How to test a stock trading app
Direct answer
Shipped untested, a stock trading app silently converts a market order to a limit order that is cancelled, so the customer re-enters it at a worse fill, and lets instant deposit buying power be traded before the ACH pull is returned. 11 tests are mandatory here, each tied to a risk in the map below. After the release smoke check, start the risk tests with unit tests on buying power: buying power, margin and options collateral feed every order ticket, and a wrong figure is shown on every order ticket and portfolio screen.
11 mandatory testsfirst: unit tests
What counts as a stock trading app
A stock trading app here is a retail brokerage app on iOS, Android and web with order placement, live quotes, buying power, instant deposits and options or margin approval, routing orders to an external router and a clearing firm. It covers the order ticket, portfolio balances, linked bank funding, options eligibility and support tooling that can see accounts. Crypto order books run by the platform itself, robo-advice without customer orders and institutional trading terminals are out of scope.
Adjacent product types not covered here
- crypto exchange: A crypto exchange runs its own order book and holds coins in hot and custodial wallets, so hot wallet theft and on-chain reconciliation replace order routing and ACH-funded buying power.
- mobile banking app: A mobile banking app moves cash between accounts and payees, so overdraft fees and payee scams replace order type conversion and market-open load.
- neobank: A neobank is a primary current account opened by remote ID checks, so sanctions screening and partner bank reconciliation replace options eligibility and clearing firm balances.
Risk map
| Risk | Grade | Note | Evidence | |
|---|---|---|---|---|
| Fraud or abuse by users fraud-abuse | money | primary | A taken-over brokerage account buys thinly traded options from the fraudster's account, or instant deposit buying power is traded before the ACH pull bounces. | |
| Money leaves or fails to arrive money-loss | money | primary | A market order is silently converted to a limit order and cancelled, so the customer re-enters it later at a worse fill price, or instant deposit buying power is traded before the ACH pull is returned and the broker carries the loss. | |
| Fine or enforcement by a regulator regulatory-penalty | legal | primary | Options trading is approved by an automated questionnaire for customers who fail the broker's own eligibility rules, and FINRA treats it as a supervision failure, and fines the broker for not disclosing that it converts market orders to limit orders. | |
| Personal or sensitive data exposed data-breach | data | practitioner single incident, no second source | An attacker who talks a support agent into access pulls customer names and emails from support tooling that can see every brokerage account. | |
| Outage during a demand peak outage-under-load | outage | primary | On a market-wide sell-off morning, login and order entry go down at the open, and customers cannot close positions while prices move. | |
| App rejected or removed by a store store-rejection | distribution | secondary by design analysis | By design analysis: a brokerage app must be submitted by the licensed broker entity and declare its financial features, or review rejects the order-placing build. | |
| Users or operators act on wrong numbers wrong-decisions | trust | practitioner single incident, no second source | The portfolio screen shows customers a negative cash balance or buying power that is wrong. |
Mandatory tests (11)
Step 1: release smoke tests
Done when: After each release, a test account logs in, sees live quotes, places and cancels a market and a limit order, and the order history shows both.
Tool class: mobile automation. Who usually runs it: QA engineer.
Step 2: unit tests
Done when: Buying power, margin and options collateral calculations match a reviewed table for cash, margin and options accounts, including after a partial fill.
Tool class: unit framework. Who usually runs it: developer.
Step 3: penetration testing
Done when: An external tester cannot place an order or change the linked bank in another customer's account, and support tooling cannot export account data without a second approver.
Tool class: proxy. Who usually runs it: external lab.
Step 4: payment and money-flow testing
Done when: In the sandbox, a deposit whose ACH pull is returned removes the instant buying power, freezes withdrawal and flags the account for review.
Tool class: API client. Who usually runs it: QA engineer.
Step 5: end-to-end functional tests
Why:money-loss
Done when: A market order placed in a fast-moving test symbol either fills or shows the customer, before submission, that it will be converted to a limit order.
Tool class: mobile automation. Who usually runs it: QA engineer.
Step 6: compliance checks
Done when: A test applicant who fails the options eligibility rules is refused options trading, and the refusal and the answers given are stored for review.
Tool class: test management. Who usually runs it: product manager.
Step 7: security scanning
Why:data-breach
Done when: The latest scan of the trading API and the support console shows no open finding that exposes account holder data.
Tool class: DAST scanner. Who usually runs it: security specialist.
Step 8: performance and load testing
Done when: At the login and order volume of the busiest market open on record, login, quotes and order entry respond within the targets agreed with the broker's operations team.
Tool class: load generator. Who usually runs it: developer.
Step 9: resilience and failure testing
Done when: When the market data feed or the order router is cut in a test environment, the app shows an outage banner and blocks new orders instead of accepting them silently.
Tool class: chaos tool. Who usually runs it: developer.
Step 10: device and browser compatibility
Why:store-rejection
Done when: The order ticket opens and submits on the oldest and newest iOS and Android versions the app supports, and the login, quote and order ticket screens open without a crash.
Tool class: device cloud. Who usually runs it: QA engineer.
Step 11: data integrity and migration testing
Why:wrong-decisions
Done when: Cash balance, buying power and position values on the app match the clearing firm's end-of-day records for a set of test accounts, including accounts with open options.
Tool class: data validation. Who usually runs it: QA engineer.
Recommended and optional tests
integration testsrecommended
Becomes mandatory when the broker changes clearing firm or order router.
contract testsrecommended
Becomes mandatory when more than one market data source feeds the same screen.
accessibility testingrecommended
Becomes mandatory when an accessibility complaint is received or the European Accessibility Act applies to the broker.
offline and poor-network testingrecommended
Becomes mandatory when duplicate orders after reconnect appear in support tickets.
regression suiteoptional
A regression pack of past order-state defects can catch a reopened bug before release.
exploratory testingoptional
Unscripted sessions around halts, splits and options expiry may find order states that scripted cases miss.
Not needed and why
Not needed for risk control: order disclosures are checked by e2e and compliance. Becomes recommended when the order ticket is redesigned.
Not needed: the app serves one market and language. Becomes recommended when the broker opens accounts in a second country.
Order of work
First release
- release smoke tests: Log in as a test account, confirm live quotes, place and cancel a market and a limit order and check both in the order history.
- unit tests: Run buying power, margin and options collateral calculations against the reviewed table for cash, margin and options accounts, including after a partial fill.
- penetration testing: Have an external tester try to place an order or change the linked bank in another customer's account and export account data from support tooling without a second approver.
- payment and money-flow testing: In the sandbox, return the ACH pull on a test deposit and confirm the instant buying power is removed, withdrawal is frozen and the account is flagged for review.
- end-to-end functional tests: Place a market order in a fast-moving test symbol and confirm it either fills or tells the customer before submission that it will be converted to a limit order.
- compliance checks: Submit a test applicant who fails the options eligibility rules and confirm options trading is refused and the answers and refusal are stored.
- security scanning: Scan the trading API and the support console and close every finding that exposes account holder data.
- performance and load testing: Replay the login and order volume of the busiest market open on record and confirm login, quotes and order entry stay within the agreed targets.
- resilience and failure testing: Cut the market data feed and the order router in a test environment and confirm the app shows an outage banner and blocks new orders.
- device and browser compatibility: Open and submit the order ticket on the oldest and newest iOS and Android versions the app supports.
- data integrity and migration testing: Compare cash balance, buying power and position values in the app with the clearing firm's end-of-day records for a set of test accounts, including open options.
Ongoing cadence
- release smoke tests: After every release that reaches production order placement.
- unit tests: On every build that changes buying power, margin or options collateral logic.
- data integrity and migration testing: After each clearing firm end-of-day file is received.
- performance and load testing: Before each release that changes login, quotes or order entry, and after each market open that sets a new volume record.
- resilience and failure testing: When the market data feed or order router provider changes its API version.
- device and browser compatibility: Before each store submission and after each new iOS or Android release.
- integration tests: When the broker changes clearing firm or order router.
Tools
Listed alphabetically inside each test type, filtered to the tests above and to the platforms of stock trading app (ios, android, web). Not recommendations.
release smoke tests
- Firebase Test LabRuns app tests on hosted devices. iosandroidfreemium
- TestRailTest case and run management. webiosandroidapicommercial
- XrayTest management inside Jira. webiosandroidapicommercial
unit tests
penetration testing
- Burp SuiteProxy and scanner for web application security testing. webapifreemium
payment and money-flow testing
- Adyen test environmentTest cards and scenarios for Adyen integrations. webapiiosandroidcommercial
- Stripe test modeTest cards and scenarios for Stripe integrations. webapiiosandroidfreemium
end-to-end functional tests
- AppiumCross-platform mobile UI automation over WebDriver. iosandroidopen-source
- ApplitoolsVisual comparison of screens across builds. webiosandroidcommercial
- BrowserStackCloud of real devices and browsers. webiosandroidcommercial
- CypressBrowser-based end-to-end testing with a visual runner. webfreemium
- DetoxGray-box end-to-end testing for React Native apps. iosandroidopen-source
- EspressoAndroid UI testing framework from Google. androidopen-source
- LambdaTestCloud browser and device grid. webiosandroidcommercial
- MaestroMobile UI flows written in YAML. iosandroidfreemium
- PercyVisual review of UI changes. webcommercial
- PlaywrightBrowser automation for Chromium, Firefox and WebKit. webopen-source
- PromptfooEvaluation and regression tests for LLM prompts and outputs. apiwebopen-source
- Sauce LabsCloud test infrastructure for web and mobile. webiosandroidcommercial
- SeleniumWebDriver-based browser automation. webopen-source
- XCTestApple's framework for unit and UI tests. iosopen-source
security scanning
- Burp SuiteProxy and scanner for web application security testing. webapifreemium
- mitmproxyInteractive HTTPS proxy. iosandroidwebapiopen-source
- MobSFStatic and dynamic analysis for mobile binaries. iosandroidopen-source
- OWASP ZAPDynamic application security scanner. webapiopen-source
- SemgrepStatic analysis with custom rules. apiwebiosandroidfreemium
- SnykDependency and code vulnerability scanning. apiwebiosandroidfreemium
performance and load testing
- ArtilleryLoad testing with YAML scenarios. apiwebfreemium
- GatlingLoad testing with Scala, Java or Kotlin scenarios. apiwebfreemium
- JMeterLoad testing tool from the Apache Foundation. apiwebopen-source
- k6Load testing scripted in JavaScript. apiwebopen-source
- LighthouseAudits for accessibility and performance in Chrome. webopen-source
- LocustLoad testing scripted in Python. apiwebopen-source
device and browser compatibility
- AppiumCross-platform mobile UI automation over WebDriver. iosandroidopen-source
- ApplitoolsVisual comparison of screens across builds. webiosandroidcommercial
- BrowserStackCloud of real devices and browsers. webiosandroidcommercial
- Firebase Test LabRuns app tests on hosted devices. iosandroidfreemium
- LambdaTestCloud browser and device grid. webiosandroidcommercial
- PercyVisual review of UI changes. webcommercial
- PlaywrightBrowser automation for Chromium, Firefox and WebKit. webopen-source
- Sauce LabsCloud test infrastructure for web and mobile. webiosandroidcommercial
- SeleniumWebDriver-based browser automation. webopen-source
integration tests
- Charles ProxyHTTP proxy for inspecting and throttling traffic. iosandroidwebcommercial
- JestJavaScript test runner with mocking and snapshots. webapiopen-source
- JUnitTest framework for the JVM. apiandroidopen-source
- VitestTest runner for Vite-based JavaScript and TypeScript projects. webapiopen-source
- XCTestApple's framework for unit and UI tests. iosopen-source
accessibility testing
- Accessibility ScannerGoogle's on-device accessibility checker for Android. androidopen-source
- axe-coreAccessibility rules engine for automated checks. webopen-source
- LighthouseAudits for accessibility and performance in Chrome. webopen-source
- Pa11yCommand-line accessibility testing. webopen-source
offline and poor-network testing
- Charles ProxyHTTP proxy for inspecting and throttling traffic. iosandroidwebcommercial
- mitmproxyInteractive HTTPS proxy. iosandroidwebapiopen-source
- Network Link ConditionerApple tool for simulating poor network conditions. iosopen-source
What to send to the person who will test
Send the checklist and the brief below. The printable checklist for stock trading app has the same 11 items with checkboxes.
Download the checklistMarkdownCSVBrief (Markdown)
Acceptance criteria wording
A release of the stock trading app is accepted when a test account sees live quotes, places and cancels a market and a limit order, and the order history shows both. A market order in a fast-moving test symbol either fills or shows before submission that it will become a limit order. Cash balance, buying power and positions match the clearing firm's end-of-day records for the test accounts.
Brief
# Test brief: stock trading app Product type: stock trading app. Retail brokerage app with order placement and market data. Risk map and evidence: https://howtotestaproduct.com/how-to-test/trading-app/ Printable checklist: https://howtotestaproduct.com/checklists/trading-app/ Run these 11 mandatory tests in this order. A test is done only when its done condition is true on the build you will release. 1. release smoke tests (risks: store-rejection, money-loss). Tool class: mobile automation. Usually run by: QA engineer. Done when: After each release, a test account logs in, sees live quotes, places and cancels a market and a limit order, and the order history shows both. 2. unit tests (risks: wrong-decisions, money-loss). Tool class: unit framework. Usually run by: developer. Done when: Buying power, margin and options collateral calculations match a reviewed table for cash, margin and options accounts, including after a partial fill. 3. penetration testing (risks: data-breach, fraud-abuse). Tool class: proxy. Usually run by: external lab. Done when: An external tester cannot place an order or change the linked bank in another customer's account, and support tooling cannot export account data without a second approver. 4. payment and money-flow testing (risks: fraud-abuse, money-loss). Tool class: API client. Usually run by: QA engineer. Done when: In the sandbox, a deposit whose ACH pull is returned removes the instant buying power, freezes withdrawal and flags the account for review. 5. end-to-end functional tests (risks: money-loss). Tool class: mobile automation. Usually run by: QA engineer. Done when: A market order placed in a fast-moving test symbol either fills or shows the customer, before submission, that it will be converted to a limit order. 6. compliance checks (risks: regulatory-penalty). Tool class: test management. Usually run by: product manager. Done when: A test applicant who fails the options eligibility rules is refused options trading, and the refusal and the answers given are stored for review. 7. security scanning (risks: data-breach). Tool class: DAST scanner. Usually run by: security specialist. Done when: The latest scan of the trading API and the support console shows no open finding that exposes account holder data. 8. performance and load testing (risks: outage-under-load). Tool class: load generator. Usually run by: developer. Done when: At the login and order volume of the busiest market open on record, login, quotes and order entry respond within the targets agreed with the broker's operations team. 9. resilience and failure testing (risks: outage-under-load). Tool class: chaos tool. Usually run by: developer. Done when: When the market data feed or the order router is cut in a test environment, the app shows an outage banner and blocks new orders instead of accepting them silently. 10. device and browser compatibility (risks: store-rejection). Tool class: device cloud. Usually run by: QA engineer. Done when: The order ticket opens and submits on the oldest and newest iOS and Android versions the app supports, and the login, quote and order ticket screens open without a crash. 11. data integrity and migration testing (risks: wrong-decisions). Tool class: data validation. Usually run by: QA engineer. Done when: Cash balance, buying power and position values on the app match the clearing firm's end-of-day records for a set of test accounts, including accounts with open options. Acceptance criteria wording: A release of the stock trading app is accepted when a test account sees live quotes, places and cancels a market and a limit order, and the order history shows both. A market order in a fast-moving test symbol either fills or shows before submission that it will become a limit order. Cash balance, buying power and positions match the clearing firm's end-of-day records for the test accounts. Report back for each test: pass or fail against its done condition, the build or version tested, and the proof (screenshot, log line or report file). Licence: CC BY 4.0.
For founders: what to forward and what to ask back. For product managers: turning this page into tickets.
Questions about testing a stock trading app
What testing does a stock trading app need?
11 tests are mandatory, from the order smoke test and buying power unit tests to market-open performance and clearing firm reconciliation. Each is tied to one of the 7 risks in the map, such as a market order silently converted and cancelled or login failing at the open of a sell-off. Integration, contract, accessibility and offline tests are recommended, each with the event that makes it mandatory.
What gets a stock trading app rejected by an app store?
The map marks store rejection as a by design analysis risk: a brokerage app must be submitted by the licensed broker entity and declare its financial features, or review rejects the order-placing build. The order smoke test and compatibility on the oldest and newest supported OS versions are tied to it.
What testing is required for a stock trading app as a financial product?
Compliance checks are mandatory while options or margin trading is offered: a test applicant who fails the eligibility rules is refused and the answers are stored. The map cites FINRA treating automated options approval for ineligible customers as a supervision failure. End-to-end tests of collared market orders are mandatory while the broker changes order types.
Which tests in a vendor test plan for a stock trading app are not needed?
Usability testing is not needed while order disclosures are checked by end-to-end and compliance tests, until the order ticket is redesigned. Localization is not needed while the app serves one market and language, until the broker opens accounts in a second country.
Evidence
ev-0184regulatorprimary
Regulatory Notice 20-32, FINRA
Supports fraud-abuse for a stock trading app: the regulator describes account takeover and new account fraud in which a bad actor uses a victim's brokerage account to buy options at inflated prices from an account the actor controls.
published 2020-09-17 · verified 2026-10-07
ev-0185regulatorprimary
Regulatory Notice 21-14, FINRA
The malicious actor will then submit a request to the firm to request an ACH transfer (or "pull") from the linked bank account while also using the "instant funds" to immediately place orders to buy securities.
Supports fraud-abuse and money-loss for a stock trading app: instant buying power granted before a linked-bank ACH pull settles lets a fraudster trade and withdraw before the deposit is returned, leaving the broker with the loss.
published 2021-03-25 · verified 2026-10-07
ev-0182court-or-fineprimary
Robinhood Financial provided customers with inaccurate or incomplete disclosures regarding its practice of 'collaring' market orders by converting them to limit orders.
Supports money-loss and regulatory-penalty for a stock trading app: market orders converted to limit orders were cancelled, customers re-entered them at worse prices and the firm paid restitution for the order-handling behavior it had not disclosed.
published 2025-03-07 · verified 2026-10-07
ev-0181court-or-fineprimary
Robinhood Financial LLC Letter of Acceptance, Waiver and Consent, FINRA
During the March outage, all of Robinhood's customers were unable to trade.
Supports outage-under-load, wrong-decisions and regulatory-penalty for a stock trading app: the regulator found a retail brokerage app went down during the March 2020 market volatility, showed customers inflated negative cash balances and approved options accounts through automated approval bots with limited oversight.
published 2021-06-30 · verified 2026-10-07
ev-0183post-mortemprimary
Robinhood Announces Data Security Incident (Update), Robinhood
The unauthorized party socially engineered a customer support employee by phone and obtained access to certain customer support systems.
Supports data-breach for a stock trading app: the broker's own incident report says an attacker reached customer names and emails through the support tooling, so support-side access to brokerage accounts is part of the attack surface.
published 2021-11-16 · verified 2026-10-07
ev-0027regulatorprimary
PS21/3: Building operational resilience, Financial Conduct Authority
The FCA requires UK firms to identify important business services, set impact tolerances and test that they can stay within them during severe but plausible disruption.
published undated · verified 2026-10-07
ev-0001store-guidelineprimary
App Review Guidelines, Apple
Apple reviews every iOS, iPadOS and macOS App Store submission against these guidelines, including crashes and bugs at review, privacy disclosures, in-app purchase rules and extra rules for medical, financial and kids apps, and apps with user-generated content must let users report offensive content and block abusive users (guideline 1.2), and apps offering loot boxes or similar mechanisms must disclose the odds of each item type before purchase (guideline 3.1.1).
published undated · verified 2026-10-07
ev-0004store-guidelineprimary
Financial Services policy, Google Play
Google Play requires declarations and licensing information from apps offering loans, trading, crypto and other financial services.
published undated · verified 2026-10-07
Disclaimer
This page lists tests and risks for a product category, not for your product. Risks are attached only with the evidence shown in the Evidence section. Tools are listed alphabetically and are not recommendations. Nothing here is legal, regulatory or security advice; where a regulator or a store sets a requirement, their page is linked and takes precedence.