Bounded by construction.

Exposure envelope

Maximum loss is bounded and pre-funded: £2,000, ring-fenced, no leverage, no derivatives, no shorts, long-only cash equity. There is no path to a liability beyond the funded amount. The ring-fence has a defined test — if the account read £0.00 tomorrow, no bill changes — stated as a binary, not a comfort level. And capital deployment is staged: £0 for three paper cycles, then half, then full — with the gate between stages operational, not performance-based. You cannot buy your way to full size with good returns; you get there by not breaking process.

Position-level controls

Single-name cap of 1/12 (~8.3%), hard, enforced by equal-weight construction rather than monitoring. A total single-name wipeout costs ~8% of book; a −30% month in one name costs ~2.5%. The cap is the position-level control — there are no stop-losses, and that should be priced honestly: the 200-day average, evaluated monthly, is the entire exit trigger, so gap risk between screens is unmitigated. A name can halve on day 2 of a cycle and is held for the remaining four weeks. At £85–165 a slot that trade-off is reasonable — a stop would protect £13–25 while adding spread, whipsaw, and a daily reason to watch prices. It would not be reasonable at 10× the size, and that is a real scaling constraint.

Portfolio-level controls

Liquidity gates at entry leave exit liquidity a non-issue by a wide margin at this size. Structural de-risking exists: in broad declines the momentum gates fail across the book, holdings exit at the monthly screen, and unfilled slots stay in cash — and the rules explicitly forbid relaxing gates to stay invested. The drawdown ladder at −15% and −25% versus high-water mark triggers documentation, not de-risking: a factual review, then a written continuation case. Structurally defensible — the cash migration already does the de-risking — but it is not a drawdown limit in the usual sense and should never be described as one. The terminal stop is time-boxed: trail the benchmark after 36 live months and the system retires.

Unmitigated and partially mitigated exposures

No sector concentration limit. Financials are excluded outright, but nothing prevents all twelve slots landing in one industrial cluster if that's where cheap-and-rising concentrates. Given the screen is cross-sectional and regime-driven, that clustering is likely, not hypothetical — the largest uncontrolled portfolio risk.

No country or currency limit, and FX is unhedged. The UK/US split is whatever the screen produces; FX cost is recorded, but the exposure itself is neither capped nor hedged. Execution is manual — orders keyed by hand into a phone app, no API — so fat-finger and omission risk is controlled only by the fills log and the rule that every printed line is executed. Data dependency on free sources is a live operational risk, partially mitigated by fail-closed handling: unfetchable fundamentals exclude a name rather than passing it, and every cycle's raw responses are archived. Key person: one operator, one account, no cover.

Change control

Parameters are frozen until July 2027 and loaded from a checksummed config file, so an undocumented edit is detectable. Proposed changes go to an amendments log before anyone checks what they would have earned — that ordering is the actual control; it prevents result-driven rule changes. Two logs run continuously: breaches (empty), and temptations that weren't acted on. The second is the better leading indicator.