Actionable news
All posts from Actionable news

Citi Spoofing and Yahoo Hacking


It seems like pretty big news that Citigroup Global Markets Inc. agreed to pay a $25 million penalty to the Commodity Futures Trading Commission last week to settle charges that it spoofed the U.S. Treasury futures market. Like ... Citi is a big bank, and Treasury futures are a big market, and $25 million is a big fine. It's the biggest spoofing story since that time a random dude in London maybe crashed the stock market.

But the CFTC and Citi don't seem to be very interested in telling the story. The CFTC order is brief, bland and generic. Five Citigroup traders "engaged in the disruptive practice of 'spoofing' (bidding or offering with the intent to cancel the bid or offer before execution) in U.S. Treasury futures markets" in 2011 and 2012, and they did it more than 2,500 times. (Bloomberg News has their names.) The "spoofing strategy involved placing bids or offers of 1,000 lots or more" -- $100 million or more face amount -- "with the intent to cancel those orders before execution"; they put in the spoofing orders "after another smaller bid or offer was placed on the opposite side of the same or a correlated futures or cash market," and cancelled them "after either the smaller resting orders had been filled or the Traders believed that the spoofing orders were at too great a risk of being executed."

That is how one spoofs, yes. But there are no funny e-mails or chats, no details of the trades or profits, no sense of how or why this happened, except that it happened a lot. Well, there is one anecdote, about a junior trader in Tokyo who visited the New York desk for training. He was apparently trained in spoofing, but not very well:

In January 2012, the junior trader returned to Tokyo and began placing spoofing orders. In one instance, on January 31, 2012, he placed a 4,000 lot offer in the 10-year U.S. Treasury futures market that he intended to cancel before execution to induce other market participants to trade on his smaller resting bid in the 10-year cash U.S. Treasury market. The majority of his 4,000 lot spoofing order traded before he could cancel the order and, as a result, he incurred a loss. Afterwards, the junior trader called several other members of the U.S. Treasury desk, including the head of the desk, to report his loss and explain his spoofing strategy and what had happened. Although the supervisor told the junior trader "that's not a smart thing to do" and cautioned him not to do it again, neither the supervisor nor the other members of the U.S. Treasury desk reported the incident to compliance or any other senior manager, despite having information that the junior trader engaged in spoofing.

Did the supervisor mean that spoofing is "not a smart thing to do," or just getting executed on your spoof order? Because the latter is inarguable.

The former is a little inarguable too? People talk about "white-collar crime" (fraud, etc.) as distinct from "blue-collar crime" (burglary, etc.), but there is a social hierarchy of fraud, too. Big banks might collude on a benchmark fixing, or sell mortgage bonds with misrepresentations about the level of due diligence they conducted, but they don't, like, run Ponzi schemes. Individual junior bankers might insider trade here and there, but big banks' trading desks don't make their money by insider trading. This is not because banks are paragons of morality; it's because they are big institutions with big compliance departments who have read the rules and thought about ways to prevent well-known sorts of dumb obvious misbehavior. Perhaps this leads to a culture of compliance, or perhaps it leads to a culture of baroque sneaky misbehavior, but in any case it probably does catch the low-hanging fruit.

These days spoofing feels pretty blue-collar, and most spoofing enforcement cases so far have tended to be against small firms and independent traders. And Citi's spoofing -- putting in 1,000-contract orders, trading small orders on the other side, and canceling the 1,000-contract orders, over and over again, thousands of times -- just feels too big and dumb and obvious for a big bank. But here we are. I suppose things were different in 2011 and 2012, when regulators were just beginning to take spoofing seriously. Sometimes it takes time for misbehavior to become dumb and obvious.


Here is a story about how the Securities and Exchange Commission is investigating Yahoo Inc. because it was hacked in 2014 and waited two years to disclose the hack to shareholders. (And users! It waited two years to disclose to users that they had been hacked! But that's not the SEC's concern.) On the one hand, sure, absolutely: You should disclose material stuff, and if you don't, then investors are misled into buying your stock at inflated prices, and then they are harmed when the stuff is disclosed and the price drops.

The weird thing about Yahoo, though, is that it waited so long to disclose the hack that, by the time it did, it had already agreed to sell itself to Verizon Communications Inc. (Well, to sell the Yahoo bits of itself. It's keeping some other bits, and renaming the stub "Altaba.") And Verizon hadn't known about the hack either. Now it does, of course, though it is still unclear whether it will try to re-negotiate the deal because of the hacks.

But this makes the SEC's potential case weird, especially if the deal closes as scheduled for the agreed price. Like: If Yahoo agreed to sell its business for a fixed amount of cash before disclosing the hack, and then it sells it for that amount of cash after disclosing the hack, then was the hack material? Shareholders got the same amount of money from Verizon after the disclosure as they expected to before the disclosure. And if the SEC ends up fining Yahoo for not disclosing it, who...