What Changes When the NBBO Loses Its Regulatory Anchor

At a Glance

• Rule 611 doesn’t define spoofing, but it does shape many of the market structure signals surveillance systems rely on today.
• If Rule 611 is rescinded, the NBBO may become a less stable benchmark for measuring manipulative price impact.
• Surveillance will need to rely more heavily on behavioral detection, adaptive baselines, and cross venue analysis.
• Extended-hours trading already presents many of these challenges, offering a useful preview of a post-611 environment.
• Firms should begin evaluating whether their surveillance programs are prepared for these changes today.

Rule 611 and Trade Surveillance

In a recent post, we explored how the proposed rescission of Rule 611 changes the mechanics of best execution without changing the underlying obligation. The same principle applies to trade surveillance — but the implications run deeper and are less intuitive.

Spoofing doesn’t depend on Rule 611. Manipulative intent is manipulative intent, regardless of the routing framework around it. But the tools, signals, and reference points that surveillance systems use to detect spoofing are deeply entangled with the market structure that Rule 611 created.

If the rule goes away, the manipulation doesn’t change. But the way firms detect it may need to.

The NBBO as a Detection Anchor

Most spoofing detection models are built around a simple premise: did someone place orders designed to move the national best bid or offer, then exploit the resulting price movement?

That question assumes the NBBO is a reliable, stable reference point, and for the last two decades it has been. Rule 611 gave the NBBO its regulatory weight. Protected quotations displayed on lit exchanges were the prices that mattered, because routing systems were required to interact with them.

In a post-611 environment, the NBBO doesn’t disappear. It still exists as a consolidated data construct. But its composition and reliability could change in ways that do matter for surveillance. If broker-dealers stop routing to lower-volume venues, the quotes that make up the NBBO could come from a smaller group of venues. Conversely, if new venues enter the market (such as tokenized platforms, extended-hours exchanges, or alternative auction models), the NBBO could become more fragmented, not less.

Either way, the benchmark against which surveillance systems measure manipulative price impact becomes less certain.

At the Security Traders Association of New York’s Annual Meeting, industry participants proposed ways to preserve a standardized NBBO without Rule 611, including market-share-based SIP participation frameworks designed to maintain broad quote representation. Those efforts may ultimately provide greater continuity. But until the future market structure is settled, firms should be cautious about assuming today’s reference points will remain unchanged. Surveillance architectures should be resilient across a range of potential outcomes, not optimized for a single regulatory path.

What Breaks in Spoofing Detection

Spoofing surveillance typically works in stages: identify a suspicious order pattern, measure its market impact, evaluate whether the trader’s behavior is consistent with manipulative intent, and assess whether the subsequent activity (cancellations and execution on the opposite side) confirms the thesis.

Several of those stages are sensitive to a post-611 environment.

Impact measurement relies on NBBO stability. A spoofing filter asks: did this order move the best bid or offer? If the NBBO is formed across fewer venues, or if its composition becomes more volatile because quoting incentives change, the same order might register as market-moving in one environment and not in another. Calibrating the threshold between legitimate price-setting and artificial price impact becomes harder when the reference benchmark itself is less stable.

Spread dynamics become noisier. Many spoofing models use the bid-ask spread as a context signal, i.e. narrower spreads suggest more competitive quoting, while sudden spread changes can indicate manipulative activity. If Rule 610(e) is also rescinded and locked and crossed markets become more common, spread-based signals will carry more noise. A locked market that would have been prevented under current rules could look, to a surveillance system, like the result of aggressive quoting on both sides which is a pattern that overlaps with layering and spoofing signatures.

The ISO signal disappears. Under Rule 611, Intermarket Sweep Orders are a key exception; they allow a firm to execute at one venue while sweeping better-priced protected quotations elsewhere. ISOs are also a meaningful data point in spoofing detection. Rapid ISO sweeps on the harvest side of a spoofing episode are a behavioral indicator. If Rule 611 is rescinded, the ISO construct becomes unnecessary. Firms may still sweep across venues, but the order type taxonomy continues to evolve.

Venue-level detection needs recalibration. Today, a spoofer placing large displayed orders on a low-volume exchange can have an outsized effect on the NBBO precisely because those quotes are protected. Remove protected status, and the calculus shifts. The same order on a venue that no longer contributes to a regulatory price benchmark may have a different or less readily measurable impact. Surveillance systems that weight venue-level quoting activity by protected status will need new heuristics.

From Rule-Based Detection to Behavioral Detection

This is the deeper shift, and it mirrors the best execution story.

Under Rule 611, spoofing surveillance could lean on structural markers: Did the order interact with the NBBO? Was it placed at a protected price level? Did the trader use ISOs on the other side? These are relatively mechanical signals anchored to the regulatory framework.

This reflects a broader shift from prescriptive rules toward principles-based oversight. As structural markers become less definitive, surveillance increasingly relies on behavioral analysis rather than specific market structure signals.

In a post-611 world, detection increasingly becomes a behavioral question. The structural markers weaken, but the underlying conduct doesn’t change. A trader who places large orders to create the appearance of supply or demand, then cancels and trades the other way, is still spoofing regardless of whether those orders affected a “protected” quotation.

That means surveillance systems need to focus more on:

• Pattern recognition across the full order lifecycle — not just whether orders touched the NBBO, but the sequence of placement, modification, cancellation, and execution relative to price movement across venues.
• Behavioral baselines — understanding what normal trading looks like for a given account, strategy, and market condition, so that anomalous patterns stand out even without a stable NBBO reference point.
• Cross-venue coordination — without mandatory routing to all protected quotes, manipulative activity could concentrate on specific venues or exploit disconnects between venues that are no longer required to interact. Detecting coordination across fragmented venues becomes more important, not less.
• Contextual dampening — distinguishing spoofing from legitimate behavior in noisier market conditions. More locked and crossed markets, more variation in venue participation, and more diverse execution models all increase the false positive risk. Surveillance systems that can contextualize behavior against prevailing market microstructure will outperform those that rely on static thresholds.

Extended-Hours Trading: A Preview of the Post-611 Detection Challenge

This shift from structural to behavioral detection isn’t hypothetical. Firms already face an analogous challenge in extended-hours trading.

Pre-market and after-hours sessions share key characteristics with what a post-611 regular-hours environment could look like: thinner order books, fewer participants contributing to price discovery, wider and more volatile spreads, and a reduced set of structural protections around displayed quotations. The NBBO during extended hours is less stable, formed across fewer venues, and more susceptible to individual orders moving the best bid or offer. Spread signals are noisier. The order type landscape is simpler. In short, the reference points that regular-hours spoofing detection has historically relied on are weaker.

Detecting spoofing in that environment requires exactly the approach described above: order lifecycle pattern recognition, account-level behavioral baselines, and contextual analysis that adapts to prevailing market conditions rather than depending on a structurally anchored NBBO.

At Trillium Surveyor, our surveillance models already operate across extended-hours sessions. That experience has shaped a detection architecture that doesn’t assume the structural conditions of regular trading hours and is built around behavioral signals that hold up in thinner, less protected markets. The techniques that work in extended hours are the same techniques that will matter in a post-611 regular session: pattern continuity across time windows, baseline-relative anomaly detection, and venue-aware contextual scoring.

The firms that have already invested in robust extended-hours surveillance may find themselves better prepared than they realize. The detection challenge that a post-611 world presents during regular hours is, in many respects, the challenge that extended-hours trading already demands.

The Compliance Challenge Is Real

This isn’t theoretical. If the SEC adopts the proposal, FINRA examiners and SEC enforcement staff will still pursue spoofing cases. The legal standard, placing orders with the intent to cancel before execution, to create a misleading impression of supply or demand, does not reference Rule 611. Dodd-Frank Section 747 and Exchange Act Section 9(a)(2) are independent of the routing framework.

Structural changes may be gradual, but surveillance systems that rely on structural signals don’t have the luxury of waiting for the transition to fully play out before adapting. What changes is the evidentiary landscape. Firms will need to demonstrate that their surveillance programs can detect spoofing in a market where the NBBO is less structurally anchored, where spread signals are noisier, where venue participation patterns are more variable, and where the order type taxonomy may evolve.

What Firms Should Be Thinking About Now

The comment period closes in August 2026 and a final vote could come as early as Q1 2027. That timeline is tight for firms that need to re-evaluate surveillance infrastructure.

A few questions worth asking now:

1. How dependent is your spoofing detection on NBBO-anchored impact measurement? If the NBBO’s composition or reliability shifts, do your thresholds still hold?
2. Can your surveillance system establish and update behavioral baselines at the account level? In a noisier market, static thresholds produce more false positives. 
3. Are you detecting patterns across venues, or venue by venue? Cross-venue coordination detection becomes critical when mandatory routing no longer connects every venue.
4. Does your surveillance already cover extended-hours sessions with the same rigor as regular hours? If so, the detection architecture you’ve built for thinner markets may already be the foundation for post-611 readiness.
5. How does your system handle locked and crossed market conditions? If those conditions become more frequent, will your filters generate signal or noise?

Market structure rules may change. The obligation to detect and prevent manipulation does not. Firms that invest now in dynamic baselines and cross-venue analytics will be best positioned to maintain effective surveillance — regardless of what the final rule looks like.

About Trillium Surveyor: Surveyor delivers multi-asset trade surveillance and best execution analytics, powered by 13+ years of continuous tick-level data and behavioral baseline models that adapt to evolving market structure.

If you’re evaluating what a potential Rule 611 change could mean for your surveillance program, schedule time with our team to discuss how Trillium Surveyor approaches spoofing detection, dynamic baselines, and cross-venue analytics.