Liquidations

A perpetual exchange must liquidate under-margined accounts before their losses become systemic. Monaco does this in two rungs, and what separates them is what the closing order is priced against.

• Protected liquidation protects price quality. It reduces risk with bounded, reduce-only execution while the bucket still has room to spare.
• Terminal liquidation protects solvency. Once a bucket falls below three quarters of its maintenance margin that room is gone, and the objective changes: closing the position matters more than preserving what is left of its equity.

Both rungs send reduce-only immediate-or-cancel (IOC) orders. The protected rung always carries an explicit limit; the terminal rung’s limit is set by the venue’s liquidation mode.

​

The pinned price

When a risk bucket enters liquidation, Monaco fixes a closing price for each of its positions: the price at which that bucket’s equity would reach exactly zero. This is the pinned price, and it does not move again for the life of the liquidation. It is derived from entry and the collateral behind the position, and the mark does not enter the derivation at all. That is what makes pinning safe rather than approximate — re-deriving it after a mark move returns the same number, so fixing it once only removes the chance to re-derive it from state that has since changed. Every limit below is priced against it, and every auto-deleveraging fill settles at it.

​

The two rungs

Let E be bucket equity and M the maintenance margin required, priced off the market’s margin ladder — M is the ladder’s piecewise MM(N) per bracket, not a single flat rate. $$\text{Healthy} \iff E \geq M$$ $$\text{Protected} \iff \tfrac{3}{4}M \leq E < M$$ $$\text{Terminal} \iff E < \tfrac{3}{4}M$$ Liquidation begins as soon as equity falls below maintenance. The terminal rung begins only once the bucket is materially deeper underwater. The three-quarters line has a precise meaning rather than being a tuned constant. The distance between a position’s mark and its pinned price is exactly the maintenance margin that position is carrying — so the fraction of that distance still unspent is the fraction of maintenance margin the bucket still holds. At E = ¾M the mark has travelled a quarter of the way to the pin. The line is a position in that corridor, and it is the same fraction in every market the bucket holds, at the same moment.

​

Protected rung

Above the line, a slice is limited at the position’s protected rung — three quarters of the way from the pinned price back toward solvency. The limit therefore tightens toward the pin as equity decays, and a fill can never cross into the bucket’s own bankruptcy. Sizing is minimal: the slice closes enough to restore the bucket to its maintenance requirement plus a buffer, not the whole position. One position is sliced per step, chosen by which slice buys the most risk reduction per unit of expected execution cost. Slices are additionally capped by remaining position size, a maximum slice notional, and the executable book depth within the limit price.

​

Terminal rung

Below the line, price protection has already failed its purpose. The slice requests the full remaining position, with no notional cap — every further tick of delay below three quarters of maintenance is insurance-fund money. Where its limit sits depends on the venue’s liquidation mode, below. Whatever the book will not take is escalated to Auto-Deleveraging, which closes it against traders holding the opposite side at the pinned price.

​

How far past the pin the venue will pay

The venue runs one of two liquidation modes. There is no middle setting.

• Unbounded (the default). The terminal slice carries no limit at all: the book takes the position at whatever it charges, and the insurance fund absorbs any fill past the pinned price. Deleveraging is reached only once the book has had no depth for the position across consecutive attempts for about a minute — sooner, though never on a single attempt, when the bucket’s shortfall would consume more than half of what the insurance fund has left.
• Zero. The terminal slice is limited at the pinned price itself, so no book fill can create bad debt: the fund pays nothing for execution, and anything the book declines at that price is handed to deleveraging on the first refusal.

The choice is a policy dial, not a safety mechanism: it trades fund draw against how many counterparties an event reaches. When the insurance fund is empty, the venue switches to Zero automatically and stays there until it is switched back once the fund is replenished — a fund with nothing left cannot pay for fills past the pin.

​

Queue priority

Pending liquidations are not processed first-in-first-out. Monaco orders them by absolute breach depth: $$D = \max(M - E,\ 0)$$ The deepest deficit is served first, with arrival time and then bucket identity as tie-breakers. Age prevents similarly-placed buckets from being reordered forever, and priority is recomputed on every requeue, so a bucket that deteriorates between attempts moves up. Absolute depth rather than a ratio is deliberate. A small account with an extreme relative shortfall is less dangerous to the system than a large account with a milder ratio but a far larger dollar hole — and it is the dollars that reach the insurance fund.

​

Post-fill revalidation

The ladder never blindly continues to a worse price. After every attempt Monaco recomputes equity, the maintenance requirement and remaining exposure, then acts on the result:

• E' >= M' — liquidation stops and the bucket returns to normal.
• Exposure fully closed and E' < 0 — liquidation stops and the deficit is crystallized as bad debt.
• ¾M' <= E' < M' — the bucket leaves the terminal rung but stays in liquidation.
• E' < ¾M' — the bucket stays on the terminal rung and is requeued with updated priority.

A bucket cannot cross back above the three-quarters line through its own fills. Closing part of a position at its pinned price leaves the bucket exactly as far from that line as it was, in proportion — so only something external recovers it: a mark rebound, a funding payment, a deposit. That is what stops a liquidation from either accelerating itself or stalling part-way through.

​

Bankruptcy price and bad debt

For a single position with signed quantity q (positive for long) and mark price S, bucket equity after a full close at price p is: $$E'(p) = E + q\,(p - S)$$ The pinned price is the closeout price that makes post-close equity exactly zero: $$p_{\text{bk}} = S - \frac{E}{q}$$ For a long, execution below p_bk creates bad debt; for a short, execution above it does. The design rules are:

• Protected liquidation cannot cross bankruptcy — its limit sits strictly inside the pin.
• Terminal liquidation crosses it only in the Unbounded mode, where the insurance fund absorbs the difference. In the Zero mode, not at all.
• Bad debt is crystallized only after exposure is closed, or after an explicit terminal closeout policy.
• Insurance resolution is downstream of crystallized bad debt. It is not a substitute for liquidation execution.

​

Bad debt and the insurance fund

A risk bucket that ends flat with negative equity is in bad debt. The margin account has lost exactly the collateral allocated to that bucket and no more; the rest of the shortfall is the insurance fund’s. This holds for cross and isolated risk buckets alike, and it applies however the bucket became flat and insolvent — through liquidation, through auto-deleveraging, or through your own closing trade. While a bucket is in bad debt it is frozen:

• Its allocation cannot change in either direction. Transfers into or out of it are refused; a top-up from the margin account does not release it.
• The insurance fund pays the shortfall as it can, and each payment is credited to the bucket as it is made, so the bucket can be paid in parts. Once the shortfall is fully covered the bucket is settled flat: an isolated risk bucket closes, and a cross risk bucket returns to normal, empty.
• If the insurance fund is empty, the bucket stays frozen until the fund can pay. Bad debt is never written off by hand; the fund is the only way out.

​

Liquidation fee

A liquidation slice is charged a fee derived from the maintenance margin it releases, evaluated at the step mark rather than at the fill price: $$\text{fee}_{\text{uncapped}} = k\,\Delta M = k\,\bigl(M(N_{\text{before}}) - M(N_{\text{after}})\bigr)$$ M(N) is the ladder’s piecewise maintenance-margin function, so \Delta M is a bracket difference rather than a flat rate times closed notional: a slice that closes a position across a tier boundary releases the whole marginal step, not just the tier-1 amount. The release fraction k is one half. That choice is what keeps a clip a survival path: with the mark unchanged and execution at the mark, a slice moves the bucket’s health E - M by (1 - k)\,\Delta M, so at k = ½ half the released maintenance margin is the fee and half is headroom the bucket keeps. At k = 1 the fee would consume the entire release and a clip could never restore health on its own. Slippage, a mark move, fee clamping, or rounding change the realized figure. The charged fee is capped by what the bucket still has — remaining cash and mark-to-market equity — and rounded down when a fee unit is configured. It is a junior claim: it never creates or deepens bad debt. What is collected is credited to the insurance fund.

​

Risk controls

Liquidation is aggressive on the terminal rung, but bounded:

• Orders are internal, liquidation-originated, and reduce-only.
• Orders are IOC and never rest on the book.
• Price limits are derived from the bucket’s own pinned price rather than a flat band around the mark: the protected rung always, and the terminal rung in the Zero mode.
• The mechanism requires a valid mark price and a tradable market state.
• Before slicing, the liquidated bucket’s own resting orders are cancelled. Forced closes do not apply self-trade prevention: liquidation slices fill against resting orders from your other risk buckets and sub-accounts in price order, exactly as against anyone else’s, and count that depth as available; auto-deleveraging fills no resting orders and can close an opposing position your other risk buckets hold; a position it fully closes has its risk bucket’s resting reduce-only orders on that pair cancelled with AUTO_DELEVERAGING.
• Every step publishes enough audit data to reconstruct queue priority, breach depth, the limit price used, attempted and filled quantity, and post-fill equity and maintenance requirement.

​

Summary

For each liquidation worker step:

1. Refresh bucket equity E and maintenance requirement M.
2. Select the highest-priority queued bucket by breach depth D, with age and identity as tie-breakers.
3. If E >= M, resolve the candidate.
4. If E >= ¾M, slice one position, sized to restore health, limited at its protected rung.
5. If E < ¾M, request the full remaining position — limited at its pinned price in the Zero mode, with no limit in the Unbounded mode.
6. Apply fills and recompute equity, maintenance requirement and remaining exposure.
7. Stop if the bucket recovered or is flat; otherwise requeue with updated priority.
8. If the book refused the position on the terminal rung, hand it to auto-deleveraging.

The key principle: protected liquidation preserves execution quality while the bucket can still afford it; terminal liquidation closes the position at a price fixed before the trouble started. When the book will not meet that price, the position leaves the book entirely — see Auto-Deleveraging. Note that the escalation is driven by the book refusing to fill, not by the bucket going bankrupt: a solvent bucket the book will not take is deleveraged, and a bankrupt one the book is still filling is not. For monitoring position risk and liquidation distance on your own account, see Margin and Positions.