← datatap.org

Detection methodology

23 patterns. Every detector states its signature, its regulatory anchor, where its thresholds come from, and the planted ground truth it proves itself against on every test run. Thresholds marked maker-checker change only through a proposal a second identity approves, with a backtest attached.

God-mode settlement outlierPre-catalyst accumulation clusterPre-catalyst accumulation (stream)Serial pre-catalyst positioningProbability-bounded spoofing at $0.99Probability-bounded spoofing (stream)Layering (multi-level spoof)Quote stuffingWash trading across linked walletsWash trading (stream)Money-pass / profit transferParity violation at the gatewayPump-and-reversal (momentum ignition)Momentum ignition (stream)Marking the settleFront-running patternCorrelated-contract structuringCluster position-limit breachHeightened-monitoring reviewBehavioral deviationSettlement integrityMM quoting obligation shortfallParticipant OTR breach

God-mode settlement outlier

Signature. Settled win rate ≥90% with binomial z ≥ det_godmode_z against the venue's own per-market expectation, ≥20 settlements

anchor · CFTC 180.1 · 38.156  ·  thresholds · det_godmode_z (maker-checker)  ·  ground truth · 38-settlement fixture, 94% win rate

Investigation checklist analysts work on this pattern
  1. Compare the account's win-rate to the market's computed expectation, not 50%
  2. Cross-reference entries against catalyst timestamps (pre-news positioning)
  3. Resolve the account's cluster — split accounts dilute the signal
  4. Check for a declared insider relationship on the restricted list

Pre-catalyst accumulation cluster

Signature. ≥2 linked accounts accumulating one side >60s before the first public catalyst

anchor · CFTC 180.1 · SA 26-08  ·  thresholds · structural  ·  ground truth · 3-account ring buying 4.3min pre-wire

Investigation checklist analysts work on this pattern
  1. Confirm the cluster's shared attributes (funding, device, subnet) on the graph
  2. Verify same-side accumulation inside the pre-catalyst window on the replay
  3. Identify the catalyst source and whether it was public at entry time
  4. Assess CFTC 180.1 misappropriation elements before referral

Pre-catalyst accumulation (stream)

Signature. ≥3 same-cluster buyers inside the 20s window before a timestamped catalyst, on continuous flow

anchor · CFTC 180.1 · SA 26-08  ·  thresholds · structural (20s window)  ·  ground truth · planted ring 7–15s before the CHIEFS wire

Investigation checklist analysts work on this pattern
  1. Confirm the detection facts against the stream replay (DVR)
  2. Identify every account involved and resolve to operator clusters
  3. Check restricted-person and participant obligations for each account
  4. Record the disposition rationale on the reviewer notes

Serial pre-catalyst positioning

Signature. One account inside ≥2 different markets' pre-catalyst windows with ≥60% wins over ≥3 settlements

anchor · CFTC 180.1 · SA 26-08  ·  thresholds · structural  ·  ground truth · planted repeat winner across 3 markets

Investigation checklist analysts work on this pattern
  1. Confirm the detection facts against the stream replay (DVR)
  2. Identify every account involved and resolve to operator clusters
  3. Check restricted-person and participant obligations for each account
  4. Record the disposition rationale on the reviewer notes

Probability-bounded spoofing at $0.99

Signature. ≥5 sub-500ms cancel sequences at the bound with cancel-to-fill ≥ det_spoof_ratio

anchor · CFTC 180.1 · CP 4  ·  thresholds · det_spoof_ratio (maker-checker)  ·  ground truth · 11 place/pull cycles at $0.99

Investigation checklist analysts work on this pattern
  1. Confirm cancel-to-fill on the flagged size from the book replay
  2. Check the account's fills on the opposite side during the cancel sequences
  3. Compare against the det_spoof_ratio in force that day
  4. Check the participant's declared OTR obligation

Probability-bounded spoofing (stream)

Signature. ≥10 bound-region (≥$0.95) cancels with cancel-to-fill ≥ det_spoof_ratio, SQL-aggregated

anchor · CFTC 180.1 · CP 4  ·  thresholds · det_spoof_ratio (maker-checker)  ·  ground truth · planted 12-cycle bound stack

Investigation checklist analysts work on this pattern
  1. Confirm the detection facts against the stream replay (DVR)
  2. Identify every account involved and resolve to operator clusters
  3. Check restricted-person and participant obligations for each account
  4. Record the disposition rationale on the reviewer notes

Layering (multi-level spoof)

Signature. ≥3 price levels stacked one side (≥9 adds, ≥2/3 canceled) with opposite-side fills

anchor · CFTC 180.1(a)(1) · CP 4  ·  thresholds · structural  ·  ground truth · planted 3-level staircase, 8 rounds

Investigation checklist analysts work on this pattern
  1. Confirm the stacked levels and cancel share on the book replay
  2. Verify opposite-side fills landed while the stack was resting
  3. Check for kill-switch or throttle triggers on the participant
  4. Compare with the single-level bound-spoof history for the account

Quote stuffing

Signature. ≥100 book messages, ≥10× market median per-account count, sustained ≥1 msg/s

anchor · CP 4 · 38.157 · OTR  ·  thresholds · structural (relative to population)  ·  ground truth · planted 120-message burst in 90s

Investigation checklist analysts work on this pattern
  1. Confirm message intensity against the market's median per account
  2. Check the participant's OTR obligation and any throttle events
  3. Assess latency impact on other participants during the burst
  4. Identify whether the burst coincided with a catalyst or settlement

Wash trading across linked wallets

Signature. Circular volume across ≥3 wallets with net transfer ≤2% of gross

anchor · CEA 4c(a) · FinCEN / BSA  ·  thresholds · structural  ·  ground truth · 9-wallet loop, net ≤2%

Investigation checklist analysts work on this pattern
  1. Confirm the wallets resolve to one operator (cluster confidence)
  2. Net the round-trip volume against gross to confirm no economic transfer
  3. Check whether volume incentives or leaderboards were in force
  4. Identify any counterparties outside the cluster

Wash trading (stream)

Signature. ≥3 offsetting cycles (equal px/qty, opposite sides, ≤5s) between same-cluster accounts

anchor · CEA 4c(a) · 38.152  ·  thresholds · structural + entity resolution  ·  ground truth · planted 6-cycle same-cluster pair

Investigation checklist analysts work on this pattern
  1. Confirm the detection facts against the stream replay (DVR)
  2. Identify every account involved and resolve to operator clusters
  3. Check restricted-person and participant obligations for each account
  4. Record the disposition rationale on the reviewer notes

Money-pass / profit transfer

Signature. ≥6 offsetting legs both directions at skewed prices, |net| ≥15% of premium exchanged; no graph link required

anchor · CEA 4c(a) · FinCEN / BSA  ·  thresholds · structural  ·  ground truth · planted skewed round trips (fair-price wash provably clear)

Investigation checklist analysts work on this pattern
  1. Confirm the detection facts against the stream replay (DVR)
  2. Identify every account involved and resolve to operator clusters
  3. Check restricted-person and participant obligations for each account
  4. Record the disposition rationale on the reviewer notes

Parity violation at the gateway

Signature. Same-account YES+NO implied sum > $1.02

anchor · CP 4 · binary microstructure  ·  thresholds · structural ($1.02 bound)  ·  ground truth · $1.03 implied fixture

Investigation checklist analysts work on this pattern
  1. Confirm the detection facts against the stream replay (DVR)
  2. Identify every account involved and resolve to operator clusters
  3. Check restricted-person and participant obligations for each account
  4. Record the disposition rationale on the reviewer notes

Pump-and-reversal (momentum ignition)

Signature. ≥50% of buy volume through a ≥$0.25 run-up, ≥70% exited after the peak

anchor · CFTC 180.1 · Module 03  ·  thresholds · structural  ·  ground truth · 8-buy pump, 4-sell exit fixture

Investigation checklist analysts work on this pattern
  1. Confirm the detection facts against the stream replay (DVR)
  2. Identify every account involved and resolve to operator clusters
  3. Check restricted-person and participant obligations for each account
  4. Record the disposition rationale on the reviewer notes

Momentum ignition (stream)

Signature. ≥6 same-account buys in 30s moving price ≥$0.20, ≥60% exited within 60s

anchor · CFTC 180.1 · Module 03  ·  thresholds · structural  ·  ground truth · planted burst $0.44→$0.72

Investigation checklist analysts work on this pattern
  1. Confirm the detection facts against the stream replay (DVR)
  2. Identify every account involved and resolve to operator clusters
  3. Check restricted-person and participant obligations for each account
  4. Record the disposition rationale on the reviewer notes

Marking the settle

Signature. ≥50% of final-15s pre-settlement volume from one account, ≥4 trades, ≥$0.10 directional move

anchor · CEA 6(c) · 180.1 · CP 4  ·  thresholds · structural (15s window)  ·  ground truth · planted 5-buy walk into the settle

Investigation checklist analysts work on this pattern
  1. Confirm the final pre-settlement window buying on the replay
  2. Compare the settle print to the pre-window VWAP
  3. Identify the account's open position benefiting from the mark
  4. Check the market registry's declared settle time

Front-running pattern

Signature. Small trade ≤1/5 size landing 1–3s before a ≥2,000-qty same-side print, ≥4 recurrences per pair

anchor · CFTC 180.1 · CP 12  ·  thresholds · structural  ·  ground truth · planted 5-recurrence leader/follower pair

Investigation checklist analysts work on this pattern
  1. Confirm the detection facts against the stream replay (DVR)
  2. Identify every account involved and resolve to operator clusters
  3. Check restricted-person and participant obligations for each account
  4. Record the disposition rationale on the reviewer notes

Correlated-contract structuring

Signature. Combined exposure ≥2× group median across ≥2 related books (shared event prefix)

anchor · CP 5 · aggregation  ·  thresholds · structural (relative)  ·  ground truth · planted cross-book structurer

Investigation checklist analysts work on this pattern
  1. Confirm the detection facts against the stream replay (DVR)
  2. Identify every account involved and resolve to operator clusters
  3. Check restricted-person and participant obligations for each account
  4. Record the disposition rationale on the reviewer notes

Cluster position-limit breach

Signature. Resolved-cluster aggregate exposure > det_cluster_limit — the operator, not the account

anchor · Core Principle 5  ·  thresholds · det_cluster_limit (maker-checker)  ·  ground truth · seeded ring over the limit

Investigation checklist analysts work on this pattern
  1. Confirm the detection facts against the stream replay (DVR)
  2. Identify every account involved and resolve to operator clusters
  3. Check restricted-person and participant obligations for each account
  4. Record the disposition rationale on the reviewer notes

Heightened-monitoring review

Signature. Watched account with ≥3 settlements and ≥60% wins — a tighter bar than god-mode

anchor · Watchlist · 38.156  ·  thresholds · structural (watchlist-gated)  ·  ground truth · watchlisted winner fixture

Investigation checklist analysts work on this pattern
  1. Confirm the detection facts against the stream replay (DVR)
  2. Identify every account involved and resolve to operator clusters
  3. Check restricted-person and participant obligations for each account
  4. Record the disposition rationale on the reviewer notes

Behavioral deviation

Signature. ≥10 trades profiled, one print ≥10× the account's own median size

anchor · 38.156 · behavioral profiling  ·  thresholds · structural (per-actor)  ·  ground truth · planted 12×100 then 5,000

Investigation checklist analysts work on this pattern
  1. Confirm the profile break against the account's own median (not population)
  2. Check the settlement that followed the outsized print
  3. Cross-reference against catalysts and the restricted list
  4. Decide whether to watch the account for recurrence

Settlement integrity

Signature. Same account/market settled with differing outcomes ≥30s apart

anchor · CP 3 · settlement records · 1.31  ·  thresholds · structural (30s gap excludes batch artifacts)  ·  ground truth · planted win-then-loss re-settlement

Investigation checklist analysts work on this pattern
  1. Confirm both settlement records and the gap between them
  2. Identify the oracle or operator action behind the re-settlement
  3. Check every position affected by the flip
  4. Record the corrective action and the reason on the record

MM quoting obligation shortfall

Signature. Declared desk account resting quotes in <50% of its active minutes over ≥30 min

anchor · CP 4 · participant obligations  ·  thresholds · structural (presence floor 50%)  ·  ground truth · test-constructed 60-min stream, adds in 6 minutes (demo flows are too short to judge)

Investigation checklist analysts work on this pattern
  1. Confirm the detection facts against the stream replay (DVR)
  2. Identify every account involved and resolve to operator clusters
  3. Check restricted-person and participant obligations for each account
  4. Record the disposition rationale on the reviewer notes

Participant OTR breach

Signature. Declared desk account with ≥100 book messages and order-to-trade ≥40:1, computed from the stream

anchor · CP 4 · 38.157 · OTR  ·  thresholds · structural (40:1, 100-message floor)  ·  ground truth · planted MM-ALGO-7 quoter (200 msgs, 4 fills → 50:1)

Investigation checklist analysts work on this pattern
  1. Confirm the computed OTR from the stream against the declared obligation
  2. Check kill-switch state and throttle history for the desk
  3. Notify the participant per the rulebook's obligation process
  4. Record the remediation commitment and follow-up date

Calibration evidence (Wilson intervals on disposition-derived false-positive rates and threshold-sensitivity curves) is generated per workspace on the Forensics screen. data & usage guide · security posture