Market Manipulation

Adversaries artificially influence asset prices, trading volumes, or market sentiment to generate seemingly legitimate gains. By orchestrating manipulative trades in capital markets—such as pump-and-dump, spoofing, or wash trading—they can transform illicit proceeds into profit-like returns, effectively integrating them into the financial system. This complexity, coupled with the high volume and volatility of equity transactions, obscures the criminal origin of funds, while final proceeds may appear to be legitimate, market-driven returns once positions are exited. In pump-and-dump scenarios, perpetrators hype an asset using false or misleading statements, then quickly sell after the price peaks. Low-liquidity shares or penny stocks are often targeted because they are easier to manipulate, and multiple accounts or shell companies can be used to conduct circular trading. Advanced electronic trading channels, such as direct market access, allow for rapid and layered transactions designed to evade scrutiny. In some instances, criminals even acquire or exert control over publicly traded companies to artificially elevate stock prices, generating further illicit gains. One documented case involved unusual trading volumes in a single targeted stock, driving prices up swiftly and resulting in a sudden peak for quick liquidation. This environment of high-speed trades, innovative technology, and cross-border capital flows amplifies opportunities for manipulation, prompting calls for closer oversight of anomalous trading behavior. As a broad category, these offenses serve as a parent technique encompassing specialized manipulative strategies aimed at placing, layering, or integrating illicit proceeds into the financial system.

[
Code
T0094
]
[
Name
Market Manipulation
]
[
Version
1.0
]
[
Parent Technique
]
[
Risk
Product Risk
]
[
Created
2025-02-28
]
[
Modified
2025-04-02
]

Guerrilla Trading Tactics in Cryptocurrencies

Blockchain Asset Manipulation

Tactics

Market manipulation is a method used to generate illicit funds through fraudulent activities such as price rigging and stock manipulation, both of which are forms of financial deception.

ML.TA0007
|
|

Criminals orchestrate repeated or complex trades explicitly to obscure the source of funds, making it harder for investigators to trace illicit proceeds. This layering strategy serves as a secondary objective to further complicate the money trail after the initial placement.

ML.TA0009
|
|

By artificially manipulating asset prices and trading volumes, criminals transform illicit capital into legitimate profits, enabling the seamless integration of these proceeds into the mainstream financial system.

Risks

RS0002
|
Product Risk
|

Market manipulation exploits inherent vulnerabilities in trading and investment products where price and volume signals are relied upon to reflect genuine market activity. Criminals can artificially inflate prices, trading volumes, or market sentiment (e.g., via wash trading or pump-and-dump) to disguise illicit proceeds as legitimate gains, demonstrating how these product features—absent robust oversight—are specifically targeted.

Indicators

IND01452
|

Sudden and unexplained spikes in trading volume of a particular security or asset without any corresponding public news or information.

IND01453
|

Frequent buying and selling of the same security or asset by the same entity within a short time frame, commonly known as wash trading.

IND01454
|

A series of orders placed and then quickly canceled, known as spoofing, to create a false impression of demand or supply.

IND01455
|

Dissemination of false or misleading information about a security or asset’s performance or prospects through social media or other channels.

IND01456
|

Unusual price movements in a security or asset that do not align with market trends or economic indicators.

IND01457
|

Patterns of trading activity that consistently occur at specific times of the day, suggesting manipulation of closing prices.

IND01458
|

Entities involved in trading activities have complex ownership structures or are based in jurisdictions with weak regulatory oversight.

IND01459
|

A sudden increase in the number of new accounts trading a particular security or asset, especially from the same IP address or geographical region.

IND01460
|

Sudden and significant price movements in a security followed by rapid reversals.

IND01461
|

Multiple accounts placing buy and sell orders for the same security, with no actual change in ownership.

IND01462
|

Accounts with no prior history of securities trading suddenly engaging in high-frequency trades.

IND01463
|

Frequent trading of a security by accounts with known connections to each other.

IND01464
|

Repeated NFT transactions among related wallets at escalating valuations, indicative of artificial price inflation or wash trading.

Data Sources

  • Consolidates risk information on countries' AML/CFT compliance and enforcement practices.
  • Pinpoints higher-risk jurisdictions lacking robust regulatory oversight, where illicit market manipulation activity may be more easily concealed.
  • Assists in focusing surveillance on trades originating from or routed through weakly regulated regions.
  • Includes information from public websites, social media platforms, and news outlets, which may contain misleading or false statements regarding securities or assets.
  • Helps detect pump-and-dump schemes by identifying coordinated promotional campaigns or negative disinformation that artificially manipulates market sentiment.
  • Captures IP addresses, timestamps, and user authentication details for account creation and trading platform access.
  • Identifies multiple new accounts associated with the same IP or location, suggesting coordinated manipulative trading.
  • Provides audit trails useful in correlating suspicious trading patterns with specific network access events.
  • Provides real-time and historical pricing data, trading volumes, and market trends for stocks, bonds, and other securities.
  • Enables detection of sudden spikes in trading volume, unusual price movements, rapid reversals, and other anomalies indicative of artificial market manipulation.
  • Facilitates comparison of specific asset performance against broader market benchmarks to identify potential pump-and-dump or spoofing schemes.
  • Documents verified customer identities, beneficial ownership data, and relationships among accounts.
  • Reveals connections between traders who may appear unrelated but share common ownership or affiliations.
  • Aids in identifying collusion and repeated trading among accounts linked to the same individuals or entities.
  • Provides on-chain transaction records for cryptocurrencies and NFTs, including wallet addresses, timestamps, and amounts.
  • Detects repeated NFT transfers among related wallets at escalating valuations, indicating artificial price inflation or wash trading.
  • Allows investigators to trace asset movements and identify potential manipulation across digital asset markets.
  • Contains detailed logs of trades on regulated financial exchanges, including timestamps, transaction volumes, order details, and prices.
  • Reveals potential wash trading, spoofing, and high-frequency manipulative patterns by analyzing order placements, cancellations, and executed trades.
  • Identifies whether trades result in genuine ownership changes or are merely circular transactions aimed at misleading the market.
  • Provides official corporate registration data, shareholder details, and beneficial ownership structures.
  • Helps uncover shell entities or multiple accounts under common control used to conduct circular or manipulative trades.
  • Enables investigators to trace ultimate beneficiaries behind complex corporate setups involved in market manipulation schemes.

Mitigations

Apply Enhanced Due Diligence (EDD) on accounts conducting high-frequency or inexplicably high-volume trades. Investigate beneficial ownership structures, verify sources of wealth, and review additional documents to explain rapid trade fluctuations, suspicious cancellations, or cross trading. This heightened scrutiny helps unveil layering or wash trading tactics disguised as legitimate market transactions.

Configure transaction analysis scenarios that focus on:

  • Frequent inbound transfers quickly deployed into speculative trades.
  • Abrupt fund movements among a small network of accounts.
  • Rapid exits immediately following price spikes.

Correlate trade data with related financial flows to detect layering mechanisms that hide illicit funds under the guise of trading gains.

Use specialized analytics to trace on-chain fund transfers and identify repeated transactions between related wallets, sudden token price surges, or NFT wash trading. Correlate suspicious on-chain activities, such as large synchronous trades and the use of multiple closely linked wallets, with apparent price manipulation attempts. This measure is essential for detecting illicit trading behaviors in digital asset markets.

Continuously monitor social media channels, message boards, and other open sources for false or misleading statements intended to drive asset prices. Cross-reference external hype campaigns with suspicious market indicators (e.g., sudden price surges, spikes in trading volume) to identify pump-and-dump schemes. Investigate sources of promotional content coinciding with manipulative trades to expose collusion or orchestrated price manipulation.

Temporarily restrict or freeze accounts engaging in confirmed or ongoing manipulative activities (e.g., repeated wash trades, spoofing strategies). This pause enables thorough investigative steps, collection of additional documentation, and timely disruption of market manipulation attempts before significant harm occurs.

Implement specialized trade surveillance systems to detect patterns of wash trading, spoofing, layering trades, and pump-and-dump activities. This involves analyzing repeated orders with no net change in ownership, frequent cancellations, and unusual intraday price or volume spikes. By flagging these anomalies, institutions can disrupt manipulative schemes and trace illicit funds disguised as legitimate gains.

Instruments

  • Digitized securities on blockchain platforms can be subjected to the same manipulative tactics as traditional securities, including pump-and-dump schemes and wash trading.
  • Limited regulatory oversight on certain token exchanges facilitates orchestrated trading among linked accounts, artificially influencing token prices and volumes.
  • By converting illicit funds into manipulated security token profits, perpetrators legitimize and integrate proceeds into a seemingly lawful investment process.
  • Wash trading of NFTs among related wallets at progressively higher valuations creates a false impression of strong interest and raises the perceived value.
  • Pump-and-dump-like tactics involve criminals driving up an NFT’s price through orchestrated buys and media hype, then rapidly selling to unsuspecting buyers.
  • Because NFTs are unique and lack uniform reference pricing, it becomes easier to fabricate “gains” from illiquid or novel assets.
IN0019
|
|
  • Criminals can inflate or deflate a security’s price through matching buy/sell orders (wash trading) among controlled accounts, creating the illusion of genuine demand or supply.
  • In pump-and-dump scenarios, fraudsters spread misleading information to attract investors before offloading their holdings at artificially higher prices, portraying illicit proceeds as legitimate investment gains.
  • The ease of placing frequent trades in securities markets enables layering, further obscuring the illicit source of funds under the guise of normal trading activity.
IN0021
|
|
  • Spoofing or layering orders in derivatives can deceive market participants about true supply and demand, influencing underlying asset prices.
  • Criminals place offsetting trades through multiple accounts, creating artificial market momentum that boosts the value of positions purchased beforehand.
  • Once prices have shifted favorably, criminals cash out profits, portraying illicit funds as legitimate gains realized from derivatives trades.
  • Perpetrators inflate the trading volumes of certain utility tokens through repeated self-trades, misleading other market participants about the demand and value.
  • Marketing hype or false statements about a token’s potential can spur rapid price increases, which criminals exploit by selling their token holdings at the peak.
  • By cycling illicit funds into these tokens, criminals can claim apparent investment returns once sold.
  • Criminals coordinate pump-and-dump schemes on small-cap or less-liquid cryptocurrencies, rapidly driving prices up by purchasing large volumes before selling off at inflated valuations.
  • Wash trading is accomplished by trading the same coin between interconnected wallets to simulate legitimate market interest, luring outside participants into trading.
  • These activities mask illicit funds as crypto “trading profits” when liquidated into fiat or other assets.

Service & Products

  • Large-volume trades occur off-exchange, disguising how supply or demand shifts can affect public pricing.
  • Limited regulatory scrutiny over OTC transactions enables criminals to distort perceived liquidity and asset value.
  • Pseudonymous participants can repeatedly trade tokens among their own wallets, creating artificial transaction volume or price momentum.
  • Lack of centralized oversight facilitates pump-and-dump schemes or ‘rug pulls,’ with criminals inflating token values before disappearing with the profits.
  • Minimal oversight can allow multiple user accounts to coordinate manipulative trades, quickly inflating or deflating asset prices.
  • Wash trading is facilitated by direct user-to-user trades that lack robust order book transparency or centralized monitoring.
  • Criminals can set up multiple brokerage accounts to place matching buy/sell orders (wash trading), boosting perceived liquidity and interest in a security.
  • Pump-and-dump ploys involve spreading false information to inflate share prices, enabling rapid sell-offs at manipulated highs.
  • Criminals can orchestrate wash trades by repeatedly buying and selling digital assets among linked accounts, artificially inflating trading volumes or boosting prices.
  • They may conduct pump-and-dump campaigns in low-liquidity tokens, driving up prices through coordinated purchases before rapidly liquidating at inflated valuations.
  • Easily opened online accounts allow criminals to engage in high-frequency or layered trades that obscure manipulative patterns.
  • False rumors or misleading 'research' can be disseminated to spur buying sprees, letting perpetrators exit large positions undetected at peak prices.
  • Leveraged trading amplifies potential price swings, making pump-and-dump or wash trading strategies more impactful.
  • Criminals can push prices up or down swiftly, triggering margin calls or forcing rapid liquidations that benefit their positions.
  • Options offer leveraged positions with minimal upfront capital, magnifying the impact of manipulative price swings.
  • Tactics like spoofing or layering can distort underlying asset prices, letting criminals profit handsomely through prearranged options positions.

Actors

AT0003
|
|

Traders knowingly orchestrate market manipulation by:

  • Placing matched buy and sell orders among accounts under their control to inflate trading volumes.
  • Conducting pump-and-dump schemes by disseminating false or misleading information, then exiting positions at peak prices.

These actions obscure the true origin and movement of funds, complicating financial institutions' ability to monitor and detect suspicious activities.

AT0041
|
|

Brokers can be exploited (knowingly or unknowingly) when criminals:

  • Open multiple or fictitious brokerage accounts to execute wash trades or pump-and-dump strategies.
  • Conceal manipulative patterns within otherwise legitimate trading flows.

This exposure makes it harder for brokers and financial institutions to detect suspicious market activity, as criminals may blend illicit trades with regular client transactions.

References

  1. FATF (The Financial Action Task Force). (2009, October). Money laundering and terrorist financing in the securities sector. FATF. https://www.fatf-gafi.org/en/publications/Methodsandtrends/Moneylaunderingandterroristfinancinginthesecuritiessector.html

  2. FATF (Financial Action Task Force). (2023, February). Money Laundering and Terrorist Financing in the Art and Antiquities Market. FATF. https://www.fatf-gafi.org/publications/Methodsandtrends/Money-Laundering-Terrorist-Financing-Art-Antiquities-Market.html

  3. FATF (Financial Action Task Force). (2003, February 14). Report on money laundering typologies 2002-2003. FATF. https://www.fatf-gafi.org/en/publications/Methodsandtrends/Moneylaunderingtypologies2002-2003.html

  4. National Crime Agency (NCA), United Kingdom Financial Intelligence Unit (UKFIU). (2022, October). SARS in Action Issue 17. https://www.nationalcrimeagency.gov.uk/who-we-are/publications/616-sars-in-action-october-2022/file

  5. AUSTRAC (Australian Transaction Reports and Analysis Centre). (2017, July). Australia's securities & derivatives sector money laundering and terrorism financing risk assessment. AUSTRAC. https://www.austrac.gov.au/business/how-comply-guidance-and-resources/guidance-resources/australias-securities-and-derivatives-sector-risk-assessment-2017

  6. Lai, L. (2010). Misuse of securities and futures market by money launderers – a general overview. Journal of Money Laundering Control, Vol. 13 No. 1, pp. 66-69. https://doi.org/10.1108/13685201011010227

  7. Al Shamsi, M., Smith, D., & Gleason, K. (2023). Space transition and the vulnerabilities of the NFT market to financial crime. Journal of Financial Crime.https://www.emerald.com/insight/content/doi/10.1108/jfc-09-2022-0218/full/html

  8. Akram T., Ramakrishnan S.A.,Naveed M. (2023). Prevalence of money laundering and terrorism financing through stock market: A comprehensive conceptual review paper. Journal of Money Laundering Control, Vol. 26 No. 5, pp. 1027-1044. https://doi.org/10.1108/JMLC-06-2022-0094

  9. The Wolfsberg Group. (2023).CBDDQ Glossary. The Wolfsberg Group. https://wolfsberg-group.org/resources/

  10. Lange, A. (2022). Financial crime in the metaverse is real – how can we fight back?. Wolf Theiss. https://www.wolftheiss.com/insights/financial-crime-in-the-metaverse-is-real/