Capital at risk is the amount of money a firm or portfolio could lose from unexpected adverse events over a defined time period, measured at a chosen statistical confidence level. It is not the maximum theoretical loss, and it is not the routine loss a business already prices into its products. It is the realistic worst case at, say, a 99% confidence level over one day or one year, and it tells risk managers and regulators how much protective capital to hold behind the position.
A bank holding $500 million in assets does not need to guard against losing all of it overnight. It does need a defensible number for what an adverse but plausible scenario would cost. Capital at risk gives that number a common definition so that firms, supervisors, and boards can talk about the same thing.
The Three Inputs Behind Any CaR Figure
Every capital at risk calculation rests on three choices.
The first is a time horizon. A bank’s trading desk might use a single day. An insurer modeling catastrophe exposure typically uses a full year. The horizon has to match how quickly the firm could realistically respond to losses.
The second is a confidence level, usually 95% or 99%. This sets the statistical threshold: at 99%, the CaR figure is the loss that should be exceeded on no more than 1% of days (or years, depending on horizon).
The third is the metric at risk. Portfolio market value is the most common, but not the only option. Earnings at Risk estimates the potential hit to net income over a defined period, which matters more to corporations focused on income-statement stability. Cash Flow at Risk does the same for projected cash flows, which is critical for treasury operations managing liquidity. A manufacturer with large foreign-currency receivables may care less about market value swings than about the chance that exchange rate moves cut next quarter’s cash receipts by 15%.
CaR targets the tail of the loss distribution. Expected losses (the borrowers who will default, the claims that will be filed) get priced into products and covered by reserves. CaR addresses the low-probability, high-severity outcomes that could threaten solvency if capital does not stand behind them.
How Capital at Risk Is Measured
The primary tool for quantifying CaR is Value at Risk. A VaR figure states the maximum expected loss over a set time period at a given confidence level. If a portfolio has a one-day 99% VaR of $10 million, there is only a 1% chance the portfolio loses more than $10 million on any given day. That $10 million is the CaR the firm needs to cover.
Three methodologies dominate VaR calculation, each with real tradeoffs.
Historical Simulation
Historical simulation takes actual past returns and replays them against the current portfolio. With 250 trading days of data, you generate 250 hypothetical profit-and-loss outcomes and pick the loss at your chosen percentile. The approach makes no assumption about how returns are distributed, which makes it intuitive. Its weakness is that the past may not represent the future. A look-back window that excludes a major crisis will understate tail risk; one that includes a once-in-a-century crash may overstate it.
Parametric (Variance-Covariance) Method
The parametric method assumes returns follow a normal distribution and uses the portfolio’s mean return, standard deviation, and asset correlations to compute VaR through a closed-form equation. It is fast and cheap to run. The problem is that real financial returns produce extreme moves more often than a normal distribution predicts. Those fat tails mean the parametric method can underestimate losses precisely when accuracy matters most.
Monte Carlo Simulation
Monte Carlo simulation generates thousands or tens of thousands of hypothetical future scenarios by sampling from assumed probability distributions. Running the current portfolio through each scenario produces a full distribution of possible outcomes, and the VaR is read from the appropriate percentile. It handles complexity well, including non-linear instruments like options and structured products. The cost is computational intensity and heavy sensitivity to the assumptions baked into the scenario generation.
Where VaR Falls Short
VaR is the industry workhorse, and it has blind spots that anyone using CaR should understand.
The most dangerous one is that VaR tells you nothing about the size of losses beyond the threshold. A 99% VaR of $10 million says there is a 1% chance of losing more than $10 million. It does not say whether the tail loss is $11 million or $200 million. Two portfolios with identical VaR figures can have radically different tail-risk profiles.
VaR also fails a mathematical property called subadditivity. Combining two portfolios can sometimes produce a VaR higher than the sum of the individual VaRs, which penalizes diversification. A coherent risk measure should show that merging portfolios reduces or at worst maintains total risk. VaR does not guarantee that.
Expected Shortfall
Expected Shortfall, also called Conditional VaR or Tail VaR, addresses both problems. Instead of reporting the threshold loss at a given confidence level, ES reports the average loss in all scenarios that exceed the threshold. If the 99% VaR is $10 million and the average of all losses beyond that point is $18 million, the ES is $18 million. One number captures how bad things get in the tail, not just where the tail begins.
The Basel Committee recognized this advantage in its Fundamental Review of the Trading Book. For banks using internal models, the primary market risk capital metric is now Expected Shortfall calculated at a 97.5% confidence level on a daily basis, replacing the earlier 99% VaR standard.1Bank for International Settlements. MAR33 – Internal Models Approach: Capital Requirements Calculation
Stress Testing
Probabilistic models like VaR and ES estimate risk under relatively normal conditions. Stress testing asks a different question: what happens under a specific extreme scenario, such as a 40% equity crash combined with a credit freeze? The weakness of traditional stress testing is that the scenarios carry no probability, so a risk manager seeing a $500 million stress loss has no way to judge how seriously to take it. Current best practice assigns probabilities to stress scenarios and folds them into the same risk framework as VaR and ES, producing a single consistent set of estimates rather than two competing views.
Backtesting: Checking That the Model Works
A CaR model is only useful if its predictions hold up in practice. Backtesting compares the model’s daily VaR predictions against actual trading outcomes over a rolling 250-day window. On a 99% VaR model, you would expect roughly 2.5 exceptions per year (days when actual losses exceed the VaR prediction). If exceptions pile up, the model is underestimating risk.
The Bank for International Settlements sets explicit supervisory thresholds for backtesting results:2Bank for International Settlements. MAR32 – Internal Models Approach: Backtesting and P&L Attribution Test Requirements
- Green zone (0–4 exceptions): the model is performing as expected, and there is no supervisory increase in capital requirements.
- Amber zone (5–9 exceptions): results suggest possible model inaccuracy, and the bank may face a capital surcharge.
- Red zone (10 or more exceptions): almost certainly indicates a flawed model, and supervisory intervention follows.
Four exceptions over 250 trading days is the maximum a bank can sustain without its model’s reliability coming into question.
From CaR to Required Capital in Banking
Capital at risk feeds two related but distinct concepts. Economic capital is a firm’s own internal estimate of the capital it needs to absorb losses at its chosen confidence level. Regulatory capital is the minimum buffer that government agencies require, calculated under standardized rules. Economic capital often exceeds regulatory minimums, because internal models can be more conservative and because management may target a higher confidence level than the regulatory floor.
Under Basel III, the international banking standard, all banks must hold Common Equity Tier 1 capital of at least 4.5% of risk-weighted assets, with total Tier 1 capital at 6% and overall capital at 8%.3Bank for International Settlements. Definition of Capital in Basel III – Executive Summary In the United States, the Federal Reserve layers additional requirements on top. Large bank holding companies with $100 billion or more in assets face a stress capital buffer of at least 2.5%, and global systemically important banks carry a surcharge of at least 1.0% above that.4Federal Reserve Board. Annual Large Bank Capital Requirements
The Federal Reserve has continued to refine how systemic risk is measured, with proposals in 2026 aimed at modernizing the framework for determining additional capital requirements for the largest and most complex banks.5Federal Reserve Board. Agencies Request Comment on Proposals to Modernize the Regulatory Capital Framework and Maintain the Strength of the Banking System
Trading desks operate under daily VaR limits that function as real-time CaR guardrails. A desk assigned a $25 million daily VaR limit must reduce positions if its calculated risk approaches that ceiling. Breaching the limit triggers immediate de-risking, and repeated breaches lead to tighter limits or management review.
From CaR to Required Capital in Insurance
Insurance is where CaR has some of its most direct consequences, because the stakes are policyholder protection. An insurer that underestimates its capital needs cannot cover claims when a catastrophe hits.
The U.S. Risk-Based Capital Framework
The National Association of Insurance Commissioners developed the Risk-Based Capital framework in 1992, requiring insurers to hold capital proportional to their risk across four categories: asset risk, insurance (underwriting) risk, interest rate risk, and business risk.6NAIC. Risk-Based Capital Preamble The formula produces an Authorized Control Level, and regulators measure an insurer’s actual capital as a ratio against that level.
When capital drops below defined thresholds, regulators escalate:
- Company Action Level (200% of Authorized Control Level): the insurer must submit a corrective action plan.
- Regulatory Action Level (150%): the state regulator can issue orders to correct the deficiency.
- Authorized Control Level (100%): the regulator may place the company under control.
- Mandatory Control Level (70%): the regulator is required to take control of the company.
These are not theoretical thresholds. Dropping below 200% of the Authorized Control Level puts an insurer on a regulatory clock, and at 70% the state takes over regardless of management’s plans.
The European Solvency II Framework
Europe’s Solvency II directive takes a more explicitly probabilistic approach. Insurers must calculate a Solvency Capital Requirement based on the economic capital needed at a 0.5% ruin probability over one year, which translates to a 99.5% VaR confidence level.7NAIC. Solvency II – Country Comparison Analysis The standard model covers underwriting risk (life, non-life, and health), market risk, credit risk, and operational risk. It does not cover strategic risk, liquidity risk, or reputational risk.
CaR, Total Exposure, and Economic Capital
These three numbers get confused, and the differences matter.
Total exposure is the maximum theoretically possible loss. For a $100 million bond portfolio, the total exposure is $100 million: complete default with zero recovery. That number is real but not useful for capital planning, because it assumes a scenario so extreme it has no meaningful probability.
Capital at risk narrows the focus to a statistically grounded figure. The same $100 million portfolio might have a one-year 99% CaR of $15 million, meaning there is only a 1% chance losses exceed $15 million. This is the number that drives actual capital decisions: how much money to set aside, how much risk each business unit can take on, and whether a new venture earns enough to justify its capital consumption.
Economic capital is the amount a firm actually decides to hold against measured CaR. A conservative firm might hold capital equal to 120% of its calculated CaR. A firm operating closer to regulatory minimums might hold exactly the required amount and no more. The gap between CaR measurement and capital held against it reflects management’s risk appetite and the board’s tolerance for near-miss scenarios.