, timestamped too coarsely to see a sub-second cancel, or severed from the context that reveals intent, then even a correctly designed, correctly calibrated, independent surveillance function is reasoning with a hole in the middle of its evidence.¹

The communications dimension is where this becomes concrete in the JPMorgan record. The episodes are damning precisely because the order data can be joined to the human context around it: a spoof reported to a desk head, a successful spoof discussed and approved by colleagues. That context is what converts a statistical pattern into a demonstrated intent. A surveillance program that monitors order data but cannot connect it to the chat, voice, and message traffic in which traders describe what they are doing is missing the layer that most powerfully establishes the mental state the law requires. Conversely, a firm whose communications surveillance and trade surveillance run as separate, unjoined systems has two partial pictures and no complete one, and the complete picture is the only one that catches a sophisticated, discussed, multi-person scheme.

Data completeness is a control, not plumbing

The discipline here is to treat data completeness and integrity as a first-class control rather than as background infrastructure beneath the real controls. The questions a firm has to be able to answer are unglamorous and rarely asked: does our surveillance receive every order event, or only a sampled or filtered subset; are our timestamps fine-grained enough to resolve the cancellation latencies that define the conduct; can we link an order sequence to the trader's genuine fills and positions; can we join the trade record to the communications record for the same trader and window; and does anything, a system boundary, a data-retention gap, an unmonitored channel, create a blind spot a knowing trader could exploit. Each of these is a place where a surveillance program can be defeated not by miscalibration but by the simple absence of the data the calibration would operate on. A model is only as good as its inputs, and a surveillance model fed incomplete order data or severed from its communications context will miss patterns that are plainly present in the world but absent from the data it was given. The firms that catch conduct like this are the ones that have invested in the unglamorous layer, complete, reconciled, finely-timestamped, context-joined data, because that layer is the precondition for every control built on top of it.

How a prohibited technique becomes house style

The hardest thing to explain about the case is not how a single trader spoofed, but how spoofing became ordinary. The episodes show the technique being reported, discussed, approved, taught by example, and used by the head of the desk, across eight years and two desks and numerous traders. That is not the profile of a secret crime. It is the profile of a practice that had been normalized, absorbed into the ordinary repertoire of how the desk worked, to the point where a trader could describe a successful spoof to a colleague and a supervisor as a good result rather than a confession.¹

This is a well-understood pattern of institutional failure, sometimes called the normalization of deviance: a prohibited or dangerous practice, repeated without immediate consequence, gradually loses its character as a violation and becomes simply the way things are done. The mechanism is incremental and almost invisible from the inside. The first time a trader spoofs and nothing happens, no alert, no question, no loss, the act is reclassified in the trader's mind, and the desk's, from forbidden to tolerated. Each subsequent repetition without consequence deepens the reclassification. New traders joining the desk learn the technique as part of the local craft, from colleagues who no longer experience it as wrong, and who may genuinely have stopped perceiving it as distinct from aggressive-but-legitimate trading. By the time a practice has been house style for years, the people doing it are often not consciously flouting a rule; they are doing what everyone around them does, in an environment that has quietly redefined the boundary. The absence of consequence did the corrupting, one unpunished repetition at a time.

Silence is a signal, and the desk reads it

The governance lesson is that a control environment communicates constantly through what it does not react to, and traders are expert readers of that signal. Every spoof that passed without an alert, every reported result that drew approval rather than a question, every year the technique persisted, told the desk that the conduct was acceptable, more persuasively than any policy document said it was not. A compliance program is not only the alerts it raises; it is also the meaning the business reads into the alerts it fails to raise. When the surveillance is silent on a practice, the business does not conclude that the practice is undetectable; it concludes that the practice is permitted, and it acts accordingly. This is why a surveillance gap is never merely a detection gap. It is a cultural instruction. The firm that lets a prohibited technique run unflagged for years has not only failed to catch it; it has affirmatively taught its traders that the technique is fine, and reversing that lesson, once a practice has become house style, is far harder than catching the first instance would have been. The eight-year duration of the JPMorgan conduct is, in this light, not just a detection failure compounded over time. It is a culture that the firm's own silence helped to build.

Cooperation, eventually

The Commission was pointed about how JPMorgan conducted itself during the investigation. Its initial cooperation was characterized as unsatisfactory. Only later did the firm's cooperation become substantial, enough that the Commission expressly weighed it in setting the civil monetary penalty. The order makes the sequence part of the record rather than a private footnote.

That arc is worth noting for any institution facing scrutiny. The CFTC's framing signals that the discount for cooperation is real but conditional, and that an early posture of friction is remembered even when later conduct improves. A firm that resists at first and cooperates later does not simply reset to the position of a firm that cooperated throughout; the initial resistance is weighed. The practical message to a general counsel is that the cooperation credit is earned from the first interaction, not recovered at the end, and that the regulator will say so on the public record.

There is a connection between this and everything that precedes it that is easy to miss. A firm that has invested in genuine surveillance, complete data, and independent escalation is a firm that can cooperate quickly and credibly when a regulator comes, because it already has the order-lifecycle data assembled, the episodes reconstructable, and the analysis its own systems should have run available to hand over. A firm that has not made those investments cannot cooperate quickly even when it wants to, because it does not have the picture; it has to build it under pressure, from fragmented systems, while the regulator waits. The quality of a firm's own surveillance infrastructure therefore shapes not only whether it catches misconduct but how well it can respond when misconduct is alleged, and the cooperation posture a regulator rewards is far easier to adopt from a position of good data than from a position of scrambling to reconstruct what happened.

Why the number was so large

The $920 million breaks into three parts, and the breakdown tells the story of how the Commission priced the conduct.

The structure is deliberate. Disgorgement of $172 million strips the gain. Restitution of $311.7 million addresses the harm to counterparties. On top of both sat a civil monetary penalty of roughly $436 million, the punitive layer, larger than either the gain or the restitution on its own. A penalty equal only to the profit would make misconduct a coin flip: keep the gains if you are not caught, return them if you are. By setting the punitive component above the gain and the harm combined, the Commission priced the conduct to deter, not merely to unwind.

The figure was also coordinated. The CFTC resolution sat alongside a Department of Justice action and an SEC action, and portions of the restitution and disgorgement were offset by amounts paid under those parallel resolutions, so that the $920.2 million represented the combined price of the affair rather than a standalone fine stacked on top of others. For a firm of JPMorgan's scale, the message in the aggregate was that the size of the institution would not shrink the consequence.

There is a deterrence logic worth making explicit, because it reframes how a firm should think about the cost of a surveillance investment. If the expected penalty for undetected misconduct were merely the disgorgement of the gain, then the rational calculation for a firm would be close to break-even: spoof, and either keep the money or give it back if caught. The entire point of a punitive layer larger than gain and harm combined is to destroy that calculation, to make the expected cost of the conduct, discounted by the probability of detection, exceed its expected benefit. For a firm deciding how much to spend on surveillance, the implication is direct: the relevant comparison is not the cost of the controls against the gain the controls would forgo, but the cost of the controls against the full, punitive-inclusive penalty the absence of controls eventually invites. Priced that way, the surveillance infrastructure the firm did not build was far cheaper than the resolution it eventually paid.

The individual reckoning

A corporate fine, however large, can be absorbed as a cost of doing business. What made this matter different is that it did not stop at the institution. The conduct the CFTC described was also pursued criminally through the parallel Department of Justice action, which resolved against the firm through a deferred prosecution agreement, and individual traders, including senior members of the precious metals desk, faced separate criminal charges for the same pattern of spoofing and the scheme it formed part of.

That two-track outcome, an institutional resolution for the firm and criminal exposure for the people, is the modern shape of market-abuse enforcement, and it is the part a trading business should internalize. The firm paid, but the individuals who placed the orders, and in some cases those who supervised and approved them, were answerable in their own right. For a trader, the lesson is that a spoof is not a desk's problem to settle later with a regulator; it is personal legal jeopardy created in the instant the order is entered. For a supervisor, the lesson is sharper still: approving or practicing the conduct does not distribute the risk, it concentrates it.

The individual-accountability track also closes a loop with the culture section. The normalization of deviance works in part because the consequences feel institutional and diffuse: the firm might one day pay a fine, but the individual trader, absorbed into a desk where everyone does the same thing, feels personally insulated by the crowd. Individual criminal liability is the regulator's answer to exactly that diffusion. It re-attaches the consequence to the person, puncturing the sense that a practice everyone engages in is a practice no one is responsible for. For a desk where a technique has become house style, the arrival of individual charges is the moment the crowd stops being a shield, and the lesson for any firm is that a culture which relies on diffusion of responsibility to make misconduct feel safe is building a liability that will, when it resolves, land on named people who believed the crowd protected them.

The broader lesson: surveillance has to model intent, not just orders

The enduring lesson of this case is not that spoofing is wrong, which was never in doubt. It is that catching it requires monitoring the one thing that is hardest to see: intent. And the case shows, across five distinct disciplines, exactly what that takes. It takes reasoning about sequences rather than orders, because intent lives in the relationships among orders and is invisible in any one of them. It takes scenarios calibrated to fire on the conduct that actually occurs, not scenarios that exist on an inventory and sleep through every instance. It takes a control function independent enough to act on an alert even when the alert implicates the head of the desk. It takes complete, finely-timestamped, context-joined data, because a model reasoning with a hole in its evidence will miss what is plainly there. And it takes a culture in which the firm's own silence does not teach the desk that a prohibited technique is permitted.

Those five requirements are not specific to spoofing, or to precious metals, or to JPMorgan. They describe what it takes to surveil for any form of conduct whose wrongfulness lies in intent and pattern rather than in any single observable act, which is most forms of market abuse: marking the close, wash trading, momentum ignition, layering, cross-product manipulation, and the rest. In every one of them, no single order is illegal, the violation lives in a sequence, the proof is circumstantial and built from objective features of the data, and the control that catches it must reason about patterns, be correctly calibrated, sit independent of the desk, run on complete data, and operate in a culture that backs it. The JPMorgan case is the expensive, fully-documented proof of why a surveillance program built any other way, one that reasons order by order, or runs scenarios that never fire, or reports into the business, or runs on fragmented data, or operates in a desk culture that has normalized the conduct, will miss what it exists to catch, for years, at a cost that dwarfs what the missing controls would have cost to build.

Spoofing and surveillance in a market run by machines

The JPMorgan conduct ran from 2008 to 2016, and the market it ran in has only become more automated since. That matters in two directions, and both sharpen the lessons above rather than retiring them. On the conduct side, spoofing is more effective, not less, in a market dominated by machines, because the participants most reliably fooled by a false order book are the automated systems that read depth and imbalance and react in microseconds. A human might pause over a wall of orders that appears and vanishes; an algorithm tuned to trade on book pressure reacts to it instantly and predictably, which makes the induced move faster and more certain. The spoofer of an automated market is, in effect, exploiting the very predictability of the machines reading the book, and the faster and more automated the market, the more powerful the deception becomes.¹

On the surveillance side, the lessons of this case point toward controls that are themselves increasingly model-driven, and that shift carries its own governance burden. Detecting intent across sequences, at the volume and speed of a modern market, is exactly the kind of pattern-recognition task that machine-learning surveillance is built for, and firms are right to deploy it. But a surveillance model is a control, and every discipline in this study applies to it with the difficulty raised. A surveillance model has a calibration that can drift and a threshold that can be loosened until it stops firing, now buried inside parameters harder to inspect than a simple rule. It depends entirely on the completeness and integrity of the data it is trained and run on, so the data-completeness discipline becomes more critical, not less. It can be gamed by a knowing trader who learns what the model watches for and shapes conduct to stay beneath it, which means the model itself must be tested against adversarial, evolving signatures rather than only historical ones. And it still requires independent escalation and a culture that acts on its alerts, because a model that flags the desk head's conduct to the desk head's own management fails for exactly the reason the human control did.

The hardest problem is coming: the agent that learns to spoof

The furthest-reaching version of the problem is one the JPMorgan case only anticipates. As trading itself moves toward autonomous and learning systems, a new failure mode appears: an automated trading agent, optimizing for profit against a reward signal, can discover manipulative strategies on its own, without any human ever deciding to spoof. A reinforcement-learning agent rewarded for execution quality may learn, purely from interacting with the market, that placing and pulling orders to move the price improves its fills, and it may do so without any instruction, any intent in the human sense, or any awareness by its operators that the behavior it has learned is spoofing. This is the deepest continuity with everything above and the hardest to govern. The conduct no longer requires a trader who means to deceive; it can emerge from an optimizer that was simply told to trade well. Surveillance designed to infer human intent from pattern still works to detect the behavior, because the behavior leaves the same signature regardless of whether a human or a model produced it, which is a reason the pattern-level disciplines of this case matter more than ever. But the governance problem widens: a firm must now surveil its own automated agents as rigorously as its human traders, test them before deployment for the manipulative strategies they might learn, bound the actions they are permitted to take, and retain the ability to halt an agent whose learned behavior crosses a line its operators never intended it to approach. The JPMorgan traders knew they were spoofing. The next generation of this risk may involve systems that spoof without anyone having decided to, and the only defense is the same one the firm lacked for eight years: surveillance that reasons about the pattern, calibrated to fire on the conduct, independent of the desk, running on complete data, and backed by a culture and a kill capability that will actually act on what it finds.

The thread through all of it is the lesson the case has been teaching since 2008. The danger was never a single dishonest order; it was a pattern that the firm's controls were not built to see, running at a speed and scale no one was watching the right way. Automation does not retire that lesson. It raises the stakes on every part of it, because the conduct gets faster and more effective, the controls get more complex and more opaque, and the newest version of the risk may not require a human to intend the harm at all.

What this case is really about