Skip to content
Contact us
Terms of usePrivacy policyRisk disclosure

BVI FSC Approved ManagerIBR/AIM/26/2644

Qlumina Risk Engine

Every new order through thirteen gates.

Pre-trade risk control between trader sessions and counterparties, over FIX 4.2 and 4.4. Every new order passes thirteen gates in one fixed order, and the first rejection stops it.

Book a call See the gates

Sent to the counterparty.All thirteen gates passed.

Stopped at gate 9.QRE:9:PRICE_COLLAR:decision_idThe rejection returns to the trader.

Illustrative sequence.

Session

One session shape on each side.

Qlumina accepts FIX 4.2 or 4.4 sessions from traders, with the dialect set per session. It initiates FIX sessions to counterparties, with the dialect set per counterparty and 4.4 as the default.

Sessions are admitted by CompID, source address allowlist and credential check, and sequence numbers are persisted. Session behavior is exercised against QuickFIX/J 3.0.2 with trader sessions on FIX 4.2 and on FIX 4.4, and a FIX 4.4 counterparty session.

  1. 01 / 05

    Logon is checked first

    A Logon from an unknown CompID, a disallowed source address or a bad credential gets no reply and the connection closes. Five failures from one address in 60 seconds block it until the window passes.

    35=A Logon

  2. 02 / 05

    Quiet links are probed

    The engine sends its own Heartbeat after one interval of outbound silence and its own Test Request after two intervals of inbound silence.

    35=0 Heartbeat35=1 Test Request

  3. 03 / 05

    Gaps are served from the store

    The engine serves a peer's Resend Request from its outbound log. On an inbound gap it discards the message and sends one Resend Request of its own; the peer's PossDup replay refills it in order.

    35=2 Resend Request35=4 Sequence Reset

  4. 04 / 05

    Bad input is refused or ignored

    A frame with a bad checksum is ignored and written to the tape. A framing error drops the connection. A non-Logon message with no SendingTime (tag 52) gets a Reject, and a gap-fill Sequence Reset with a NewSeqNo that does not exceed its MsgSeqNum gets a Reject.

    35=3 Reject

  5. 05 / 05

    Silence ends a session

    A peer that does not answer a Test Request within one more interval is logged out by the engine.

    35=5 Logout

FIX session

  1. 35=A LogonCredentials checked, Logon returned

  2. 35=0 HeartbeatKeepalive, either direction

  3. 35=1 Test RequestTest request ID echoed in a Heartbeat

  4. 35=2 Resend RequestServed from the outbound log

  5. 35=4 Sequence ResetGap fill moves the expected number

  6. 35=3 RejectNo tag 52, or a bad NewSeqNo

  7. 35=5 LogoutEchoed, then the connection closes

Illustrative sequence.

  1. 01Logon is checked first
  2. 02Quiet links are probed
  3. 03Gaps are served from the store
  4. 04Bad input is refused or ignored
  5. 05Silence ends a session

Dialect translator

A trader on one dialect can be filled by a counterparty on the other.

Execution reports use a different ExecType code for some states between FIX 4.2 and FIX 4.4. Qlumina translates between them.

Dialect translator

ExecType (tag 150)

  1. Pending NewAA
  2. New00
  3. Partial fill1F
  4. Fill2
  5. Done for day33
  6. Canceled44
  7. Replaced55
  8. Pending cancel66
  9. Rejected88
  10. ExpiredCC
  11. Pending replaceEE
  12. Order statusII

On the wire

Received from the counterparty on FIX 4.2

35=820=039=1150=1

Delivered to the trader on FIX 4.4

35=839=1150=F

A 4.2 Partial fill carries 150=1. In 4.4 it becomes F, and ExecTransType is dropped.

The other ten states keep the same code in both dialects. FIX 4.2 execution reports also carry ExecTransType (tag 20), which Qlumina writes and requires on inbound 4.2 reports. FIX 4.4 does not use it. Illustrative sequence.

Pre-trade gates

Thirteen gates, one fixed order, first rejection stops it.

Every decision is recorded with a decision ID. Rejection text takes the form QRE:<gate>:<reason>:<decision_id>. A rejection issued before any gate, such as a ClOrdID that belongs to an order already in the book, uses gate 0.

Gate pipeline

Stopped at gate 9. QRE:9:PRICE_COLLAR:decision_id

  1. Trader35=D
  2. 0Order book checkPassed
  3. 1Global killPassed
  4. 2Account kill and profilePassed
  5. 3Instrument haltPassed
  6. 4Session statePassed
  7. 5Message ratePassed
  8. 6Duplicate ClOrdIDPassed
  9. 7Quantity and lotPassed
  10. 8Notional limitPassed
  11. 9Price collarStopped
  12. 10Credit and marginNot reached
  13. 11Position exposureNot reached
  14. 12Loss stopNot reached
  15. 13Counterparty capacityNot reached
  16. Counterparty

9. Price collarPRICE_COLLARREFERENCE_PRICE_MISSINGREFERENCE_PRICE_STALE

Rejects limit prices outside the configured band around the reference price. A limit order with a stale quote is refused under the reject stale policy (REFERENCE_PRICE_STALE). A limit order with no quote is refused when a collar is set and passes when none is set. A market order with a stale or missing reference price is refused.

A limit price outside the band around the reference price is stopped at gate 9. The limit price sits further from the reference price than the configured band allows.

Illustrative sequence. Hover or focus pauses the cycle. Pick a scenario to run it now.

35=D New Order Single
Runs the full gate pipeline before any counterparty sees it.
35=F Order Cancel Request
Passes only gates 4, 5 and 6. A kill, restriction, halt, trading hours or credit never block it.
35=G Order Cancel/Replace Request
Runs gates 1 to 6, then quantity and notional on the new total, the price collar and reference price (gate 9), credit on the margin delta, exposure with the replaced order excluded, the loss stop, and capacity on the existing counterparty session.
35=H Order Status Request
Answered from the order record.
35=8 Execution Report
Translated between the two dialects.

Audit tape

Written before the order goes upstream. No tape, no order.

Every message in and out is written to a hash-chained audit tape, and no byte reaches a socket before the records behind it are durable.

Audit tape
  1. 0135=DAccepted at all thirteen gatesSentprev 0000000000hash 281dfbf79c
  2. 0235=DRejected before gate 1DUPLICATE_CLORDIDReturnedprev 281dfbf79chash e66316d61a
  3. 0335=FAccepted at gates 4 to 6Sentprev e66316d61ahash 842e1d1c25
  4. 0435=DRejected at gate 9PRICE_COLLARReturnedprev 842e1d1c25hash f4ecee1007
  5. 0535=GAccepted, checked on the existing counterparty sessionSentprev f4ecee1007hash 1040c6a09e
  6. 0635=DRejected at gate 8REFERENCE_PRICE_MISSINGReturnedprev 1040c6a09ehash 9d87af0d45
  7. 0735=DRejected at gate 8REFERENCE_PRICE_STALEReturnedprev 9d87af0d45hash 79f7043425

Closed segment, sealed by qre_tapeHMAC-SHA256 | 7 records | last seq 7 | head 79f7043425

Chain intact

Run by the operator with qre_tape, not by the engine process: verify recomputes every hash and checks each prev link, seal signs the closed segment, and replay rebuilds orders, positions and sequence numbers.

Illustrative entries. The engine chains SHA-256: each tape line holds the previous hash and its own.

Refusal

An order or replace needs a durable record before it is sent upstream. A cancel is refused if its record cannot be written.

Replay

The operator tool qre_tape verifies the tape and replays it. Replay rebuilds the order book, positions with realized profit and loss, and each session's sequence numbers.

Seal

The tape is cut into one segment per UTC day. The operator tool qre_tape seals each closed segment with an HMAC-SHA256 over its name, record count, last sequence and head hash. A sealed segment detects truncation; an open segment can lose its tail undetected until it is sealed.

Kill switches

Four kill scopes, one cancel wave, two people to release.

Kill switches apply at global, host, account and counterparty scope, and cancel working orders in the killed scope. A global kill covers every working order. An instrument halt is separate: it stops new orders in the instrument at gate 3 and sends no cancel.

Kill switches

ProposerRequests release

Kill controlReleased

Second approverApproves

  • GlobalKill

  • HostKill

  • AccountKill

  • CounterpartyKill

  • InstrumentHalt, gate 3

Account Kill. A second approver, not the proposer, approves the release.

Illustrative sequence. Solid bars are working orders, outlined bars have had their cancel sent, a bar with a gold fill filled before the kill, and a dashed bar is a new order refused by the halt. Order counts and states are sample data.

A manual kill release needs a second approver (maker-checker), and so does a limit change proposed at global or account scope. While the recorded source of a kill is the loss stop, a proposal cannot release it.

Talk through your venues.

Tell us which venues and dialects your accounts use, and we will confirm support against each venue's own specification.

Book a call Talk to the desk

Also from Qlumina

Apex MarketplaceHedge funds on demandAlpha OSHedge fund in a boxDelta OSFamily office in a box

Related research