SEC spoofing case traces visible orders and trading gains across separate accounts

At 6:25 p.m. Eastern Time on 10 January 2025, an exchange-traded fund had a quoted bid of $61.58 and an offer of $62.04. In the next minutes, according to an SEC complaint, a trader used one brokerage account to enter visible sell orders that lowered the best offer while another account bought 15,700 shares. He then reversed the sequence: visible buy orders helped lift the bid while the other account sold the shares. The case’s detailed chronology shows how the visible orders and profitable executions could appear in different firms’ records.[1]

The alleged trader was Frank M. Cerisano Jr., a Las Vegas resident and former securities-industry professional. In August 2026 the SEC filed settled charges alleging that he used this cross-account structure repeatedly between at least May 2021 and April 2025, producing about $1.116 million in illicit gains across no fewer than 3,000 incidents. The agency's account does not describe a normal spread-capture strategy: it alleges orders placed with no intention of execution to create artificial prices. Cerisano agreed to a proposed judgment without admitting or denying the complaint's allegations, the SEC said. Its later whistleblower notice identifies a qualifying judgment or order dated September 17, 2026. That record confirms a later legal milestone; it does not, by itself, reproduce every operative term of the judgment.[1][2][3]

The reconstruction connects two periods in the SEC’s complaint. In February 2021 a brokerage identified the suspicious sequence within its own account and eventually closed it. By January 2025, the worked example involves visible orders at a professional brokerage and executed trades at a separate retail brokerage. Comparing those episodes advances the question from whether an individual firm noticed unusual orders to how records across firms could establish the trader’s complete sequence. It does not establish that any named intermediary knowingly facilitated wrongdoing.[1]

The first broker identified the combined pattern

The SEC complaint says a compliance officer at the first brokerage, called BD 1, emailed Cerisano on February 24, 2021 after activity in an unidentified Company A stock on the preceding day. According to the complaint, the trader had a hidden order to buy 2,000 shares at $56.02. He subsequently entered four visible short-sale limits at successively lower prices over 55 seconds, beginning at $56.38 and ending at $56.05. The brokerage said those orders accounted for as much as 84% of the quoted shares in the first ten offer tiers; meanwhile 1,295 shares of the hidden bid filled. Two seconds after the relevant execution sequence, the sell orders were cancelled.[1]

The firm did not rely on an unexplained black-box alert. It described the combined facts that concerned it: an undisplayed interest to trade, a large visible wall on the opposite side, movement in the midpoint, executions of the hidden interest and immediate cancellation of the displayed orders. It warned that repeated instances could lead to closure. The activity occurred in the pre-market session, when the stock's reported volume was about 2.9 million shares versus roughly 52.5 million during the regular session. These are trading-volume observations for different session lengths, not hourly turnover rates. They nonetheless illustrate why the regulator regarded the extended-hours order book as especially vulnerable.[1]

A second email on February 26 addressed activity in another security on the preceding day. The complaint says the trader displayed orders offering 17,000 shares at four successively lower levels while an undisplayed bid in the same stock was filled on 9,200 shares. The visible orders were said to represent 82% of the quantity at the relevant offer tiers. The compliance officer again described why the sequence resembled spoofing and warned that another instance would result in closure. A third notice, sent on April 6 about March 30 activity, cited a similar pattern. On May 7, the account was restricted to closing trades and shut.[1]

The sequence matters for assigning responsibility. The first broker did identify activity and took escalating action. That cannot be flattened into a claim that broker surveillance universally failed. The subsequent enforcement allegation is that the trader adapted his conduct so that no one broker-dealer saw both sides of the plan. A local control that succeeds at spotting a pattern inside one account does not automatically catch the same pattern distributed among institutions.[1]

Eight accounts changed the monitoring perimeter

Following the closure, the complaint says Cerisano opened three accounts at other brokerages between May and June 2021, then four more later, while maintaining an existing account elsewhere. The SEC collectively calls these eight accounts the new spoofing accounts. It alleges that he placed order-book-moving instructions through professional accounts capable of targeting specific exchanges while using retail brokerage accounts for the genuine trades that generated his intended profit. Such retail orders were often internalised by the broker or a liquidity provider, so they did not appear on the public quote feed in the same fashion.[1]

This distinction is central to the mechanism. An order visible on an exchange can influence the national best bid or offer and other participants' expectations. An internalised execution can fill against the resulting quote without posting an equivalent order at that venue. The complaint says the cross-account division reduced the chance that an institution would connect the displayed orders with the apparently independent executions. It also reduced the risk of the trader's own spoof and genuine orders matching each other. These are the SEC's allegations about the structure, not a conclusion that every internalised retail order is manipulative.[1]

The regulator quotes an email the trader allegedly sent to his former brokerage in July 2021 while seeking to reopen the closed account. He suggested an account design that would permit orders on only one side of the market. The complaint interprets the request as an effort to obtain another helper account compatible with his subsequent strategy. The significance of this evidence lies in how apparently benign order restrictions can be exploited when a person controls complementary accounts elsewhere. The ordinary functionality of a one-sided order account is not itself unlawful.[1]

A later brokerage reportedly restricted his access to pre- and post-market trading in October 2024 after questioning suspicious activity. The complaint says the trader demanded account closure and a transfer of capital around ten minutes after being told of that restriction. Again, it alleges a response to surveillance. The public records do not establish that the brokerage facilitating any particular transaction knowingly participated in wrongdoing. That is a critical distinction between an alleged individual's misconduct and an intermediary's liability.[1]

Reconstructing nineteen minutes in January 2025

The January 10 example supplies the most precise time-and-price record. At approximately 6:25 p.m., the ETF's national best bid was $61.58 and best offer was $62.04, a spread of 46 cents. The SEC contrasts that snapshot with an average spread of $0.010229 during regular hours the same day. Dividing the extended-hours snapshot by that full-session average produces roughly 45 times, but the comparison mixes a single instant with an average and should not be presented as a measured 45-fold average increase in all after-hours spreads. It supports a narrower point: the displayed market was unusually wide at the instant examined.[1]

Between 6:25:46 and 6:30:30 p.m., the complaint says Cerisano entered nine sell orders totalling 5,600 shares through a professional ‘helper’ account, at progressively lower prices. The national best offer fell from $62.04 to $61.65. Nine purchase orders through the separate account, entered between 6:26:32 and 6:30:52, bought 15,700 shares at a reported average $61.67. The helper sell orders were cancelled between 6:30:38 and 6:31:03, after which the best offer returned to $62.04. The SEC links the opposite-side orders, executions and cancellations as one sequence.[1]

The reverse sequence began at 6:32:07 p.m. Ten helper buy orders totalling 5,300 shares were entered through 6:36:20, lifting the best bid from $61.57 to $61.87. Ten sell orders at the separate brokerage, entered between 6:34:25 and 6:36:46, sold 15,700 shares at a reported average $61.85. Most helper orders were cancelled by 6:36:50; the last cancellation was at 6:44:05, and the best bid returned to $61.57. The later endpoint is the final cancellation, rather than the time when all helper orders were being entered.[1]

The rounded execution averages provide an independent arithmetic check. Eighteen cents multiplied by 15,700 shares equals $2,826, whereas the complaint reports approximately $2,884 of illicit profit for the episode. The $58 difference is about $0.0037 per share, small enough to be consistent with rounding the displayed average prices to cents. The precise trade ledger is not supplied in the published example, so that explanation cannot be verified trade by trade. The rounded prices support the scale of the reported gain without reproducing it to the dollar.[1]

The helper and winner sizes also tell different stories. The cited displayed orders total 5,600 and 5,300 shares on the two phases, while 15,700 shares were bought and sold in the other account. Displayed order size is not a measure of completed trading, and dividing the two figures would not produce the fraction of the national market manipulated. The alleged effect came from where those quotes sat in the order book and when they were entered and cancelled. A small visible quantity at the best price can matter more than a much larger order further away.[1]

What the legal record establishes

The SEC’s 10 August 2026 litigation release describes a proposed settlement, without admitting or denying the allegations, comprising injunctions, $1,115,672 in disgorgement, $26,472.82 in interest and a $334,701.60 civil penalty. Those amounts total $1,476,846.42. It also describes a five-year requirement to give a broker the complaint and final judgment before opening or maintaining specified accounts. The later notice identifies a qualifying judgment or order, but the signed September judgment was not available in the records reviewed. The proposed terms therefore cannot be represented here as independently checked final payment obligations.[1][2][3]

The SEC’s covered-action notice identifies 17 September 2026 as the judgment or order date and 30 October as the notice date. It confirms that later legal milestone, without establishing collection or reproducing every operative term. The case-wide allegations of at least 3,000 incidents and approximately $1.116 million in gains cover several years. They do not count unique counterparties or establish an equivalent loss for a specified set of customer accounts.[1][2][3]

The institutional lesson is about visibility

This case should not be used to imply that extended-hours trading itself is abusive or that professional routing and retail internalisation are inherently suspect. Those mechanisms serve legitimate customers. The vulnerability arises when multiple apparently independent venues and brokers together carry a sequence designed to move a published quote and execute on the opposite side. Evidence of manipulative intent requires the full pattern, context and applicable law, rather than cancellation rates or fast trading in isolation.[1]

The investigation's open questions are operational and measurable. How quickly can surveillance systems connect orders and executions across institutions? What data do venues and regulators receive in time to reconstruct ownership and execution? Do cross-broker alerts preserve evidence while avoiding false accusations against legitimate traders? How does the additional risk of an extended-hours order book affect the thresholds used for escalation? The public SEC case provides a compelling reconstruction but not a benchmark of the performance of every broker's surveillance technology.[1]

The 2021 notices document a broker detecting a combined pattern, warning the customer and closing the account. The later complaint alleges that the trading strategy was distributed across brokerage relationships, so the visible orders and the executions had to be joined to reconstruct it. That is the institutional significance of this record. It supports examination of cross-firm visibility while preserving the difference between the SEC’s allegations, the proposed settlement and the limited later court-status information publicly identified here.[1][2][3]

Report an error or submit an update