Beyond credit: market, operational and interest-rate risk in the banking book

Two lenses regulators use:

• EVE (Economic Value of Equity): the present value of all assets minus liabilities. A rate shock that lowers EVE erodes net worth silently, no cash-flow event required.
• NII (Net Interest Income): the earnings view over the next 12 months.

A worked EVE example

Imagine a simplified bank with a single 10-year fixed-rate loan worth 100 (face) and a 1-year deposit funding it. Rates rise 200 basis points (2 percentage points). The rough price change on a fixed-rate instrument is:

The short deposit barely moves (duration near 1, so about -0.2). Net EVE hit: roughly -15.8 on a 100 asset base. If equity was 10, a 2% rate move just wiped out more than the entire capital cushion on paper.

That is why the Basel Committee on Banking Supervision (BCBS) sets a supervisory "outlier" test: if a standard rate shock reduces EVE by more than 15% of Tier 1 capital (the highest quality capital, mostly common equity), the bank flags for supervisory attention. In the EU this is enforced through the European Banking Authority (EBA) guidelines; in the US, the Federal Reserve and OCC (Office of the Comptroller of the Currency) supervise IRRBB through examinations rather than a hard formulaic charge.

The BCBS standards on IRRBB lay out the six prescribed rate shock scenarios (parallel up, parallel down, steepener, flattener, and two short-rate shocks).

The diligence check

Ask for the bank's EVE and NII sensitivity table under standard shocks. A well-run bank shows the impact of a +200bp and -200bp shift on both measures. Red flag: large negative EVE sensitivity combined with a heavy "held to maturity" bond book and a flighty deposit base. That was the SVB signature.

Market risk and the rogue trader problem

Market risk is the risk of loss on trading-book positions from moves in prices, rates, FX, equities, or commodities. Unlike IRRBB, this is marked to market daily, so losses show up fast.

The classic failure mode is concentration plus weak controls. In 2008, Jerome Kerviel at Societe Generale built unauthorized positions estimated near 50 billion euros, producing a loss of about 4.9 billion euros when unwound. In 2012, JPMorgan's "London Whale" lost an estimated 6.2 billion dollars on outsized credit derivative positions that breached internal risk limits. In both cases the trades were visible in the data; the controls failed to act.

How market risk capital works

Basel measures market risk two ways:

• Value at Risk (VaR): the maximum loss expected over a set horizon at a confidence level. "One-day 99% VaR of 10 million" means: on 99 of 100 days, losses should not exceed 10 million.
• Expected Shortfall (ES): the average loss in the worst tail beyond VaR. Basel's Fundamental Review of the Trading Book (FRTB) replaced VaR with ES because VaR ignores how bad the tail actually gets. FRTB implementation is rolling out across jurisdictions through the mid-2020s, with the EU applying it from January 2025 and the US finalizing its version of the Basel III "endgame" rules on a phased timeline.

VaR's blind spot: it says nothing about the day you breach it. A trader can sit comfortably inside VaR limits while building a position that detonates in the tail. That is exactly the Whale scenario.

The diligence check

• Review VaR backtesting: how many times did actual daily losses exceed the VaR estimate? More than a handful of "exceptions" per year (Basel's traffic-light system flags this) means the model understates risk.
• Check for limit breaches and how fast they were escalated. A culture where limits are "soft" is the warning sign, not the size of the book.

Operational risk: the loss category that finally got a capital charge

Operational risk is the risk of loss from failed internal processes, people, systems, or external events. Translation: fraud, cyberattacks, IT outages, mis-selling fines, and rogue trading itself.

For years this was the neglected risk. Then the losses piled up. Estimates put global conduct and litigation costs at banks in the hundreds of billions of dollars over the decade following 2008. Regulators responded.

Under Basel's Standardised Approach for Operational Risk (SA-OR), capital is driven by a Business Indicator (BI), a proxy for a bank's size and income, scaled up as the bank grows, and multiplied by an Internal Loss Multiplier that rises if the bank has a poor historical loss record. In plain terms: bigger banks and banks that lose more money to operational failures must hold more capital.

Concrete triggers you will recognize:

• IT outages: a payments system going dark for hours. UK banks have faced repeated multi-hour outages, and the UK's Financial Conduct Authority (FCA) has pushed operational resilience rules requiring firms to set "impact tolerances" for critical services.
• Cyber and fraud: the EU's Digital Operational Resilience Act (DORA), in force from January 2025, imposes strict ICT (information and communications technology) risk management and third-party (cloud vendor) oversight on financial firms.
• Conduct: fines for money laundering failures. Multiple global banks have paid penalties in the hundreds of millions to billions for AML (anti-money laundering) breaches.

The diligence check

Pull the operational loss database. Look at frequency and severity by category over five years. A rising trend in "external fraud" or "clients, products and business practices" (the Basel loss-event category covering mis-selling and legal settlements) tells you where the next fine may land. Then check third-party concentration: if one cloud provider underpins core banking, a single outage is now a capital-relevant event.

How the three fit together

These risks are not siloed. A rate shock (IRRBB) can force asset sales that crystallize market-risk losses, which may reveal an operational-risk control gap in how positions were valued. SVB was all three at once: interest-rate mismatch, a bond portfolio marked far below cost, and a supervisory-oversight failure. The bank held plenty of capital against credit risk. It held almost nothing against the risks that actually killed it.

Key takeaways

• IRRBB erodes net worth silently. A 200bp shock can gut a bank's economic value of equity with zero defaults. Always request the EVE and NII sensitivity table and check it against the 15% of Tier 1 outlier threshold.
• Market risk fails through controls, not just markets. Kerviel and the London Whale were data-visible; the escalation failed. In diligence, weight VaR backtesting exceptions and limit-breach culture over headline book size.
• Operational risk now carries real capital. Under the Basel Standardised Approach, past losses raise future capital via the Internal Loss Multiplier. DORA and FCA resilience rules make IT outages and cyber events regulatory, not just reputational.
• The books hide the risk. The gap between "held to maturity" accounting and market value is where danger accumulates. Read the banking book, not just the trading book.