Controls
Thresholds should not wait for somebody to be awake
The events that justify having a kill switch have an inconvenient habit of happening outside office hours, in markets that opened while your desk was asleep.
This account crosses a loss or exposure threshold
New orders refused, existing positions optionally closed
One market becomes untradeable or moves beyond tolerance
That symbol suspended across every client and platform
A client group behaves abnormally in aggregate
Trading halted for that segment, others unaffected
Total exposure or loss passes the ceiling
The book stops. Deliberately blunt, deliberately rare
Three things worth being honest about
A kill switch is only as good as where it is set
It exists for the hours nobody is watching
A threshold that requires a dealer to notice it is a threshold that works during the session and not at three in the morning, which is when the events that justify having one tend to occur.
Set it where you would actually pull it
A firm-wide halt set so high it will never fire is decoration. Set at a level you would genuinely act on, it is the only control that reliably works when everything else is already going wrong.
Coming back is part of the design
Restoring trading is a deliberate action with its own authority, not an automatic recovery when the number drops back. Automatic re-entry into a market that just moved is how a bad hour becomes a bad day.
See it live
The threshold and the buffer, always visible
Margin health and the distance to stop-out sit on screen continuously, so the kill switch fires against a number the desk has already been watching.
FAQ
Kill switch: common questions
6 short answers to what teams ask before a demo.
Either, configured per scope. Refusing new orders while leaving existing positions open is the softer setting and usually the right default; forced closure is available where the risk justifies it.
Whoever your policy names, and the action is attributable. Manual triggering exists alongside the automatic thresholds because a dealer sometimes sees something a rule does not describe.
Nothing automatic. Restoring trading is a deliberate action with its own authority. Re-entering a market moments after it moved sharply is how a contained problem becomes a larger one.
It is evaluated on the same event stream as exposure, so it fires when the threshold is crossed rather than at the next refresh. A kill switch on a polling interval has a window in which it does nothing.
That depends entirely on where you set it. Thresholds set too tightly cause disruption and get disabled; set too loosely they never fire. Getting this right is a policy conversation, and we would rather have it before go-live than after.
It is deliberately blunt and deliberately rare, and most firms never use it. Its value is not in frequency — it is in existing at a level someone has actually thought about rather than being an option nobody configured.
Still have a question?
A specialist will answer it directly, with your set-up in mind.
Ask a specialistWhere would you actually pull it?
That number is the whole conversation, and it is worth having before go-live rather than during an incident.