Market Microstructure: How Futures Trades Actually Get Filled
Overview #
Every price you see on a chart is the result of a trade — an aggressive buyer lifting an offer or an aggressive seller hitting a bid. But between your click and your fill, there's an entire mechanical process that determines when you get filled, at what price, and whether the liquidity you saw was even real. That process is market microstructure.
This isn't academic abstraction. Understanding how the matching engine works, how queue priority determines who gets filled first, and how hidden orders distort the visible order book — this is the difference between a trader who wonders why fills are inconsistent and one who engineers execution deliberately.
The Matching Engine: What Happens After You Click #
When you submit an order to CME, it enters the Globex matching engine — the central system that pairs buyers with sellers. The process is simple in concept:
- Your order arrives. The engine validates it — correct instrument, valid price increment, acceptable size, proper account permissions.
- Market orders execute immediately against the best available resting limit orders on the opposite side of the book. If size at the best price is insufficient, the order "walks the book," consuming liquidity at progressively worse prices until completely filled.
- Limit orders that can't match immediately rest in the book at their specified price, waiting for an incoming order to cross them.
- Partial fills leave the remainder in the book at the same price with the same queue position.
- Cancellations remove liquidity instantly — your order disappears from the book and queue.
That's the skeleton. The nuance is in what happens at each step.
Walking the Book #
Here's a practical example. ES is showing 5,400.00 bid for 800 contracts, 5,400.25 offered at 600. You send a market order to buy 1,200 contracts.
- First 600 fill at 5,400.25 (the entire offer at that level)
- Next 600 need to come from 5,400.50, 5,400.75, and beyond — wherever resting sell orders exist
Your average fill price isn't 5,400.25. It's something worse, depending on depth at the next levels. This is slippage, and it's entirely a function of depth-by-price-level, not the quoted spread.
As NexusFi member [josh explained] [1] in the legendary Spoo-nalysis thread: the last traded price isn't always an accurate indication of the current state of the order book. Orders are constantly being added and withdrawn — the book you see is a snapshot of a moving target.
Price-Time Priority: The Queue That Determines Your Fill #
CME uses price-time priority (also called FIFO — first in, first out) for most products, as confirmed by [CME Group's official Globex matching algorithm documentation] [13]. This is the single most important execution concept most traders never think about.
Price priority first. A buy order at 5,400.25 always gets filled before a buy order at 5,400.00, regardless of when either arrived. Higher bids and lower offers have absolute priority.
Time priority second. At the same price level, the order that arrived first gets filled first. Period.
This creates a queue at every price level. If there are 800 contracts ahead of you at 5,400.00, you don't get touched until all 800 are filled (or cancelled). Your position in this queue is determined by when your order arrived.
Why Queue Position Is Alpha #
In fast markets near the inside quote, the difference between being 50th in line and 500th is the difference between getting filled and watching the market leave without you. [Fat Tails noted on NexusFi] [2] that the most recent price isn't always an indication of the current order book state — orders are constantly added and withdrawn before new trades occur.
For scalpers working the ES, queue position at the touch represents a genuine informational and execution edge. Firms invest millions in low-latency infrastructure for exactly this reason — fractions of a millisecond translate directly into queue advantage.
The Amendment Trap #
Modifying a working order typically resets your queue position. A price change effectively cancels your old order and submits a new one at the back of the line. Even size modifications can reset priority on some products.
This means constantly adjusting limit orders is self-defeating. Each modification sends you to the back of the queue, reducing your fill probability. The traders who fill consistently at the touch are the ones who get positioned early and stay put.
Queue position warning: Modifying a working limit order resets your queue position to the end of the line. Every amendment — even a size change on some products — sends you from 50th in queue to 800th. If you're scalping the touch, constant order adjustment is the fastest way to never get filled.
Bid-Ask Spread Dynamics: What Actually Drives the Spread #
The bid-ask spread isn't a fixed feature of a market — it's an emergent property of competing limit orders. Understanding what drives it wider or tighter tells you a lot about current market conditions.
Five Drivers of Spread Behavior #
1. Order book imbalance. When the top-of-book queue on one side is thin relative to the other, spreads tend to widen because incoming market orders are more likely to walk through the thin side. As [matthew28 described on NexusFi] [3] when discussing Eurex products: the bid might show 1 contract while the offer shows 2 — but those numbers change constantly.
2. Liquidity replenishment speed. After an aggressive move, market makers pull quotes and reassess. The time between quote withdrawal and replenishment is when spreads are widest. In ES, this can be milliseconds. In thin markets, it can be seconds.
3. Adverse selection risk. Market makers widen spreads when they sense "toxic" order flow — flow that's consistently on the right side of price moves. When HFT algorithms detect informed trading, they reduce quoted size and widen their markets to compensate for the expected loss.
4. Inventory constraints. A market maker carrying net long inventory will quote a wider offer (or smaller offer size) to avoid getting more long. Their spread becomes asymmetric based on their position.
5. Regime changes. Spreads widen at the open, around economic releases, and during any period of elevated uncertainty. As [FlyingMonkey observed] [4] in the Micro Euro futures competition: when the market opens on Sunday, the bid/ask is as wide as the leftover limit orders from Friday. New limits stream in and narrow the spread until someone crosses and the first trade prints.
The Quoted Spread Is Not Your Execution Spread #
This is critical. The spread you see — one tick in ES, two ticks in crude — is the displayed spread. Your realized spread depends on:
- Depth at the touch (can you actually get filled at the displayed price?)
- Queue position (are you near the front or back of the line?)
- Book stability (will the liquidity still be there when your order reaches the front?)
A one-tick displayed spread means nothing if the quote is for 50 contracts and you need 200. Your effective spread is wider.
Iceberg Orders: The Liquidity You Can't See #
Not all liquidity is visible. Iceberg orders (also called reserve orders) display only a portion of the total size — the "peak" — while hiding the rest.
How Icebergs Work #
- The displayed portion sits in the book with normal queue priority
- When the displayed portion is completely filled, the next tranche is automatically replenished
- Whether replenishment preserves or resets queue priority varies by exchange and product
The Great Iceberg Debate #
[Jigsaw Trading's Peter Davies] [5] made an important distinction in the Cumulative Delta thread: "It isn't possible for an exchange to remove iceberg orders because they don't exist at the exchange." Many icebergs are actually managed client-side by the trading platform — the platform feeds slices to the exchange, not the exchange hiding portions of a single order.
This has practical implications. Exchange-native reserve orders behave differently from platform-managed icebergs in terms of queue priority, refill timing, and detection signatures.
Detecting Icebergs #
You can spot iceberg activity when:
- The same price level absorbs much more volume than the displayed size suggested
- Depth at a level keeps refreshing to the same size after each wave of execution
- Time & Sales shows repeated trades at a level that should have been exhausted based on visible book depth
In the [Jigsaw AMA] [6], Davies laid out specific patterns: look for icebergs on the bid at range highs, icebergs on the bid during pullbacks in uptrends, and be especially aware of icebergs at the POC — the highest volume price — where institutional participants often defend positions.
Market Makers: Who Provides the Liquidity #
Unlike equities, futures markets don't have designated market makers with obligations to quote. But they do have de facto market makers — firms that consistently provide two-sided liquidity to earn the bid-ask spread.
The Market Making Business Model #
As explained in [a focused discussion on NexusFi] [7] about market makers in futures: their goal is to sell as much on the offer as they buy on the bid, earning the spread while keeping inventory balanced. Based on customer order flow and their view of fair value, they adjust where and how aggressively they quote.
Observable Market Maker Behavior #
Watch for these patterns in the order book:
Tightening spreads in calm conditions. When flow is balanced and volatility is low, makers quote aggressively at the inside, competing for queue position because each fill earns them the spread with minimal risk.
Widening spreads and faster cancellations during trends. When price moves directionally and aggressive flow dominates, makers widen their quotes and pull size. They're protecting against adverse selection — the risk that every fill puts them on the wrong side.
Depth pulling near breakout levels. This is the most actionable pattern. As price approaches a level where a breakout would trigger momentum, the visible depth at nearby levels often thins dramatically. Makers are preemptively pulling orders they expect to be run over.
Queue Poison #
An underappreciated concept: even when the displayed spread is tight, your realized cost depends on which fills you actually get. If you're consistently getting filled right before adverse moves — buying just before price drops, selling just before it rips — you're experiencing adverse selection. The spread looks fine on screen but you're hemorrhaging on realized execution quality. Tracking maker/taker breakdown and realized vs. quoted spread is how you detect this.
Spoofing and Order Book Games #
Spoofing — placing orders with the intent to cancel before execution to mislead other participants — is illegal. It's also still widespread. Understanding what it looks like helps you avoid being manipulated by it.
How Spoofing Works #
[Jigsaw Trading defined it cleanly] [8]: "Spoofing is simply submitting limit orders that you will pull before they get filled." Flipping is spoofing one side of the book while executing on the other — stack large orders on the offer to scare people into selling, while quietly buying on the bid.
In [a detailed breakdown on NexusFi] [9], Davies explained the mechanics: "A lot of spoofing goes on and generally that involves stacking the order book on one side to fool people into trading in the other direction. At the same time they will be putting in icebergs on the other side."
Practical Detection Heuristics #
You can't prove spoofing from your trading desk, but you can develop a healthy skepticism about large displayed orders:
- Short resting times. Genuine institutional orders typically sit in the book for seconds to minutes. Orders that appear and vanish within milliseconds are suspect.
- Size-price clustering without execution. Large orders that appear at key levels, influence price movement, then cancel without a single fill.
- Correlation with trade direction. After large orders appear on the offer, price drops — and the orders are pulled. This is the classic spoof-and-fade pattern.
The Practical Takeaway #
Don't trust large displayed size at face value. Treat it as one input, not a signal. The depth that matters is the depth that actually executes — what you see in Time & Sales, not what flashes on the DOM.
Spoofing defense: Large displayed orders that appear and vanish within milliseconds are suspect. The only depth you can trust is depth that actually executes — track what prints on Time & Sales, not what flickers on the DOM. If big size shows up at a key level and price moves before it fills, treat that move with skepticism.
As the [30-year Treasury bond discussion noted] [10], some of the most high-profile spoofing cases involved orders that "only a portion of the order's full size was visible to other market participants at any given time." The [DOJ prosecution of Tyler Forbes] [14] illustrated this intersection precisely — Forbes placed genuine iceberg orders on one side while layering fully displayed spoof orders on the other, manipulating Treasury note prices over a six-month period. The real and the fake can look identical on the DOM.
Passive vs. Aggressive: The Execution Decision Framework #
Every order you send is a decision between passive execution (limit orders that rest in the book) and aggressive execution (market orders that take from the book). Market microstructure tells you when each is appropriate.
| Condition | Best Approach | Why |
|---|---|---|
| Stable depth, balanced flow | Passive limit at the touch | You earn the spread; stable conditions mean your queue position will hold |
| Thin book, high cancel rates | Aggressive market/IOC | Displayed liquidity is unreliable; pay for certainty |
| Iceberg refills at target price | Patience — let the iceberg absorb | Icebergs indicate institutional defense; don't fight them |
| Large transient orders at the touch | Wait — potential spoof | Depth may vanish; don't react to phantom liquidity |
| Trending market, liquidity thinning | Aggressive or smaller passive | Queue position is meaningless if the level never trades |
Measuring Execution Quality #
Track these metrics over time to assess whether your execution is genuinely good or just appears that way:
Realized spread vs. quoted spread. If the displayed spread is one tick but your average fill-to-midpoint cost is 1.5 ticks, you have an execution problem.
Fill rate on passive orders. What percentage of your limit orders actually fill? If it's below 30%, you might be placing orders at levels that rarely trade — you're in the queue but the queue never clears.
Adverse selection ratio. Of your fills, what percentage move against you immediately? A ratio above 55-60% suggests you're systematically getting picked off — your execution is toxic and you need to rethink entry methodology or improve queue management.
Execution red flag: If more than 55-60% of your fills immediately move against you, your execution methodology needs a fundamental rethink. You're not unlucky — you're systematically providing liquidity to informed flow. Track your adverse selection ratio across 100+ trades before drawing conclusions.
The Information Asymmetry #
Here's the uncomfortable truth about market microstructure: you're competing against participants with better technology, faster connections, and more sophisticated models. High-frequency market makers can see and react to order book changes in microseconds. You can't.
But microstructure awareness still gives you an edge over the majority of retail traders who never think about this. You won't out-speed an HFT firm, but you can:
- Avoid the traps. Don't chase phantom liquidity. Don't react to large displayed orders without checking if they persist.
- Time your aggression. Use aggressive orders when passive execution is unreliable (high volatility, thin book) and passive orders when conditions favor patience.
- Choose your levels wisely. Place limit orders where you expect genuine execution based on depth analysis, not where you hope price will trade.
- Track your execution. Measure realized spread, fill rate, and adverse selection. Most traders never quantify their execution quality and never realize how much it costs them.
What Microstructure Can't Tell You #
Market microstructure is about how trades happen, not which direction price will move. A deep understanding of order matching, queue dynamics, and hidden liquidity makes you a better executor of trades. It doesn't replace having a valid trading methodology.
The traders who combine solid directional analysis with microstructure-aware execution — they're operating on a different level. They know when their order book is telling the truth and when it's lying. They know when to be patient and when to hit the bid. They know the difference between displayed liquidity and real liquidity.
That's the game.
Knowledge Map
Prerequisites
Understand these firstGo Deeper
Build on this knowledgeReferences This Article
Articles that build on this topicCitations
- — Spoo-nalysis ES (2022) 👍 6“No test to fail :) In the picture you'll see that 81.8 was the last price that traded. However, right now, if you want to buy, you can buy up to 2 at 81.6. If you want to sell, you can sell 1 at 81.4. Imagine you want to buy, so you pay 81.6.”
- — DOM question (2013) 👍 5“The most recent price is not always an indication of the current state of the order book. Orders can be added and withdrawn before a new trade is executed. Your DOM shows an order book with the best bid at 128.61 and the best ask at 128.62.”
- — Eurex Products (2020) 👍 4“I'll preface my answer again by saying I have never traded CFD's only spot forex but that was a few years ago.”
- — M6E Micro Euro (2017) 👍 4“Yes me thinks. Ill take a stab at a more involved explanation. I'm sure I am missing some pieces. As of the friday close, the market orders have all been filled, and the unfilled good-till-close orders are auto-canceled.”
- — CDV Trading (2012) 👍 11“It isn't possible for an exchange to remove iceberg orders because they don't exist at the exchange. There is some confusion about icebergs I think. They are NOTHING magical. They are simply the opposite of spoof orders.”
- — Jigsaw AMA (2013) 👍 13“Look for a couple of things: 1 - Good trade location. So for example, if you are in a range day as of late then you look at the top and bottom of the range/steps in the volume profile.”
- — Market Makers (2013) 👍 2“Dealers make money by maximizing their realized spread. That is, they favor a balanced order flow where they can sell as much on the offer as they buy on the bid and therefore they earn the spread.”
- — Flipping spoofing (2013) 👍 2“Spoofing is simply submitting limit orders that you will pull before they get filled. Flipping is a process of spoofing one side of the market to make that side look strong whilst sucking up contracts on the other side.”
- — Order book (2011) 👍 11“Well, a lot of spoofing goes on and generally that involves stacking the order book on one side to fool people into trading in the other direction.”
- — Treasury Bond (2022)“Somewhat related to learning about the order book: https://www.justice.gov/opa/pr/former-bank-employee-pleads-guilty-manipulating-us-treasury-securities-prices >>Many of Forbes's genuine orders were "iceberg" orders, meaning that only a portion...”
- — Tape reading (2012) 👍 3“Rocky I think it depends on the sort of iceberg. Some trading platforms support iceberg orders but some exchanges do to. So - with the CME, they do the following http://www.cmegroup.com/globex/files/GlobexRefGd.”
- — Spoo-nalysis (2015) 👍 12“Due to the way CME reports transactions, it's largely irrelevant whether a large trade is shown as a bid or an offer transaction.”
- — CME Globex Matching Algorithm Steps (2025)
- — Former Bank Employee Pleads Guilty to Manipulating U.S. Treasury Securities Prices (2022)
