Cancel On Disconnect (COD) monitors the iLink system for involuntary lost connections between iLink users and the CME Globex platform. If a lost connection is detected, COD cancels all resting futures and options orders for the disconnected registered iLink user. This does not include GTC (Good Till Cancel) and GTD (Good Till Date) orders. It is the user's responsibility to reenter all orders that have been cancelled by COD. There is no charge for the COD service.

All newly created SenderComp IDs will be created with Cancel on Disconnect (COD) enabled. To disable COD, Clearing Firm Administrators must enter the change request via Firm Admin Dashboard (FADB). 

Registration for COD is based on session ID and trader ID. The session disconnect triggers COD for all registered session and trader ID pairs.

There is a 24-hour turn-around for COD services provided that requests from customers are submitted by noon.


The COD functionality allows users to have working orders automatically canceled upon the involuntary loss of session connectivity. Upon a session disconnect, the COD functionality checks for resting orders for registered session and trader ID pairs and sends a command to cancel the orders. If COD has worked correctly, a user will receive all cancel acknowledgment messages upon reconnecting.

In the event a market is in a no-cancel period, or during certain emergency situations where it is necessary to transition the market to a state that does not allow order cancellations, all orders may not be cancelled.

Customers should either call the GCC or login to iLink to check order status after an ungraceful disconnect. Upon ungraceful disconnect, if COD functionality attempts to cancel an order that has been completely filled at the host, this cancel request will be rejected with an Execution Report (tag 35-MsgTyp=8) message with the reason as Too Late to Cancel (TLTC).

Cancels initiated by COD will be visible in FirmSoft.

COD - Conditions under Which COD Is Invoked

CME Group detects a loss of session connectivity by monitoring its application messaging with the client system. When there is a lack of messages received for a period exceeding the client-specified heartbeat interval, CME Group will send a Test Request (tag 35-Msgtype=1) message to the client to check for connectivity. The following process will be executed:

  • If a Test Request is sent, a iLink 2 Heartbeat message should be sent in response, although any message received will satisfy the Test Request.
  • If CME Group does not receive a Heartbeat message (or any message) in response to the Test Request message by the end of the next Heartbeat interval, the connection is assumed to be stale and the socket is closed.
  • If CME Group sends out logout confirmation without client system sending logout request, the Cancel On Disconnect functionality will be invoked for COD-registered trader IDs on the particular session.

If CME Group closes a session's socket as a result of lost connectivity (determined by the above process), the Cancel On Disconnect functionality will be invoked for COD-registered trader IDs on the particular session. Connectivity is monitored in this way until the voluntary client logout process is successfully completed.

If the connection being closed is the primary connection and the client system employs Fault tolerance, CME Globex initiates a fail over process to make the backup connection the new primary. This does not trigger Cancel On Disconnect.

If the primary iLink Gateway fails, CME Globex initiates failover to backup component as follows:



Logon without Fault Tolerance

Cancel On Disconnect is invoked for COD-registered trader IDs for sessions on the gateway.

Logon with Fault Tolerance

This does not trigger Cancel On Disconnect.

For more information see Test Request and Fault Tolerance.

COD - Conditions under which COD Is Not Invoked

Cancel On Disconnect is not invoked for a graceful disconnect--a voluntary log out performed by the client system which executes the full logging out process. This involves the successful completion of each of the following steps prior to termination of the connection:

  • Client system sends logout request
  • CME Group sends logout confirmation
  • Client system receives logout confirmation

If a session CODs during the Preopen - No Cancel Market State, COD will run but fail due to cancellation not being available. No orders will cancel, and the customer must wait until the state changes to take action via FirmSoft, the GCC, or by reconnecting and sending multiple Order Cancel Request messages or a single Mass Action Request.

COD - Scenarios

This section provides various cancel scenarios for COD. The registered session and trader IDs are indicated where multiples are listed.

One Session ID and One Trader ID

With one registered Session ID and Trader ID, COD cancels resting orders for its respective Session ID and Trader ID.

Session ID

Trader ID

Expected Result



Cancel all resting orders

One Session ID with Multiple Trader IDs

When one Session ID can route to different Trader IDs, thus different firm numbers, COD will only cancel orders for the registered Session ID and Trader ID pair.

The registered session ID and trader ID pairs for this example are:

  • Session ID ABC, Trader ID 0J0L (firm 000)
  • Session ID ABC, Trader ID 1B3L (firm 123)

The non-registered Session ID and Trader ID pair for this example is:

  • Session ID ABC, Trader ID 2C4L (firm 234)

Session ID

Trader ID

Expected Result



Cancel all resting orders for this session ID and trader ID pair.



Cancel all resting orders for this session ID and trader ID pair.



Will not cancel resting orders for this session ID and trader ID pair.

Different SenderCompIDs on Single iLink Session

A customer can submit orders with different SenderCompIDs through a single iLink session. If COD is enabled on that session, upon an ungraceful disconnect, CME Globex cancels all orders under a single iLink session.

For example,

Session ID


COD Enabled 







  • Customer logs in to COD-enabled session with sendercompID XX00X0
  • Customer submits order1 with sendercompID XX00X0
  • Customer submits order2 with sendercompID XX00X1
  • COD is triggered
    • Order1 is cancelled
    • Order2 is also cancelled

All risk management services are offered by CME Group on a best-efforts basis. Clearing Member Firm (CMF) Risk Administrators only have access to the Execution Firms and Exchanges that they guarantee. Any attempt to take action on an Executing Firm and Exchange assigned to a different CMF will be rejected.