Accounts, custody, and pre-trade risk

An order book full of orders that might be funded is worthless — every fill would be provisional. The exchange's guarantee that trades are real starts here: no order reaches the book unless the assets behind it are already locked.

Each account tracks, per currency and per instrument: total holdings, reserved (backing live orders), and available = total − reserved. The risk engine sits in the sequenced path (it is core, per 1.1) and runs the cycle:

sequenceDiagram
    autonumber
    participant G as Gateway
    participant R as Risk engine
    participant M as Matching engine
    G->>R: Alice buys 100 at 10.00 — needs 1,000 + fees
    R->>R: available 1,500? yes → reserve 1,005
    R->>M: order admitted
    Note over M: fills 60 at 9.98 — price improvement
    M->>R: fill: 60 at 9.98 = 598.80
    R->>R: consume 598.80 → Alice holds 60 ACME. Excess stays reserved for the rest
    Note over M: Alice cancels the remaining 40
    M->>R: order done — unused reservation
    R->>R: release remainder to available
    

Details that separate a real venue from a toy:

• Reserve worst case, settle actual. A limit buy reserves at the limit price, but may fill better (step 4). The difference releases at completion — never leaks.
• Sells reserve shares, buys reserve cash. Same machinery, opposite asset. Short selling and margin add borrowed assets to "available" under collateral rules — an extension, not a redesign.
• Fat-finger limits: per-order max notional and max quantity, plus per-account order-rate caps — cheap checks that catch the "sell 1,000,000 not 1,000" class of disaster before the book does.
• Self-trade prevention: if an account's buy would match its own sell, cancel one side instead of printing a fake-volume trade (wash trades are market manipulation, even accidental ones).
• The kill switch: one admin command that cancels all of a participant's live orders and blocks new ones — the emergency brake when a member's algorithm runs away. It enters through the sequencer like everything else, so it is ordered, journaled, and replayable.