Market Anomaly: Pinging / Order Anticipation

• CEX order types enable a “ping environment”: IOC/FOK and Hidden/Iceberg order types are standard on major exchanges (e.g. Binance: IOC/FOK & Iceberg; Kraken: Iceberg; Bitfinex: Hidden & “Visible-on-Hit”) - the market mechanics for pinging are therefore present.
• Surveillance practice models pinging: vendors such as Trading Technologies (TT) describe detectable sequences: series of small FOK “pings” followed by a larger exploiting follow-up trade.
• Regulatory references acknowledge the phenomenon: ESMA discusses “ping orders” in MAR-related documents; NBIM proposed criteria to identify when pinging becomes abusive.

Note: There are few public enforcement cases specifically for pinging in spot crypto, but the mechanics and surveillance models are documented.

1. Probe: Very small orders placed near the touch (often IOC/FOK). Fills, partial fills or re-quotes reveal presence of an iceberg/hidden order.
2. Infer: Using fill patterns, refill rhythm and resting time, the trader infers hidden size and side (liquidity detection / order anticipation).
3. Exploit: Immediately execute a larger same-side trade or re-price ahead of the revealed liquidity (TT model: ping → counterparty reacts → larger follow-up trade).
4. Differentiation: Not automatically illegal; intent and effect matter. For example, FCA analysis found no systematic cross-venue order-anticipation by HFT in an equity dataset.

• Micro-probes at the touch: sequences of very small orders (notional ≪ median), sub-second spacing, elevated cancel/no-fill rates.
• Refill signature: immediate reappearance of the same quantity/price after a mini-fill - indicative of iceberg/hidden liquidity.
• Exploiting follow-up trade: a large same-side trade shortly after micro-fills/cancels that moves price by several ticks.

• Order toolbox: IOC/FOK plus Hidden/Iceberg orders are standard - probing carries low capital risk.
• 24/7 trading & fragmentation: multiple venues with heterogeneous depth - pinging gives venue-selection and execution advantages.
• Low counterparty transparency: no CAT-equivalent; intent is hard to prove, so behavioural metrics are essential.

Definitions and study: IOSCO classifies liquidity-detection strategies (including pinging); ESMA / MAR explicitly mention “ping orders”; the SEC Staff Report provides multi-venue and speed context. Surveillance systems (SMARTS, TT) detect ping chains: micro-pings → exploiting burst.

• Execution & risk: pinging can trigger stops, shift impact and increase slippage - especially in thin books.
• MiCA (EU): largely applicable since 30.12.2024; transitional arrangements until 01.07.2026 in some member states. Supervisors expect effective integrity controls, including order/behaviour-based signatures such as pinging.

Calibrated per symbol/venue; baseline = 30 days at the same time of day. Required data: L2/L3 (Add/Replace/Cancel/Fill). Where TIF flags are missing, use timing/size proxies.

E3 (high) - “ping chain + exploiting burst”

• ≥ 6 micro-orders ≤ 1 s at the touch (median size ≤ p20), ≥ 70% no-fill/partial-fill,
• ≤ 500 ms thereafter a large same-side trade (notional ≥ p80) with mid-move ≥ 3 bp,
• refill indicator at level (≥ 2 re-quotes of same size ≤ 300 ms).

Rationale: captures the ping → follow-trade chain described in surveillance guides.

E2 (medium)

• ≥ 3–5 micro-orders ≤ 2 s plus refill signature at the price level, or
• OTR spike (order-to-trade ratio) ≥ p97 with small-size clusters (rounding concentration).

E1 (low)

• “Probe-pattern light”: increase in small touch orders (z-score ≥ 2) with reduced resting time vs baseline → watchlist until E2/E3 criteria are met.

• Legitimate iceberg interaction ≠ abuse: many micro-fills without an exploiting burst indicate execution search, not misconduct.
• Event filters: listings, news, or volatility shocks can produce legitimate micro-order surges - only escalate when sequence (ping → burst) occurs absent news.
• Venue specifics: feeds often lack TIF flags - use timing proxies (inter-arrival, quote half-life).
• Cross-venue check: local-only patterns are more suspicious; broad synchronous probes are more likely risk management or legitimate flows.

• For traders: do not over-estimate visible depth; plan executions realistically (TWAP/POV, avoid crossing illiquid minutes) and avoid FOMO fills into probed levels.
• For operators / compliance: combinations of micro-order series, refill signature, exploiting burst and OTR spikes provide testable evidence - consistent with practical surveillance models.

• IOSCO – “Regulatory Issues Raised by the Impact of Technological Changes on Market Integrity and Efficiency” (liquidity detection strategies; hidden liquidity).
• ESMA – “Discussion Paper on MAR” (2013) - explicitly references “ping orders”.
• NBIM – response to ESMA (2014) - flags ping orders as potentially abusive and requests criteria.
• FCA – Occasional Paper No. 16 (2016) - finds no systematic cross-venue order anticipation by HFT in the studied equity dataset (contextual counterpoint).
• SEC – “Staff Report on Algorithmic Trading in U.S. Capital Markets” (2020) - data, speed and multi-venue context.
• Trading Technologies (TT) – “Pinging | Market Abuse Models” - ping sequence (FOK micro-orders → follow-trade).
• CEX docs – Binance (IOC/FOK & Iceberg), Kraken (Iceberg), Bitfinex (Hidden / Visible-on-Hit).
• Deutsche Börse / GoMBER et al. – “High-Frequency Trading” - section on liquidity detection.