What is a kill switch in automated trading?

What a real kill switch looks like

The test of a kill switch is not the button — it is the architecture behind it. A real one sits between the strategy and the broker, so that when it is off, orders physically cannot flow, regardless of what the strategy thinks it wants to do. It fails closed: if the switch's state is unknown, nothing trades.

It also needs to be yours. A kill switch on the vendor's server, operated by the vendor's staff during the vendor's business hours, is a customer-service process, not a safety control. Our own desk stack runs the switch locally with the operator, alongside two narrower controls: one switch to go live, one switch to fall back to paper.

• Sits in the order path, not in the strategy's good intentions.
• Fails closed: uncertainty means stop.
• Held by the operator, not the vendor.
• Independent of the strategy process, so a hung bot can still be stopped.

The professional precedent

Kill switches are not a hobbyist invention — they are standard market infrastructure. Exchanges provide them to member firms, and risk controls that can halt an algorithm are a baseline expectation in institutional trading, reinforced by rules like the SEC's market access requirements after several famous runaway-algorithm incidents.

Retail deserves the same architecture at smaller scale. When you evaluate any automated trading product, ask to see the stop control demonstrated live — a vendor proud of its safety design will show you; a vendor selling excitement will change the subject.

First-party data — from our own desk

Keep going