Self-trade prevention and cancel-on-disconnect
An order you never cancelled is gone from the book. Or you sent an order that should have crossed, and instead of filling, it disappeared — along with something else you had resting.
Venues cancel orders on their participants’ behalf, under rules that exist for good mechanical reasons and that operate without asking. Two of them account for most of the surprise: self-trade prevention, which stops your own orders matching each other, and cancel-on-disconnect, which removes your resting orders when your connection goes away. Both are protective by design and both remove protection you may have thought you had.
Self-trade prevention
If you have a resting bid and you send a sell that crosses it, the engine’s ordinary rule would match them. Both orders are yours, so nothing changes hands and a print appears in the tape for a trade that transferred nothing.
That is mechanically identical to a wash trade, whether or not anyone intended it, and the print pollutes the record for everyone reading it. So venues implement STP: a check, before matching, for whether the two sides belong to the same account or the same configured group, and a defined action when they do.
The check is not always account-level. Some venues scope it to an account, some to a group of accounts you nominate, and some allow it to be configured per order. Which scope applies determines whether two deliberately separate books of orders under one umbrella can trade with each other.
The four behaviours, and they are not equivalent
When a self-match is detected, something has to give, and the choice of what changes the outcome completely.
Cancel newest. The incoming order is cancelled. Your resting order survives untouched, and the order you just sent achieves nothing — it does not fill, and it does not walk past your own resting order to the quantity beyond.
Cancel oldest. The resting order is cancelled and the incoming order proceeds to match against whatever else is there. You have lost a resting order, including its queue position, and the new order fills.
Cancel both. Neither survives. You are left with no order on either side.
Decrement and cancel. The smaller quantity is removed from both orders, and whatever remains of the larger continues. This is the least destructive form: the overlapping quantity is neutralised and the excess still works.
None of these is a default you can assume. All four exist, and the same instruction produces four different states depending on which is in force.
Cancel-on-disconnect
The second rule addresses a different problem: a resting order is a live commitment, and a participant who cannot see the market or send a cancel is committed anyway.
Cancel-on-disconnect removes resting orders when the connection that placed them goes away. The purpose is to prevent orders continuing to work on behalf of someone who has lost the ability to manage them, which protects both that participant and the integrity of the displayed book.
Related, and worth distinguishing:
Auto-cancel timers. Sometimes called a dead-man’s switch. Orders are cancelled unless the participant periodically confirms they are still there. The distinction from cancel-on-disconnect is that a timer catches the case where the connection is technically alive and nothing is actually watching.
Session boundaries. On venues with defined sessions, some order types expire at the boundary regardless of connection state. This is time-in-force behaviour rather than a disconnect rule, and it looks identical afterwards.
The direction of the surprise is consistent: an order you set up as a standing instruction — an exit, a resting bid — can be withdrawn by the venue for a reason that has nothing to do with the market.
Other venue-initiated cancellations
Completing the list, because they arrive the same way and are easy to attribute to the wrong cause.
Margin-driven cancellation. In derivatives, resting orders that would increase risk can be cancelled when an account’s margin situation deteriorates, to free capacity.
Band and halt purges. Orders outside a moved price band may be cancelled rather than left inert, and some venues purge the book across a halt.
Reduce-only invalidation. A reduce-only order that no longer reduces anything is cancelled instead of being allowed to open an opposite position, as covered in the order lifecycle.
Instrument changes. Tick or lot size changes, contract expiries and instrument delistings all produce book-wide cancellations on their own schedules.
The mechanism
THE MECHANISM — cancellations you did not send
· Incoming order would match your own
resting order
→ self-trade prevention acts before
matching. Something is cancelled.
· STP set to cancel newest
→ your incoming order dies. It does
NOT walk past your resting order
to the quantity behind it.
· STP set to cancel oldest
→ your resting order dies, queue
position included, and the new
order fills.
· STP set to cancel both
→ you hold NO ORDER on either side.
· Connection lost with orders resting
→ cancelled, if cancel-on-disconnect
is in force. Your standing exit is
no longer standing.
· Margin deterioration, band moves, halts,
instrument changes
→ venue cancels without notice. The
order simply is not there.
· Which STP action applies, its scope,
whether disconnect cancellation exists
and any timer
→ VENUE-SPECIFIC. All four STP
behaviours are in use somewhere.Worked example
Illustrative figures, synthetic throughout. Suppose you have a resting buy for 2.0 units at 40,000, and the rest of the bid side holds 5.0 units at 39,990. You then send a market sell for 3.0 units.
Without STP, the sell would match your own 2.0 at 40,000 and then 1.0 at 39,990. Two units of the trade would be you against yourself, printing 2.0 at 40,000 for no transfer of anything.
Under cancel newest. Your sell order is cancelled. Nothing fills — not the 2.0 against yourself, and not the 1.0 at 39,990 that would have been a real trade. Your resting bid is still there. You sent a market order and hold exactly what you held before, which is the outcome least like what a market order normally promises.
Under cancel oldest. Your resting 2.0 at 40,000 is cancelled, and the sell matches 3.0 against 39,990. You are filled in full at a worse average than the touch suggested, and you have lost a bid you may have been relying on.
Under decrement and cancel. The overlapping 2.0 is removed from both. Your resting bid is gone and your sell is reduced to 1.0, which fills at 39,990. Filled for part, one order lost, no self-print.
Same book, same instruction, three positions and three different sets of remaining orders.
Now the disconnect case. Suppose instead you have a resting sell at 40,500 as a standing exit and your connection drops for a minute. Under cancel-on-disconnect, that order is cancelled at the moment of the disconnect. If the price reaches 40,500 during the minute, nothing happens — the order is not there. When you reconnect, the book shows no order and the market may be back below your price, leaving no trace of the event except in your own order history.
The failure mode
Every rule here removes an order for a reason, and every one of them can remove the specific order you were depending on.
The sharpest case is a standing exit. It presents as something arranged and finished — an instruction sitting at the venue, waiting. Cancel-on-disconnect, a margin-driven purge, a band move and a halt each break that assumption in a different way, and none of them announces itself in the interface as anything other than an absence.
The second failure mode is STP silently defeating an aggressive order. Under cancel-newest, an order that would have filled against other participants’ quantity is destroyed because your own order happened to be in front of it. You did not trade with yourself, correctly — and you also did not trade at all, which reads as an inexplicable rejection and is the rule working.
The mechanically honest summary: the set of your live orders is maintained by the venue under rules you did not send, and the only reliable way to know what is currently working is to ask for current state rather than to reason from the instructions you remember sending.