Capital at Risk is the amount a firm or portfolio could lose from unexpected adverse events over a defined period, stated at a chosen statistical confidence level. It is the number risk managers use to size the protective capital a business should hold against tail-risk scenarios, and it is measured mainly through Value at Risk, Expected Shortfall, and related simulation techniques. A bank with $500 million in assets does not need to guard against losing all of it overnight, but it does need a defensible figure for the realistic worst case, and Capital at Risk supplies that figure.
What Capital at Risk Measures
Capital at Risk focuses on unexpected losses, not the routine losses a business already budgets for. Lenders expect some borrowers to default. Insurers expect some claims. Those expected losses get priced into products and absorbed by reserves. Capital at Risk targets the tail of the distribution: low-probability, high-severity outcomes that could threaten solvency if capital does not stand behind them.
Any Capital at Risk calculation rests on three inputs:
- A time horizon. This might be a single trading day for a bank’s trading desk or a full year for an insurer’s catastrophe modeling.
- A confidence level, typically 95% or 99%, which sets how extreme the loss scenario has to be before it falls outside the estimate.
- The metric at risk, whether that’s portfolio market value, annual earnings, or projected cash flows.
Change any of those inputs and the number changes. A one-day 99% figure and a one-year 95% figure are describing very different things about the same portfolio.
How Capital at Risk Is Measured
The primary tool for quantifying Capital at Risk is Value at Risk (VaR). A VaR figure states the maximum expected loss over a set period at a given confidence level. If a portfolio has a one-day 99% VaR of $10 million, there is only a 1% chance the portfolio loses more than $10 million on any given day. That $10 million is the Capital at Risk the firm needs to cover.
Three methodologies dominate VaR calculation, and each carries real tradeoffs.
Historical Simulation
Historical simulation replays actual past returns against the current portfolio. With 250 trading days of data, you generate 250 hypothetical profit-and-loss outcomes and pick the loss at your chosen percentile. The approach requires no assumptions about how returns are distributed, which makes it intuitive. The weakness is that the past may not represent the future. A look-back window that excludes a major crisis will understate tail risk; one that includes a once-in-a-century crash may overstate it.
Parametric (Variance-Covariance) Method
The parametric method assumes returns follow a normal distribution and uses the portfolio’s mean return, standard deviation, and asset correlations to compute VaR through a closed-form equation. Fast and computationally cheap. The problem is that real financial returns produce extreme moves more frequently than a normal distribution predicts, and those fat tails cause the parametric method to underestimate losses precisely when accuracy matters most.
Monte Carlo Simulation
Monte Carlo simulation generates thousands of hypothetical future scenarios by sampling from assumed probability distributions. Running the current portfolio through each scenario produces a full distribution of possible outcomes, and the VaR is read from the appropriate percentile. This method handles complex instruments like options and structured products well. The cost is computational intensity and heavy sensitivity to the assumptions baked into scenario generation.
Earnings at Risk and Cash Flow at Risk
Not every organization measures risk in terms of portfolio market value. Earnings at Risk (EaR) estimates the potential hit to net income over a defined period, which matters more to corporations focused on income-statement stability. Cash Flow at Risk (CFaR) does the same for projected cash flows, which is critical for treasury operations managing short-term liquidity. A manufacturer with large foreign-currency receivables might care less about the market value of a derivatives book than about the chance that exchange rate moves cut next quarter’s cash receipts by 15%.
Where Value at Risk Falls Short
VaR is the industry workhorse, but it has blind spots. The most important one: VaR tells you nothing about the size of losses beyond the threshold. A 99% VaR of $10 million says there is a 1% chance you lose more than $10 million. It does not say whether that tail loss is $11 million or $200 million. Two portfolios with identical VaR figures can have radically different tail-risk profiles.
VaR also fails a mathematical property called subadditivity. Combining two portfolios can sometimes produce a VaR higher than the sum of the individual VaRs, which penalizes diversification and creates perverse incentives for risk reporting. A coherent risk measure should always show that merging portfolios reduces or at worst maintains total risk. VaR does not guarantee that.
Expected Shortfall
Expected Shortfall (ES), also called Conditional VaR or Tail VaR, addresses both weaknesses. Instead of reporting the threshold loss at a given confidence level, ES reports the average loss in all scenarios that exceed the threshold. If the 99% VaR is $10 million and the average of all losses beyond that point is $18 million, the ES is $18 million. One number captures how bad things get in the tail, not just where the tail begins.
The Basel Committee recognized this advantage in its Fundamental Review of the Trading Book. For banks using internal models, the primary market risk capital metric is now Expected Shortfall calculated at a 97.5% confidence level on a daily basis, replacing the earlier 99% VaR standard.1Bank for International Settlements. MAR33 – Internal Models Approach: Capital Requirements Calculation
Stress Testing
Probabilistic models like VaR and ES estimate risk under relatively normal conditions. Stress testing asks a different question: what happens under a specific extreme scenario, such as a 40% equity crash combined with a credit freeze? The weakness of traditional stress testing is that the scenarios carry no probability, so a risk manager seeing a $500 million stress loss has no way to judge how seriously to take it. Current best practice assigns probabilities to stress scenarios and folds them into the same risk framework as VaR and ES, giving one consistent set of estimates rather than two competing views.
From Measurement to Capital Held
A Capital at Risk figure is only useful if it drives how much capital the firm actually holds. Two related concepts translate the measurement into a dollar amount on the balance sheet.
Economic capital is a firm’s own internal estimate of the capital it needs to absorb losses at its chosen confidence level. Banks build proprietary models for this, factoring in correlations between risks that simplified regulatory formulas may miss. Regulatory capital is the minimum buffer that government agencies require, calculated under standardized rules. Economic capital often exceeds regulatory minimums because internal models can be more conservative, and because management may target a higher confidence level than the regulatory floor.
Banking: Basel III and U.S. Overlays
Under Basel III, all banks must hold Common Equity Tier 1 capital of at least 4.5% of risk-weighted assets, with total Tier 1 capital at 6% and overall capital at 8%.2Bank for International Settlements. Definition of Capital in Basel III – Executive Summary In the United States, the Federal Reserve layers additional requirements on top. Large bank holding companies with $100 billion or more in assets face a stress capital buffer of at least 2.5%, and global systemically important banks carry a surcharge of at least 1.0% above that.3Federal Reserve Board. Annual Large Bank Capital Requirements
Insurance: Risk-Based Capital in the U.S.
The National Association of Insurance Commissioners developed the Risk-Based Capital framework in 1992, requiring insurers to hold capital proportional to their risk across four categories: asset risk, insurance (underwriting) risk, interest rate risk, and business risk.4NAIC. Risk-Based Capital Preamble The formula produces an Authorized Control Level, and regulators measure actual capital as a ratio against that level. When capital drops below defined thresholds, regulators escalate:
- Company Action Level, at 200% of Authorized Control Level: the insurer must submit a corrective action plan.
- Regulatory Action Level, at 150%: the state regulator can issue orders to correct the deficiency.
- Authorized Control Level, at 100%: the regulator may place the company under control.
- Mandatory Control Level, at 70%: the regulator is required to take control.
These are not theoretical thresholds. Dropping below 200% puts an insurer on a regulatory clock, and at 70% the state takes over regardless of management’s plans.
Insurance: Solvency II
Europe’s Solvency II directive takes a more explicitly probabilistic approach. Insurers must calculate a Solvency Capital Requirement based on the economic capital needed at a 0.5% ruin probability over one year, which translates to a 99.5% VaR confidence level.5NAIC. Solvency II – Country Comparison Analysis The standard model covers underwriting risk (life, non-life, and health), market risk, credit risk, and operational risk. It does not cover strategic risk, liquidity risk, or reputational risk.
How Firms Confirm the Measurement Works
A Capital at Risk model is only useful if its predictions hold up. Backtesting compares the model’s daily VaR predictions against actual trading outcomes over a rolling 250-day window. On a 99% VaR model, you would expect roughly 2.5 exceptions per year, meaning days when actual losses exceed the VaR prediction. If exceptions pile up, the model is underestimating risk.
The Bank for International Settlements sets explicit supervisory thresholds for backtesting results:6Bank for International Settlements. MAR32 – Internal Models Approach: Backtesting and P&L Attribution Test Requirements
- Green zone, 0 to 4 exceptions: the model is performing as expected, and no supervisory increase in capital requirements applies.
- Amber zone, 5 to 9 exceptions: results suggest possible model inaccuracy, and the bank may face a capital surcharge.
- Red zone, 10 or more exceptions: almost certainly a flawed model, and supervisory intervention follows.
Four exceptions over 250 trading days is the maximum a bank can sustain without its model’s reliability coming into question. The framework gives firms a concrete standard rather than leaving model validation to judgment.
Capital at Risk Is Not Total Exposure
Total exposure is the maximum theoretically possible loss. For a $100 million bond portfolio, the total exposure is $100 million, representing complete default with zero recovery. That figure is real but not useful for capital planning, because it assumes a scenario so extreme it has no meaningful probability.
Capital at Risk narrows the focus to a statistically grounded figure. The same $100 million portfolio might have a one-year 99% Capital at Risk of $15 million, meaning there is only a 1% chance that losses exceed $15 million. That is the number that drives actual capital allocation decisions: how much money to set aside, how much risk each business unit can take on, and whether a new venture earns enough to justify its capital consumption. Economic capital is then what the firm actually decides to hold against the measured Capital at Risk. A conservative firm might hold 120% of its calculated figure. A firm operating closer to regulatory minimums might hold exactly what is required and no more. The gap between the measurement and the capital held against it reflects management’s risk appetite and the board’s tolerance for near-miss scenarios.