Keep an Automated System From Blowing Up

Why can an automated system still blow up an account?

The dangerous thing about automation isn't that it makes bad trades — a human does that too. It's that there is no one in the loop to notice something has gone wrong and stop it. A discretionary trader who watches three stops hit in an hour feels the heat and steps away from the screen. A bot feels nothing. It will fire the same logic into the same bad conditions at machine speed, all night, until either the market turns or the margin runs out.

Automation removes the human circuit breaker at exactly the moment you'd want one most: during the tail events your backtest under-weighted. The result is a small set of recurring failure modes, and every rule in this article maps to one of them:

• Unbounded single-trade loss — a trade with no hard stop that keeps running.
• Compounding size on a losing streak — bets that stay large (or grow) while equity shrinks.
• Breached total exposure — several correct-looking positions that, stacked, are too big for the account.
• No one to hit stop — a malfunctioning strategy nobody halts.
• Secretly correlated bots — "independent" systems that all lose on the same move.
• Drift into a deep hole — a slow drawdown met with "wait and hope" instead of a plan.

Left unchecked, those combine into the one outcome the headline names — risk of ruin, the mathematical probability that a losing streak empties the account before your edge ever gets to play out. Good risk management is nothing more than driving that probability toward zero, layer by layer.

The layered risk-control framework

No single rule keeps an account safe, because each rule has a blind spot. A stop-loss caps one trade but says nothing about how many you open at once. A size limit controls each bet but not whether five bets are secretly the same bet. So think of risk control as layers of defense, each catching what the one before it misses — the way a series of nets catches what falls through the one above.

The stack this article walks through, in order:

1. Position sizing — how much of the account each trade may risk.
2. Stop-loss — where a losing trade is forced to close.
3. Exposure caps — how much total risk may be open at any moment.
4. Correlation limits — stopping "diversified" positions from being one bet.
5. Kill-switches — the conditions under which the system halts itself.
6. Drawdown protocol — the pre-decided response when the account is underwater.

Build them from the inside out. Sizing and stops protect the individual trade; exposure and correlation limits protect the portfolio of open trades; kill-switches and the drawdown protocol protect the account as a whole when the first four layers are being overwhelmed.

How much should you risk per trade? (position sizing)

Everything else rests on this number, so get it right first. A position sizing rule answers one question: given your account and where your stop sits, how large may this trade be? The rule you want for an automated system is fixed-fractional — you risk a fixed percentage of current equity on every trade, never a fixed dollar amount and never a fixed lot size.

The reason is the whole point of the article. A fixed dollar risk is suicidal on a losing streak: risk $200 on a $10,000 account and, after five losses, you're still risking $200 on an $8,900 account — a bigger and bigger slice of a shrinking pile. Percent-of-equity sizing does the opposite automatically: as equity falls, the dollar risk falls with it, so a bad run decelerates instead of compounding. Most systematic traders keep risk per trade between 0.5% and 2%; above roughly 2%, a normal cluster of losses starts doing real structural damage.

You will meet the Kelly criterion when you go looking for the "optimal" fraction — a formula that sizes bets from your edge and win rate. It is worth understanding, but for a live automated system most practitioners run a fraction of full Kelly (often a quarter or less), because full Kelly assumes your edge is measured perfectly, and yours isn't. Start conservative; a smaller size never blows up an account.

Notice the third output: at 1% risk it takes about ten straight losses to reach a 10% drawdown; at 3% it takes only three or four. That single dial is the difference between a survivable slump and a crisis. If you want to sanity-check the reward side of each trade against this risk, the reward-to-risk calculator lets you run the ratio directly.

Setting a stop-loss the algorithm can't override

Position sizing decides how much a trade can lose; the stop-loss decides where it stops losing. In an automated system the stop has one extra requirement that a manual trader can be sloppy about: it must be hard-coded and unconditional, not something the strategy can "decide" to move or ignore mid-trade.

Two failures happen when the stop is soft. First, an optimization or a stray condition lets the bot widen or cancel the stop on an open loser — the classic "it'll come back" logic, now running at machine speed with no shame. Second, the stop lives only inside your bot's process, so a crash, a disconnect, or a frozen loop leaves the position naked. The fixes:

• Encode the stop as a fixed rule — a set price or a fixed percentage from entry, written once and never mutated by later logic.
• Place it server-side where the platform allows it — a broker- or exchange-held stop survives your bot going offline; a bot-held stop does not.
• Treat the stop as a trigger, not a guaranteed fill. On a gap or a fast move, slippage means you exit worse than the stop price. Size for a slightly larger loss than the stop implies, so a bad fill doesn't break the math you did a section ago.

A hard, server-side stop is the single highest-leverage control on this list. It is also the one automated traders most often weaken in pursuit of a prettier backtest — resist it.

Capping total exposure — per trade, per symbol, account-wide

Per-trade sizing is necessary but not sufficient, because a bot can open many correctly-sized trades at once. Ten trades each risking a disciplined 1% is 10% of the account on the line simultaneously — and if they move together (next section), it may as well be one 10% bet. You need three ceilings sitting above the per-trade rule:

• Per trade — the fixed-fractional risk you already set (say, 1%).
• Per symbol — the most open risk allowed on any one instrument at once (say, 3%), so the bot can't quietly pyramid into a single market.
• Account-wide — the total open risk across everything, and a hard max open trades count, so the whole book can't exceed what you can afford to lose in one adverse move.

The account-wide cap is the one people forget, and it's the one that saves you when several strategies signal at the same time. When total open risk is already at the cap, the correct behavior is simple: the system takes no new trade until an existing one closes. Here's how those ceilings and their headroom read on a $10,000 account mid-session:

Correlation limits — when 'independent' bots aren't

This is the risk unique to running more than one automated strategy, and it defeats every control above if you ignore it. You launch four bots on four instruments and feel diversified. But if those instruments move together, you don't have four independent bets — you have one bet in four costumes, and a single adverse move hits all of them at once.

Concretely: a long EUR/USD position and a long GBP/USD position are largely the same trade, because both are really short the US dollar. Add a long in gold and a long in a US index and you may still be, at bottom, one big "risk-on, weak-dollar" wager. Your exposure cap said 6% across four positions; correlation quietly turned it back into a concentrated 6% on one theme.

The rule to code: before opening a new trade, check the recent correlation between the candidate instrument and everything already open. Two practical forms work well — cap the combined open risk across any group of highly-correlated instruments (treat a +0.8 cluster as if it were one symbol against your per-symbol cap), or refuse a new position whose correlation to an existing one exceeds a threshold you set. Either way, the goal is the same: stop the account from concentrating without you noticing.

Kill-switches — when should the system shut itself down?

Every layer so far shapes trades the system takes. A kill switch is different: it is the coded authority to stop taking trades entirely, standing in for the human who would otherwise pull the plug. An unattended system needs at least three triggers, each a hard, binary halt — not a suggestion:

• Daily loss limit — if the account is down more than a set amount on the day (say -4%), halt all new entries until tomorrow. A bad session ends itself instead of compounding.
• Consecutive-loss shutdown — if the system takes a run of consecutive losses beyond what its backtest ever produced (say four or five in a row), halt and flag it. A streak longer than anything you tested is evidence the market has changed or the strategy is broken.
• Technical-failure shutdown — if the price feed goes stale, the connection drops, or orders start rejecting, halt. A bot trading on frozen data is worse than a bot not trading at all.

The transition traders most often get wrong is the exit into the halted state. It must be reachable from wherever the system is — scanning for a setup, or already sitting in a trade — and once halted, only a human restart brings it back. Never let a kill-switch auto-clear on a timer; that just re-arms the same problem.

stateDiagram-v2
    [*] --> Scanning
    Scanning --> InTrade: signal + risk checks pass
    InTrade --> Cooldown: trade closed
    Cooldown --> Scanning: cooldown elapsed
    Scanning --> Halted: daily loss limit hit
    InTrade --> Halted: consecutive losses beyond backtest
    Scanning --> Halted: feed or connection failure
    Halted --> [*]: manual restart only
    

Drawdown thresholds and what to do when one is hit

Kill-switches are the emergency brake. The drawdown protocol is the graduated response before the emergency — the pre-decided plan for what happens as the account slips underwater, so the answer is never the default "wait and hope." Measure drawdown as the percentage decline from the account's peak equity, and decide your responses in advance.

The single most useful reference point is your backtest's own worst maximum drawdown. As long as the live account stays inside that historical worst case, you're seeing normal variance and should do nothing — reading a live account against its tested numbers is exactly how you judge whether a bot is performing as it should. It's when the live drawdown exceeds anything the strategy produced in testing that you have real evidence something is off — and that's the threshold that should trigger action, not a round number picked from the air.

One number makes this concrete and is worth internalizing: a drawdown takes a bigger gain to recover than the loss itself — down 20% needs a 25% gain to get back to even, and it only gets steeper from there. That asymmetry is why reducing size early beats trading your way out. Run your own numbers with the drawdown recovery calculator and the case for an early, disciplined response makes itself.

Putting the rules together — a worked example

Rules listed in isolation stay theoretical. Here they are as one coherent configuration on a single $10,000 account — the point is that they operate together, each covering another's blind spot:

Trace a bad day through it. The system takes a trade (1% at risk, hard stop set), loses, resizes the next trade to the now-smaller equity, loses again. On the fourth signal, total open risk is near the 6% cap, so a fifth correlated setup is skipped, not taken. Two more losses trip the consecutive-loss kill-switch; the bot halts and waits for you. No single rule saved the account — the stack did. Before trusting any of these numbers with real money, prove the whole configuration by testing these risk rules inside a backtest before running them live, so you can see how the caps and switches behave on historical data first. (These are illustrative figures, not a promise — every automated system can lose money, as our full risk warning makes plain.)

Pre-launch risk-rule checklist

Before you flip the switch, walk this list. If you can't tick every box, the system isn't ready to run unattended — a missing control is a hole the market will eventually find.

Risk management for an automated system isn't a feeling or a category to "keep in mind" — it's code. Every rule above is a line you can write, a threshold you can set, a switch that fires without you. Build the layers before you go live, and the machine that would otherwise blow up your account on an afternoon you weren't watching becomes one that simply stops, waits, and hands the decision back to you.

FAQ

Isn't a good backtest enough to keep an automated system safe?

No. A backtest tells you whether the strategy has an edge; it says nothing about whether the account survives the strategy's worst live behavior. Risk rules — sizing, stops, exposure and correlation caps, kill-switches — are a separate layer built on top of a validated strategy, not a byproduct of it. A profitable edge run with no risk controls still blows up on a long-enough losing streak.

What percentage should an automated system risk per trade?

Most systematic traders keep risk per trade between 0.5% and 2% of current equity, sized as a fixed fraction so it falls automatically as the account draws down. Above roughly 2%, an ordinary cluster of losses starts doing structural damage; the calculator above shows how few consecutive losses it takes to reach a 10% drawdown at higher risk levels.

Where should the stop-loss for a bot actually live?

Ideally with the broker or exchange, not only inside your bot's process. A server-side stop survives a crash, a disconnect, or a frozen loop; a bot-held stop leaves the position naked the moment your software goes offline. Encode it as a fixed rule that later logic can't widen or cancel, and size for a little slippage beyond the stop price.

How is a kill-switch different from a drawdown protocol?

A kill-switch is a hard, binary halt — a daily-loss limit, a consecutive-loss trigger, or a technical fault stops all new entries at once. A drawdown protocol is the graduated response before that emergency: as the account slips underwater, you reduce size or pause according to a plan decided in advance. The switch is the emergency brake; the protocol is easing off the accelerator first.

Can running several bots make an account less safe, not more?

Yes, if the strategies are correlated. Four bots on four instruments that all move together aren't diversification — they're one bet in four costumes, and a single adverse move hits every position at once. Cap combined risk across correlated groups, or refuse a new trade whose correlation to an open one is too high, so your exposure limits mean what you think they mean.

Sources & Further Reading

Want to go deeper? These independent, authoritative sources shaped this guide — each one is worth reading in full:

• Investopedia — Risk of Ruin: definition and the probability model
• Kelly criterion — the optimal-fraction position-sizing formula
• Investopedia — Drawdown: measuring peak-to-trough decline