Should you turn your trading system off during a crash?

Two things can be happening when an automated strategy is bleeding.

The first: it is doing exactly what it was built to do, in the conditions it was always going to lose money in. Every system has those conditions. A trend-following approach gives money back in chop. A pullback-buying approach gets run over when supports keep failing. The drawdown is not evidence of a defect. It is the bill for the edge, arriving.

The second: something is actually wrong. A data feed went stale weeks ago and nobody noticed. A stop stopped being honoured. The system is holding an instrument it was never meant to touch. Here the losses have nothing to do with the strategy, because the strategy is no longer what is running.

From inside the drawdown these feel the same. Same red numbers, same nausea, same urge to hit the switch. And the honest position is that no test separates them with certainty while it is happening. That is exactly why the criteria have to be written down first — not because pre-written rules are smarter than you, but because they were written by someone who was not scared.

What "working as designed" looks like

Three things tend to be true when a system is losing correctly.

The drawdown sits inside its historical range. If your research showed a worst peak-to-trough decline and you are currently shallower than it, nothing surprising has happened yet. You are inside the envelope you accepted when you turned it on. This requires you to actually know that number before you need it, which is one of several reasons to read a backtest properly — see how to read a backtest for what that number is worth and where it lies to you.

The losses are coming from the lanes it always loses in. Go position by position. If a leadership-rotation approach is losing on rotation whipsaws, that is its known failure mode showing up on schedule. If it is somehow losing on a mechanism that never appeared in testing at all, that is a different conversation.

The exits fired where they were set. This is the most checkable of the three and the most neglected. Pull the fills. Did each exit trigger at the level the system decided on when it opened the trade? A stop that fires at its level in a bad tape is a working stop. Painful, and working.

What genuinely broken looks like

Broken has a different signature. It is usually about behaviour, not results, and it is usually visible without waiting.

• Behaviour outside the tested envelope. Position sizes larger than the cap. More concurrent positions than the design allows. Holding periods far beyond anything researched.
• Stops not honoured. A level was set and price went through it and nothing happened. Distinguish this from a stop that fired late because the market gapped past it — that is the market, not the software, and it is a permanent feature of protective stops rather than a bug.
• Instruments it was never given. A ticker in the book that is not in the universe. This is the loudest possible alarm, because it means something upstream of the strategy is wrong.
• Stale data, unnoticed. The quietest failure and the most common. The system is not misbehaving; it is reasoning correctly about facts that are hours or days old. It produces confident, well-formed, completely wrong decisions, and nothing in the output looks unusual.

None of those require an opinion about the market. That is the point. They are answerable by looking at logs.

Write your kill criteria before you need them

A kill criterion is a sentence with a number in it, written while nothing is wrong, that says what you will do and at what threshold. It is not a forecast. It is a promise to your future self, who will be worse at this than you are right now.

Reasonable ones to write down:

• The drawdown depth past which you stop new entries, and the recovery level at which they resume. Two numbers, not one — a single threshold makes you flip the switch on every wobble around it.
• The deeper drawdown at which everything halts and stays halted until a human deliberately restarts it.
• The maximum age of the data the system is allowed to act on.
• What counts as an integrity failure — a breached cap, an unhonoured stop, an unknown ticker — each of which stops new risk immediately, regardless of whether you are up or down.

Notice what is absent: any threshold expressed as a feeling, and any threshold about the market rather than the system. "If this gets much worse" is not a criterion. Neither is "if the selloff continues." You are writing rules about your machine, not predictions about the world.

Disarming is not the same as changing the strategy

This distinction does more work than anything else in this post.

Disarming stops new entries. Existing risk management keeps running: stops still fire, exits still execute, positions still close where they were always going to close. It is reversible, it changes no rules, and the record afterwards is still a record of the same system.

Changing the strategy means widening a stop so a position stops hurting, lifting a cap to average down, adding an instrument because it looks cheap. Each of those may be defensible on a calm Tuesday with evidence. Made mid-drawdown, they are the same act: rewriting the thing you were testing, in the middle of the test, in the direction that makes the pain stop. The performance record before and after are no longer measuring the same system, and you have quietly lost the ability to know whether the original one worked.

Turning something off is cheap and undoable. Editing it under stress is neither.

There is a related trap. Many systems treat a weak tape as permission to stop trading entirely. Sitting in cash because nothing qualifies is a legitimate output — we have argued that at length in cash is a position. Deciding mid-drawdown that the market is now too dangerous for your rules is not the same thing. The first is the process running. The second is you overriding it and calling it risk management.

What this looks like when it is built in

These are design choices, and it is fair to ask what they look like implemented rather than described. Coil is our own engine, so treat the following as a disclosure of how we handle it rather than a claim it is the only sane arrangement.

• It ships disarmed. Live order placement is a single kill switch that is off in the packet you download. Installing it, scheduling it, watching it produce signals — none of that arms it. Approving a schedule is never arming.
• A drawdown ladder with three rungs. Down 6% on the day suppresses new exposure for the rest of that day and resets the next. Down 20% from the account's high-water mark turns entries off until equity recovers to within 16% of that mark — two numbers, so it does not flicker on the threshold. Down 25% is a hard halt that latches to disk; only a deliberate human reset re-arms it.
• Exits are never gated by any of it. Every freeze in the engine stops new entries only. A halt cannot deadlock the stop loop, which would be the worst possible failure: a system that refuses to buy and also refuses to sell.
• Stale scanner data freezes new buys. If the scanner's last publish is older than 20 minutes, or missing, new entries stop. The engine does not act on scores it cannot verify, and a dead feed produces no trades rather than confident wrong ones.
• The safety floor is fingerprinted. The hard limits — position caps, the account allowlist, the drawdown ladder — live in a separate file with a pinned SHA-256 hash. If the file changes, the check fails and the cycle suppresses new exposure until a human looks. We are also blunt in our own source about the limits of this: it is tamper-evidence, not proof, and the file permissions are a speed bump rather than a wall.

If you want the mechanics in more detail, they are laid out on the trading bot page. The reason we are describing them here is narrower: every one of them was decided before there was anything to panic about, which is the only property that matters.

The honest summary

You cannot reliably tell a bad regime from a broken system in the middle of one. Nobody can. What you can do is decide, while calm, which observations would count as evidence of each, and what you will do in response. Then, when it happens, your job shrinks to something you can actually perform under stress: check the list, act on what it says.

The question is not whether to turn it off. It is whether you wrote down what would make you.

FAQ

Should I turn off my trading bot during a drawdown?

Only if it breaches a rule you wrote before the drawdown started. A system losing money in conditions it was designed to lose money in is behaving correctly, and switching it off mid-decline converts a designed loss into a permanent one by removing the recovery you were being paid to sit through. A system behaving outside its tested envelope should be stopped immediately. Decide in advance which of those you are looking at, because you cannot decide it honestly while it is happening.

How do I know if my strategy is broken or if it is a bad regime?

Check behaviour, not profit and loss. Ask whether the drawdown sits inside the worst one your research showed, whether the losses are in the lanes the strategy has always lost in, and whether every exit fired at the level it was set at. If all three hold, the evidence points to a bad regime. If any fail, you have a defect. No test settles this with certainty in real time.

What is the difference between disarming and changing the strategy?

Disarming stops new entries while existing risk management keeps running. It is reversible and changes no rules. Changing the strategy rewrites the thing you were testing, so the record before and after are no longer the same experiment. Under stress, disarming is almost always the safer of the two.