An accusation of market abuse based on anomalous orders can call into question operations that, for those who carried them out, had a precise financial or technical logic. If you have received a request from CONSOB, an administrative dispute, or a prosecutor's act in Milan, it is natural to wonder whether subsequently cancelled orders, rapid changes to the order book, or trades on different sides of the market are enough to speak of manipulation.
An unusual order does not prove an offense by itself. I want to clarify what the authorities must prove, why the context of trading is decisive, and what differences exist between the CONSOB assessment and criminal proceedings. We will also examine which data can give a different meaning to the same sequence of orders: instrument liquidity, the trader's position, executed trades, automatic rules, and the concrete reason for the trading activity.
When an order can become market abuse
The ban concerns operations, orders, and conduct. The European regulation on market abuses, called MAR, considers manipulation any transaction or order that sends, or is likely to send, false or misleading signals as to the supply, demand, or price of a financial instrument; conduct that secures, or is likely to secure, the price at an abnormal or artificial level is also relevant. The same regulation prohibits both manipulation and attempted manipulation. The applicable text is Regulation (EU) No 596/2014 on market abuse, specifically in Articles 12 and 15.
Cancellation alone does not decide the dispute. An order revoked before execution can be a normal reaction to a changing price, partial execution, a risk limit, or a trading strategy modified during the session. It assumes a different weight if it is entered with a size and placement such as to alter the perception of the order book—meaning visible buy and sell proposals—and is removed after trades are executed on the opposite side.
Technical indicators must be read together. MAR contains a non-exhaustive list of indicators: order volume compared to daily trading, price effect, concentration of activity, position already held, and proximity to sensitive trading phases. However, the regulation clarifies that these elements must not automatically be considered manipulation. For this reason, an order book screenshot or an isolated sequence of a few seconds does not exhaust the reconstruction.
Revoked Orders, Spoofing, and Layering: The Facts Matter More Than the Label
Spoofing and layering are descriptions, not proofs. Spoofing generally refers to the entry of orders seemingly suitable for influencing the market and withdrawn before execution; layering recalls orders distributed across multiple price levels. The words used in the allegation can help identify the hypothesized scheme, but the defense does not end with discussing its name. It is necessary to understand which single orders are attributed to the person, what effect they would have had, and why the authority believes they did not express a genuine intention to trade.
Chronology can change the meaning of the same data. A very large order on an illiquid security may appear more impactful than an identical order on an instrument with continuous trading. The limit price, distance from the best available price, duration of the order, executed trades, market changes, and the presence of operations by the same person or related parties all matter. The concrete question is whether the order truly participates in the market or merely serves to represent an interest that does not exist.
The use of an algorithm neither excludes nor demonstrates liability. In automated systems, authorized settings, risk limits, manual modifications, generated alerts, and technical logs become central. A malfunction or incorrect parameter does not necessarily coincide with conduct aimed at influencing the market. At the same time, the fact that orders were generated by software does not eliminate the need to clarify who defined its rules and for what purpose.
The Boundary Between Administrative Offense and Criminal Crime
Manipulation can have administrative relevance before CONSOB. Article 187-ter of the Consolidated Law on Finance (TUF) links the administrative penalty to the violation of the ban on manipulation provided by Article 15 MAR. The national provision also establishes that anyone who proves legitimate motives and compliance with an accepted market practice in the relevant market shall not be subject to a penalty. Therefore, a generic explanation formulated after the facts is not enough: the indicated reason must find confirmation in the concrete operations and applicable rules.
Internal practice is not an accepted market practice. A habitual way of operating, a corporate protocol, or a choice shared by a group of traders can be useful data for understanding orders, but they do not replace the accepted practice provided for in Article 13 MAR. The distinction is important: an internal procedure can explain the context, whereas the exemption regulated by the regulation requires both legitimate motives and compliance with a recognized practice for the relevant market.
The crime of manipulation requires further verification. Article 185 TUF concerns, among other things, simulated operations or other artifices concretely suitable for causing a sensitive alteration in the price of financial instruments. Anomalous behavior therefore does not alone equate to a crime. The criminal charge must identify the contested artifices and address their concrete suitability to produce the alteration required by the rule.
National legislation was also amended in 2026. Legislative Decree No. 128 of June 25, 2026, which entered into force on August 7, 2026, reformed the sanctionary procedures of the TUF and affected, among other things, the procedure referred to in Article 187-septies and certain relations between administrative and judicial proceedings. To correctly read an act received after this date, it is necessary to consider Legislative Decree No. 128 of 2026 alongside the TUF rules it amends.
Data That Can Support or Refute the Reconstruction
The overall position is more useful than a single order. To interpret conduct, it is necessary to link the entered orders, revocations, modifications, executions, the position held before and after the session, and any related instruments. Economic exposure can also derive from derivatives or operations on instruments whose value depends on the traded security. Looking solely at shares bought or sold can therefore return an incomplete picture.
The economic rationale must be verifiable. A hedging need, an exposure limit, a received mandate, a programmed strategy, or a liquidity constraint can assume significance if they are consistent with data existing before or during the operations. The explanation must converse with quantities, prices, times, and actual methods of the orders. An abstract motivation, devoid of traces in documents or market data, will hardly clarify a sequence that appears artificial.
Communications can have a double value. Emails, messages, operating instructions, corporate chats, and recorded conversations can support the accusatory hypothesis or place the trading activity in a different context. Not only favorable phrases should be selected: the language used, the temporal succession, and the people involved can also be decisive. For this reason, it is not prudent to delete, modify, or reconstruct technical data and communications from memory after receiving a request from the authority.
Market quality affects the reading of behavior. Book depth, volatility, traded volume, and the phase of the session help establish whether an order truly had the capacity to influence other participants. This does not mean low liquidity automatically turns an order into manipulation; it means that in a thin market, quantities and timing can have a more marked informational effect and must be explained with greater precision.
CONSOB Investigation and Criminal Proceedings Can Proceed Together
A CONSOB request has a specific subject and its own deadline. Article 187-octies TUF grants CONSOB investigation powers: the authority can request news, data, and documents, acquire existing recordings of telephone conversations, electronic communications, and data exchanges, as well as proceed with hearings. The most recent powers and procedural amendments are referred to in the text of Legislative Decree No. 128 of 2026.
The response should not confuse different levels. An invitation to transmit data does not coincide with an allegation of an offense; an administrative dispute does not coincide with a notice of investigation; a prosecutor's act follows procedural rules different from those of the CONSOB inquiry. Understanding which document has been received makes it possible to identify the contested fact, the recipient, the indicated deadline, and the powers actually recognized in that phase.
Administrative proceedings do not necessarily remain on hold. TUF regulations establish that the administrative investigation and the proceedings instituted against the sanctionary measure are not suspended simply because criminal proceedings are pending on the same or related facts. The two paths can therefore advance in parallel. This makes it essential to maintain consistency between the technical explanations provided in different contexts, without treating one as irrelevant to the other.
Consequences are not always limited to pecuniary sanctions. TUF contemplates accessory measures and asset-related instruments that depend on the specific case, the measure adopted, and the phase of the proceedings. The 2026 legislative decree also amended the discipline relating to the profit of the offense. It is incorrect to derive the outcome from a single formula contained in the act: it is necessary to distinguish what is contested, what the authority can request, and what can be ordered only by the concluding measure or in judicial proceedings.
How to Address the Dispute Without Oversimplifying the Problem
The first priority is to identify the precise charge. Defending oneself against a hypothesis based on misleading signals in the order book is different from a dispute regarding simulated operations, or an accusation combining anomalous orders and privileged information. Market abuse is a broad expression: it does not replace the indication of the applicable rule, the described scheme, and the nexus the authority posits between the conduct and the effect on the market.
A useful response combines law and technique. Market data are not a detail reserved for IT experts. Millisecond chronology, limit prices, system logs, order visibility, partial executions, and correlated instruments can directly affect the contested element. Likewise, a technical analysis lacking a connection to the rule does not clarify whether the fact truly constitutes manipulation, an attempt, or lawful but unusual conduct.
Preserving materials avoids fragile reconstructions. Platform reports, execution confirmations, configuration logs, change registers, internal policies, received instructions, and contemporaneous communications can be relevant. This is not about accumulating documents without criteria: each element must help clarify a concrete point, such as real trading intent, the origin of an order, economic exposure, or the reason for its cancellation.
Criminal defense requires attention right from the initial act. If the accusation concerns market abuse and anomalous orders in Milan, I can assist you in framing the received document, distinguishing the administrative level from the criminal one, and setting up an interpretation that keeps market rules and actual trading data together.
Frequently Asked Questions
Can a cancelled order be enough to accuse me of manipulation?
No, it is not enough on its own. Cancellation is a data point that must be read alongside size, price, duration, book conditions, executed trades, and the operator's position. MAR considers such indicators as evaluation elements, rather than automatic proof. It becomes essential to understand whether the order expressed a concrete willingness to trade or merely an apparent interest.
Can I explain that the orders had a legitimate economic rationale?
Yes, if the explanation finds concrete evidence. A hedging strategy, a risk limit, or a mandate can be relevant when compatible with times, quantities, and prices of operations. For the exemption provided by Article 13 MAR, however, legitimate motives must be accompanied by compliance with an accepted market practice: a private or corporate custom is not enough on its own.
Can CONSOB request emails, chats, and telephone recordings?
It can request existing data and recordings within the limits of its powers. Article 187-octies TUF allows CONSOB to request news, documents, electronic communications, conversation recordings, and data exchanges, setting the deadline for transmission. It is necessary to carefully read the object of the request, recipient, considered period, and relationship between the requested material and the assessment.
If criminal proceedings are open, does the CONSOB procedure stop?
Not necessarily. TUF establishes that the administrative investigation and proceedings against the sanctionary measure are not suspended simply due to the pending of criminal proceedings concerning the same facts. The two events can therefore proceed in parallel, with different rules and acts. An administrative dispute should not be left unanswered thinking it is enough to wait for the criminal file.
Can the company be involved alongside the person who entered the orders?
The entity's position must be distinguished from that of the natural person. TUF regulates hypotheses of corporate liability for violations committed in its interest or advantage. It is not sufficient that operations occurred through a company: it is necessary to verify what advantage or interest is contested, who made the decisions, and what functions the individuals involved held.
Regulatory References and Assistance
The starting rules are MAR and TUF. To delve into the European ban and manipulation indicators, you can consult Regulation (EU) No 596/2014. Italian coordination with European discipline was introduced by Legislative Decree No. 107 of 2018 and updated, on a procedural level, by Legislative Decree No. 128 of 2026. If you have received an act concerning market abuse or anomalous orders, you can contact me to examine the ongoing phase and the technical and criminal issues raised by the dispute.