A risk check in the critical path validates position limits, fat finger bounds and instrument permissions, adding 3 microseconds to every order. A colleague proposes moving it out of the path and checking asynchronously. Give the correct design and quantify the exposure the asynchronous version creates.

A risk check in the critical path validates position limits, fat finger bounds and instrument permissions, adding 3 microseconds to every order. A colleague proposes moving it out of the path and checking asynchronously. Give the correct design and quantify the exposure the asynchronous version creates.

Approach: Ask what an asynchronous check can still prevent once the order is on the wire, then look for ways to keep the check synchronous while removing its cost from the path.

Keep the check synchronous and make it cheap, because a check that runs after the order is on the wire prevents nothing. Once an order leaves the gateway it can be filled in the time it takes the exchange to match, often under 10 microseconds, so an asynchronous check discovers a breach after the position exists. At 1,000 orders per second and a 200 microsecond asynchronous lag, roughly 0.2 orders are unvalidated at any instant, and a runaway loop sending 100,000 orders per second puts 20 orders in flight per lag period with no bound on total exposure until something stops it. The correct design keeps every check on the critical path before the send and shrinks its cost: precompute limits into a flat array indexed by instrument id so the check is a handful of comparisons on one cache line, keep the position counters in registers or L1, remove branches by making the check arithmetic, and move it into the FPGA or the NIC where it costs tens of nanoseconds. Firms that run the check in hardware get pre-trade risk for well under a microsecond. Separately, a kill switch that drops the session and cancels on disconnect is the backstop, since it bounds the damage even when the per-order check is correct.

Follow-up: Your position counter is updated by fills arriving asynchronously while the check reads it. How do you make the check correct without a lock?

Key concepts: pre-trade risk, critical path, kill switch, fpga.