Marking the close: meaning, examples and why it peaks at month-end

Marking the close means buying or selling a security deliberately at or near the end of the trading session, in an effort to move the closing price to a chosen level. EU and UK rules describe it as trading "at the reference time of the trading session (e.g. opening, closing, settlement) in an effort to increase, to decrease or to maintain the reference price"; a US federal court called it "investor argot for buying or selling stock as the trading day ends to artificially inflate the stock's value". It matters to asset managers for an uncomfortable reason: the closing price sets the value of their portfolios, and peer-reviewed research finds closing-price manipulation concentrated on month-end and quarter-end days, in stocks with high institutional ownership. Telling a manager's legitimate quarter-end trading from a manipulated print is hard, because both happen in the same minutes. Botminds' Trade Surveillance builds the case behind each marking-the-close alert, with the order's origin, the closing auction and the fund's valuation dates side by side, and tests every proposed threshold change against past real cases before anyone approves it.

The product examples come from a fictional asset manager, Quillfield Capital, run through the solution on sample data. Everything else is from regulators, courts and peer-reviewed journals.

What does marking the close mean?

It means placing orders around the close in order to set the closing price, rather than to buy or sell what you need. The intent is the line: a large order executed in the closing auction because an index changes that evening is ordinary; a small order placed in the last minutes of a thinly traded stock to lift the print that values a portfolio is manipulation. Regulators on both sides of the Atlantic define the practice by its purpose.

In the EU and the UK, the Delegated Regulation that lists manipulative practices describes it as "Buying or selling of a financial instrument ... deliberately, at the reference time of the trading session (e.g. opening, closing, settlement) in an effort to increase, to decrease or to maintain the reference price (e.g. opening price, closing price, settlement price) at a specific level — usually known as 'marking the close'" (Delegated Regulation 2016/522, Annex II). The reference price can be an open or a settlement price, so the same practice in a futures settlement window counts. In the US, the D.C. Circuit, upholding an SEC order against an investment adviser in 2015, gave the shorter version quoted above (Koch v. SEC, No. 14-1134, D.C. Cir., July 14, 2015).

How common is marking the close?

More common than enforcement suggests. The largest published estimate comes from a peer-reviewed study of closing-price manipulation and its detection, which models how manipulated closes behave and applies the model to market-wide data:

We estimate that ∼1% of closing prices are manipulated, of which only a small fraction is detected and prosecuted. ... A significant proportion of manipulation occurs on month/quarter-end days. Manipulation on these days is more likely in stocks with high levels of institutional ownership.

Comerton-Forde and Putniņš, 'Stock Price Manipulation: Prevalence and Determinants', Review of Finance 18(1): 23–66, 2014

The same abstract adds two findings a surveillance team can use. Stocks "with high levels of information asymmetry and mid to low levels of liquidity are most likely to be manipulated", which is where a modest order moves a closing price. And "Government regulatory budget has a strong effect on both manipulation and detection": where less is spent on catching it, more of it happens. For a buy-side firm, the first finding says where to look and the second says not to infer from a quiet enforcement record that the risk is small.

Why month-end and quarter-end: the fund manager's incentive

Because that is when performance is measured. A fund's net asset value, its reported returns and often its fees are computed from closing prices on the last day of the month or quarter. A manager who lifts the closing prices of stocks it already owns on that day lifts its own reported performance, if only until the next session.

Researchers found that pattern in US equity mutual funds two decades ago. "We present evidence that fund managers inflate quarter-end portfolio prices with last-minute purchases of stocks already held," the authors wrote, putting the price inflation at "0.5 percent per year for large-cap funds to well over 2 percent for small-cap funds", and finding it largest "for the stocks held by funds with the most incentive to inflate" (Carhart, Kaniel, Musto and Reed, 'Leaning for the Tape', The Journal of Finance, 2002).

The rules recognise the link to valuation directly. Among the indicators of manipulation listed in Annex I of the Market Abuse Regulation is "the extent to which orders to trade are given or transactions are undertaken at or around a specific time when reference prices, settlement prices and valuations are calculated and lead to price changes which have an effect on such prices and valuations" (UK MAR, Annex I, indicator A(g)). For an asset manager, the valuations in that sentence are its own.

A marking the close example: an adviser's quarter-end prints

The clearest recent example involves a US investment adviser, its own client portfolios and two quarter-end dates. In 2009 the owner of a small adviser that invested in community bank stocks worried that clients, newly able to see their account values online, would think their accounts were underperforming. On 30 September and 31 December, the last trading days of the third and fourth quarters, his broker's trader bought shares of three thinly traded bank stocks in the final minutes of the session, on his instructions.

The evidence that decided the case was not the trading pattern alone. The adviser had emailed the trader to "move last [High Country] trade right before 3pm up to as near $25 as possible without appearing manipulative", and on 28 December asked for "a closing price for High Country in the 20–25 [dollar] range, but certainly above 20". On recorded calls on 31 December he told the trader to "just create prints". When a later order in another stock missed the close by nine seconds, the court noted that failing to move the price did not help him, because "intent—not success—is all that must accompany manipulative conduct" (Koch v. SEC).

Two details matter for surveillance. The case began when an exchange investigator wrote to the executing broker asking about its "policies and procedures for preventing traders from marking the close", and the adviser's explanation to the broker was that he was "simply trying to get rid of some excess cash in a client's account". And the SEC found, and the court upheld, that the adviser had also violated the rule requiring advisers to adopt and implement compliance policies (SEC Litigation Release 23308, July 2015). The adviser's own surveillance, had it existed, would have seen quarter-end orders in illiquid holdings, placed in the last minutes, by the owner.

Marking the close in market abuse law: UK and EU MAR

In the UK and the EU, marking the close is market manipulation under Article 12 of the Market Abuse Regulation, and it is named in the article itself. Article 12(2)(b) lists as manipulation "the buying or selling of financial instruments, at the opening or closing of the market, which has or is likely to have the effect of misleading investors acting on the basis of the prices displayed, including the opening or closing prices" (UK MAR, Article 12). Unlike the US standard, the test is effect, not intent alone: trading that is "likely to have the effect" of misleading is within the article, and under Article 12(1)(a) trading that gives false or misleading signals escapes only where the person "establishes" that it was "carried out for legitimate reasons" and conforms with an accepted market practice.

The Delegated Regulation then gives the indicators that analysts and alert models are built on. They are not proof; the rule says the indicators "shall not necessarily be deemed, in themselves, to constitute market manipulation". They are where an analyst should look first.

Marking the close and the SEC: what a case must prove

In the US, marking the close is charged as manipulation under Section 10(b) of the Exchange Act and Rule 10b-5, and for an adviser also under the anti-fraud provisions of the Advisers Act. Under the Commission's precedent, as the D.C. Circuit summarised it, the charge has two elements: "conduct evidencing a scheme to mark the close—i.e., trading at or near the close of the market so as to influence the price of a security" and "scienter, defined as a mental state embracing intent to deceive, manipulate, or defraud" (Koch v. SEC).

That second element is why surveillance evidence beyond the trades matters. The Commission itself acknowledged that "some of the trading at issue here, standing alone, [could be seen] as consistent with legitimate attempts to obtain illiquid stocks"; the emails and the recorded calls turned it into a case. A buy-side alert that shows only the order and the closing price gives an analyst half of what a regulator would weigh. The other half is in the communications archive and the order's origin.

Is window dressing marking the close?

Not by itself. Window dressing usually means changing what a portfolio holds just before a reporting date, for example selling losers and buying recent winners so the holdings list looks better. It changes what investors see in the holdings, not the prices at which those holdings are valued. It may mislead clients, which raises its own questions under disclosure rules, but it is not price manipulation.

It becomes marking the close when the trades aim at the closing price itself: buying more of a stock the fund already owns, in the last minutes of the quarter, in a size and at prices chosen to lift the print. That is the conduct the 2002 study called "leaning for the tape". The distinction is the one surveillance should draw: a quarter-end trade in a name the fund is adding to for portfolio reasons, executed through the closing auction at a modest share of volume, is different from late, aggressive orders in an illiquid holding whose price rises at the close and falls back the next morning.

Marking the close vs spoofing and layering

Both are manipulation, but they work differently and need different alerts. Marking the close usually uses real trades to set one price at one moment. Spoofing and layering use orders that are never meant to trade: the Delegated Regulation describes "Submitting multiple or large orders to trade often away from the touch on one side of the order book in order to execute a trade on the other side of the order book. Once the trade has taken place, the orders with no intention to be executed shall be removed — usually known as layering and spoofing" (Delegated Regulation 2016/522, Annex II).

The data point in the last caption is not academic. The FCA reported in 2022 that it had "observed instances where firms are not monitoring all orders and trades, including cancelled and amended orders", and warned that order surveillance "can be critical in identifying certain forms of market manipulation, such as those that involve false or misleading signals" (FCA, Market Watch 69). A firm that feeds its surveillance only executed trades can run a marking-the-close alert and no meaningful spoofing alert at all.

Marking the close surveillance: the FINRA case of the 98% drop

The easiest way to reduce marking-the-close alerts is to make the alert blind, and regulators treat that as a failure, not a saving. In January 2022 FINRA fined a large retail broker $350,000 after finding that in February 2017 it had changed its main marking-the-close report to look only at orders "entered and executed in the last minute of the trading day", and to flag a case only if three further conditions "were present simultaneously". After the change, "the average number of trades identified by its marking-the-close surveillance report decreased more than 98 percent". FINRA found the report "was not a reasonable method for identifying potential marking-the-close activity" (FINRA AWC No. 2014039952901).

The FCA has made the same point about calibration from the other side. It warned that firms using "'out of the box' and 'industry standard' settings" or "average peer alert volumes" to calibrate risk not meeting the requirement that surveillance be "appropriate and proportionate to the scale, size and nature of their business activity" (FCA, Market Watch 56). The honest test of a threshold change is not how many alerts it removes, but whether the alerts that mattered would still fire.

A marking-the-close threshold change, backtested before approval

In the sample firm, the marking-the-close model raised 204 alerts a month, and only 0.5% of them led to an escalation or a recorded finding. The Tuning agent's proposal narrows only the cases with a documented innocent reason, orders the order system marks as index events, and leaves the price-impact test alone. It cuts the volume by 38% in a six-month backtest, and the three past cases that were real still fire. The Head of Surveillance approves or rejects it, and the change log records who did which. Measured that way, a threshold change can be defended to an examiner; the 98% version could not. How to test surveillance models covers the method in more depth.

Explaining your own quarter-end trades

An asset manager will always trade heavily at month-end and quarter-end, because flows, rebalances and index changes are scheduled there. The research says that is also where closing-price manipulation clusters, so the manager's own surveillance should expect its alerts there and be able to explain each one quickly.

The explanation is in the order's origin. A rebalance ticket created days earlier, a benchmark-tracking instruction to trade at the close, a subscription that had to be invested that day: each is a fact with a timestamp, and each is in a system the surveillance team rarely sees directly. A trade that has none of these, placed late, in an illiquid name the fund already owns, by someone whose performance is measured on that day's close, is the one that needs a person's full attention. That is why the analyst's job is evidence assembly first, as the trade surveillance analyst guide describes, and why Trade Surveillance puts the ticket, the auction data and the valuation calendar in the same case file. To see it on your own alerts, start at Trade Surveillance.

Questions people ask

Is it illegal to trade at the close?

No. Trading at the close, including in the closing auction, is normal and often required, for example to match an index fund's benchmark price. It becomes manipulation when the purpose, or under EU and UK MAR the likely effect, is to set or mislead about the closing price, without a legitimate reason.

What is the difference between marking the close and portfolio pumping?

The terms overlap. Portfolio pumping usually describes a fund manager buying holdings at period-end to inflate the fund's reported value; marking the close is the technique of trading at the close to set the price. The 2002 study of US equity funds found the pattern it called "leaning for the tape" with quarter-end price inflation of up to well over 2% a year for small-cap funds.

Can marking the close happen in bonds or futures?

Yes. The EU and UK definition covers any reference price, including "settlement" prices, so manipulating a futures settlement window or the price used to value a bond position is within it. The FCA has also warned that surveillance which uses price when an instrument trades on yield "may fail to carry out meaningful monitoring".

What is the penalty for marking the close?

It depends on the regime. In the US it is charged as securities fraud; the adviser in the 2015 D.C. Circuit case was barred from the industry. In the UK, market manipulation can bring an FCA fine and prohibition, and misleading conduct can also be prosecuted as a criminal offence.

How should a fund document a legitimate trade at the close?

By keeping the reason with the order: the rebalance ticket or instruction, who created it and when, the target execution method, and the share of closing volume. When that information is linked to the trade, a marking-the-close alert can be closed with a cited reason instead of a general statement that the trade was for portfolio purposes.