Mass Cancel And Cancel-On-Disconnect

Cancelling one order at a time is fine when things are normal, but the moment something goes wrong — a bad price feed, a bug that's mispriced every quote, a market event nobody expected — a firm needs every resting order gone at once, not one Cancel Request per order sent in sequence while the clock runs.

Mass Cancel: an explicit, deliberate action

The FIX Order Mass Cancel Request (35=q) message lets a firm pull every resting order matching a scope in one shot — everything on one symbol, everything on one session, or literally everything the firm has resting at that venue. It's a single message that the firm's system (or a human hitting a button) sends on purpose, and the exchange confirms with a Mass Cancel Report telling you how many orders were actually cancelled. This is the tool you reach for when a human or a monitoring system has decided, in the moment, that trading needs to stop right now.

Cancel-on-Disconnect: automatic, not requested

Cancel-on-Disconnect is different in kind: it's a session parameter agreed at logon time, not a message sent in the moment. If a firm's connection to the exchange drops — the TCP session dies, heartbeats stop, the gateway loses contact — the exchange automatically cancels every one of that firm's resting orders on that session, without anyone asking it to. The logic is that a firm that's lost its connection has also lost its ability to manage or cancel its own orders if the market moves, so leaving those orders live and unmonitored is far riskier than pulling them.

This protects against exactly the failure mode a firm can't act on itself: if you can't reach the exchange, you also can't send a Mass Cancel Request to clean up after yourself. Cancel-on-Disconnect is the exchange's own safety net for that specific case, configured once and then triggered by the exchange's own detection of a dead session rather than by anything the firm sends.

Using both together

A well-designed risk setup treats these as complementary, not redundant: Mass Cancel handles the "something looks wrong and I want to act" case, while Cancel-on-Disconnect handles the "I can no longer act at all" case. A firm that only relies on Mass Cancel is exposed the moment its own connectivity fails — which is precisely the scenario where it can't send that message.