Guy trading at home caused the flash crash

Hey look, they caught the guy who caused the flash crash of 2010! His name is Navinder Singh Sarao, and he lives in London and in 2009 he asked someone to help him build a spoofing robot:

On or about June 12, 2009, SARAO sent an email to a representative of his FCM in which he explained that he “need[ed] to get in touch with a [] technician [at the company that provided his trading software (“Trading Software Company #1″)] that will be able to programme for me extra features on [the software],” namely, “a cancel if close function, so that an order is canceled if the market gets close.”

Sarao was trading E-mini S&P 500 futures contracts, but he wanted a more convenient way to not trade them, so he e-mailed his FCM (futures commission merchant, i.e. broker) for help automating that. The idea is that he would put in a big order to sell a whole bunch of futures at a price a few ticks higher than the best offer. So probably he wouldn’t sell any futures, since he wasn’t offering the best price. But he had to keep constantly updating his orders to keep them a few ticks higher than the best offer, to make sure that he didn’t accidentally sell any futures as the market moved. And that’s a bit of a pain, so he programmed an algorithm to do it for him. Though he also seems to have done similar things manually, to support the algorithm’s efforts, or to stave off boredom while the algorithm did its thing.

The point of this — according to the federal prosecutors, the Federal Bureau of Investigation and the Commodity Futures Trading Commission, who are not happy with Sarao — is that by placing all these fake sell orders, Sarao would artificially drive down the price of the E-mini futures. It’s classic spoofing: He’d place a lot of big orders to sell, everyone else would say, “Ooh look at all those big sell orders, I’d better sell too,” they’d sell, the market would go down, he’d buy, he’d turn off his algorithm, everyone else would say, “Oh hey never mind, things are great again, there are no more big sell orders,” they’d buy, the price would go back up, and Sarao would sell the futures he’d bought at a lower price a moment ago. We’ve talked about spoofing before, and I’ve always been a little troubled that it works, but what can I say, it works.

On May 6, 2010, according to the authorities, it worked a little too well: Sarao did such a good job of driving down the price of the E-mini future that he caused a flash crash in which “investors saw nearly $1 trillion of value erased from U.S. stocks in just minutes.” I’ll put some more details downstairs but honestly they are boring details. Sarao traded a ton of E-mini futures during the flash crash — “62,077 E-mini S&P contracts with a notional value of $3.5 billion” — and made “approximately $879,018 in net profits” that day, or a profit of about 2.5 basis points on the notional amount, which I guess isn’t bad for one day’s work. He did this by, basically, putting in orders to sell thousands of contracts away from the best offer. Those orders were never executed, or intended to be executed, but they tricked people into thinking that there was a lot more selling interest than there actually was. That combined with a collapse in buying interest — at one point Sarao’s fake sell orders alone “were almost equal to the entire buyside of the Order Book” — to create a collapse in prices. He profited from those collapsing prices by selling high and buying back lower. It’s a pretty straightforward spoofing story.

So straightforward that one of the biggest puzzles here is why it took so long — and the help of a whistleblower — for regulators to figure it out. They came tantalizingly close:

As reflected in correspondence with both SARAO and an FCM he used, the CME observed that, between September 2008 and October 2009, SARAO had engaged in pre-opening activity — specifically, entering orders and then canceling them — that “appeared to have a significant impact on the Indicative Opening Price.” The CME contacted SARAO about this activity in March 2009 and notified him, via correspondence dated May 6, 2010, that “all orders entered on Globex during the pre-opening are expected to be entered in good faith for the purpose of executing bona fide transactions.” The CME provided a copy of the latter correspondence to SARAO’s FCM, which suggested to SARAO in an email that he call the FCM’s compliance department if he had any questions. In a responsive email dated May 25, 2010, SARAO wrote to his FCM that he had “just called” the CME “and told em to kiss my ass.”

Emphasis added because come on: The futures exchange wrote to Sarao on the day of the flash crash, telling him to stop spoofing, and he called them back “and told em to kiss my ass.” And then regulators pondered that reply for five years before deciding that they’d prefer tohave him arrested in London and extradited to face criminal spoofing charges. One conclusion here might be that rudeness to regulators really works.

Even odder, Sarao didn’t just retire to a supervillain lair after the flash crash. The CFTC lists “at least” 12 days on which he allegedly manipulated the futures market; eight of them came after the flash crash, and he allegedly continued to manipulate the futures market more or less up to the moment he was arrested. The CFTC claims that Sarao basically started his spoofing career by causing the flash crash, and then went ahead and kept spoofing for another five years without much interruption. I guess he got more subtle at it? Not very subtle though; he was a consistently large trader, “placing, repeatedly modifying, and ultimately canceling multiple 200-, 250-, 300-, 400-, 500-, 550-, 600-, and 900-lot sell orders,” versus an average order size of seven contracts. He also seems to have had some patterns (like putting in orders for exactly 188 or 289 contracts that never executed) that you’d think would make him easier for regulators or exchanges to spot. If regulators think that Sarao’s behavior on May 6, 2010, caused the flash crash, and if they think he continued that behavior for much of the subsequent five years, and if that behavior was screamingly obvious, maybe they should have stopped him a little earlier?

Also, I mean, if his behavior on May 6, 2010, caused the flash crash, and if he continued it for much of the subsequent five years, why didn’t he cause, you know, a dozen flash crashes?

So I mean … maybe he didn’t cause the flash crash? There’s a jointCFTC and Securities and Exchange Commission report that came out a few months after the flash crash that blames it on an effort by Waddell & Reed to sell some E-mini futures with an inept algorithm; lots of people have long had their doubts about that theory, and now the CFTC itself seems to have abandoned it in favor of the new one-guy-in-London theory. You could maintain a skeptical attitude about the one-guy-in-London theory too though. The CFTC says that Sarao’s “Layering Algorithm” was turned on between 11:17 a.m. and 1:40 p.m. Central time, and that “the Layering Algorithm caused the price in the E-mini S&P contract to be temporarily artificially depressed while the Layering Algorithm was active. Once the Layering Algorithm was turned off and the orders were canceled, the market price typically rebounded.” But the CFTC also describes the flash crash this way:

Between 1:41 and 1:44 p.m. CT, the E-mini S&P market price suffered a sharp decline of 3%. Then, at 1:45 p.m. CT, in a matter of 15 seconds, the E-mini S&P market price declined another 1.7%. The price crash in the E-mini S&P market quickly spread to major U.S. equities indices which suffered precipitous declines in value of approximately 5 to 6%, with some individual equities suffering much larger declines.

Get that? The flash crash happened when Sarao’s algorithm had been turned off, and the price should have been rebounding:

I mean, look, he probably didn’t help. The markets were nervous, and his spoof orders probably made them more nervous. Oneintriguing theory is that his orders interacted badly with Waddell & Reed’s algorithm: Perhaps Waddell sold its futures too quickly because its algorithm thought that there was a lot of selling pressure behind it. But Sarao, according to the CFTC, was 20-29 percent of the sell-side pressure at his peak, and almost none of his orders executed. Other people provided the other 71-80 percent of the sell orders, and at least some of their orders executed, causing prices to actually go down. It seems unlikely that Sarao’s not trading caused the whole crash. And, to be fair, the authorities say that Sarao’s “manipulative activities contributed to an extreme E-mini S&P order book imbalance that contributed to market conditions that led to the Flash Crash,” rather than coming out and saying that the crash was his fault. At the very least, though, he picked the wrong day to do billions of dollars worth of spoofing.

It’s worth keeping the notions of “spoofing” and “high-frequency trading” carefully separated. Sarao may have been a spoofer, but he doesn’t seem to have been doing the sort of high-speed algorithmic trading that usually qualifies as “HFT.” He himself claimed to be “‘an old school point and click prop trader’ who had ‘always been good with reflexes and doing things quick,'” and the “Layering Algorithm” that he used was a customized version of “a program that allowed non-programmers to engage in automated trading using spreadsheet commands and functions.” He was also the sole owner and employeeof his trading firm, which he “operated from his residence.” In style and substance he is not all that different from other spoofers we have known and loved, who did their high-speed trading by just punching keys really fast.

I have always been impressed and puzzled that low-tech spoofers have much success ripping off whomever they rip off. It’s such a minimal fraud; it’s just saying that you want to sell when you don’t want to sell. It’s always surprising that that could have a major effect on markets. John Arnold has argued here at Bloomberg View that spoofing only hurts front-running high-frequency traders, whileothers point out that “algorithmic trading tools are used by a wide class of traders,” including long-term investors like Waddell & Reed who use algorithms to try to avoid the front-running HFTs. But the FBI’s and CFTC’s theory here is far more troubling: It suggests that existing algorithms are not just dumb enough to give spoofers some of their money, but dumb enough to give spoofers so much of their money that they destabilize the financial markets. It’s not especially confidence-inspiring to read that a guy with a spreadsheet can trick everyone into thinking that the market is crashing, and thereby cause the market to crash.

1. Also I guess to keep his reflexes sharp. From the FBI:
   

   On or about May 29, 2014, SARAO provided written responses to a questionnaire that had been submitted to him by the United Kingdom’s Financial Conduct Authority, at the request of the CFTC pursuant to the International Organization of Securities Commissions Multilateral Memorandum of Understanding. In those responses, which I have reviewed, SARAO claimed that he was “an old school point and click prop trader” who had “always been good with reflexes and doing things quick.”

2. People, by which I mean algorithms, really rely on the order book to tell them what prices will do next. From the CFTC:
   

   Many market participants, relying on the information contained in the Order Book, consider the total relative number of bid and ask offers in the Order Book when making trading decisions. For instance, if the total number of sell orders significantly outweighs the total number of buy orders, market participants may believe a price drop is imminent and trade accordingly. Similarly, if the balance of buy and sell orders changes abruptly, market participants may believe the new orders represent legitimate changes to supply and demand and therefore trade accordingly. Further, many market participants utilize automated trading systems that analyze the market for these types of order imbalances and use that information to determine trading strategies. Consequently, actions in the Order Book can, and do, affect the price of the E-mini S&P.

3. Here’s the CFTC’s more technical description:
   

   The “2010 Flash Crash” refers to an event that occurred on May 6, 2010 in the U.S. financial markets. Between 1:41 and 1:44 p.m. CT, the E-mini S&P market price suffered a sharp decline of 3%. Then, at 1 :45 p.m. CT, in a matter of 15 seconds, the E-mini S&P market price declined another 1.7%. The price crash in theE-mini S&P market quickly spread to major U.S. equities indices which suffered precipitous declines in value of approximately 5 to 6%, with some individual equities suffering much larger declines. After a few minutes, markets quickly rebounded to near previous price levels. In their Preliminary Findings Regarding the Events of May 6, 2010, the CFTC and the Securities and Exchange Commission noted that a significant imbalance between sell orders and buy orders contributed to a sudden loss of liquidity in the E-mini S&P market. This loss of liquidity, in conjunction with other market events, directly contributed to the E-mini S&P price crash.

4. From the FBI:
   

   SARAO’s use of the dynamic layering technique was particularly intense in the hours leading up to the Flash Crash. SARAO used the technique continuously from 11:17 a.m. until 1:40 p.m. SARAO began this cycle by placing the following five sell orders nearly simultaneously at approximately 11:17:38.782 a.m.: (1) 600 lots at $1,156.50; (2) 600 lots at $1,156.75; (3) 600 lots at $1,157.00; (4) 600 lots at $1,157.25; and (5) 600 lots at $1,157.50. At approximately 1:13 p.m., SARAO added a sixth sell order for 600 lots, bringing the total to 3,600 lots. The orders were replaced or modified more than 19,000 times before SARAO canceled them, without having executed any of them, at approximately 1:40:12.553 p.m.

   The CFTC provides some context:

   These orders represented approximately $170 million to over $200 million worth of persistent downward pressure on the E-mini S&P price and, over the next two hours, represented 20-29% of the entire sell-side of the Order Book. The orders were replaced or modified more than 19,000 times before being canceled at 1 :40 p.m. CT. At that time, the Order Book was severely imbalanced and Defendants’ 3,600 Layering Algorithm orders were almost equal to the entire buyside of the Order Book.

   And he also did some manual spoofing, putting in manual orders to sell 188 or 289 contracts, which for some reason seem to have been his lucky numbers:

   At the same time that SARAO ran this lengthy cycle of the dynamic layering technique, he aggressively used the 188-and-289-lot spoofing technique. Between 12:33 p.m. and 1:45 p.m., SARAO placed 135 sell orders consisting of either 188 or 289 lots, for a total of 32,046 contracts. SARAO canceled 132 of these orders before they could be executed.

   So all the dumb algorithms looked at the order book and saw a lot of sellers — some real, Sarao fake — and not so many buyers, and they panicked and started selling too, and Sarao was there to pick up the pieces:

   During this two-hour period, Defendants traded 62,077 E-mini S&P contracts with a notional value of $3.5 billion.

   The FBI says that “In total, SARAO obtained approximately $879,018 in net profits from trading E-Minis that day.”

5. Here’s how the CFTC characterizes his timing:
   

   The Commission has presented evidence that, from at least April 2010 to January 2012; July 2012 to June 2014; and September 2014 to present (“Relevant Period”), Defendants have manipulated, attempted to manipulate and/or spoofed the near month of the Chicago Mercantile Exchange E-mini S&P futures contract (“E-mini S&P”). Similarly, the CFTC has presented evidence that Defendants have profited over $40 million from E-mini S&P trading during the Relevant Period.

6. From the FBI:
   

   While SARAO’s dynamic layering technique was the most prominent manipulative technique he used, it was not the only one. Based on my discussions with Consulting Group representatives, I understand that analysts have also identified SARAO’s repeated placement of 188- and/or 289-lot orders on the sell side of the market, nearly all of which he canceled before the orders were executed. Based on analysis of SARAO’s trading activity, SARAO appears to have used this 188-and-289-lot spoofing technique in certain instances to intensify the manipulative effects of his dynamic layering technique, by further contributing to the E-Mini order book imbalance (i.e., the difference in the quantity of sell-side and buy-side orders) and corresponding price impact, which SARAO then exploited through his actual trading activity.

   What is more, Consulting Group analysts have identified a third technique whereby SARAO “flashed” a large 2,000-lot order on one side of the market, executed an order on the other side of the market, and canceled the 2,000-lot order before it was executed

7. From DealBook today:
   

   The arrest casts a harsh light on the original explanation for the crash, which appears to have been completely wrong.

   After the flash crash, the Securities and Exchange Commission and the Commodity Futures Trading Commission produced a report that laid the blame on one trade from Waddell & Reed, a brokerage firm based in Kansas City, Mo. A Dutch academic later challenged that view, saying the answer was more complex.

8. Note that the time scale is in Eastern time, one hour ahead of Central.To be fair, the CFTC also says (paragraph 77) that he continued placing fake 188/289-lot orders manually until 1:45 p.m. Central. But then it says (paragraph 78) that “Between 11:17 a.m. CT and 1:40 p.m. CT, Defendants’ actions contributed to an extreme order book imbalance in the E-mini S&P market,” suggesting that the main effect was before the flash crash.
9. One speculative note: The 2010 SEC/CFTC report (page 21) shows the E-mini market depth, with a sharp drop-off of both buying and selling depth at about 1:45 p.m. Central/2:45 Eastern. Is that related to Sarao, who was allegedly 20+ percent of the sell order book? If he actually dropped off at 1:45, then my timeline in the text is off, and he might have been causing selling pressure until 1:45. If he dropped off earlier, though, might the disappearance of both buying and selling orders have caused trouble, as more traders decided that everyone else was panicking and shutting off their algorithms, and so they should too?
10. And, crucially, actually being ready to sell. The FBI notes that Sarao “acknowledged that he traded large volumes of E-Minis in large lot orders, but again asserted that his orders ‘were 100% at risk, 100% of the time.'” The FBI never denies that they were: If the price had moved against Sarao faster than his algorithm could cancel (if, for instance, a big buyer came in and took out several price levels all at once), he’d be selling a lot of futures.A lot of trader types view this as the difference between manipulation and legitimate trading: If you’re at risk, it’s legal. It should be said that this does not seem to be the CFTC’s or FBI’s view.

I mean, “front-running.” Not in the legal sense of front-running. If you’re into this debate you know what I mean; if you’re not, probably best to keep it that way.

Originally Published by Matt Levine at Bloomberg.