diff --git a/app/api/trading/check-risk/route.ts b/app/api/trading/check-risk/route.ts
index 1b84a93..61949c6 100644
--- a/app/api/trading/check-risk/route.ts
+++ b/app/api/trading/check-risk/route.ts
@@ -7,6 +7,7 @@
 
 import { NextRequest, NextResponse } from 'next/server'
 import { getMergedConfig } from '@/config/trading'
+import { getInitializedPositionManager } from '@/lib/trading/position-manager'
 
 export interface RiskCheckRequest {
   symbol: string
@@ -41,23 +42,37 @@ export async function POST(request: NextRequest): Promise<NextResponse<RiskCheck
     
     const config = getMergedConfig()
     
-    // TODO: Implement actual risk checks:
+    // Check for existing positions on the same symbol
+    const positionManager = await getInitializedPositionManager()
+    const existingTrades = Array.from(positionManager.getActiveTrades().values())
+    const duplicatePosition = existingTrades.find(trade => trade.symbol === body.symbol)
+    
+    if (duplicatePosition) {
+      console.log('🚫 Risk check BLOCKED: Duplicate position exists', {
+        symbol: body.symbol,
+        existingDirection: duplicatePosition.direction,
+        requestedDirection: body.direction,
+        existingEntry: duplicatePosition.entryPrice,
+      })
+      
+      return NextResponse.json({
+        allowed: false,
+        reason: 'Duplicate position',
+        details: `Already have ${duplicatePosition.direction} position on ${body.symbol} (entry: $${duplicatePosition.entryPrice})`,
+      })
+    }
+    
+    // TODO: Implement additional risk checks:
     // 1. Check daily drawdown
     // 2. Check trades per hour limit
     // 3. Check cooldown period
     // 4. Check account health
-    // 5. Check existing positions
     
-    // For now, always allow (will implement in next phase)
-    const allowed = true
-    const reason = allowed ? undefined : 'Risk limit exceeded'
-    
-    console.log(`✅ Risk check: ${allowed ? 'PASSED' : 'BLOCKED'}`)
+    console.log(`✅ Risk check PASSED: No duplicate positions`)
     
     return NextResponse.json({
-      allowed,
-      reason,
-      details: allowed ? 'All risk checks passed' : undefined,
+      allowed: true,
+      details: 'All risk checks passed',
     })
 
   } catch (error) {