Pre-trade risk checks assess an order before it reaches the market. They test whether its size, price, permissions and potential exposure fit the account’s approved limits. A trading signal answers whether a strategy wants a position. The risk check answers whether the system should permit it.
The distinction matters most when orders arrive quickly or several strategies share an account. An order can look reasonable on its own while pushing the combined portfolio beyond its exposure ceiling. Effective controls therefore assess both the instruction being submitted and the positions that could exist if outstanding orders execute.
This guide covers order limits, exposure calculations and practical control design. Numerical examples are illustrative, not recommended trading limits.
What Pre-Trade Risk Checks Should Control
A useful risk gateway should produce a clear decision: accept the order, reject it, or hold it for an authorized review where the workflow permits. For automated execution, an alert alone should not substitute for a required blocking control.
In US securities markets, Rule 15c3-5 requires broker-dealers with market access to maintain controls reasonably designed to prevent orders exceeding appropriate preset credit or capital thresholds and to prevent erroneous orders. Sending an excessive order and immediately trying to cancel it does not satisfy that preventive standard. The SEC’s market access rule FAQs address both threshold setting and this rejection requirement. These obligations apply to covered broker-dealers; they are not a universal rulebook for every retail trading program.
For system design, separate four questions: Is the instruction valid? Is the account permitted to trade it? Can the account support the resulting exposure? Is the system’s information reliable enough to decide? These checks belong within the wider framework of trading system security and risk controls, rather than inside the strategy’s signal logic alone.
Order Limits: Quantity, Value and Price
Per-order limits catch mistakes close to their origin. They should be easy to interpret, but they cannot replace portfolio controls. Ten acceptable orders can still create one unacceptable position.
| Check | What it assesses | Illustrative rejection reason |
|---|---|---|
| Maximum quantity | Shares, contracts or units in one order | Order exceeds the instrument’s approved size |
| Maximum order value | Estimated monetary exposure from the order | Quantity is acceptable, but notional value is too high |
| Price tolerance | Distance from an approved reference price | Limit price falls outside the permitted range |
| Instrument permissions | Account, product and trading authorization | Account is not approved for the requested instrument |
| Submission rate | Order and amendment traffic over a defined interval | Strategy exceeds its approved message rate |
Use Quantity and Notional Limits Together
A maximum quantity check can catch an extra zero, but quantities do not translate consistently into monetary exposure. A 1,000-share order at $5 represents $5,000 of notional value. The same quantity at $250 represents $250,000.
For ordinary cash equities, estimated order notional is quantity multiplied by the valuation price. Futures calculations also need the contract multiplier. Currency conversion is necessary before comparing exposures denominated in different currencies. Define the valuation method for each product rather than applying one formula everywhere.
For a limit order, the limit price provides one possible conservative valuation input, depending on the control’s purpose. For a market order, use a documented reference and an adverse execution allowance. Do not assign zero exposure because the order lacks a stated price.
Check Price Against a Reliable Reference
A price tolerance check compares an order with an approved reference, such as a valid quote or another permitted benchmark. Define which reference applies during normal trading, auctions and periods without a reliable quote. A stale reference can reject legitimate orders or approve an unreasonable price.
Exchange protections provide another layer, not a replacement for account controls. CME Group’s explanation of price limits and price banding distinguishes market price limits from order validation that rejects prices outside a permitted band. A venue’s acceptable price range does not establish that an order is affordable or appropriate for a particular account.
Position Exposure Must Include Working Orders
Checking only filled positions leaves a gap. Working orders are commitments that may become positions, and submitted orders awaiting acknowledgment also need explicit treatment.
Consider an illustrative account holding 600 shares of a stock with a maximum long position of 1,000 shares. It already has a working buy order for 250 shares. A new buy order requests another 200.
Potential long position = 600 held + 250 working + 200 proposed = 1,050 shares.
The new order exceeds the ceiling by 50 shares. Looking only at the current position would approve it incorrectly. A rejection should identify the binding limit and remaining capacity, rather than return an unexplained “risk error.”
Assess long and short outcomes separately. Do not automatically subtract a working sell order from a working buy order: one side may fill without the other. Give offsetting credit only where the execution arrangement and risk methodology justify it. An intended hedge is not an executed hedge.
Reserve Capacity Before Sending the Order
For a shared account, design approval and exposure reservation as one indivisible operation. Otherwise, two strategies could inspect the same remaining capacity and both receive permission to consume it.
Suppose an account has $100,000 of capacity remaining. Two strategies simultaneously request $70,000 orders. A safe design approves one reservation and assesses the other against the reduced balance. Independent reads of the original balance could approve $140,000.
Keep the reservation until reliable order events justify changing it. On a partial fill, transfer the filled portion into position exposure while retaining the reservation for the remaining quantity. Release unused capacity after a confirmed rejection or cancellation, not simply after sending a cancel request. The related guide to order messages, execution reports and trade status covers the communication states behind this process.
Measure More Than Net Exposure
Net exposure measures directional balance. Gross exposure measures the size of the positions before offsetting longs and shorts. Both are useful, but they answer different questions.
An illustrative portfolio with $400,000 of long positions and $350,000 of short positions has $50,000 of net long exposure and $750,000 of gross exposure. The small net figure should not be treated as evidence of a small portfolio. The positions still need financing, execution capacity and appropriate risk allowances.
Set exposure checks at several levels: instrument, issuer, strategy, account and combined portfolio where visibility permits. Concentration checks should also consider related positions. Several instruments can express much the same economic risk even when their symbols differ.
Distinguish Notional, Margin and Potential Loss
Notional describes economic scale. Margin is collateral required under the applicable methodology. Neither figure, on its own, states the maximum loss of every product.
For derivatives, select controls that reflect the contract’s risks. An options framework may need directional sensitivity, volatility sensitivity and scenario losses alongside contract count. Avoid treating delta-adjusted exposure as a complete measure of options risk.
Read each external control’s scope carefully. CME Globex Credit Controls documentation describes exposure and maximum quantity settings at defined clearing and execution firm groupings. Do not assume that a control at one grouping captures every position, account or product in a separate internal portfolio.
Set Limits That Reflect the Strategy and Account
Start with the account’s approved risk budget and work down to strategies and individual orders. Treat broker buying power as an external constraint, not a target allocation. A system can have permission to trade more than its owner intends to risk.
Document each limit’s purpose, calculation, owner and breach response. Explain whether the threshold uses shares, contracts, notional, collateral usage or a modeled loss. Two controls both labeled “exposure limit” may measure different things.
Consider normal order sizes, liquidity, holding periods, overnight positions and adverse market scenarios when choosing thresholds. Build headroom for valuation changes and execution costs, but avoid making the buffer so large that the control stops being useful.
Use warning thresholds below hard ceilings where helpful. A warning allows an operator to investigate approaching capacity; a hard ceiling prevents further risk increases. Neither should silently resize an order unless that behavior is explicitly designed, tested and compatible with the strategy.
Control Limit Changes and Exceptions
Require authorized approval for changes, with the old value, new value, reason and effective time recorded. Temporary increases should have an expiry and a defined review process. A limit that gets raised every time it blocks an order is more of a suggestion.
FINRA Regulatory Notice 15-09 on algorithmic trading controls recommends documenting and periodically reviewing risk parameters, restricting traders’ ability to bypass controls, and controlling outbound message volume. Its suggested practices complement applicable obligations; implementing the list alone does not establish compliance.
Handle Amendments, Retries and Missing Information
A replacement order needs a fresh risk assessment whenever it changes potential exposure. Increasing quantity is the obvious case, but raising a buy limit price can also increase reserved notional. Define how the system accounts for the original order while its amendment is pending.
For retries, use persistent order identifiers and check the known order state before submitting again. A timeout means the response is missing, not necessarily that the order failed. Treating every timeout as permission to resend creates a route to duplicate exposure.
Order and cancellation rate controls should also distinguish between adding risk and removing it. Avoid designing a traffic limit that consumes all available capacity on new submissions and then obstructs emergency cancellations. Implementation must respect the actual interface and venue rules.
Block New Risk When State Is Uncertain
Define a fail-closed policy for situations where the system cannot establish account capacity reliably. Missing limits, stale positions, unavailable prices and unresolved order states should not silently become approvals.
Fail-closed does not have to mean blocking every instruction. A separately controlled cancellation or verified risk-reducing path may remain available. But a sell order is not automatically risk reducing: an oversized sell can close a long position and open a short one.
After a disconnect or restart, reconcile positions and working orders before restoring ordinary submissions. Preserve reservations or reconstruct them from authoritative records. Broader continuity procedures belong in the guide to trading platform failover and recovery.
Test the Risk Gateway, Not Just the Trading Strategy
A profitable strategy backtest does not establish that its order controls work. Test the gateway independently, including exact boundaries: one unit below a limit, exactly at the limit and one unit above it.
Include simultaneous submissions, partial fills, delayed acknowledgments, duplicate reports, rejected amendments, disconnects and restarts. Check instrument multipliers, currency conversion and invalid numerical inputs. Test that reserved capacity moves correctly through each order state and never disappears simply because a process restarted.
Historical failures show why aggregate coverage matters. On August 1, 2012, Knight Capital’s router sent more than four million orders while attempting to fill 212 customer orders. The SEC’s Knight Capital enforcement release identified inadequate controls immediately before market submission and failures in controls over aggregate financial exposure. The practical lesson is to test the complete order path, including accounts and routing components that might otherwise escape coverage.
Make Every Decision Traceable
For each approval or rejection, record the order identifier, relevant account and strategy, evaluated exposure, reserved capacity, reference price, limit version and decision reason. Protect those records from unauthorized changes and define retention through the applicable compliance process.
Pre-trade checks should prevent disallowed new exposure. They cannot guarantee an exit price, eliminate market losses or cancel every outstanding instruction after a failure. Coordinate them with trading kill switches and emergency shutdown procedures, while keeping prevention and incident response as distinct responsibilities.
The acceptance standard is straightforward: every order uses a known limit set, every approval reserves the capacity it needs, and every order event updates exposure without losing or double-counting it. If the system cannot establish those conditions, pause new risk and resolve the uncertainty before trading resumes.