FCA Says Bank's Algorithm Overfilled Stop-Loss Order

After an enhancement, a wholesale bank's trading algorithm had an incorrect picture of how much of a stop-loss order had already executed. The result was an overfilled order and a very significant intraday position, according to the Financial Conduct Authority's 2 November supervisory insights. The regulator does not identify the firm, instrument or trading venues, and it gives no loss figure. Those omissions matter: the disclosed failure is specific enough to examine the controls, but not to calculate a financial impact or attribute the incident to a named bank.

The FCA says the defect emerged after an enhancement to the algorithm. Before implementation, the firm simulated the change, but its tests did not cover near-simultaneous fills in different geographic locations. That scenario would have exposed an error in the order-management component that communicated fill notifications to the algorithm, the FCA says. With an incorrect executed-quantity view, the algorithm overfilled the stop-loss order.

A failure at the hand-off

A fill is the execution of all or part of an order. A fill notification is the message telling the trading system what has executed, so it can update the quantity still outstanding. If that feedback is wrong, an algorithm can make its next decision using a false remaining quantity even when the trading rule it is trying to follow has not changed. That is the central distinction in this case. The FCA describes a defect in the interaction between an enhanced algorithm and order management, not a finding that its market prediction or stop-loss threshold was inherently wrong.

The public account does not specify whether a notification was lost, delayed, duplicated or processed out of sequence. Nor does it describe the exact order-routing sequence. It would therefore be premature to name a particular software bug. What the FCA does identify is the missing test condition: executions arriving almost together from different locations. A test that exercises only a clean sequence of single-location fills may show the algorithm behaving as designed while leaving the combined execution and notification path untested.

The question for a trading desk is whether its testing reflects the whole route from order submission through venue execution, order management and the feedback that changes the algorithm's next instruction. That is an inference from the disclosed failure, rather than an account of additional facts about this bank. It is also the lesson the FCA draws: when firms enhance an algorithm, they should assess effects across the entire trading process, including unforeseen interactions with venues, data and fill notifications.

What the rules require

For firms engaging in algorithmic trading, FCA Handbook MAR 7A.3 requires effective systems and controls suited to the business. Trading systems must be subject to appropriate thresholds and limits, prevent erroneous orders or other behaviour that could contribute to a disorderly market, and be fully tested and properly monitored. The rule also requires effective business continuity arrangements. It states an operating standard; the FCA's account of this anonymous incident does not announce a formal breach finding against the firm.

RTS 6, the regulatory technical standard for algorithmic trading, puts more detail around that standard. Article 5 requires a clear methodology before an algorithm is deployed or substantially updated, with testing adapted to the venues and markets where it will operate. Article 7 keeps specified testing in an environment separate from production and leaves responsibility with the investment firm, including when a venue or vendor provides the test environment. Article 8 requires predefined deployment limits for instruments, orders, strategy positions and venues. None of those provisions prescribes one particular simulation script for cross-location fills. Together, they make the scope of testing and the controls around a changed algorithm a practical governance question.

Controls must also operate while orders are live. RTS 6 Article 15 specifies pre-trade price collars, maximum order values and volumes, and message limits. Orders sent to venues count immediately towards applicable limits, and orders that threaten the firm's risk thresholds must be blocked or cancelled. Article 16 requires real-time monitoring for signs of disorderly trading. Article 17 requires continuous post-trade controls, assessment of effective exposure and reconciliation of the firm's trading logs with external information on outstanding orders and risk exposures, in real time where that information is available in real time.

Those layers address different points in the same chain. A pre-trade limit can restrict an order before it leaves the firm; monitoring and reconciliation can reveal a position or record that diverges from expectations. They do not make a defective fill-notification path harmless, and the FCA has not said which of these controls did or did not operate in the bank's case. RTS 6 Article 12 separately requires the ability to cancel unexecuted orders immediately in an emergency. Cancellation cannot undo an execution that has already happened, which is why accurate executed-quantity feedback matters before a position grows.

The test that was absent

The case fits a concern in the FCA's 2025 multi-firm review of algorithmic trading controls. That review found some simulation testing lacked sufficiently varied market scenarios, even where firms had strong pre-trade and post-trade controls. It urged firms to keep testing methods in step with the speed and complexity of their algorithms and markets. The review was supervisory guidance on existing requirements, not a new rule or a verdict on this unnamed bank.

The FCA's 2018 review of algorithmic trading in wholesale markets likewise emphasised documented development and testing, independent challenge and approval before substantial changes reach production. Its point remains relevant to a change whose behaviour depends on another component: testing the revised algorithm alone may miss what happens when execution data reaches it through order management.

The FCA has disclosed enough to locate the control gap but not to establish the bank's complete response. For firms reviewing similar systems, the concrete question is whether a simulation can reproduce near-simultaneous fills in different geographic locations, trace each notification into the order-management record, and confirm the algorithm's resulting executed quantity against the actual fills. If those records diverge, the next question is how quickly live limits, monitoring and cancellation procedures detect and contain the exposure. The case shows why a stop-loss instruction is only as reliable as the execution information on which its next action depends.