Automated Trading Controls Do Not Fail Loudly, They Clear – OpEd

Key Takeaways:

• The author builds on Luke Soon’s 8 September essay and Rule 15c3-5 (2010): a pre-trade gate can run, log, and still pass a bad order if the reference it compares against—limits, NBBO, last sale, exposure—has gone stale or unrepresentative. FINRA’s 2026 AI oversight flags agents’ autonomy and audit trails; the lesson is deeper than “put a gate in front.”
• Three decay modes: a live quote that no longer describes the market (FINRA 2018 on wide NBBO); temporary limit hikes that never snap back (findings still in 2026); and the same cap applied per venue so the total is never seen (J.P. Morgan 2023 case). Knight Capital was loud; this failure is quiet—an approval with a clean audit.
• Proposed: treat the reference as first-class—keep provenance and freshness, pre-declare fallbacks, expire exceptions by default, aggregate above partitions. For financial AI, a narrow “trade” permission is not narrow if the number it trusts is wrong. That is the author’s control design, not a new statute.

Rule 15c3-5 taught markets to block dangerous orders before execution. Fifteen years later, regulators still find thresholds that fail to revert and controls that fragment across connections. As AI agents move deeper into finance, the next risk is whether the gate is looking at evidence that is still true.

A trading control can work perfectly, pass its audit, leave a complete record, and still approve the order it should have refused.

On September 8, Luke Soon published “We Sold God Out.”, an essay arguing that finance solved a problem now confronting agentic AI when the Securities and Exchange Commission adopted Rule 15c3-5 in 2010. The rule put deterministic controls in front of market access: an order that breaches specified financial or erroneous-order limits is supposed to be stopped before it reaches the market. Soon also cited my September 4 Eurasia Review essay, “Financial AI Should Not Have One Big Permission Called ‘Trade’,” which made the complementary authority argument: submitting an order, increasing exposure, moving collateral and continuing to trade after evidence degrades should not all sit inside one blanket permission.

Soon is right that the pre-trade gate matters, and he is unusually candid about two limits outside it: semantic quality and aggregate effects. There is a third limit that neither of us developed in those pieces. A gate is a comparison, and only one side of that comparison is the action being tested. The other side is the reference against which the action is judged. That reference can decay while the gate itself remains flawless.

That matters now because FINRA’s 2026 oversight work on generative AI identifies agents as an emerging trend and highlights autonomy, scope and authority, and auditability as risks. The financial sector is moving toward systems that can take more actions faster. The old market-access rulebook has a lesson for them, but the lesson is deeper than “put a gate in front.” The gate must know when the evidence it relies on has stopped deserving trust.

The rule compares two things

Rule 15c3-5 requires broker-dealers with market access to maintain controls reasonably designed to prevent orders that exceed appropriate pre-set credit or capital thresholds and to prevent erroneous orders, including orders outside appropriate price or size parameters. The SEC’s adopting release deliberately does not prescribe one universal number. Firms calibrate controls to their business and markets.

That architecture contains two objects. The first is the order: symbol, side, size, price, account and related fields. It is structured, inspectable and available at decision time. The second is the reference: the credit limit, capital threshold, market price, liquidity measure, customer exposure or other state used to decide whether the order may pass.

The order can be perfectly typed while the reference is stale, unrepresentative, incompletely aggregated or left at a temporary setting long after the reason for changing it has disappeared. In that case the control does not crash. It evaluates the comparison correctly and returns the wrong operational answer because the second term no longer represents the condition the control was meant to enforce.

The reference is evidence

FINRA has been documenting versions of this problem for years. Its 2018 examination findings report described firms relying on an “away from the market” control when the National Best Bid and Offer was not indicative of the true market. FINRA pointed to an alternative reference, such as measuring price as a percentage away from the last sale, when the NBBO spread becomes unusually wide.

That is not a story about a broken comparator. The control can perform exactly as designed. The failure is that the reference is current yet not representative. A fresh number can still be bad evidence.

Industry guidance says the same thing in different language. FIA’s 2024 Best Practices for Automated Trading Risk Controls and System Safeguards notes that exchange price bands can become stale or cease to reflect the current market, especially in illiquid products or stressed conditions. The response may be to recalculate or widen the band using another pricing mechanism. Again, the lesson is not that price controls are useless. It is that the reference itself is an operational state that needs monitoring.

Three ways a reference decays

The first is representativeness. A market reference can exist, update normally and still cease to describe the market well enough for the decision being made. The NBBO example is the clean case. The correct control question is not merely “is there a price?” but “is this price still a defensible reference for this action under current conditions?”

The second is failed reversion. FINRA’s 2021 examination program found firms without adequate policies governing intraday changes to credit and capital thresholds, including ensuring that temporary adjustments returned to their pre-adjusted values. That finding persists in the 2026 Annual Regulatory Oversight Report. A threshold may have been raised for a legitimate reason. If the exception outlives the reason, the gate continues to clear orders against a state that was never meant to become permanent.

The third is partition. In a 2023 disciplinary matter involving J.P. Morgan Securities, FINRA described a duplicate-order control that would hard-block more than 50,000 order messages with the same symbol, side and quantity within two seconds. The threshold, however, was applied separately to each external venue connection. FINRA found it too high to be effective and noted the lack of a documented rationale. The official FINRA disciplinary summary is a concrete example of a general problem that the 2026 oversight report still flags: multiple stand-alone controls can fail to capture aggregate activity across ports and venues for the same customer.

Every local gate can be “correct” while the combined exposure is wrong. This is the enforcement counterpart to the cumulative-limits argument in my earlier Eurasia Review piece. A narrow permission is not narrow if the accounting for its use is partitioned into compartments that never meet.

Why there is no Knight Capital moment for this

Markets remember spectacular failures because they are visible. Knight Capital is the canonical example. According to the SEC’s 2013 order, 212 customer orders led its system to send millions of orders into the market, producing more than four million executions in 154 stocks over roughly 45 minutes and a loss exceeding $460 million. Something had obviously failed.

Reference decay is quieter. A stale threshold or misleading reference does not necessarily generate an exception, an error message or an outage. It may generate a well-formed approval in the expected time, backed by an audit record showing that the control ran. Much of the public evidence for this failure mode therefore appears in examination findings and enforcement settlements rather than spectacular incident reports. A regulator sees it by inspecting what the control consulted and how that state was maintained.

The opposite polarity is easier to notice. On June 3, 2024, incorrect Limit Up-Limit Down price bands published through the CTA Securities Information Processor caused erroneous trading pauses. The CTA post-mortem traced the problem to a software release and a failover to a data center running the previous version; NYSE said the issue affected up to 40 symbols. There the reference layer failed loudly because the bad reference caused controls to fire when they should not have. A permissive reference failure can be more dangerous precisely because nothing announces it.

Make reference state part of the control

The fix does not require a new statute. Rule 15c3-5 already requires effective risk controls and regular review. The missing discipline is to treat the reference behind a control as a first-class assurance object rather than invisible configuration.

First, every consequential pre-trade decision should preserve the identity, provenance and freshness of the reference used to make it. A verdict without the state behind it is only half an audit record. If the reference is derived, the system should retain enough information to reconstruct which source and transformation produced it.

Second, reference decay needs predeclared behavior. If an NBBO-based control becomes unrepresentative, the system should know whether to switch to an approved alternative, narrow the available action set, escalate for review or refuse the order. FINRA’s last-sale example shows that alternative references are not exotic. What matters is deciding the fallback before the primary reference fails.

Third, temporary thresholds should revert by default. A time-limited increase should carry its expiry with it. Reversion should not depend on somebody remembering to undo yesterday’s exception. Human approval may be appropriate to extend the exception; human memory should not be the mechanism that ends it.

Fourth, aggregate state should sit above partitions. If a risk limit applies to a customer, account or firm, the control must aggregate the relevant activity at that level quickly enough to refuse the next action. A limit enforced independently per port, connection, venue or agent instance is not an aggregate limit merely because every component uses the same number.

The lesson for financial AI

This is where the 2010 market-access architecture meets the 2026 agentic-AI debate. FINRA is now warning that agents can exceed intended scope and authority and that multi-step behavior can complicate auditability. The obvious response is to give agents narrow, revocable permissions and deterministic controls at the execution boundary. That remains the right direction.

But a deterministic gate is only as trustworthy as the state it consults. An AI trading agent can be perfectly prevented from breaching a credit threshold and still operate too freely if the threshold failed to revert. It can respect a per-venue message cap and exceed the intended aggregate exposure through several connections. It can stay inside a price band whose reference stopped representing the market.

That is the deeper lesson of fifteen years of automated-trading controls. Finance did not merely discover that consequential actions need gates. It also accumulated evidence that the inputs to those gates are part of the safety system.

To say that a control is working is therefore an incomplete sentence until we say what it is looking at. Markets became very good at measuring the shape of the order before letting it through. The next step, especially as more autonomous systems arrive behind those controls, is to measure whether the thing used to judge the order is still true.