A trading router sends erroneous orders for 45 minutes

What happened

The New York Stock Exchange’s Retail Liquidity Program launched on 1 August 2012. To take part in it, Knight deployed new code to its SMARS order router. A technician did not copy the code to one of the eight servers, and no second technician reviewed the deployment. The new code reused a flag that had once switched on “Power Peg,” a function unused since 2003. On the eighth server, incoming orders set off Power Peg, which kept sending orders to the market.

In about 45 minutes, 212 customer orders produced more than 4 million executions in 154 stocks, over 397 million shares. By the time it stopped sending the orders, Knight held about $3.5 billion in net long positions and $3.15 billion in net short positions. It lost more than $460 million. Before the market opened, Knight’s systems had sent 97 automated emails referring to “Power Peg disabled.”

The SEC found that Knight lacked controls to block erroneous orders “immediately prior to the submission of orders to the market” and had failed “to link pre-set capital thresholds to Knight’s entry of orders.” Knight paid a $12 million penalty in what the SEC called its first enforcement action under the market access rule.

What allowed the action to take effect

Orders went from the router directly to the market. Capital thresholds existed, but the SEC found that they were not linked to order entry. The emails sent before the open went to an inbox, and no one acted on them.

An illustrative control

Assumptions. Each order passes pre-trade checks that run independently of the router, as the market access rule requires. These checks act as the external control layer, and they include a kill switch that the router cannot override.

rule:       pre-trade-limits
applies to: order.submit
deny when:  child quantity exceeds [2x] the parent order
            firm exposure would exceed the pre-set capital threshold
            message rate exceeds the strategy's limit
then:       quarantine the strategy and page the head trader

The first runaway orders are refused seconds after the open, and the strategy stops until a person decides otherwise. The router can still malfunction, but only orders within the limits reach the market.

Limits of this control

Pre-trade controls limit the damage but do not correct the deployment error. Knight also needed change controls to confirm that each server had received the new code, and someone needed to act on the warnings.

Relevance to AI systems

AI agents act faster and more often than people can watch. Limits enforced at the point where an action goes through cap the harm that a malfunction can do, whatever its cause. Securities regulators wrote this principle into the market access rule in 2010, two years before the Knight incident.

Controls that apply

• P1 Complete mediation and P2 Independence: checks the router cannot bypass.
• P3 Fail-closed and P5 Human authority: a kill switch that stops the strategy until a person decides.
• P8 Sequence awareness: limits on what orders add up to.

Sources

• In the Matter of Knight Capital Americas LLC, Release No. 34-70694SEC order, 16 October 2013
• SEC Charges Knight Capital With Violations of Market Access RuleSEC press release 2013-222, 16 October 2013