FCA exposes algorithmic overfill and billion-versus-million RFQ mistakes in wholesale trading

In a supervisory review published on 2 November, the Financial Conduct Authority described an algorithmic trading defect that created a very significant unintended intraday position. The fault arose after an enhancement to an algorithm and its interaction with the order-management system for a stop-loss order. The algorithm held an incorrect view of the quantity already executed, allowing the order to be overfilled. The regulator did not identify the firm or quantify a monetary loss, so both should remain unknown rather than inferred from the phrase “very significant”.[1]

The root cause is unusually instructive. Pre-implementation testing was concentrated on simulation of the changed algorithm; it did not model near-simultaneous fills occurring in different geographic locations. Such fills exposed an error in the component communicating fill notifications. The experience illustrates how a strategy can appear correct in isolation and still generate excess exposure once message timing, venues and acknowledgements interact. End-to-end test coverage was the missing layer.[1]

The FCA cited its algorithmic-trading technical standard RTS 6, which covers areas such as governance, testing, pre-trade controls and mechanisms to cancel unexecuted orders. A reasonable broker lesson is to test the exact interaction of the trading strategy with OMS state, exchange acknowledgements, partial fills, duplicate messages and cancellation. That is an analytical implication, not a new product mandate arising from this review. The regulator also suggested analogous controls could inform governance for other automation including AI.[1]

The same supervisory publication contains a separate example of a bank entering a fixed-income request-for-quote size in billions rather than millions. The error reached a clearing-submission stage before cancellation, illustrating a different control failure: a mistaken unit or magnitude in a human workflow can defeat the economics of an otherwise properly functioning technology stack. These examples must not be merged into a single incident or attributed to one unidentified institution.[1]

Elsewhere the review described financial-crime surveillance data not being ingested because of a coding defect, and incomplete records of trading communications. Those findings add an important common thread: control systems are only as effective as the completeness of their input and the checks made when infrastructure changes. Outsourcing surveillance or execution technology does not outsource a regulated firm’s responsibility for ensuring it works.[1]

Three failure modes, three distinct layers of control

The FCA's two examples identify different controls. An algorithm with incorrect fill-state information over-executed a stop-loss order because testing omitted near-simultaneous venue fills; a separate fixed-income RFQ was entered in billions rather than millions and reached clearing submission before cancellation. The first calls for end-to-end execution-state testing and independent order limits. The second requires notional-unit awareness and pre-submission plausibility checks. Treating them as one algorithmic malfunction would hide the distinct roles of software design and human input.[1]

A useful risk review should ask whether all components agree on executed quantity, whether units can be mistaken by orders of magnitude and whether missing control inputs are detected promptly. The FCA’s examples are case studies, not a quantified industry-wide incidence rate.[1]

Report an error or submit an update