Kill switch

An algorithm goes wrong at 11:04 in the morning and starts firing orders. By 11:05 there are hundreds of them resting in the order book, any of which could trade at any second. Cancelling them one at a time is not a plan.

The kill switch is the answer: one command cancels all outstanding orders of that member. It sits in the exchange's list of pre-trade risk checks, alongside the trade execution range, the self-trade check and market price protection.

What it does not do is as important as what it does. It cancels orders. It does not touch trades already executed, and it does not close the positions those trades created. After the switch is pulled, the damage already done is still on the books and still has to be squared off in the market like any other position.

The exchange runs risk checks in two layers, and the kill switch belongs to the second.

Pre-order checks, applied before an order is accepted: price range check, quantity freeze (a single order cannot exceed the exchange's limit), single order quantity or value limits set by the member for its dealer, user order value limits, cumulative open order value checks at dealer, branch and member level, and a UCC/PAN check to ensure no order is entered for an unregistered client.

Pre-trade checks, applied at matching: trade execution range, self-trade check (which cancels the active or passive order when the same PAN or CP code appears on both sides), market price protection (a market order that executes only up to a specified level), kill switch, and cancel on logout — under which all outstanding orders of a user are cancelled automatically once that user logs out of the trader workstation.

Cancel on logout is the passive cousin of the kill switch: same effect, triggered by logging off rather than by a deliberate command.

When the problem is not the member's algorithm but the member's own systems failing, the relevant facility is different: the Investor Risk Reduction Access (IRRA) platform, a joint platform developed by the exchanges that lets investors square off or close open positions and cancel pending orders when their trading member suffers a technical glitch.

Pending order exposure = Number of pending orders
                       × Lots per order
                       × 1,000 (USD per USDINR contract)
                       × Price

Kill switch removes : pending order exposure
Kill switch leaves  : executed trades and the open position they created

A trading member's algorithm malfunctions on the USDINR April futures and floods the book with 52 buy orders of 50 lots each at 83.50. Each lot is USD 1,000.

Total exposure it tried to create:

52 × 50 × 1,000 × 83.50 = Rs 21,71,00,000  — Rs 21.71 crore

The dealer hits the kill switch. At that moment 12 of the 52 orders have already traded and 40 are still resting.

Cancelled by the switch : 40 × 50 × 1,000 × 83.50 = Rs 16,70,00,000
Already executed        : 12 × 50 × 1,000 × 83.50 = Rs  5,01,00,000

Rs 16.70 crore of potential exposure vanishes in one command. Rs 5.01 crore of it does not.

The member now holds a long position of USD 600,000 (600 contracts) bought at 83.50, which the kill switch cannot undo. If USDINR is at 83.20 when he squares off:

Loss = 600,000 × (83.50 − 83.20) = Rs 1,80,000

Rs 1.8 lakh of realised loss on the part that got through — against the roughly Rs 5 lakh a further 30-paise adverse move would have cost had all 52 orders filled. That difference is what the switch bought, and it is a good deal; but a member who believed the switch had "cancelled everything" and went to lunch would discover a Rs 5 crore naked position at the close.

Chapter 6 (Trading Mechanism in Exchange Traded Currency Derivatives) lists the pre-order and pre-trade risk checks, and the kill switch appears in the pre-trade list with a one-line definition: it "allows a member to cancel all outstanding orders with one single command."

Questions are recall-and-distinguish. You will be asked which check cancels all outstanding orders (kill switch), which cancels them automatically when the user logs off (cancel on logout), which stops a market order running away (market price protection), and which stops the same PAN appearing on both sides of a trade (self-trade check). The other trap is pairing it with IRRA: the kill switch is for the member's own runaway orders; IRRA is for when the member's systems fail and the investor needs a way out.

• It cancels orders, not positions. Trades already executed and the open position they created survive the switch and must be squared off in the market.
• It is the member's tool, not the investor's. An investor stranded by a broker's technical glitch uses the IRRA platform instead.
• Do not confuse it with cancel on logout. COL fires automatically at logout; the kill switch is pulled deliberately, with the user still logged in.
• It is a pre-trade check, not a pre-order check. The pre-order checks — price range, quantity freeze, order value limits, UCC/PAN — stop bad orders being entered. The kill switch removes orders already accepted.
• It is not a circuit breaker or a trading halt. It affects one member's orders only; the market carries on.
• The related SEBI framework for algorithmic trading is what makes such a facility necessary, but the switch itself is available to any member, algo or not.