Value at Risk

Every investment can lose money. The question is: how much, and how often? Before the 1990s banks answered that question mostly with intuition and spreadsheets. Then J.P. Morgan published its RiskMetrics framework in 1994 and gave the world Value at Risk — a single number designed to capture downside in a form that executives and regulators could read at a glance.

The idea is disarmingly simple. Fix a confidence level (say 95%) and a time horizon (say one trading day). VaR is the dollar loss that will not be exceeded on 95% of days — equivalently, the loss you should expect to see surpassed only once every twenty days on average.

Formally, if $L$ is the random daily loss and $\alpha \in (0,1)$ is the confidence level, then

$$\text{VaR}_\alpha = \inf\{ \ell \in \mathbb{R} : P(L > \ell) \leq 1 - \alpha \}$$

which is simply the $\alpha$-quantile of the loss distribution. At 95% confidence, VaR is the point on the loss axis to the left of which 95% of the probability mass sits.

That one number became the lingua franca of risk management. Basel II and Basel III made it a regulatory requirement for banks worldwide. But a number this compact inevitably hides something — and what VaR hides can be severe.

The demo below shows a simulated daily return distribution for a hypothetical portfolio. Returns have been negated so losses appear on the positive side of the axis — positive numbers are bad days.

<!-- {{c_html_intro}} -->
<div class="controls">
  <label for="conf">{{lbl_confidence}} <strong id="conf-val">95%</strong></label>
  <input type="range" id="conf" min="80" max="99" value="95" step="1">
  <label for="dist-select">{{lbl_distribution}}</label>
  <select id="dist-select">
    <option value="normal">{{opt_normal}}</option>
    <option value="skewed">{{opt_skewed}}</option>
    <option value="heavy">{{opt_heavy}}</option>
  </select>
  <button id="resample" type="button">{{btn_resample}}</button>
</div>
<canvas id="chart" width="560" height="280"></canvas>
<div class="stats" id="stats"></div>
<p class="note">{{note_tail}}</p>

/* {{c_css_intro}} */
* { box-sizing: border-box; }
body { font-family: system-ui, sans-serif; color: #222; margin: 0; padding: .5rem; }
.controls { display: flex; flex-wrap: wrap; gap: .5rem .9rem; align-items: center; margin-bottom: .6rem; }
label { font-size: .88rem; font-weight: 600; }
input[type=range] { width: 160px; cursor: pointer; }
select { font: .88rem system-ui, sans-serif; padding: .2rem .4rem; border: 1px solid #b0bec5; border-radius: 6px; }
button { font: 600 .82rem system-ui, sans-serif; padding: .3rem .75rem; border: 1px solid #1d3557;
         background: #1d3557; color: #fff; border-radius: 7px; cursor: pointer; }
canvas { display: block; width: 100%; max-width: 560px; }
.stats { font-size: .9rem; margin: .4rem 0; min-height: 1.6em; }
.stats span { font-weight: 700; }
.note { font-size: .8rem; color: #555; margin: .3rem 0 0; line-height: 1.4; }
@media (prefers-color-scheme: dark) {
  body { color: #ddd; background: #1a1a2e; }
  select { background: #222; color: #ddd; border-color: #555; }
  button { background: #3a5a8a; border-color: #3a5a8a; }
  .note { color: #aaa; }
}

// Code not found

Drag the confidence slider and watch the VaR line move. At 95% the shaded tail contains 5% of the probability mass — those are the days VaR does not cover. Notice how VaR says nothing about how large the losses in that tail are: two portfolios can share the same VaR yet face very different catastrophes.

VaR looks clean, but its simplicity is also its danger.

What VaR measures — and what it does not. VaR marks a threshold on the loss distribution. Everything to the right of that threshold — the tail — is invisible to VaR. Two portfolios can have identical 95% VaRs while one has losses of $1 M in the tail and the other has losses of $1 B. VaR is silent on the severity of the worst outcomes.

Non-subadditivity. A coherent risk measure should satisfy $\rho(A + B) \leq \rho(A) + \rho(B)$: diversification should not increase risk. VaR violates this property for non-elliptical distributions. Adding two positions can produce a VaR higher than the sum of their individual VaRs — the opposite of what diversification should do.

Expected Shortfall fixes the tail blindness. Also called Conditional VaR (CVaR), Expected Shortfall answers: given that we are in the worst $(1-\alpha)$ fraction of days, what is the average loss? Formally:

$$\text{ES}_\alpha = \frac{1}{1-\alpha} \int_\alpha^1 \text{VaR}_u \, du$$

ES is coherent, subadditive, and tells you about tail severity — at the cost of being harder to estimate and less intuitive to communicate. Basel III's Fundamental Review of the Trading Book (FRTB, 2016) moved banks from 99% VaR to 97.5% ES for exactly this reason.

Model risk. VaR is only as good as the model for the loss distribution. The historical simulation approach uses the last $T$ days of returns directly — simple, but it completely misses risks not present in the window. The parametric (variance-covariance) approach assumes normality, which famously underestimates tail probabilities. Monte Carlo is flexible but computationally expensive and sensitive to correlation assumptions.

Estimation difficulty. Estimating the 99th percentile from daily data requires years of history to get a reliable sample — but markets change, making old data misleading. This is the classic bias-variance tradeoff applied to tail estimation: a short window is noisy; a long window is stale.

VaR is not just an academic concept — it is embedded in the architecture of global finance:

• Regulatory capital: Basel II/III requires banks to hold capital proportional to their VaR. A trading desk's VaR directly determines how much capital is locked up to absorb potential losses, affecting every loan and investment the bank can make.
• Trading limits: risk managers set position limits in VaR terms. A desk is allowed to carry a portfolio whose daily VaR does not exceed a budget — VaR becomes the currency of internal risk allocation.
• Hedge fund risk budgeting: funds allocate VaR across strategies the same way a company allocates a budget across departments, seeking the highest return per unit of risk.
• Margin and collateral: clearing houses use VaR-like calculations to set the initial margin required for derivatives positions, sizing the buffer against a one-day adverse move.
• Stress testing and back-testing: regulators require banks to count how often actual losses exceed VaR (back-testing). Too many exceedances trigger capital add-ons, creating a feedback loop between the model and the regulatory environment.

VaR's grip on finance is so tight that its flaws caused real damage. During the 2008 financial crisis, many institutions held positions whose VaR looked comfortable at 99% while tail losses were catastrophic — a reminder that a number's popularity does not guarantee its safety.

Value at Risk earned its place in finance by doing something genuinely hard: turning a whole probability distribution into a single number that busy executives and regulators can act on. At 95% confidence, VaR says we expect to lose at most X on a typical bad day — a sentence that fits in a board presentation.

But that compression is also its trap. VaR is blind to what happens beyond its threshold, can fail the diversification intuition, and is only as trustworthy as the model behind it. Expected Shortfall addresses the tail blindness; stress testing addresses the model-risk gap; neither replaces genuine judgment about where a portfolio's fragility lies.

Risk is not a single number. VaR is a useful approximation of downside — a starting point, not an ending one. The next time you see a risk report, ask not just what the VaR is, but what happens after it.