A trading router sends erroneous orders for 45 minutes

After an incomplete deployment, Knight’s order router ran dormant code and sent millions of erroneous orders to the market. Knight had no adequate control between the router and the exchanges to check what it sent.

Date: August 2012
Kind of system: Conventional automation, included as a precedent
Outcome: Harm

Gaps found

G1G2G3G4G5G6G7G8G9G10G11G12G13

G2 Direct access G5 Blind to the total G9 Warning with no authority G10 No independent stop G12 Unreviewed change

What happened

Beginning on 27 July 2012, Knight deployed new code in stages for the New York Stock Exchange’s Retail Liquidity Program, which started on 1 August. A technician did not copy it to one of the eight servers running SMARS, the firm’s order router, and no second technician reviewed the deployment. On 1 August, orders sent to that server switched on Power Peg, a function unused since 2003, which kept sending child orders after their parent orders were filled.

In about 45 minutes, 212 customer orders produced more than 4 million executions. By the time the orders stopped, Knight held net long positions of about $3.5 billion and net short positions of about $3.15 billion, and it lost more than $460 million. The SEC found that Knight lacked controls to block erroneous orders immediately before they reached the market. Knight settled without admitting or denying the findings.

What allowed the action to take effect

G2 Direct access
The system held the credentials or connection to carry out the action itself, so nothing outside it stood between its decision and the effect.
Knight had controls before orders reached SMARS but no adequate controls between SMARS and the market. The SEC found it lacked controls “to prevent the entry of erroneous orders at a point immediately prior to the submission of orders to the market.”
Kind of evidence: finding. Source: U.S. Securities and Exchange Commission, 16 October 2013, “In the Matter of Knight Capital Americas LLC: Order Instituting Administrative and Cease-and-Desist Proceedings, Making Findings, and Imposing Remedial Sanctions and a Cease-and-Desist Order (Exchange Act Release No. 70694)”, ¶¶ 9.A, 20, 21, 38.
Related guidance: P1 Complete mediation. Contract clause C-2.
G5 Blind to the total
Each action was allowed one at a time. Nothing tracked what the actions added up to in volume, rate, exposure, or repetition until the total did the harm.
Position limits “did not account for the firm’s exposure from outstanding orders,” and capital thresholds were not linked to order entry, so SMARS “continued to send millions of child orders to the market despite the fact that the parent orders already had been completely filled.”
Kind of evidence: finding. Source: U.S. Securities and Exchange Commission, 16 October 2013, “In the Matter of Knight Capital Americas LLC: Order Instituting Administrative and Cease-and-Desist Proceedings, Making Findings, and Imposing Remedial Sanctions and a Cease-and-Desist Order (Exchange Act Release No. 70694)”, ¶¶ 22, 24.
Related guidance: P8 Sequence awareness. Contract clause C-8.
G9 Warning with no authority
Signs that the action was wrong existed before or during the harm, but none of them could stop or hold the action, and nothing required anyone to act on them.
Before the open, an internal system sent 97 automated emails referring to “Power Peg disabled.” Knight “did not design these types of messages to be system alerts,” and its main risk tool “relied entirely on human monitoring and did not generate automated alerts.”
Kind of evidence: finding. Source: U.S. Securities and Exchange Commission, 16 October 2013, “In the Matter of Knight Capital Americas LLC: Order Instituting Administrative and Cease-and-Desist Proceedings, Making Findings, and Imposing Remedial Sanctions and a Cease-and-Desist Order (Exchange Act Release No. 70694)”, ¶¶ 19, 25.
Related guidance: P3 Fail-closed and P8 Sequence awareness. Contract clauses C-3 and C-8.
G10 No independent stop
Nothing could stop the system in time without relying on the system itself. In the agent incidents with this gap, the only way to stop the action went through the agent.
Knight “did not have procedures in place to halt SMARS’s operations in response to its own aberrant activity,” and it stayed connected to the market while staff looked for the cause.
Kind of evidence: finding. Source: U.S. Securities and Exchange Commission, 16 October 2013, “In the Matter of Knight Capital Americas LLC: Order Instituting Administrative and Cease-and-Desist Proceedings, Making Findings, and Imposing Remedial Sanctions and a Cease-and-Desist Order (Exchange Act Release No. 70694)”, ¶¶ 10, 21.
Related guidance: P5 Human authority and P2 Independence. Contract clauses C-5 and C-4.
G12 Unreviewed change
The change that introduced the harmful behavior went live without independent review. The change can be code, a prompt, a model, a package, a configuration, or a procedure.
A technician did not copy the new code to one of the eight servers, and “Knight did not have a second technician review this deployment.” It had no written procedures that required one.
Kind of evidence: finding. Source: U.S. Securities and Exchange Commission, 16 October 2013, “In the Matter of Knight Capital Americas LLC: Order Instituting Administrative and Cease-and-Desist Proceedings, Making Findings, and Imposing Remedial Sanctions and a Cease-and-Desist Order (Exchange Act Release No. 70694)”, ¶¶ 15, 26.
Related guidance: P4 Reviewable policy and P2 Independence. Contract clauses C-10 and C-4.

Considered and left out

G11 Safeguard off: No safeguard was switched off. The controls the market access rule required were missing, which G2 and G5 record.

Entries with gaps in common

Sources

Official recordIn the Matter of Knight Capital Americas LLC: Order Instituting Administrative and Cease-and-Desist Proceedings, Making Findings, and Imposing Remedial Sanctions and a Cease-and-Desist Order (Exchange Act Release No. 70694)U.S. Securities and Exchange Commission, 16 October 2013
Official recordSEC Charges Knight Capital With Violations of Market Access RuleU.S. Securities and Exchange Commission, 16 October 2013

Cite this entry

External Control Layer. (2026). Entry 1: A trading router sends erroneous orders for 45 minutes. In Control Gap Record (Version 0.3). G-14, Inc. https://externalcontrollayer.ai/record-1

@misc{ecl_cgr_1,
  author = {{External Control Layer}},
  title = {Entry 1: A trading router sends erroneous orders for 45 minutes},
  howpublished = {Control Gap Record, version 0.3},
  publisher = {G-14, Inc.},
  year = {2026},
  url = {https://externalcontrollayer.ai/record-1},
  note = {Released 2 November 2026}
}

Uses Control Gap Classification 0.2.

Correct this entry

Email ecl@g14.ai with “ECL record 1” in the subject line.

Write the email

Facts about this incident

When: 1 August 2012
Who: Knight Capital Americas LLC
System: SMARS, Knight’s automated equity order router
Kind of system: Conventional automation
Precedent: The system is older automation rather than AI. The incident is included because the controls that failed are of the same kind, and it is counted separately from the AI incidents.
Sector: Finance and real estate
Action: Sent millions of child orders to the market while working 212 customer orders, long after those orders were filled.
Why it acted: Conventional fault. A deployment missed one of eight servers, and the new code reused a flag that switched on a function unused since 2003.
Outcome: Harm. More than 4 million executions in 154 stocks in about 45 minutes, and a loss of more than $460 million. The SEC imposed a $12 million penalty.
Confidence: High. SEC order. Knight consented without admitting or denying the findings.
Full analysis: What a check outside the system would have changed