Key takeaways
- Toxic flow detection is more reliable when brokers measure what happens after the fill, not only before the order arrives.
- Post-fill markout helps identify accounts that repeatedly trade just before price movement, which can point to latency arbitrage or weak execution controls.
- The goal is not to punish profitable clients. It is to separate normal skill, news trading, and volatility from flow that damages LP relationships or creates hidden book risk.
Toxic flow detection is not one alert or one rule. It is a set of checks that shows whether client flow is repeatedly adverse after execution.
Post-fill markout is one of the most useful checks. It measures where the market moves after a trade is filled. For broker owners, dealing desks, risk teams, and prop firm operators, this helps identify patterns that are not obvious from one trade.
Latency arbitrage often appears as repeated fast entries, short hold times, immediate profit after the fill, and negative markout for the broker or liquidity provider.
What post-fill markout measures
Post-fill markout compares the execution price of a trade with the market price after fixed time intervals. These can be very short, such as 100 milliseconds or 500 milliseconds, or longer, such as 1 second, 5 seconds, or 30 seconds. The right windows depend on the broker setup, asset class, platform, and execution model.
For a buy order, markout is positive for the client if the market moves higher after the fill. For a sell order, it is positive if the market moves lower.
A normal account will have mixed results. Some trades move in the client’s favor, some move against the client, and many are noise. A toxic pattern appears when an account, strategy group, or introducing broker segment repeatedly receives fills just before price moves in its favor.
That does not prove abuse by itself. It is a signal to investigate.
Markout helps answer practical questions:
- Did the client regularly receive a price that was about to become uncompetitive?
- Did the LP or house book lose value immediately after execution?
- Is the pattern isolated, or does it affect many symbols and sessions?
- Does it happen only during volatile events, or also in normal conditions?
How to read markout windows
Use several time windows, not one. A very short window can show latency advantage. A longer window can show whether the trade is normal directional trading.
If an account has consistently favorable markout at 100 milliseconds and 500 milliseconds, but little edge after 30 seconds, the pattern may point to latency or price delay. If the edge remains for longer, it may be a directional strategy.
Split markout by order type, symbol, session, and connection path. Aggregated numbers can hide the issue. One account may look normal overall while one symbol in one session shows clear adverse selection.
Useful breakdowns include:
- Account and account group
- Symbol and asset class
- Trade direction
- Time of day
- Order size bands
- Hold time bands
- Routed LP or internal book
- Entry method, where available
Compare similar clients under similar conditions. A prop firm challenge account trading small lot sizes should not be judged the same way as a professional account trading larger size during event risk.
Signals that point to latency arbitrage
No single metric is enough. Markout becomes stronger when it is combined with execution and behaviour signals.
Short holding time matters, but it is not proof. Scalpers may also hold briefly. The key question is whether profit appears immediately after execution and whether the broker or LP is consistently marked against.
Order timing also matters. Review trades that cluster around quote changes, session opens, fast markets, or unstable pricing. This is especially relevant where a broker uses multiple liquidity streams, symbol mappings, markups, and routing rules.
Rejection, slippage, cancel, and retry patterns add context. If a client receives many favorable fills, avoids unfavorable fills, or interacts with the execution stack in an unusual way, the broker should investigate.
The strongest cases usually combine several signs:
- Consistent favorable markout after fill
- Very short time between order and market movement
- Short trade duration
- Concentration in selected symbols or sessions
- Similar behaviour across related accounts
- Material negative impact on LP performance or house book results
Operational checks before action
Before changing client conditions or routing, confirm that the issue is not caused by broker-side configuration. Toxic flow controls should not be used to cover weak infrastructure.
Start with symbol setup. Contract size, digits, tick size, trading sessions, and symbol mapping must be correct. A configuration error can create false positives or real losses.
Then review price construction and safeguards. If the broker uses aggregation, failover, spread limits, or stale price alerts, check those controls during the period where the markout issue appears. Price quality and execution logs should support the same conclusion. Broker teams can use tools around price aggregation and stale price alerts to support that review.
Next, review routing and risk treatment. A client may be harmless in the house book but damaging when passed to an LP, or the opposite. Clear risk account structure and exposure controls help teams avoid emotional decisions during fast markets.
Monitoring also needs to be timely. A weekly report may identify the loss after it has already affected the relationship. Practical monitoring and alerts should show abnormal execution, LP health, feed health, and unusual account behaviour early enough to act.
Response options for brokers and prop firms
Once there is evidence, the response should be proportional. Immediate blocking may be right in clear abuse cases, but many cases need adjustment first.
Common responses include:
- Moving the account to a different execution group
- Applying symbol-specific or account-specific markup
- Adjusting routing rules
- Reducing maximum order size
- Limiting trading during defined high-risk conditions
- Reviewing terms for news trading or latency-sensitive strategies
- Separating related accounts for investigation
For prop firms, the issue is often challenge integrity rather than LP loss. If accounts exploit execution delay, quote delay, or platform-specific behaviour, payouts, leaderboards, and risk assumptions can be distorted. The same markout logic can identify patterns across accounts, strategies, and trading times.
Documentation matters. Keep the evidence simple: fill time, execution price, post-fill reference prices, account group, symbol, routing path, and comparison with normal accounts. A clear markout record is more useful than a vague label.
Near the end of the workflow, infrastructure can make controls easier to apply. XiroLink supports LP aggregation, markups, Centroid compatible FIX, market data, and monitoring in one liquidity bridge layer.
The aim is not to remove all fast trading. It is to detect patterns where speed, pricing gaps, or execution design create unfair adverse selection, then act before the issue becomes a larger risk problem.
Frequently asked questions
Is every profitable fast trader toxic flow?
No. Fast trading is not automatically toxic. The concern is repeated execution against prices that move against the broker or LP immediately after the fill, especially when the pattern is consistent and concentrated.
Can post-fill markout prove latency arbitrage?
Post-fill markout is strong evidence, but it should not be used alone. Brokers should combine it with fill timing, symbol concentration, rejected order patterns, quote age, and LP feedback where available.
Should a broker block a client as soon as toxic flow appears?
Usually not. First confirm the pattern across enough trades, check technical issues, and review commercial terms. Response options include routing changes, markup adjustments, exposure limits, or account review.