The risk-first trader: limits before ideas
The longest-running traders we know share one habit: they think about how much they can lose before they think about how much they can make. This sounds obvious. It is also, in practice, almost the inverse of how most market participants — retail and institutional — operate.
- Every position has its hard stop in the market and acknowledged by the broker before it counts as a position.
- Daily, weekly and monthly loss circuit breakers are enforced by a separate supervision service — not the trader.
- Intraday human override is not allowed. The only way to change a limit is between sessions, with a written rationale.
- Most large blowups share one root cause: the risk system was advisory, not enforcing.
The rule that comes before any other rule
Our first internal rule is the simplest one. A position cannot exist until its hard stop is in the market and acknowledged by the broker. Not a mental stop. Not a price alert. Not an intention to act if the price gets there. An actual working order, sized so that the worst case is bounded, and tagged so the post-trade journal can reconstruct it.
This rule applies to every strategy, every instrument, and every account. There are no exceptions. The reason is structural: a stop that is not in the market is a stop that requires the trader to act, and the trader is the part of the system most likely to fail under stress. Putting the stop in the market removes the trader from the loop at exactly the moment they would otherwise add the most risk.
Circuit breakers above the trader
On top of per-trade stops we run circuit breakers at three timescales — intraday, daily, and weekly. Each one is a hard percentage drawdown threshold. Hitting any of them causes the supervision layer to flatten positions and freeze new entries until the next session at the appropriate timescale.
Circuit breakers are not the trader's responsibility. They are enforced by a separate service that the trader has no intraday access to. The rationale is the same as the per-trade rule: the human is the failure point under stress, so the system that contains the human has to be outside their reach when it matters.
Breakers can be tuned, but only between sessions, with a written rationale, and never downward in response to a single bad day. The asymmetry is deliberate. Tightening is fast and trivial. Loosening is slow and requires evidence.
“Rules like this feel paranoid until the day they save the account. After that, they never feel paranoid again.”
Why advisory risk fails
Most large blowups we have studied — retail account wipeouts and multi-billion-dollar institutional events both — share the same structural failure. The risk system was advisory. It told someone there was a problem, and that someone overrode it, scaled past it, or simply turned off the alert and kept going.
Advisory risk is a comfort, not a control. It works perfectly in normal conditions, which is when it is not needed, and it fails reliably in stressed conditions, which is when it is. Enforcing risk is the opposite — annoying in normal conditions and the only thing that matters when conditions are not normal.
The cost of paranoia
Strict enforcement has a cost. There are days when a circuit breaker takes us out of a position that subsequently recovers. There are weeks when a per-trade stop gets hit during noise and the model is then proven right after the position is closed. These costs are real and we measure them.
We measure them because the alternative — softening the rules — is a much larger cost we cannot directly observe until it arrives in the form of an account-ending event. The expected value of strict enforcement, over a long horizon, is overwhelmingly positive even when individual instances look painful.
What this looks like in code
In implementation terms, every strategy has hard limits baked into the code: max position size, max instrument exposure, max number of open positions per family. Above the strategies, the supervision service enforces account-level limits: max daily loss, max gross exposure, max single-name concentration, max venue concentration.
All limits are versioned. A change to any limit is a code change, reviewed, deployed between sessions, and logged with the rationale. There is no UI that lets a trader bump a number during market hours. The absence of that UI is, in itself, one of the most valuable design decisions we have made.
This piece is practitioner writing from a working self-trading desk. It is not investment advice. Defam AG trades only its own capital — see the disclosure page for the full statement.