The backstop that wasn't

A $70,000 fine for believing in a safety net that was not there

On 29 June 2026, Nasdaq settled a disciplinary matter with Stifel, Nicolaus & Company, the broker-dealer arm of a diversified wealth management and investment banking group that provides direct market access to institutions. The penalty was modest: a censure and a $70,000 fine, agreed in a Letter of Acceptance, Waiver, and Consent.¹ The size of the fine is the least interesting thing about the case. What it describes is one of the most common and most dangerous illusions in market-access risk: a firm that thought it had defence in depth, and actually had nothing.

Between September 2020 and January 2023, a coding error meant that Stifel's average daily volume control was never applied to certain orders routed to its algorithmic trading strategies. One of the two controls that should have guarded those orders was, in effect, switched off, and had been for more than two years. That left a single control standing between the firm's algorithms and the market: a Max Quantity check. And that check, Nasdaq found, was set at a threshold that was not reasonably designed to prevent erroneous orders.¹ One control was broken by a bug. The other was calibrated never to fire. Together they protected nothing.

The gap was not theoretical. It persisted until a market event on 11 January 2023, after which Stifel implemented additional and more conservative controls.¹ And it was not the firm's first warning: just seven months before that event, in June 2022, Stifel had already consented to Nasdaq findings that it failed to establish and maintain adequate market-access risk controls, for which it was censured and fined $125,000.¹ The firm had been told its controls were deficient, and the deficiency was still live.

Defence in depth, with no depth

The whole idea of market-access controls is layering. Under SEC Rule 15c3-5, the Market Access Rule, a broker-dealer that sends orders to an exchange must maintain controls reasonably designed to prevent erroneous orders from reaching the market. In practice firms build several, so that if one check misses, another catches. An average-daily-volume limit and a maximum-order-quantity limit are two of the most standard, and they guard against different things. Stifel had both on paper. The case is about what happened to each.

Control one: switched off by a bug

The ADV control is meant to flag or block an order that is large relative to how much of a security actually trades in a day. It is one of the better defences against a runaway or fat-finger order, because an order that dwarfs the instrument's normal volume is almost always a mistake. But because of a coding error, Stifel's ADV control was simply not applied to certain orders directed to its algorithmic strategies.¹ It did not fail loudly. It did not throw an error. It just silently did not run on that path, for over two years, while everyone assumed it was there.

Control two: set never to catch

With the ADV check absent, the orders were subject only to the Max Quantity control, a simple ceiling on how many shares a single order may contain. That control was present and functioning. The problem was its calibration. Nasdaq found the threshold was set at a level not reasonably designed to prevent erroneous orders, which is the regulator's careful way of saying it was set so high that an erroneous order would sail straight under it.¹ A limit set above anything you actually fear is not a limit. It is a number in a configuration file that makes the control panel look complete.

One control was broken and silent. The other was intact and useless. The firm had two safety nets, and an order fell through both without touching either.

A limit set never to fire is not a limit

The Max Quantity control is the more instructive of the two failures, because it is the one firms are least likely to think of as a failure at all. A disabled control is at least a visible gap once you find it. A miscalibrated control is worse, because it passes every inspection that asks the wrong question. Does the firm have a maximum-order-size check? Yes. Is it documented? Yes. Is it running in production? Yes. Every box ticked, and the control still cannot do its job, because the only question that matters, the one the audit rarely asks, is whether the threshold is set at a level that would actually catch the event you are afraid of.

This is the quiet failure mode that connects almost every modern market-access case. A firm builds the control, documents it, demonstrates it to the regulator, and then sets its threshold so wide that it never binds. It is not negligence in the obvious sense; it is the path of least resistance. A tight threshold generates false positives, and false positives are annoying, so the threshold drifts outward over time until the alerts stop, and a control that no longer fires feels, day to day, like a control that is working perfectly. Nothing is breaking. That is exactly the problem.

The discipline that prevents it is almost never applied: take every limit the firm believes protects it, and ask not whether it exists but whether it would reject the specific bad order you are worried about. Set the Max Quantity against a real fat-finger scenario, not against the largest legitimate order anyone can imagine. Calibration, not existence, is what makes a control a control, and calibration is precisely what Stifel's backstop lacked.

The control nobody tested was the control that failed

Step back from the two controls and the deeper failure comes into focus: nobody was testing whether the controls themselves still worked. A coding error disabled a risk check on a specific order path and went undetected for more than two years. That is not a story about one bad line of code. Code has bugs; that is a given. It is a story about the absence of any process that would have caught the bug by checking, periodically and deliberately, that every control actually fires on every path it is supposed to guard.

Firms pour enormous effort into testing their trading strategies, because a broken strategy loses money visibly and immediately. They pour far less into testing their controls, because a broken control costs nothing until the day it is needed. A disabled ADV check is invisible precisely because its job is to do nothing almost all the time. The only way to know it still works is to deliberately send it the kind of order it is meant to stop, and confirm that it stops it. Stifel, like many firms, evidently did not run that test on the path that mattered, and so a control that had quietly stopped running looked identical, from the outside, to a control that was working.

A control that does nothing when it should do nothing is indistinguishable from a control that is broken, until the one moment you need it. By then it is not a test. It is an incident.

This is also why the coding error could coexist with a miscalibrated backstop for so long without anyone noticing that the firm was unprotected. Each failure hid the other. The ADV control was silently off, so the Max Quantity control was doing all the work, and the Max Quantity control was set never to fire, so it produced no alerts to suggest anything was wrong. Two broken controls can look exactly like two working ones, right up until an order arrives that both were supposed to catch.

Told once, then it happened anyway

The detail that lifts this from a routine control lapse to a cautionary tale is the timeline. Stifel did not walk into this blind. It had been warned, specifically and recently, about the exact area in which it then failed.

The June 2022 finding is the one that stings. A firm that is told its market-access risk controls are inadequate is being handed the exact question it most needs to answer: are our controls, across every system and every order path, actually working? A thorough response to that finding, a genuine look rather than a narrow patch, would have meant testing whether each control fired where it was supposed to. That is precisely the test that would have surfaced the disabled ADV check and the slack Max Quantity threshold. The remediation did not reach them, and seven months later the gap produced a market event.

This is the same pattern that runs through the largest automation disasters as through the smallest: the warning arrives, the firm fixes the specific thing in front of it, and declines to ask the broader question the warning was really posing. A control failure is rarely a single control. It is usually evidence that the firm does not systematically test whether its controls work, and that evidence does not go away when you patch the one you were caught on.

Every new order path is a place a control can be missing

The specific trigger here is worth generalising, because it will recur with every new layer of automation a firm adds. The ADV control was not missing everywhere. It was missing on one path: the orders routed to the algorithmic strategies. The control existed, was documented, and presumably fired correctly on the firm's other flows. It just was not wired into this one, and the gap lived exactly where a new or specialised order path met a control framework built for the general case.

That is the structural risk in a sentence. Controls are written for the paths that exist when they are built. Every time a firm adds a new routing path, a new strategy, a new venue connection, a new automated workflow, it creates an opportunity for a control to simply not be applied there, silently, with no error and no alert. The more order flow a firm routes through specialised and automated channels, the more such seams it creates, and the easier it becomes for a control to be present in the policy and absent on the path.

Artificial intelligence sharpens this in two ways. First, AI-driven and adaptive strategies multiply the number of distinct paths and behaviours a control framework has to cover, and they change faster than a control inventory is usually reviewed. A control that covered an agent's behaviour last quarter may not cover what it learned to do this quarter. Second, the failure is exactly the kind that is hard to see: not a control that fires wrongly, which generates a visible alert, but a control that silently never runs on a path, which generates nothing at all. The answer is unglamorous and specific. Map every order path, confirm that every required control is applied to each one, and test that each control actually fires there, on a schedule, not just when a regulator asks.

The same failure, at every size of firm

What makes the Stifel case quietly important is that its two failures, a silent coding error and a miscalibrated threshold, are the exact failures that have brought down far larger firms. This is not a small-firm problem. It is the market-access problem, and it scales.

Goldman's $7 million order and Stifel's $70,000 one are two orders of magnitude apart in penalty and describe the same disease. In both, a control was present, documented, and defeated: at Goldman by a threshold set too wide, at Stifel by the same miscalibration plus a bug that switched a second control off entirely. Latour's case adds the third element, a routine code change that silently broke a regulatory control and ran undetected for more than a year. Line them up and the lesson is unmistakable: the dangerous market-access failure is almost never a control the firm forgot to build. It is a control the firm built, believed in, and never tested to see whether it still worked.

What a market-access desk should be able to prove

The Stifel case converts a handful of good intentions into testable obligations. The questions a supervisor can now ask are concrete, and the honest answer to each requires evidence, not a control inventory.

• Is every required control applied to every order path? Map the paths, including each algorithmic strategy and routing channel, and confirm which controls fire on each. A control that guards the general flow but not a specialised path is the Stifel failure exactly.
• Does each control actually fire? Deliberately send each control the kind of order it is meant to stop, in a controlled test, and confirm it stops it. A control that does nothing is indistinguishable from a broken one until you test it.
• Is every threshold calibrated to a real scenario? Set Max Quantity, ADV and price limits against the erroneous order you actually fear, not the largest legitimate one you can imagine, and review the calibration when volumes or volatility change.
• Are control changes code-reviewed under four eyes? The coding error that disabled the ADV check is exactly what independent review and end-to-end testing of control logic are for. Treat risk-control code as the most sensitive code the firm runs.
• Did your last finding get a real look, not a patch? After any control deficiency, test the whole control framework, not just the one you were caught on. The next gap is rarely the one in the order.

Controls fail silently, and silence looks like safety

The uncomfortable truth in the Stifel case is that for more than two years, nothing looked wrong. There were no alerts, because the control that would have alerted was disabled, and the control that remained was set never to speak. The firm's dashboards were quiet, and quiet is exactly what a well-controlled firm is supposed to look like. The absence of a problem and the absence of a working control produce the same readout, and telling them apart is the entire discipline of risk management.

That is why defence in depth is a promise a firm has to keep actively, not a structure it can build once and trust. Layers do not fail loudly; they fail silently, one at a time, and a firm with two broken layers looks identical to a firm with two sound ones until the day an order tests them. The only way to know which firm you are is to keep testing the layers, deliberately, on every path, against the specific failures they exist to stop. A control you have not tested firing is not a control you have. It is a control you hope you have.

As firms route more of their flow through automated and AI-driven strategies, the number of layers and paths multiplies, and so does the number of places a control can be silently missing or quietly slack. The Stifel fine was small. The lesson it carries is not. It is that the safety net you never test is not a safety net, and the day you find out is the day you needed it.