How Regulators Replay Your Orders to Catch Market Manipulation

Imagine someone claims they never said something in a meeting. Now imagine there's a recording. That's roughly the relationship between a brokerage's ordinary record-keeping and trade reconstruction — except the "meeting" is the stock market, and the recording is built from millions of timestamps per day.

Here's the idea in one sentence: regulators can take a brokerage's order records, line them up in time, and replay what happened — order by order, cancellation by cancellation — to spot behaviour that looks like manipulation. Let's unpack how that actually works, and why it matters even if you never trade a single share of anything exotic.

First, what counts as an "audit trail"?

An audit trail is a chronological record of actions, transactions and decisions inside a system. Each entry typically captures who acted, what they did, when it happened, and sometimes why. In financial services, this isn't optional paperwork — it's the evidence base regulators, banking partners and internal auditors rely on.

For broker-dealers in the US, two rules form the statutory foundation. Rule 17a-3 defines what must be created and kept: the terms and conditions of every order received or originated, the time of receipt, who handled it, whether it was solicited or unsolicited, and the full modification and cancellation history. Rule 17a-4 defines how: records must be preserved in a non-rewriteable, non-erasable format — often called WORM, short for "write once, read many" — for a minimum of three years, with certain record types kept for six. No notes in the margin. No take-backs.

A useful mental model: an audit trail isn't just a logging system. It's a reconstruction layer that proves, on demand, what happened to a specific trade from the moment the order arrived to the moment it settled.

The golden thread that ties it together

Picture a single order as a thread. At origination, the order gets a persistent identifier — in the FIX messaging standard used across trading systems, that's the ClOrdID, or client order ID. Every subsequent event carries the same identifier: the routing decision, the execution report from the venue, the allocation instruction for an institutional block, the settlement confirmation.

One order, one identifier, many linked records. Firms sometimes call this the "golden thread".

Why care? Because when a regulator asks a broker-dealer to produce the records for a specific security — a request often called an Electronic Blue Sheet — the difference between a firm with a linked trail and one without is the difference between answering in seconds and manually correlating records across an order management system, an execution system, a middle office and a custody layer. That manual stitching can take hours per inquiry. Regulators notice speed, because it's one of the most visible signs of whether a firm's controls actually work.

Enter the Consolidated Audit Trail

In the US, the biggest version of this idea is the Consolidated Audit Trail, or CAT. The SEC adopted Rule 613 in 2012 to create it, and approved the CAT plan in November 2016. The rule requires national securities exchanges and FINRA to jointly build a central repository tracking activity in National Market System securities — that is, exchange-listed equities and options.

The origin story is worth knowing. Rule 613 followed the May 2010 "flash crash", when the Dow Jones Industrial Average fell roughly 1,000 points in minutes before largely recovering. At the time, there was no single database of comprehensive order and execution data. Each self-regulatory organisation kept its own audit trail, with requirements that varied significantly, so regulators analysing cross-market activity had to merge large volumes of disparate data from different entities. CAT was conceived to fix that.

Scale puts it in perspective: the system was expected to collect tens of billions of data points each day when fully operational.

What does CAT actually capture? Information on quotes, orders, routes and trade executions across exchange-listed equities and options, including related events such as cancellations, modifications and acceptances. The scope covers the end-to-end order lifecycle. Unlike FINRA's older Order Audit Trail System, or OATS, there are no broker-dealer exemptions from CAT reporting: essentially any broker-dealer that is a member of a national securities exchange or FINRA and handles orders must report. Customer information is included — a point that generated considerable industry debate, along with questions about data security, which is a live discussion rather than a settled one.

How replaying orders catches manipulation

Now the interesting part. What can you see when you can replay the book?

Consider spoofing: placing a large order on one side of the market with the intent to cancel it before execution, hoping others react to apparent supply or demand that was never real. When prices move, the spoofer trades in the genuine direction and cancels. Or layering, its close relative, where orders stack up at several price levels to simulate deep liquidity that doesn't exist.

What gives these away in the data isn't one smoking gun but a pattern: an unusually high ratio of orders placed to orders executed, cancellations that cluster tightly in time, and a suspicious correlation between the appearance of big orders, price movement in the direction they imply, and their disappearance shortly after. The Sarao case in E-mini S&P 500 futures became the most documented example — investigators used order-level data showing orders concentrated far above the best ask, repeatedly modified to avoid execution, alongside genuine trades in the opposite direction.

Two honest caveats. First, intent matters legally, and intent is hard. A trader who routinely cancels orders can argue market conditions simply changed. That's exactly why surveillance produces alerts, not verdicts. Second, most alerts are false positives — legitimate market-making can look mechanically similar to manipulation, which is why firms spend serious effort triaging rather than just detecting.

The other major category is front-running — trading ahead of a customer order you know about — which shows up as a suspicious temporal correlation between a firm's own activity and client orders.

Why "show me" beats "trust me"

Here's the practical punchline. When regulators ask a firm to reconstruct the conditions around a trade, that request can arrive with as little as 72 hours' notice. The firm must produce the order details, execution details, the accounts that received allocations, and pricing — often alongside related communications and market data on a single timeline.

A firm with a unified, identifier-anchored trail produces this in something approaching a click. A firm with records scattered across siloed systems — order timestamps in one database, execution reports in another, allocations in a third — reconstructs manually, trade by trade, and hopes nothing was missed. As one industry framing puts it, the standard isn't whether the trades were lawful; it's whether the firm can demonstrate they were lawful, completely and without ambiguity.

That's also why audit trails aren't only about suspicion. They support best-execution analysis, dispute resolution, and the more mundane accountability of knowing who approved what, and when.

What this means for you

If you're an ordinary investor, this infrastructure is mostly invisible — which, in a healthy system, is rather the point. Markets rely on the assumption that displayed orders represent genuine trading interest. Reconstruction and audit trails are how that assumption gets tested after the fact, and how the occasional exception gets separated from the noise.

A few honest limits worth holding onto. Rules and reporting regimes differ meaningfully by jurisdiction — the US approach under Rule 613, the EU framework under the Market Abuse Regulation, and the UK's post-Brexit equivalent are related but not identical. Timelines and implementation details have shifted repeatedly; CAT itself saw delays, a change of plan processor, and an industry dispute over liability language in reporter agreements. And data protection questions around large repositories of trading and customer data remain actively debated.

So no, this isn't a magic camera. It's a very good flight recorder — and flight recorders don't prevent every incident. But they make it much harder to claim, later, that nothing happened.