Skip to main content

Value at Risk (VaR)

Updated Jun 24, 2026 at 2:35pm

Research Draft High 1,301 words

Value at Risk (VaR) is a single-number summary of downside risk: the maximum loss a portfolio is expected not to exceed over a fixed horizon at a chosen confidence level. A "1-day 95% VaR of $1M" means that on 95% of days the portfolio should lose less than $1M — and, equivalently, that a loss greater than $1M is expected roughly 1 day in 20. Its appeal is that it collapses an entire return distribution into one intuitive dollar figure comparable across desks and asset classes. Its core tension is also right there in the definition: VaR is a threshold, not the worst case. It says how often you cross the line, never how far past it you go — and that silence about the tail is the source of nearly every criticism leveled at it.

How it's calculated / formed

VaR has three inputs — a horizon (e.g. 1 day, 10 days), a confidence level (commonly 95% or 99%), and a return distribution — and three standard ways to estimate that distribution:

  • Parametric (variance-covariance / "delta-normal"). Assumes returns are normally distributed. VaR = V × z × σ, where V is portfolio value, σ is the portfolio standard deviation over the horizon, and z is the one-tailed normal quantile: 1.645 for 95%, 2.326 (~2.33) for 99% (Ryan O'Connell, CFA; fe.training). Fast and closed-form, but it inherits the thin tails of the normal distribution and assumes positions are roughly linear in their risk factors (it breaks for options).
  • Historical simulation. Re-prices the current portfolio against a window of actual past returns (e.g. the last 250–500 days), sorts the resulting P&L, and reads off the relevant percentile (the 5th-worst of 100 days for 95% VaR). Makes no distributional assumption, but is entirely captive to its lookback window — a calm window produces a calm VaR.
  • Monte Carlo simulation. Generates many random scenarios from an assumed (or fitted) model of the risk factors and reads VaR from the simulated loss distribution. The most flexible — it handles non-linear payoffs and fat-tailed assumptions — but the most computationally heavy, and only as good as the model fed into it.

Time scaling. Practitioners often compute 1-day VaR and scale it with the square-root-of-time rule: 10-day VaR ≈ 1-day VaR × √10 ≈ 3.16×. This is exact only if returns are i.i.d. with stable volatility; it understates risk when volatility clusters or returns are autocorrelated, which is the norm in stressed markets.

How it's used in practice

VaR is overwhelmingly an institutional tool. Banks, asset managers, and clearinghouses use it to set risk limits per desk, allocate capital, and report aggregate exposure to risk committees and regulators. Trading limits are frequently expressed in VaR ("this desk's limit is $5M 1-day 99% VaR"). Under Basel II/2.5 it sat at the core of market-risk regulatory capital, with the charge driven by 99% 10-day VaR plus a multiplier tied to backtest performance.

The companion discipline is backtesting: counting how often realized losses exceed the VaR estimate ("exceptions" or "breaches"). At 99% 1-day VaR over 250 trading days you expect 2.5 breaches; Basel's "traffic-light" framework (BCBS, 1996) flags a model green (≤4 exceptions, no penalty), yellow (5–9, an escalating capital-multiplier add-on at supervisory discretion), or red (≥10) to penalize underestimation. Backtesting is what keeps VaR honest — a model that never breaches is too conservative; one that breaches in clusters is mis-specified.

For an individual trader or a swing book, VaR is rarely the operational sizing tool — per-trade risk (the R-multiple / fixed-fractional approach in this branch's sizing nodes) is more direct. VaR earns its keep when you need one portfolio-level number that nets correlated positions together rather than summing standalone stop-losses.

Adoption, debate & evidence

VaR went from a J.P. Morgan internal metric to the global standard almost single-handedly through RiskMetrics, the methodology and free dataset J.P. Morgan published in 1994 (with Till Guldimann a central figure). Within years it was best practice at essentially every bank and was embedded in Basel rules.

That ubiquity coexists with serious, well-documented criticism:

  • It is not "coherent." Artzner, Delbaen, Eber & Heath (1997–99) defined the axioms a sound risk measure should satisfy; VaR violates subadditivity — combining two portfolios can produce a VaR larger than the sum of the parts, perversely penalizing diversification. (Parametric VaR under normality is the special case that happens to be subadditive.)
  • It is blind to the tail. Two portfolios with identical 99% VaR can have wildly different losses beyond the 99th percentile. VaR says nothing about severity once the threshold is crossed — Nassim Taleb's long-standing critique that VaR breeds false confidence about exactly the events that matter most.
  • It failed loudly in 2008. Empirical studies of the 2007–09 crisis found VaR models systematically understated risk going in and produced clustered breaches during the turmoil — a signature of model inadequacy, much of it traceable to the normality assumption and short lookback windows. A 2009 U.S. House hearing was literally titled around "the risks of financial modeling: VaR and the economic meltdown."

The regulatory response was decisive: under the Fundamental Review of the Trading Book (FRTB), Basel III replaced 99% VaR with 97.5% Expected Shortfall (ES / CVaR) for market-risk capital. Expected Shortfall — the average loss in the tail beyond VaR — is coherent (it is subadditive) and captures tail severity. The pivot was enabled partly by Rockafellar & Uryasev (2000) showing CVaR can be optimized efficiently. ES is the sibling concept; see this branch's drawdown and correlation/concentration nodes for the related portfolio-risk lenses.

Strengths & limitations

Strengths: one comparable, aggregatable number across instruments and desks; nets correlation rather than summing standalone risks; backtestable against a clear, falsifiable expected breach count; intuitive to non-quants.

Limitations: says nothing about how bad the tail is; non-coherent (can punish diversification); deeply sensitive to method and assumptions (normal vs. historical vs. simulated can disagree materially); historical and short-window versions are procyclical — low in calm regimes, spiking only after volatility has already arrived; square-root scaling understates multi-day risk in stressed, autocorrelated markets.

The single most common misuse: treating VaR as a worst-case loss ("we can't lose more than the VaR"). It is a frequency statement about a threshold, not a ceiling — losses beyond it are not only possible but expected at the stated rate, and can be arbitrarily large. Anyone managing real tail risk should pair VaR with Expected Shortfall and explicit stress testing.

Sources

Dispute flagged: VaR's status is genuinely contested — it is the historical industry standard yet has been formally superseded by Expected Shortfall in Basel III market-risk capital. Both views are represented above.