Value at Risk (VaR) Explained: The Math, Limits & Backtesting

Value at Risk, or VaR, answers one question: on a normal bad day, how much could this portfolio lose? It is a line, not a ceiling. It tells you where the bad tail starts, not how far it goes. This post follows a fictional regional bank, Ridgeway Regional, through a daily VaR report, the basic math, and what to do when the number moves.

<iframe width="560" height="315" src="https://www.youtube.com/embed/sFBu6BSlgQM" title="Value at Risk (VaR) Explained: The Math, Limits & Backtesting" frameborder="0" allowfullscreen></iframe>

Watch on YouTube

What a VaR number actually means

Imagine you've just joined ALCO, the asset-liability committee, at Ridgeway Regional, a fictional bank with about $9 billion in assets, mostly loans and deposits. We'll focus on its $500 million bond book: Treasuries and agency mortgage-backed securities, run by the treasury team. Every Ridgeway number here is made up for teaching.

Tomorrow morning, a risk report lands in front of you. Near the top: one-day, 99% value at risk, $4.7 million. Every VaR number has three parts: a horizon, like one day; a confidence level, like 99%; and a dollar amount.

So a one-day 99% VaR of $4.7 million means: on 99 out of 100 ordinary days, we'd expect to lose less than that. On about one day in a hundred, we'd lose more. Not the worst day imaginable. A bad day inside the normal range.

Why VaR exists

By the early 1990s, J.P. Morgan's chairman, Dennis Weatherstone, was getting one daily view of the firm's market risk next to profit and loss: the 4:15 report, delivered just after the market close. In October 1994, J.P. Morgan published its approach for free, as RiskMetrics. And in January 1996, the Basel Committee let banks use their own VaR models to set capital for market risk.

The spirit is one comparable number, every day, so leaders can see risk next to profit and set limits that mean something.

The basic math: z times sigma times position

The simplest version is parametric VaR: roughly z, times sigma, times the position value. Sigma is the typical daily move, the volatility.

Say Ridgeway's book typically moves 0.4% a day. On $500 million, that's $2 million. z sets the confidence level: how many typical moves you go out on the bad side. For 95%, z is 1.65. For 99%, 2.33.

So 95% VaR is 1.65 times $2 million: about $3.3 million. And 99% VaR is 2.33 times $2 million: about $4.66 million. That's the $4.7 million on your report.

Most days cluster near zero. The worst 1% of days is the bad tail. VaR is the line where that tail begins. It does not tell you how far the tail goes.

From one day to ten days

The 1996 Basel rules used a ten-day horizon for capital, since you can't always exit a position in a day, and they allowed scaling up with the square root of time. Multiply one-day VaR by the square root of ten, about 3.16. For Ridgeway: $4.66 million times 3.16, about $14.7 million.

That assumes independent days and unchanged positions. In a crisis, bad days cluster, so treat it as a rough guide.

Historical simulation

Many banks skip the bell curve and use historical simulation: replay today's portfolio through the last 250 trading days of real market moves, about a year. That gives 250 possible results. Sort them, worst to best.

One percent of 250 is two and a half days, so 99% VaR sits between the second- and third-worst losses. A common choice is the third worst: here, $4.8 million. No bell curve needed, but it's only as good as the year you replay. A calm year gives a calm VaR.

How to read the daily report

Read the report like a decision-maker: VaR, the board-approved limit, and how much is used.

• Treasuries: $3.1 million against $4 million, 78% used.
• Agency mortgage-backed securities: $2.4 million against $3 million, 80%.
• Total book: $4.7 million against $6 million, 78%.

The pieces add up to $5.5 million, but the total is $4.7 million. That $800,000 gap is diversification: the books don't always lose on the same days. Below: yesterday's actual loss, $1.2 million, inside VaR. And three backtesting exceptions in the past year.

A VaR limit is risk appetite. The board decides how much daily market risk to carry, and VaR turns that into a number treasury can manage to.

A limit breach is not the same as a backtesting exception

Say total VaR comes in at $6.4 million against the $6 million limit. That's a limit breach. It is not a $6.4 million loss. It means the bank is carrying more risk than the board agreed to. First, escalate, usually the same day, to whoever your risk policy names. Second, explain: did positions grow, or did markets get more volatile? Third, decide: reduce, hedge, or formally approve a temporary higher limit, with an end date.

A backtesting exception is different. It is a day when the actual loss beat that day's VaR. A breach is about the risk you took. An exception asks whether the model is honest. At 99%, expect about two or three exceptions in 250 days.

The Basel Committee's traffic light makes it concrete. Zero to four exceptions is green. Five to nine is yellow. Ten or more is red. For banks using internal models, the capital charge is VaR times a multiplier of at least three. Yellow can raise it; red adds a full point. An optimistic model costs capital. Ridgeway's three exceptions? Green.

What VaR misses

VaR marks where the worst 1% begins, not how bad those days get. Two books can share a VaR, and one can lose twice as much on its worst day. VaR also learns from the past. In 2022, the Fed began raising rates from near zero in March; by December the target range was 4.25 to 4.5%. A VaR trained on calmer years could understate a move like that.

So ALCO also runs stress tests. Rates up two percentage points? Spreads blow out? A 2022-style shock? VaR asks about a normal bad day. Stress tests ask what if. You need both.

Expected shortfall and FRTB

Regulators saw the tail problem too. Under FRTB, the Fundamental Review of the Trading Book, internal models for the trading book move from VaR to expected shortfall at 97.5%. Expected shortfall asks: beyond the line, what's the average loss?

In Ridgeway's replay, the worst 2.5% is about six days. Their average: about $5 million. Now make the worst day $12 million instead of $7.4 million. The 99% VaR doesn't move: it's still the third-worst day. Expected shortfall jumps to about $5.8 million. It sees the tail.

How VaR feeds capital

Basel's core idea is to match the capital cushion to the risk. The basic formula: capital ratio equals capital divided by risk-weighted assets, or RWA. Since 1996, the market risk charge is multiplied by 12.5, that's one over 8%, and added to risk-weighted assets. So more measured risk means more capital, and a model with too many exceptions can push the multiplier up too.

In the U.S., the market risk capital rule generally applies once trading assets plus liabilities reach $1 billion, or 10% of total assets. Many regional banks sit below that line. But VaR is still a useful management tool for a treasury or securities book. For rate risk across the whole balance sheet, ALCO leans on other measures: net interest income and economic value of equity.

Five questions for your next VaR report

1. What horizon and confidence level?
2. How much of the limit is used, and why did it change?
3. How many backtesting exceptions this year?
4. What do the stress tests say about the tail?
5. What data period is the model learning from?

Recap

VaR is the loss line on a normal bad day. The math is z times sigma times position, with z of 2.33 at 99%. A breach: check the risk. An exception: check the model. And VaR doesn't show the tail, so pair it with stress tests and expected shortfall.

Watch more Bank Risk Decoded videos on the Bank Risk Decoded YouTube channel.