Accounts, custody, and pre-trade risk
How the exchange guarantees every order is good for the money — the reserve/settle/release cycle that runs before and after every trade.
The core already owns order transitions and their total order. Risk is correct only if its view of available funds and inventory changes in that same order.
A natural first design is to ask an external balance service whether the account looks sufficient, then submit the order to matching after that check returns. But the sequenced core reserves before admission, consumes the reserved amount on fills, and releases only the unused remainder when the order becomes terminal.
An order book full of orders that might be funded is worthless — every fill would be provisional. The exchange's guarantee that trades are real starts here: no order reaches the book unless the assets behind it are already locked.
Each account tracks, per currency and per instrument: total holdings, reserved (backing live orders), and available = total − reserved. The risk engine sits in the sequenced path (it is core, per 1.1) and runs the cycle:
sequenceDiagram
autonumber
participant G as Gateway
participant R as Risk engine
participant M as Matching engine
G->>R: Alice buys 100 at 10.00 — needs 1,000 + fees
R->>R: available 1,500? yes → reserve 1,005
R->>M: order admitted
Note over M: fills 60 at 9.98 — price improvement
M->>R: fill: 60 at 9.98 = 598.80
R->>R: consume 598.80 → Alice holds 60 ACME. Excess stays reserved for the rest
Note over M: Alice cancels the remaining 40
M->>R: order done — unused reservation
R->>R: release remainder to available
Details that separate a real venue from a toy:
- Reserve worst case, settle actual. A limit buy reserves at the limit price, but may fill better (step 4). The difference releases at completion — never leaks.
- Sells reserve shares, buys reserve cash. Same machinery, opposite asset. Short selling and margin add borrowed assets to "available" under collateral rules — an extension, not a redesign.
- Fat-finger limits: per-order max notional and max quantity, plus per-account order-rate caps — cheap checks that catch the "sell 1,000,000 not 1,000" class of disaster before the book does.
- Self-trade prevention: if an account's buy would match its own sell, cancel one side instead of printing a fake-volume trade (wash trades are market manipulation, even accidental ones).
- The kill switch: one admin command that cancels all of a participant's live orders and blocks new ones — the emergency brake when a member's algorithm runs away. It enters through the sequencer like everything else, so it is ordered, journaled, and replayable.
An account owns 1,000 shares and submits two simultaneous sells for 800. Independent external checks can approve both before either sees the other. A sequenced reservation approves one and rejects or limits the next before the book can overcommit custody.
Reserve before the book, consume at fill, release at completion. Risk lives in the sequenced core — external checks race fills and lose. Fat-finger caps, self-trade prevention, and a kill switch are table stakes.