Stress testing and VaR: quantifying what could blow up

For asset managers in Europe, VaR is embedded in UCITS rules (Undertakings for Collective Investment in Transferable Securities, the EU retail fund framework). A UCITS fund using the "VaR approach" for leverage must respect a hard cap: absolute VaR is limited to 20% of net asset value over a 20-day horizon at 99% confidence. That is a real, enforceable number, per the European regulator ESMA (European Securities and Markets Authority) guidelines.

The worked example: a balanced portfolio

Take a simple $10 million balanced portfolio, as of a hypothetical 2026 date:

• $6 million in equities.
• $4 million in investment-grade bonds.

We will use the parametric (variance-covariance) method, the simplest VaR. It assumes returns follow a normal (bell curve) distribution.

Assume these estimates (illustrative, not live market data):

• Equity daily volatility: 1.2%.
• Bond daily volatility: 0.4%.
• Correlation between them: 0.2.

Step 1: dollar volatility of each sleeve.

• Equities: $6,000,000 × 1.2% = $72,000.
• Bonds: $4,000,000 × 0.4% = $16,000.

Step 2: portfolio volatility (combining with correlation ρ = 0.2):

Portfolio σ = √(72,000² + 16,000² + 2 × 0.2 × 72,000 × 16,000)

= √(5,184,000,000 + 256,000,000 + 460,800,000)

= √5,900,800,000

≈ $76,817.

Step 3: apply the 95% multiplier.

For a normal distribution, the 95% one-tailed cutoff is 1.645 standard deviations.

95% one-day VaR = 1.645 × $76,817 ≈ $126,000.

So the model says: on a normal day, you should not lose more than about $126,000, or 1.26% of the portfolio, 19 days out of 20.

Here is the same calculation in a few lines of Python:

Where VaR tells the truth

For day-to-day risk budgeting, VaR is genuinely useful. It lets a chief risk officer compare a long-only equity fund against a multi-asset fund on one scale. It flags when a trader has quietly doubled position size. It gives a defensible number to a client asking "how risky is my mandate?"

VaR is also honest about correlation in calm markets. That 0.2 equity-bond correlation lowered our risk number, and in normal times bonds really do cushion equity drawdowns.

Where VaR dangerously lies

Now the problem. VaR has three structural blind spots.

1. It ignores the size of tail losses. VaR tells you the threshold, not what lies beyond it. Losing $130,000 or losing $2 million both count as "a breach." The model shrugs at the difference. This is why FRTB and modern risk teams use Expected Shortfall (ES), also called Conditional VaR: the *average* loss on the days you breach VaR. ES answers "when it goes bad, how bad?"

2. It assumes a normal distribution. Real market returns have fat tails: extreme moves happen far more often than a bell curve predicts. A "6 standard deviation" event should be near-impossible under normality, yet markets produce them every few years.

3. Correlations break in a crisis. Our comforting 0.2 equity-bond correlation is a fair-weather number. In a liquidity panic, investors sell everything at once. Correlations jump toward 1. The diversification benefit that shrank our VaR evaporates exactly when you need it.

This last point is the assassin. The 2008 crisis, and the March 2020 COVID shock, both saw "uncorrelated" assets fall together.

Stress testing: the honest crude tool

A stress test throws out the statistics and asks a blunt question: if a specific bad scenario happened tomorrow, what would this portfolio lose? No probabilities, no bell curve. Just: apply the shock, revalue the book.

Two flavors:

• Historical scenario: replay a real crisis. "What if 2008 happened again?"
• Hypothetical scenario: invent a plausible shock. "Rates up 200 basis points and equities down 25%."

Let us run a 2008-style stress on our $10 million portfolio. During the worst of 2008, broad equities fell roughly 40% peak to trough, and even investment-grade credit sold off hard while correlations converged.

Illustrative stress assumptions:

• Equities: down 40%.
• Investment-grade bonds: down 8% (credit spreads widened; the flight-to-quality helped Treasuries but hurt corporate credit).

Stress loss:

• Equities: $6,000,000 × 40% = $2,400,000 loss.
• Bonds: $4,000,000 × 8% = $320,000 loss.
• Total: $2,720,000, or 27.2% of the portfolio.

Compare that to our 95% VaR of $126,000. The stress test reveals a potential loss over 21 times larger than the daily VaR headline. Same portfolio. Same day. Two numbers that live in different universes.

That is the lesson in one line: VaR measures the weather, stress testing prepares for the storm.

What regulators require

Stress testing is not optional decoration. It is written into law.

• In the US, the Federal Reserve runs CCAR (Comprehensive Capital Analysis and Review) and DFAST (Dodd-Frank Act Stress Test) on large banks, mandated by the Dodd-Frank Act of 2010. Firms must model losses under a severely adverse scenario the Fed publishes each year.
• In Europe, the European Banking Authority (EBA) runs EU-wide bank stress tests, and ESMA conducts stress tests on money market funds and central counterparties.
• For asset managers specifically, UCITS and AIFMD (Alternative Investment Fund Managers Directive, the EU framework for hedge funds, private equity, and real estate funds) require regular liquidity stress testing: can the fund meet redemptions if markets seize up? ESMA published detailed liquidity stress testing guidelines for funds that took effect in 2020 and remain the operating standard in 2026.

The March 2020 dash-for-cash, when several open-ended bond and property funds had to gate or suspend redemptions, made liquidity stress testing a front-line due-diligence check, not a compliance afterthought.

The due-diligence checklist

When you assess a manager's risk framework, ask:

1. Which VaR method, and which confidence level? A 95% VaR looks smaller than 99%. Always normalize before comparing managers.

2. Do they report Expected Shortfall, not just VaR? ES-aware teams take tails seriously.

3. How often is VaR backtested? A model that breaches its 99% VaR far more than 1% of days is broken. Basel's "traffic light" backtesting scheme flags exactly this.

4. What scenarios are in the stress library, and how correlated do they assume assets stay? Beware anyone still trusting fair-weather correlations.

5. Is liquidity stressed separately? Losing 27% on paper is survivable. Being unable to sell to meet redemptions is fatal.

Key Takeaways

• VaR quantifies normal-day risk, not crisis risk. Our balanced portfolio showed a 95% one-day VaR of about $126,000 but a 2008-style stress loss of about $2,720,000: a 21x gap on the same book.
• VaR's three lies are tail blindness, the normal-distribution assumption, and fair-weather correlations. Expected Shortfall fixes the first; stress testing addresses all three.
• Regulators no longer trust VaR alone. FRTB shifts banks to Expected Shortfall, and Dodd-Frank (US), the EBA (EU), and ESMA (funds) mandate explicit stress and liquidity testing.
• In due diligence, always normalize confidence levels, demand backtesting evidence, and check that liquidity is stressed independently. A precise-looking VaR number is a warning sign, not a comfort, if no stress scenario sits beside it.