The Insurance Fund: What Operators Need to Design, Size and Disclose

The insurance fund is the quietest surface on a leveraged venue and the one that decides whether the platform survives its first genuine stress event with its reputation intact. Underneath the marketing line, it is a specific piece of engineering — a contribution pipeline, a balance ledger, a drawdown rule, a monitoring surface, and a fallback queue for when the reserve runs out.

Operators inheriting a matching engine, or building their own, need every layer of that stack designed before real flow arrives. The retail question is "is the fund big enough to protect me?" — the operator question is "is the fund big enough to keep our winning counterparties whole through the specific tail events our asset mix creates, and can we prove it publicly?" This is a playbook for the second question.

What the Fund Actually Underwrites

Every liquidation on a leveraged venue has a fill price and a bankruptcy price. Fill better than bankruptcy and the delta is a surplus; fill worse and there is a shortfall. The insurance fund exists to absorb that shortfall so profitable counterparties on the other side of the trade keep their full P&L rather than getting clawed back through auto-deleveraging (ADL) or socialised loss.

From the operator's perspective, the fund is a promise to the winning side of every trade. If the platform cannot make that promise credibly, the flow that pays the tightest spreads — market makers, arb desks, institutional counterparties — will price a discount into their quotes or walk. The fund is not a nice-to-have; it is the collateral behind the venue's execution guarantee.

See liquidation prices on multi-asset margin for the mechanics of how bankruptcy and fill prices diverge, and why the gap widens during fast moves on thin books.

Contribution Mechanism: Three Real Options

Three design patterns cover almost every credible venue:

• Liquidation surplus routing. Every liquidation that fills between the liquidation price and the bankruptcy price contributes the delta to the fund. This is the dominant inflow in quiet markets and self-sizes with venue volume. It costs the operator nothing directly, which is why every serious platform ships it.
• Taker-fee slice on leveraged contracts. A small, published percentage of taker fees on leveraged product routes to the fund. This is the counter-cyclical top-up — it grows the reserve fastest during high-volume periods, which usually precede the stress event that draws it down. Ten to twenty percent of leveraged taker revenue is a typical range.
• Bonded operator reserve. The operator posts a dedicated balance-sheet reserve alongside the earned fund. This is what turns a young venue's fund from a rounding error into something an institutional counterparty will take seriously at launch, before liquidation surpluses have had time to accumulate.

Most credible venues combine at least two, usually all three. A fund built on liquidation surplus alone will be undersized on the day it is needed; a fund built on operator reserve alone signals that the fee schedule is not routing revenue back into risk absorption.

Sizing Heuristic Per Asset Class

The working heuristic across the industry is a percent of open interest on the assets the fund covers. A single-line target does not work — the right number depends on volatility, liquidity depth and the leverage cap the venue publishes on each asset class.

Anything under 1% of open interest is a fund that will not survive a real stress event. Operators launching a new asset class need to fund the reserve up-front against projected OI — waiting for liquidation surpluses to accumulate over months is not a plan, it is a decision to socialise the first bad event.

The fund also needs to be segregated per quote asset. A single pooled fund creates cross-contamination risk between contract classes and complicates disclosure. USDT-margined product draws from a USDT fund; if the venue lists inverse contracts, those need their own fund in the relevant base asset.

Drawdown Rules and Rebuild Pathway

A fund that never draws down is either very young or the venue is quietly reaching for ADL first. Real venues with real flow draw the fund down periodically — the design question is how the platform behaves during and after that drawdown.

Three rules the operator needs shipped before launch:

• Drawdown gate. Below a defined threshold (typically 50% of target size), the risk engine tightens — leverage caps step down, funding caps compress, new-position margin requirements step up. The point is to slow the bleed while the rebuild kicks in, not to freeze the venue.
• Rebuild acceleration. During a drawdown, the taker-fee slice routed to the fund steps up automatically (for example, from 10% to 25% of leveraged taker fees) until the fund returns above the target. This is a rules-based recovery, not a discretionary operator decision.
• Public disclosure of the drawdown. The event is published on the fund page in real time. Hiding a drawdown to protect the venue's reputation destroys the reputation faster than the drawdown itself would have.

The rebuild pathway matters because a fund that draws down and stays depressed signals to counterparties that the fee schedule is undersized or the risk model is broken. A fund that draws down and visibly recovers within weeks signals a functioning venue.

The ADL and Clawback Fallback

Even a well-designed fund can be exhausted by a genuine tail event. The operator needs the fallback shipped and disclosed before it is needed, not designed during the incident.

• ADL queue design. The engine ranks profitable counterparties by profit percentage and effective leverage, then force-closes them at bankruptcy price against the residual bankrupt position. The ranking rule needs to be published; opaque ADL destroys counterparty trust faster than the ADL event itself.
• Clawback / socialised loss. A pro-rata haircut across all profitable accounts on the affected contract. This is the harshest fallback and should be reserved for events that exhaust both the fund and the ADL queue.
• Operator absorption. The venue pays the residual out of its own balance sheet. Expensive but survivable for well-capitalised operators, and often the right call when the reputational cost of ADL exceeds the shortfall.

From the operator's side, the temptation is to reach for ADL first because it costs the balance sheet nothing directly. That calculus is wrong on any horizon longer than a single incident — the flow that leaves after an unexpected ADL costs far more than the fund would have. Ship the fund big enough, gate the drawdown, and reserve ADL for the events the fund genuinely cannot absorb.

Disclosure and Proof-of-Reserve

Institutional counterparties evaluating a venue in 2026 expect:

• Live fund balance published per quote asset. Not a daily PDF, not a monthly attestation — a live endpoint or dashboard.
• On-chain reserve attestation where the fund is held in stablecoin. The reserve address is public; the balance is verifiable independently of the venue's own reporting.
• Fund history with drawdown timeline. A visible trend line showing contributions, drawdowns, and rebuilds over the venue's operating life.
• Explicit disclosure of the ADL ranking rule and the socialised-loss policy underneath it.

Any venue not publishing these is trading on trust it has not earned. For a young venue, the disclosure standard is the fastest way to be taken seriously by counterparties who have been through prior cycle blow-ups.

Failure Modes to Design Against

Four patterns the team has watched break other venues:

• Undersized fund at launch. The venue lists new asset classes without seeding the fund against projected OI. The first stress event on the new asset class is an ADL cascade, and the flow leaves within weeks.
• Opaque balance. Monthly PDFs, no on-chain attestation, no history. Institutional counterparties price this as unquantifiable tail risk and quote wider spreads permanently.
• No published ADL queue design. The venue ships the fund but never documents what happens when it runs out. The first ADL event is a surprise to everyone, including the ops team.
• Insurance-fund raid during stress. The operator quietly pulls from the fund to cover an unrelated operating shortfall or a bad hedge. This is unrecoverable once discovered and has ended more than one venue.

Each failure is a decision made at the platform layer months before the incident. The ops team surfaces these patterns as monitoring alerts — fund balance versus OI ratio, drawdown rate, contribution-versus-payout ratio — so the risk team sees the shape of the reserve before an incident forces the question.

What Basis Points Ships

Every default in the Basis Points platform reflects the team's roughly thirty years of combined experience shipping matching engines, hedging stacks and risk systems for institutional venues. The fund design ships with the platform: liquidation-surplus routing on every close-out, a configurable taker-fee slice on leveraged contracts (default 15%), and a bonded operator reserve slot that ops teams size against projected OI at launch.

The fund is segregated per quote asset. The drawdown gate tightens leverage and funding caps automatically below 50% of target. The rebuild-acceleration rule steps taker-fee routing up to 25% until the fund returns above target. The ADL queue ranks by profit percentage and effective leverage, and the ranking rule is published. Fund balance and history are exposed on a public endpoint per quote asset, with on-chain attestation where the reserve is held in stablecoin.

Operators licensing the platform inherit these defaults and tune per their own risk appetite and asset mix. The ops console surfaces the fund ratio versus OI, drawdown velocity, and contribution-versus-payout balance in real time — so the risk team sees the fund's health before the market does. See funding rate arbitrage flow for the flow that most often stresses the fund at the extremes, and matching engine architecture for the mark-price feed design that keeps ordinary volatility from becoming a drawdown event in the first place.

The insurance fund is the quietest part of a well-designed venue. Getting it right is a platform-layer decision made before the first trade. Getting it wrong is an incident report the operator gets to write in public.

Frequently Asked Questions

Evaluating the platform?

Related articles