Limits and escalation · RiskAtoms Academy

By the end you will be able to

1Design a limit structure from the board's appetite down to a desk, and explain what happens when a limit is breached.
2Name the main types of limit and what each one controls.
3Calculate limit utilisation and place it on an escalation ladder.
4Tell a good response to a breach from a bad one.

Why it matters

A limit that is breached and then quietly raised is not a limit. In early 2012 the London Whale's book broke all five of its major risk limits. The response was to question the limits and change the model, not to cut the position. The loss passed US$6 billion.

Core explanation

From appetite to the trading desk

The risk appetite (L2.3.05: Risk appetite frameworks) is set for the whole firm. But a trader in Hong Kong cannot check every trade against the group's capital ratio. So the appetite is broken down, or cascaded, into limits that each person can see and act on: group, business line, desk, and finally the individual trader or lending officer. Think of a household budget: the annual total is split into monthly amounts, then into food, rent and holidays, so you notice an overspend in March rather than in December.

Types of limit. No single measure catches every risk, so a desk usually has several:

Limit	What it caps	Example
Notional or exposure	Size of positions	No more than US$500m of bonds from one country
Sensitivity	Exposure to one market factor	DV01 of US$250,000 per basis point
Value at risk	Loss in normal markets at a confidence level	1-day 99% VaR of US$10m
Stress	Loss in a severe scenario	No more than US$80m in a 2008-style shock
Stop-loss	Losses already made	US$2m in a month for one trader
Concentration and counterparty	Exposure to one name, sector or country	8% of Tier 1 capital to one client group

Sort itWhich limit is it?

Match each rule to the type of limit.

The desk may not lose more than US$5m this quarter.
Total gross exposure to Bank X across all products: at most €300m.
A 1 basis point rise in yen rates may cost the desk at most ¥20m.
On 99% of days the desk should not lose more than US$8m.
No more than £200m face value of corporate bonds held.

Hard and soft limits. A hard limit cannot be exceeded without approval in advance; trading systems often block the order. A soft limit can be exceeded briefly, but triggers immediate notification. The board's appetite limits and regulatory limits are hard; many desk limits are soft, so the desk can serve a client on a busy day and reduce afterwards.

Escalation. When usage rises, more senior people must be told and must decide. A typical ladder, used throughout this lesson:

ExploreAn escalation ladder

Click each step to see who is told and what happens.

Within limit

Business as usual. Market risk reports usage daily.

A good breach process

Detect: risk systems flag the breach, ideally the same day.
Notify: the people on the ladder are told, in writing.
Decide: cut or hedge the position, or approve a temporary excess with a deadline.
Record: log the breach, its size, cause and resolution in the breach register.
Learn: report patterns to the risk committee; repeated breaches by one desk can affect pay (L2.3.08: Risk culture and incentives).

Not every breach is bad behaviour. A passive breach happens when markets move or a model is updated and the same position suddenly measures as riskier. It must still be escalated and resolved, but it says something different from a trader deliberately adding risk over the limit.

The formal version

Limit use is a percentage (M-A01: Percentages), shown in full:

\text{utilisation} = \frac{\text{current usage}}{\text{limit}} \times 100\%

The escalation level depends on utilisation and on how long the breach has lasted. On this page's ladder: at least 80% is an early warning; above 100% is a breach; above 110%, or a breach lasting more than 3 days, goes to the CRO; above 125% goes to the CEO and the board risk committee. Real firms set their own levels.

Try it

Step through ten days on a desk with a US$10m VaR limit. Watch the gauge and who is told. On day 6, you decide how to respond to a breach; then follow the consequences. Try all three choices.

Try itTen days on the euro rates desk

Day 1: VaR US$6.2m / limit US$10.0m

Level 0: Within limit

Who is told: Desk.

Business as usual. Market risk reports usage daily.

Worked example

Cascading a VaR limit to three desks

A trading business has a VaR limit of US$40m, split across three desks. Today the business's diversified VaR is US$31m.

Check the limit structure

Step 1 of 4

1
Business utilisation
US$31m ÷ US$40m = 77.5%: within limit, below the 80% early warning.

Regulatory lens

Supervisors expect limits that follow from the board's appetite and a documented escalation process (FSB risk appetite principles, 2013; BCBS governance principles, 2015). The Basel market risk standard (2019) requires each trading desk to have a clear strategy and its own risk limits. Some limits are rules in their own right: the Basel large exposures standard caps exposure to one counterparty at 25% of Tier 1 capital. In the US, the SEC's market access rule (Rule 15c3-5, 2010) requires broker-dealers to have pre-trade controls that block orders breaching credit and capital thresholds. The detail of market risk limits and capital returns in Level 4: Regulation, Capital & Accounting.

Sparks

Spark45 minutes without a hard limit

On 1 August 2012, faulty trading software at Knight Capital sent millions of unintended orders into US stock markets in about 45 minutes. The SEC later found the firm lacked adequate pre-trade controls under the market access rule; Knight lost more than US$460 million and agreed to a takeover before the year was out.

SparkBreaches without trades

When volatility jumps, as in March 2020, VaR rises on positions that have not changed. Many desks can breach at once without a single new trade. That is why escalation rules separate passive breaches from active ones, and why a sensible temporary excess can be better than selling into a falling market.

Key takeaways

Limits cascade the board's appetite down to businesses, desks and individuals, so everyone can see their share.
Use several limit types together: notional, sensitivity, VaR, stress, stop-loss, concentration and counterparty.
Utilisation = usage ÷ limit. Early warnings (often around 80%) give time to act before a breach.
A breach must be detected, notified, decided (cut, hedge or a temporary excess with a deadline), recorded and learned from.
VaR limits do not add up because of diversification; notional limits do.
Raising a limit to make a breach disappear is limit creep, a classic sign of weak governance.

Reaction

Check what stuck

Glossary

Limit: A ceiling on a measure of risk, set in advance by someone with the authority to do so.
Utilisation: How much of a limit is in use: current usage divided by the limit.
Hard limit: A limit that may not be exceeded at all without prior approval; systems often block trades that would breach it.
Soft limit: A limit that can be exceeded briefly, but only with prompt notification and approval.
Passive breach: A breach caused by market moves or model changes rather than new risk-taking.
Temporary excess: Permission, from someone with the authority, to stay above a limit for a set time while the position is reduced.
Value at risk (VaR): Value at risk: a loss a portfolio is not expected to exceed over a set horizon at a given confidence level.
DV01: The change in a position's value for a one basis point (0.01%) move in interest rates.
Stop-loss limit: A limit on cumulative losses over a period; when reached, the position must be cut or reviewed.

Deep Dives & Origins

Deep Dives

Hull, J., Risk Management and Financial Institutions, 6th edition, Wiley, 2023, chapters on market risk measures and trading limits. Intermediate.
US Senate Permanent Subcommittee on Investigations, JPMorgan Chase Whale Trades: A Case History of Derivatives Risks and Abuses, March 2013, chapter on disregarding risk limits. Intermediate.

Origins

Financial Stability Board, Principles for an Effective Risk Appetite Framework, November 2013.
Basel Committee on Banking Supervision, Minimum capital requirements for market risk, BIS, January 2019.
Basel Committee on Banking Supervision, Supervisory framework for measuring and controlling large exposures, BIS, April 2014.
US Securities and Exchange Commission, “SEC Charges Knight Capital With Violations of Market Access Rule”, press release 2013-222, 16 October 2013.
US Senate Permanent Subcommittee on Investigations, JPMorgan Chase Whale Trades, March 2013.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 10-minute video will sit here, made from this page's script.