The Empty-BBO Problem: Designing an FX Circuit Breaker for Real Risk Management

Table of Contents

• The Empty-BBO Problem: Why One Dealer’s Book Isn’t a Market
• Inside the Mechanism: Pricing Gateway, Contribution Gateway, and the Staleness Block
• The Eleven-Minute Cascade: What a Dead-Letter Queue Taught Us About Instrumentation
• The SNB Boundary Condition, and a Second Case: GBP, October 2016
• Beyond FX: The Trigger Without a Named LP Set
• The Control Gap: A Circuit Breaker Is Not a Position-Size Governor
• A Practical Framework: Seven Questions for Your Next Risk Review
• Where the Instrumentation Was Missing

Years ago, at a sell-side FX desk, we made a decision that looked irrational from outside the pricing engine: we pulled our own prices off EBS and LSEG, on purpose, in the middle of a live session.

The trigger was mechanical, not discretionary. Fewer than two liquidity providers quoting a given pair. Cross that line and our contributed price stopped being a market. It became one dealer’s book, echoed through our pricing gateway and stamped with our own name.

If you run pricing or risk infrastructure for a trading desk, this is the underlying engineering question: how few contributors can stand behind a best bid and offer before it is just one counterparty’s book, and what does your infrastructure do the moment that line is crossed?

I spent the better part of two years inside a pricing and risk stack that answered this question for a dozen liquidity providers across multiple pairs. This article walks through the mechanism we built, the incident that forced us to build the second half of it, and a boundary case from January 2015 that still shapes how I think about circuit breaker design: a breaker firing exactly as intended and still leaving a desk exposed, because a circuit breaker and a position-size governor are two different controls answering two different questions. Most desks I have seen keep them in separate reviews. That gap is the actual subject of this piece.

The Empty-BBO Problem: Why One Dealer’s Book Isn’t a Market

A best bid and offer built from two or more independent liquidity providers has a property a one-LP book does not: a second price to check the first one against. If your aggregated BBO is sourced from three dealers and one of them prints something off-market, the other two hold it in check. The contributed price you publish carries some information about where the market actually is, not just where one participant wants it to appear.

Drop to a single LP and that check disappears. The BBO becomes one dealer’s book, republished under your own name to every counterparty pulling your price off EBS or LSEG.

In my experience running this kind of desk, the bulk of the fills you get on a one-LP book carry adverse selection. The counterparty on the other side can usually tell your price is stale or mispriced relative to where the broader market has moved, and they trade against it accordingly. Contributing on a zero- or one-LP BBO is a worse position than not contributing at all: it broadcasts a price you cannot defend, with none of the depth a healthy book would give you to lean on.

This is not a novel observation in isolation, but it has had surprisingly little formal treatment. A 2025 paper by Barzykin, Bergault, Guéant, and Lemmel, “Optimal Quoting under Adverse Selection and Price Reading” (arXiv:2508.20225, submitted 27 August 2025), models exactly this dynamic from the dealer’s side: a market maker’s own quotes reveal information about inventory and intent to informed counterparties, a phenomenon the authors call “price reading,” compounding the adverse selection a dealer already faces from informed order flow. The paper notes this combination “has received limited attention in the quantitative finance literature,” despite being, in the authors’ framing and in my own operating experience, one of the more consequential problems a quoting desk actually lives with. A one-LP contributed book is the sharpest version of that problem: there is no depth left to obscure what your price is telling an informed counterparty.

Inside the Mechanism: Pricing Gateway, Contribution Gateway, and the Staleness Block

The architecture split the decision into two components, each with a distinct job.

The Pricing Gateway aggregated LP streams per currency pair and computed the contributed BBO. It also owned the trigger logic: when the count of live, quoting LPs for a pair dropped below two, the gateway stopped publishing that pair’s BBO. No price went out. That is the entire mechanism at the pricing layer, a withdrawal, not a widening. A desk carrying contractual quoting obligations does not always have that option, and that constraint changes the design conversation considerably.

The Contribution Gateway enforced the withdrawal on the venue side. Once triggered, it sent QuoteCancel messages (FIX MsgType=Z, added in FIX.4.2 as the standard message an originator of quotes uses to cancel quotes it has previously published) to both EBS and LSEG. The venues stopped showing our price to their participants.

A staleness block backed both of these up. Any pricing message older than a configured threshold, between 200 milliseconds and 1 second depending on the pair, got discarded rather than republished. This mattered independently of the LP-count trigger: a message can be stale even when LP count looks healthy, if the feed handler or a downstream queue falls behind.

Two is the floor because it is the minimum count that gives a cross-check: at two dealers, one wrong print still has a second price it can be measured against; at one, there is no second opinion left. The staleness threshold varies by pair for the same reason it exists at all: it has to track that pair’s natural quote-update cadence. Set it tighter than the pair actually updates and you start discarding healthy quotes as if they were stale; set it looser and you let genuinely stale prices back out onto the venue.

It is worth being precise about what this mechanism is and is not. No public venue rulebook I am aware of, at EBS, Refinitiv Matching, or LSEG FX, publishes a “stop contributing below N liquidity providers” rule. This is proprietary sell-side pricing-engine logic, built and owned by the desk, not a standardized venue mechanism. I am describing our own risk architecture from the inside, not citing an industry standard.

That distinction is useful when you set this mechanism next to the industry’s actual standardized control on liquidity provision: last look. FX Global Code Principle 17 defines last look as the practice where a price maker gets a final opportunity to accept or reject a trade request before execution. It is a decision made at the moment a trade is requested, after a counterparty has already acted on your price. A 2017 GFXC consultation on the practice found respondents split: most argued that trading during the last-look hold window was bad practice, while others held it “allowed for tighter pricing and better liquidity provision for clients.” The industry has been narrowing that window since. CME’s EBS Direct cut its last-look hold-time threshold from 200 milliseconds to 30 milliseconds effective 1 April 2023, reporting that average 2022 hold times already sat at 12 milliseconds and that 96% of volume ran through FX Global Code-adherent liquidity providers.

The circuit breaker I am describing sits at a different point in the pipeline entirely. Last look protects a price maker on a specific trade request, after a counterparty has acted. A contribution circuit breaker protects the published quote itself, before any trade request exists, by refusing to publish a BBO the desk cannot stand behind. One governs what happens when someone tries to trade on your price. The other governs whether you should be showing a price at all.

Halting is the easier half of this design. The harder half is re-entry: when you start quoting again, how long you hold dark before you try, and who owns the decision to resume. A breaker with no re-entry logic either stays dark long after the market has recovered, with the sales desk asking why a major pair has gone silent, or it flaps, resuming and re-triggering on the same noisy print as the LP count crosses back and forth across the threshold. Hysteresis, dwell time, and flap suppression on the resume side are a real design axis. I cannot walk you through how that desk handled it from the inside; that detail did not survive any better than the firing counts did. It sits on the same list as the instrumentation gap: a place I know the question mattered and cannot hand you the answer from lived experience.

The Eleven-Minute Cascade: What a Dead-Letter Queue Taught Us About Instrumentation

We added the staleness block after a dead-letter cascade left our contribution dark for eleven minutes. Messages backed up in a queue, failed delivery, and sat there instead of triggering a cancel. The Pricing Gateway’s LP-count trigger had never been designed to catch this failure mode, because the LPs were quoting fine. The problem was entirely on our own message path.

I cannot tell you today how often the trigger fired in production, or what those eleven dark minutes actually cost in adverse fills. Those numbers did not survive. We built the control, watched it work, and moved on to the next fire. Instrumenting the frequency and the cost of every firing is the first thing I would do differently if I rebuilt that system today.

That gap is not a footnote. A circuit breaker you cannot measure is a control you cannot govern. If you do not know how often your own breaker fires, you cannot answer the next question a risk committee will ask, which is whether the control is calibrated correctly or simply lucky so far.

The SNB Boundary Condition, and a Second Case: GBP, October 2016

On 15 January 2015, the Swiss National Bank discontinued the minimum exchange rate of CHF 1.20 per euro and simultaneously cut its policy rate to negative 0.75%. Liquidity providers across the market withdrew quotes within seconds. Spreads in EUR/CHF, and in pairs correlated to it, widened by orders of magnitude almost instantly.

A contribution circuit breaker built the way I have described here would have fired correctly that morning. When most liquidity providers pull their quotes at once, LP count for the pair drops below the threshold, the Pricing Gateway stops publishing, the Contribution Gateway sends QuoteCancel to every connected venue. The mechanism does exactly what it was built to do.

Here is the boundary case: the breaker firing correctly says nothing about the position book that existed one second before the trigger. Whatever inventory the desk was carrying in that pair when the SNB made its announcement was still there after the breaker stopped new contribution. A circuit breaker governs what you quote going forward. It does not govern what you already own. The SNB event produced real industry losses that day, retail FX brokers failed outright and several prime brokers absorbed losses that made headlines for weeks, and in every case the losses were about existing exposure, not about a bad price still being published.

A second, structurally different case makes the same point from the other side. On 7 October 2016, sterling depreciated roughly 9% against the dollar in early Asian trading before retracing most of the move within minutes. The Bank for International Settlements’ Markets Committee published a forensic report on the episode (Paper No. 9, 13 January 2017). A Bank of England working paper on the same event noted that the move in sterling “may have been amplified by the pause in trading on the CME futures exchange,” a circuit breaker on one venue pausing while the correlated cash FX market kept moving underneath it. Mark Carney’s assessment afterward was notably different from the SNB outcome: “there were no material losses incurred by systemic financial institutions.” Not every flash event exposes a control gap. The GBP event shows a breaker interacting badly with a correlated venue and still resolving without lasting damage. The SNB event shows a breaker working exactly as designed and the desk still taking losses, because the position book was never the breaker’s job to protect.

Beyond FX: The Trigger Without a Named LP Set

Kraken’s Exchange Trading Rules state plainly that the exchange “does not employ the use of automated circuit breakers to halt trading.” Coinbase’s Markets Trading Rules, Section 2.51, say the same thing in different words: Coinbase “does not use circuit breakers or automated trading halts based on predetermined price bands.” On 10 October 2025, more than $19 billion in leveraged crypto positions were liquidated within 24 hours, per Coinglass data reported by CoinDesk Research, the largest single-day deleveraging cascade on record.

The trigger I described for the sell-side FX desk depended on a named, countable LP set: fewer than two dealers quoting. A central limit order book has no named LP set to count. The question still ports, but the observable it runs on has to be rebuilt from what the book actually shows: the number of distinct makers resting at the top of book, the depth resting within a band around mid, and the rate at which quotes are being updated. On an AMM, the analogous inputs are pool depth and oracle staleness, not a dealer count at all. The mechanism is the same idea, a trigger and a withdrawal, but the desk has to choose its own proxy deliberately instead of inheriting one from a named LP relationship.

Some venues run their own controls around liquidation mechanics, mark-price bands and forced deleveraging among them, without publishing the same “no circuit breaker” language Kraken and Coinbase do. Those mechanisms answer a different question than the one this article is about, so I am leaving them alone here. Whatever a venue runs, none of it re-sizes your position book. That is still the desk’s own control to build, on any venue, named LP set or not.

The Control Gap: A Circuit Breaker Is Not a Position-Size Governor

Here is the synthesis. A circuit breaker protects the quote you are about to publish. It answers one question: is this price still worth standing behind? A position-size governor protects the book you already hold. It answers a different question entirely: how much exposure are we willing to carry, independent of whether our current price is any good?

These are two separate control layers, and on the desk I ran, they never sat in the same risk review. The breaker lived in the pricing and connectivity engineering conversation. The position-size governor lived in the risk management conversation. Nobody in either room was asked whether the two controls saw the same inputs, or fired on the same timeline, or had ever been tested together against a scenario like SNB.

The scale at stake has only grown since 2015. The BIS Triennial Survey for April 2025 recorded OTC FX turnover at $9.6 trillion per day, up 28% from $7.5 trillion in 2022, the highest figure ever recorded. Even a brief empty-BBO window during a systemic dislocation now touches meaningful notional across a market that size. A breaker that fires cleanly next to a position book nobody re-sized in the same conversation is the default state on most desks I have reviewed.

A Practical Framework: Seven Questions for Your Next Risk Review

You do not need to rebuild your pricing engine to close this gap. You need to walk seven questions through your next risk committee meeting, and be honest about which ones nobody in the room can currently answer.

1. Does your circuit breaker have a trigger-frequency counter? If you cannot say how many times it fired last quarter, you cannot say whether it is well calibrated or simply untested.
2. Do you know the cost per firing? Approximate it: spread widening during the dark window, multiplied by the notional that would have flowed through it. Without this number, the breaker is a control you cannot defend in a post-mortem.
3. Does your staleness threshold match your actual measured message latency, or is it a guess inherited from a vendor default? A threshold set without a latency distribution behind it is a number nobody has tested against your own system.
4. Does your position-size governor see the same liquidity-depth and LP-count inputs as your circuit breaker, or does it work off a separately maintained, potentially stale risk snapshot?
5. Do the circuit breaker and the position-size governor appear in the same review, on the same cadence, with the same owner in the room? If the answer is no, you have the exact gap this article describes.
6. If you run market-making infrastructure into a venue that has explicitly stated it runs no circuit breaker, where does that control live in your own stack, and has anyone confirmed it actually exists rather than assumed it does?
7. Does your breaker have a defined re-entry rule? Dwell time, hysteresis, a named owner for the decision to resume, and a way to tell whether it is flapping. If nobody can say how often it resumes and re-triggers on the same print, treat the resume path as undesigned.

Where the Instrumentation Was Missing

I can tell you the mechanism we built worked, in the sense that it fired and stopped a bad price from going out. I cannot tell you how often it fired, or what the dark minutes cost across two years of running it. We never built that instrumentation, and by the time I understood how much that gap mattered, the numbers that would have answered it were already gone.

The test I would run today, on any desk: count how many times your breaker has fired in the last year, price the dark minutes at your average spread times average notional during those windows, and put that figure next to what your position-size governor would have allowed the book to carry during a two-standard-deviation move in the same period. If nobody in the risk review can produce both numbers on request, the review has been scoped too narrowly. The SNB boundary case is a gap in your own controls that has not been tested yet.

Where does your circuit breaker sit relative to your position-size governor? If you want to walk through it against your own architecture, hftAdvisory.com is where that conversation starts.

---

Originally shared as a LinkedIn post: https://www.linkedin.com/feed/update/urn:li:activity:7497474499102105600/