Stock Manipulation

Criminals launder illicit funds by orchestrating manipulative trades in capital markets, such as pump and dump, spoofing, or wash trading. The complexity, volume, and volatility of equity transactions help to obscure the illicit origin of funds. Once criminals exit these positions, final proceeds may appear to be legitimate, market-driven returns. Techniques often involve low-liquidity shares or penny stocks, which are easier to influence, and can leverage multiple accounts or shell companies to conduct circular trading. Research also highlights the use of advanced electronic trading channels, such as direct market access, which facilitate rapid and layered transactions designed to evade scrutiny. In some cases, criminals acquire or exert control over publicly traded companies, artificially inflating stock prices to generate additional illicit profits. One observed scenario involves focusing on a single targeted stock, generating unusual trading volumes that drive prices up rapidly, only to be sold at a sudden peak. This environment of high-speed trades, innovative technology, and cross-border capital flows reinforces the potential for manipulation, prompting calls for enhanced oversight of anomalous trading behavior.

[
Code
T0094.001
]
[
Name
Stock Manipulation
]
[
Version
1.0
]
[
Parent Technique
]
[
Tactics
]
[
Risk
Product Risk, Channel Risk
]
[
Created
2025-02-13
]
[
Modified
2025-04-02
]

Pump-and-Dump Schemes

Wash Trading

Spoofing

Tactics

ML.TA0007
|
|

Criminals orchestrate manipulative stock trades and high-volume transactions across multiple accounts or shell entities to obscure the trail of illicit funds, creating a complex chain that detaches the proceeds from their criminal origin.

Risks

RS0002
|
Product Risk
|

Criminals exploit the inherent complexities of equity and derivatives trading—such as high volumes, volatility, and opaque price movements—to obscure the illicit origin of funds. By orchestrating pump-and-dump schemes, wash trading, and other manipulative techniques, they leverage these financial products' complexity to blend illicit proceeds into seemingly legitimate market transactions.

RS0003
|
Channel Risk
|

Advanced electronic trading channels (e.g., direct market access, online brokerages) enable rapid, high-volume trades with minimal direct oversight or face-to-face interaction. Criminals exploit these channels to layer transactions across multiple accounts, mask beneficial ownership, and execute manipulative strategies that evade real-time scrutiny, thereby impeding AML detection.

Indicators

IND00087
|

Large, unexplained deposits and capital injections into trading accounts that far exceed the client's declared income or wealth profile.

IND00088
|

Frequent reciprocal trades among a cluster of interconnected accounts, creating unusually high and artificial trading volumes.

IND02388
|

Rapid successive purchases of equities using funds that are not supported by documented sources, indicating integration of mixed capital.

IND02389
|

Repetitive buying and selling of shares at prices significantly deviating from prevailing market values, suggesting potential collusive price manipulation.

IND02390
|

Use of nominee investors or multiple beneficial owners in trading accounts, complicating the verification of the true source of funds.

IND02391
|

Trades executed in rapid bursts or during atypical trading hours without clear market rationale, which may indicate orchestrated market manipulation.

IND02392
|

Abrupt and significant increase in trading volume and share price of a low-liquidity stock, followed by a rapid liquidation of holdings.

IND02393
|

High levels of placed-and-canceled orders for a targeted stock, with minimal executions, suggestive of spoofing or layering schemes.

Data Sources

  • Captures IP addresses, device identifiers, and login timestamps across online and mobile trading platforms.
  • Enables detection of multiple trading accounts accessed from the same device or location, helping to uncover coordinated or collusive trading patterns.
  • Highlights suspicious or unauthorized login attempts, supporting the identification of orchestrated manipulation using advanced electronic trading channels.
  • Provide comprehensive records of all transaction details, including timestamps, amounts, sources, and destinations.
  • Facilitate the identification of large, unexplained deposits or sudden capital inflows that enable manipulative stock trading.
  • Compare inbound funds with subsequent equity purchases to confirm the integration of illicit capital into market transactions.
  • Provide real-time and historical pricing, trading volumes, and market trends for stocks and other securities.
  • Enable detection of transactions at prices deviating significantly from prevailing market rates, a hallmark of stock manipulation.
  • Facilitate monitoring of sudden volume or price spikes in low-liquidity stocks frequently targeted for pump-and-dump schemes.
  • Contain verified customer identities, beneficial ownership structures, risk profiles, and financial statements.
  • Help identify accounts controlled by the same individuals or entities, even when using nominee investors.
  • Uncover misalignments between declared wealth and actual investment activity in capital markets.
  • Document trades across regulated financial exchanges, including trade volumes, timestamps, prices, and counterparties.
  • Reveal patterns of rapid buying and selling, circular trading, or artificially high volumes indicative of manipulation.
  • Enable detection of spoofing and layering activities through order placement and cancellation logs.
  • Contain official records on companies, shareholders, and beneficial owners.
  • Help identify shell entities or undisclosed owners controlling multiple trading accounts.
  • Support detection of complex corporate structures used to obscure ultimate beneficiaries in stock manipulation scenarios.

Mitigations

Apply deeper scrutiny to customers who trade in penny stocks or thinly traded stocks, hold multiple related accounts, or engage in unexplained high-volume trades inconsistent with their stated profiles. Verify the ultimate beneficial owners when corporate or shell entities appear coordinated, and cross-check the source of funds to expose hidden collusion and mitigate high-risk manipulation attempts.

Implement specialized alerts and analytics for equity trades to detect manipulative patterns such as spoofing, wash trading, and circular transactions among accounts under common control. Focus on abrupt price or volume changes in low-liquidity stocks, repeated buy/sell sequences within short timeframes, and cross-border fund movements that exceed typical retail profiles. By flagging these anomalies in near real-time, institutions can escalate potential stock manipulation for immediate investigation.

Leverage public regulatory filings, negative media, and other open data to identify stocks or entities previously implicated in pump-and-dump, spoofing, or other manipulation schemes. Cross-reference flagged names with internal trading records to proactively detect attempts at orchestrated market manipulation, allowing timely compliance intervention.

Actively participate in formal industry partnerships, regulatory forums, and stock exchange watch groups to exchange intelligence on newly emerging pump-and-dump or spoofing techniques. Share relevant trading data, subject to legal constraints, to strengthen collective detection efforts across market venues and intervene rapidly against manipulative networks.

Restrict direct market access or advanced trading capabilities for accounts linked to repetitive suspicious trades in low-liquidity equities. Impose additional verifications or withhold margin trading privileges until legitimate business purposes are confirmed. These targeted controls prevent repeated manipulative behavior and safeguard the integrity of capital markets.

Instruments

IN0019
|
|
  • Criminals target publicly traded shares, particularly low-liquidity or penny stocks, to execute pump-and-dump or wash trading schemes that artificially inflate share prices and trading volumes.
  • By cycling illicit funds through multiple brokerage or nominee accounts, they create the appearance of legitimate market activity, obscuring direct links to illegal proceeds.
  • Once shares are sold at the manipulated peak, the resulting profits appear to be ordinary investment gains, effectively integrating illicit funds into the financial system.
IN0021
|
|
  • Derivative contracts (e.g., futures or options) are exploited for spoofing, layering, or wash trading processes to manipulate market signals.
  • Criminals place large orders and quickly cancel or offset them, distorting perceived demand or supply, which can artificially move prices.
  • This complexity conceals the true source of funds by dispersing illicit money across multiple trades and accounts under the guise of legitimate, high-volume trading.

Service & Products

  • Involve decentralized or less transparent trading environments, often used for penny stocks that can be manipulated with lower volumes.
  • Allow high-volume or private trades off major exchanges, reducing visibility of excessive or circular trading patterns and hindering regulatory oversight.
  • Facilitate direct purchase and sale of equities, allowing criminals to orchestrate manipulative trades across multiple accounts.
  • Provide an interface to trade low-liquidity or penny stocks, enabling pump-and-dump and wash trading schemes where abnormal volumes or prices can obscure illicit fund origins.
  • Offer remote account setup and electronic trading features, enabling rapid purchase or sale of shares without in-person oversight.
  • Allow criminals to maintain multiple or nominee accounts to perform coordinated trades, artificially inflating or deflating stock prices.
  • Permit leveraging borrowed funds to amplify the impact of manipulative trades and artificially inflate trading volumes or stock prices.
  • Enable layering by mixing illicit funds with margin loans, masking suspicious capital inflows behind normal securities trading activity.
  • Provide vehicles such as futures or options where spoofing, wash trading, or layered trades obfuscate the ultimate ownership and transaction flows.
  • Enable complex hedging or offsetting positions designed to hide illicit proceeds among legitimate market activities.

Actors

AT0003
|
|

Traders knowingly or unknowingly engage in stock market manipulation by:

  • Executing pump-and-dump, wash trading, or spoofing strategies that artificially alter share prices and volumes.
  • Rapidly buying and selling equities across multiple accounts to layer illicit proceeds and obscure their origin.
  • Leveraging electronic trading channels or direct market access to evade detection of manipulative behavior.

These actions complicate trade surveillance, making it harder for financial institutions to pinpoint suspicious trading patterns.

AT0041
|
|

Brokers can be exploited or complicit in stock market manipulation by:

  • Providing account setup, order execution, and margin facilities that enable artificial price inflations.
  • Facilitating large or frequent trades in penny stocks or low-liquidity shares, creating abnormal trading patterns.
  • Potentially overlooking or failing to detect high-volume trading across multiple client accounts.

These practices complicate financial institutions’ ability to distinguish legitimate client activity from manipulative trades.

Shell or front companies facilitate circular or wash trading by:

  • Opening brokerage accounts under corporate identities, obscuring the ultimate controlling parties.
  • Interacting with other affiliated accounts to generate artificial trading volumes or prices.

Financial institutions face significant challenges in identifying beneficial owners and detecting layered flows of illicit funds.

AT0068
|
|

Nominees help conceal criminal beneficiaries by:

  • Holding shares or brokerage accounts in their own names while taking instructions from undisclosed parties.
  • Obscuring the genuine ownership structures, complicating financial institutions’ due diligence.

This arrangement hinders effective transaction monitoring, allowing the underlying criminal actor’s involvement to remain hidden.

Criminals may install themselves or associates as business owners of publicly traded companies by:

  • Acquiring or controlling the entity’s operations or majority shareholdings.
  • Orchestrating manipulative trades that artificially inflate share value.

Such maneuvers complicate financial institutions' detection of abnormal price movements tied to insiders acting with fraudulent motives.

References

  1. FATF (The Financial Action Task Force). (2009, October). Money laundering and terrorist financing in the securities sector. FATF. https://www.fatf-gafi.org/en/publications/Methodsandtrends/Moneylaunderingandterroristfinancinginthesecuritiessector.html

  2. FATF (Financial Action Task Force). (2003, February 14). Report on money laundering typologies 2002-2003. FATF. https://www.fatf-gafi.org/en/publications/Methodsandtrends/Moneylaunderingtypologies2002-2003.html

  3. AUSTRAC (Australian Transaction Reports and Analysis Centre). (2017, July). Australia's securities & derivatives sector money laundering and terrorism financing risk assessment. AUSTRAC. https://www.austrac.gov.au/business/how-comply-guidance-and-resources/guidance-resources/australias-securities-and-derivatives-sector-risk-assessment-2017

  4. Lai, L. (2010). Misuse of securities and futures market by money launderers – a general overview. Journal of Money Laundering Control, Vol. 13 No. 1, pp. 66-69. https://doi.org/10.1108/13685201011010227

  5. Akram T., Ramakrishnan S.A.,Naveed M. (2023). Prevalence of money laundering and terrorism financing through stock market: A comprehensive conceptual review paper. Journal of Money Laundering Control, Vol. 26 No. 5, pp. 1027-1044. https://doi.org/10.1108/JMLC-06-2022-0094