Stress testing and VaR: quantifying what could blow up

# Stress testing and VaR: quantifying what could blow up

On a single Monday in October 2008, the S&P 500 fell about 9%. Any risk model that had told a portfolio manager the day before "you will lose at most 3% tomorrow, 19 days out of 20" was not slightly wrong. It was catastrophically, reputationally wrong. That gap between what a model promises and what a real crisis delivers is the whole subject of this lesson.

We are going to run two tools on the same portfolio: Value at Risk (VaR) and a stress scenario. One will look precise and reassuring. The other will look crude and alarming. The crude one is closer to the truth.

What VaR actually claims

Value at Risk (VaR) answers one narrow question: over a given period, at a given confidence level, what is the most I expect to lose under normal market conditions?

A "95% one-day VaR of $2 million" means: on 19 days out of 20, losses should not exceed $2 million. It says nothing about the 20th day. That silence is the trap.

Three inputs define any VaR number:

• Horizon (one day, ten days).
• Confidence level (95%, 99%).
• Method (historical, parametric, or Monte Carlo).

Regulators lean on VaR heavily. Under the Basel framework (global banking rules set by the Basel Committee on Banking Supervision), banks long used 99% ten-day VaR for market risk capital. The newer FRTB (Fundamental Review of the Trading Book), now rolling into force across jurisdictions in 2025 to 2026, actually moves banks away from pure VaR toward Expected Shortfall (more on that below), precisely because VaR hides tail losses.

For asset managers in Europe, VaR is embedded in UCITS rules (Undertakings for Collective Investment in Transferable Securities, the EU retail fund framework). A UCITS fund using the "VaR approach" for leverage must respect a hard cap: absolute VaR is limited to 20% of net asset value over a 20-day horizon at 99% confidence. That is a real, enforceable number, per the European regulator ESMA (European Securities and Markets Authority) guidelines.

The worked example: a balanced portfolio

Take a simple $10 million balanced portfolio, as of a hypothetical 2026 date:

• $6 million in equities.
• $4 million in investment-grade bonds.

We will use the parametric (variance-covariance) method, the simplest VaR. It assumes returns follow a normal (bell curve) distribution.

Assume these estimates (illustrative, not live market data):

• Equity daily volatility: 1.2%.
• Bond daily volatility: 0.4%.
• Correlation between them: 0.2.

Step 1: dollar volatility of each sleeve.

• Equities: $6,000,000 × 1.2% = $72,000.
• Bonds: $4,000,000 × 0.4% = $16,000.

Step 2: portfolio volatility (combining with correlation ρ = 0.2):

Portfolio σ = √(72,000² + 16,000² + 2 × 0.2 × 72,000 × 16,000)

= √(5,184,000,000 + 256,000,000 + 460,800,000)

= √5,900,800,000

≈ $76,817.

Step 3: apply the 95% multiplier.

For a normal distribution, the 95% one-tailed cutoff is 1.645 standard deviations.

95% one-day VaR = 1.645 × $76,817 ≈ $126,000.

So the model says: on a normal day, you should not lose more than about $126,000, or 1.26% of the portfolio, 19 days out of 20.

Here is the same calculation in a few lines of Python:

import numpy as np

value = np.array([6_000_000, 4_000_000])   # equities, bonds
vol   = np.array([0.012, 0.004])           # daily volatility
corr  = np.array([[1.0, 0.2],
                  [0.2, 1.0]])

dollar_vol = value * vol
cov = np.outer(dollar_vol, dollar_vol) * corr
port_sigma = np.sqrt(cov.sum())

var_95 = 1.645 * port_sigma
print(f"Portfolio sigma: ${port_sigma:,.0f}")
print(f"95% 1-day VaR:   ${var_95:,.0f}")

Where VaR tells the truth

For day-to-day risk budgeting, VaR is genuinely useful. It lets a chief risk officer compare a long-only equity fund against a multi-asset fund on one scale. It flags when a trader has quietly doubled position size. It gives a defensible number to a client asking "how risky is my mandate?"

VaR is also honest about correlation in calm markets. That 0.2 equity-bond correlation lowered our risk number, and in normal times bonds really do cushion equity drawdowns.

Where VaR dangerously lies

Now the problem. VaR has three structural blind spots.

1. It ignores the size of tail losses. VaR tells you the threshold, not what lies beyond it. Losing $130,000 or losing $2 million both count as "a breach." The model shrugs at the difference. This is why FRTB and modern risk teams use Expected Shortfall (ES), also called Conditional VaR: the *average* loss on the days you breach VaR. ES answers "when it goes bad, how bad?"

2. It assumes a normal distribution. Real market returns have fat tails: extreme moves happen far more often than a bell curve predicts. A "6 standard deviation" event should be near-impossible under normality, yet markets produce them every few years.

3. Correlations break in a crisis. Our comforting 0.2 equity-bond correlation is a fair-weather number. In a liquidity panic, investors sell everything at once. Correlations jump toward 1. The diversification benefit that shrank our VaR evaporates exactly when you need it.

This last point is the assassin. The 2008 crisis, and the March 2020 COVID shock, both saw "uncorrelated" assets fall together.

Stress testing: the honest crude tool

A stress test throws out the statistics and asks a blunt question: if a specific bad scenario happened tomorrow, what would this portfolio lose? No probabilities, no bell curve. Just: apply the shock, revalue the book.

Two flavors:

• Historical scenario: replay a real crisis. "What if 2008 happened again?"
• Hypothetical scenario: invent a plausible shock. "Rates up 200 basis points and equities down 25%."

Let us run a 2008-style stress on our $10 million portfolio. During the worst of 2008, broad equities fell roughly 40% peak to trough, and even investment-grade credit sold off hard while correlations converged.

Illustrative stress assumptions:

• Equities: down 40%.
• Investment-grade bonds: down 8% (credit spreads widened; the flight-to-quality helped Treasuries but hurt corporate credit).

Stress loss:

• Equities: $6,000,000 × 40% = $2,400,000 loss.
• Bonds: $4,000,000 × 8% = $320,000 loss.
• Total: $2,720,000, or 27.2% of the portfolio.

Compare that to our 95% VaR of $126,000. The stress test reveals a potential loss over 21 times larger than the daily VaR headline. Same portfolio. Same day. Two numbers that live in different universes.

That is the lesson in one line: VaR measures the weather, stress testing prepares for the storm.

What regulators require

Stress testing is not optional decoration. It is written into law.

• In the US, the Federal Reserve runs CCAR (Comprehensive Capital Analysis and Review) and DFAST (Dodd-Frank Act Stress Test) on large banks, mandated by the Dodd-Frank Act of 2010. Firms must model losses under a severely adverse scenario the Fed publishes each year.
• In Europe, the European Banking Authority (EBA) runs EU-wide bank stress tests, and ESMA conducts stress tests on money market funds and central counterparties.
• For asset managers specifically, UCITS and AIFMD (Alternative Investment Fund Managers Directive, the EU framework for hedge funds, private equity, and real estate funds) require regular liquidity stress testing: can the fund meet redemptions if markets seize up? ESMA published detailed liquidity stress testing guidelines for funds that took effect in 2020 and remain the operating standard in 2026.

The March 2020 dash-for-cash, when several open-ended bond and property funds had to gate or suspend redemptions, made liquidity stress testing a front-line due-diligence check, not a compliance afterthought.

The due-diligence checklist

When you assess a manager's risk framework, ask:

1. Which VaR method, and which confidence level? A 95% VaR looks smaller than 99%. Always normalize before comparing managers.