When the SEC issued a formal order of investigation alleging market manipulation by a mid-size broker-dealer's proprietary trading desk, Law & Forensics' forensic reconstruction of 11 million order events over 18 months gave regulators the data-driven narrative that ended the investigation without charges or sanctions.
The situation
A mid-size U.S. registered broker-dealer operating a principal electronic market-making desk received a formal order of investigation from the SEC Division of Enforcement. Staff alleged that the firm's algorithmic trading system had engaged in layering and spoofing — placing and rapidly canceling large orders to create the appearance of supply or demand, then trading on the artificial price movement — across equities and options markets over an 18-month period.
The investigation came with significant production demands: 11 million order-entry, modification, and cancellation events across 14 trading venues; communications from six traders and three quantitative developers; algorithm source code; and supervisory review records. The firm faced the prospect of a Wells Notice, public enforcement action, and disgorgement of approximately $22 million in market-making profits. A parallel FINRA examination was also underway.
The fundamental challenge was not legal but forensic: market-making algorithms legitimately cancel a high percentage of orders as conditions change. The line between legal, liquidity-providing behavior and manipulative layering lives entirely in the data — in order sequencing, timing intervals, fill rates, and the relationship between cancellations and subsequent proprietary trades. Without an independent, rigorous forensic reconstruction, the firm had no credible response to staff's pattern-based allegations.
Our approach
Law & Forensics was retained as both a forensic expert and a litigation-support partner to outside defense counsel. The engagement proceeded in three stages.
Forensic data reconstruction. The team ingested the full 11-million-event order record from 14 venue-level FIX logs, normalized the data across venue-specific timestamp formats and order-type taxonomies, and reconstructed a unified, millisecond-resolution order-activity timeline for each trader and algorithmic strategy under examination. The reconstruction process identified and resolved significant timestamp-synchronization discrepancies between venue logs and the firm's internal order-management system — discrepancies that, left unaddressed, would have made some of the firm's most aggressive but lawful market-making activity appear manipulative.
Algorithmic-intent analysis. Law & Forensics developed an analytical framework distinguishing legitimate market-making from manipulative layering across five dimensions: order-to-fill ratios by venue and instrument class, cancellation timing relative to market data events, directionality of proprietary positions after large order cancellations, the firm's role as a liquidity provider versus liquidity taker over the investigation period, and comparison of the firm's cancellation patterns against published academic benchmarks for registered market makers. The analysis demonstrated that the firm's cancellation rates were within normal ranges for its strategy type and that its post-cancellation trading did not systematically benefit from artificial price movements it had created.
Algorithm source-code protection. Staff sought production of the algorithmic trading source code in unredacted form. Law & Forensics supported outside counsel's successful designation of the code as a trade secret under the Defend Trade Secrets Act and produced instead a functional specification describing the algorithm's decision logic at a level of detail sufficient to explain the behavioral patterns in the order data — without exposing the proprietary implementation.
Expert presentation to SEC staff. A Law & Forensics senior expert presented the forensic findings to SEC staff in a three-hour technical session, walking through the data reconstruction methodology, the algorithmic-intent framework, and the specific order sequences that staff had identified as potentially manipulative, explaining each in its full market-data context.
The impact
SEC staff accepted the forensic reconstruction and closed the investigation without issuing a Wells Notice or recommending charges. The $22 million in trading profits that had faced potential disgorgement was retained. The algorithm source code was protected from further production. The parallel FINRA examination closed on the same record. Following the investigation, the firm retained Law & Forensics to design and implement an enhanced real-time surveillance system calibrated to its specific market-making strategies — converting the defense investment into a permanent operational safeguard.
| Metric | Result |
|---|---|
| Order events forensically reconstructed and analyzed | 11M across 14 venues |
| Trading profits at risk | $22M retained |
| Regulatory outcome | Investigation closed, no charges |
| Time from formal order of investigation to closure | 14 months |
| Algorithm source code protected from production | Yes |
