Market Risk Limit Framework Template (VaR, ES, Stop-Loss)

Market Risk Limit Framework: [Bank or trading entity name]

The framework that turns the board's market risk appetite into a hierarchy of trading limits, defines every limit metric (value at risk, expected shortfall, stressed value at risk, sensitivities, notional and stop-loss), explains how limits are calibrated, and sets out how utilisation is monitored and how excesses and breaches are escalated and closed. It is written for a bank with a trading book under Regulation (EU) No 575/2013 (CRR, as amended by Regulation (EU) 2024/1623, "CRR3"), with references to the Basel Framework market risk standard (MAR, cited by chapter ID and name only) and to the UK and US positions as of 2026-10. Replace every [bracketed] value and every row marked Example. The worked example is the trading book of the fictional Fernhollow Bank (EUR, reference date 2026-09-30). This is a document format, not financial, regulatory, legal or accounting advice. Obtain the regulation or standard for the normative text.

Document control

Approvals

Revision history

Contents

• 1. Purpose, scope and regulatory basis
• 2. Roles and responsibilities
• 3. Trading book boundary and desk structure
• 4. Limit hierarchy
• 5. Metric definitions
• 6. Limit calibration method
• 7. Limit schedule
• 8. Measurement, monitoring and reporting
• 9. Early warnings, excesses and breaches
• 10. Temporary increases, new limits and delegated authority
• 11. Stop-loss and drawdown management
• 12. Regulatory status and transition
• 13. Model dependencies, review and assurance
• 14. Glossary and references
• Standard and licence note

1. Purpose, scope and regulatory basis

This framework sets the limits that keep the market risk of the trading book inside the board's risk appetite. It translates one qualitative statement and a small number of board-level metrics into limits that a trader, a desk head and a risk manager can check every day. It also fixes what happens when a limit is approached or exceeded, so that escalation does not depend on individual judgement in a stressful moment.

The framework covers all positions held with trading intent or to hedge positions held with trading intent, as defined by the trading book boundary in section 3. It applies to every legal entity in the prudential consolidation group that books trading positions. Interest rate risk arising from non-trading activities is limited under the IRRBB policy, counterparty credit risk on derivatives under the credit risk framework, and credit valuation adjustment risk under its own limit set. Where a position moves between books, the reclassification rules in section 3 apply before any limit consequence is assessed.

The legal basis in the EU is the CRR. Articles 102 to 104 set the requirements for the trading book, its management and the inclusion of positions; the own funds requirements for market risk sit in Part Three, Title IV. The bank currently calculates own funds for market risk under [the standardised approach / an internal model approved under Part Three, Title IV, Chapter 5]. The revised market risk framework introduced by CRR2 and CRR3 (often called FRTB, the Fundamental Review of the Trading Book) has a deferred application date, explained in section 12. Supervisory expectations on trading book governance in the Basel Framework are found in the MAR standard, cited here by chapter only: MAR11 (Definitions and application of market risk), MAR12 (Definition of trading desk), MAR30 to MAR33 (internal models approach: general provisions, model requirements, backtesting and P&L attribution test requirements, and capital requirements calculation) and MAR99 (Guidance on use of the internal models approach). Obtain the consolidated regulation and the Basel Framework for the normative text.

Example: Fernhollow Bank is a fictional mid-sized EU credit institution with total assets of EUR 47,400 million. It calculates own funds for general market risk with an internal model (VaR and stressed VaR, model MOD-MR-001) and for specific risk with the standardised approach; market risk RWEA is EUR 1,000 million, 5% of TREA (see the ICAAP Report (finance/icaap-report), section 5.1). Its trading book serves clients and hedges the resulting positions; the bank does not run proprietary trading strategies, in line with statement QS-05 of its risk appetite statement. The board metric RAS-MKT-01 (trading book 99% one-day VaR) has an appetite of EUR 4.0 million, a tolerance of EUR 5.0 million and a limit of EUR 6.0 million. On 2026-09-30 the utilisation was EUR 2.7 million.

2. Roles and responsibilities

Accountability follows the three lines. The board owns the appetite and approves this framework. The second line (Market Risk) designs the limit structure, calibrates limits, measures utilisation independently of the front office and escalates. The first line (the trading desks and their management) takes risk within the limits and owns every excess on its book. Internal audit tests whether the framework operates as written.

Limits are measured on data that Market Risk controls: positions from the books and records system reconciled to the general ledger, market data validated by the independent price verification function, and models approved under the model risk management policy. A desk may run its own pre-trade estimate, but only the official end-of-day figure counts for limit purposes.

3. Trading book boundary and desk structure

The trading book contains positions that the bank holds for short-term resale, to profit from short-term price movements, to lock in arbitrage, or to hedge such positions. The bank documents trading intent through the desk mandate, the booking model and the trading strategy approved for each desk. Moving a position between the trading book and the banking book is exceptional, requires CRO approval and a written rationale and, where CRR Article 104a applies, the prior permission of the competent authority; any resulting reduction in own funds requirements is not recognised (check the consolidated text and the current EBA position on the application of the boundary rules). Record each reclassification in the boundary log with the date, the positions, the reason and the approval reference.

A trading desk is the unit to which limits are allocated. Each desk has one head trader, a documented business strategy, a list of permitted instruments and risk factors, and its own P&L. The desk structure follows the definition used for regulatory purposes so that the same desks can be used for desk-level backtesting and the P&L attribution test once the revised framework applies.

4. Limit hierarchy

The bank uses three levels. Level 1 metrics belong to the board and come from the risk appetite statement. Level 2 limits are management limits for the whole trading book, approved by the CRO on the recommendation of the Market Risk Committee and set inside the Level 1 appetite. Level 3 limits apply to individual desks and are approved by the Head of Market Risk within the Level 2 envelope.

Desk VaR limits are not additive. Because of diversification between desks, the sum of desk VaR limits can exceed the aggregate Level 2 limit, and the framework allows this up to a set ratio (the example uses 115%). The aggregate limit then binds before every desk is full, which is intended: it forces a discussion about which desk gets the scarce capacity when all desks are busy at once.

Each limit is classed as a hard limit or a monitoring trigger. A hard limit may not be exceeded without prior approval; an unapproved excess is a breach. A monitoring trigger, such as the expected shortfall trigger during the FRTB parallel run, starts a review but is not a breach.

5. Metric definitions

Every limit metric has one owner, one calculation engine and one definition. If a management metric differs from the regulatory metric, both are named, and the limit always refers to the management metric listed here.

Value at risk (VaR). For a loss variable $L$ over a fixed horizon and a confidence level $\alpha$, VaR is the smallest loss that is exceeded with probability no greater than $1-\alpha$:

The management VaR uses historical simulation, a 99% confidence level, a one-day horizon and the most recent [500] business days of equally weighted market data. The ten-day figure used in some reports is a scaled approximation, $\mathrm{VaR}_{10d} \approx \sqrt{10}\,\mathrm{VaR}_{1d}$, which assumes independent and identically distributed daily returns; state this assumption wherever the scaled figure appears. Example: a one-day VaR of EUR 2.70 million scales to about EUR 2.70 million x 3.1623 = EUR 8.54 million over ten days.

Stressed VaR (SVaR). The same model run on a 12-month window of significant stress relevant to the current portfolio. The stress window is reviewed at least quarterly and changed when a different window produces a materially higher result.

Expected shortfall (ES). The average loss in the tail beyond the VaR quantile:

Under the revised framework the regulatory measure is ES at 97.5% with liquidity horizons that vary by risk factor class. Until that framework applies, the bank calculates a management ES at 97.5% on a one-day horizon as a monitoring trigger, so that desks become used to it before it becomes binding.

Sensitivities. PV01 is the change in present value for a one basis point parallel increase in the relevant curve, reported in total and by tenor bucket. CS01 is the equivalent for a one basis point widening of credit spreads. FX delta is the net open position per currency in EUR equivalent. Equity delta is the EUR value change for a 1% move in the index, and vega the change for a one volatility point increase.

Stress scenario loss. The worst loss across the bank's hypothetical and historical trading book scenarios defined in the stress testing programme, revalued in full.

Notional and concentration. Gross notional per product and the largest single-issuer exposure, used where VaR understates risk (new products, illiquid issuers, jump risk).

Stop-loss. The cumulative loss on a desk or the trading book over a month or year to date, measured on Product Control's official P&L.

6. Limit calibration method

Calibrate limits top down and check them bottom up. Top down, the Level 2 aggregate VaR limit is set at or below the Level 1 appetite, and stressed VaR and stress loss limits are set so that the capital consumed by the trading book stays inside the allocation in the ICAAP. Bottom up, each desk limit is compared with recent utilisation, the desk's revenue budget and its business plan for the next year.

The standard desk calibration is: take the 95th percentile of the desk's daily VaR over the last 12 months, add a headroom factor for planned growth and normal client flow, and round to a practical figure. A desk with a new mandate, or one that changed products materially, is calibrated from its business plan instead, with a review after three months.

Check each desk limit against its loss budget. A desk that can lose its monthly stop-loss in two days at full VaR utilisation has a stop-loss that is too tight or a VaR limit that is too wide; the example sets each monthly stop-loss at about 2.5 times the desk VaR limit, so that a desk would need more than two consecutive losses at its full VaR limit to reach it. Likewise, a stop-loss larger than the desk's annual revenue budget implies the bank accepts losing more than a year of expected income on one desk, which the Market Risk Committee must accept explicitly.

Example: the FB-RAT desk had a 12-month 95th percentile VaR of EUR 1.80 million. With a headroom factor of 1.10 the raw figure is EUR 1.98 million, rounded up to the nearest EUR 0.1 million gives a limit of EUR 2.0 million. The four desk VaR limits then sum to EUR 4.5 million, which is 112.5% of the Level 2 aggregate limit of EUR 4.0 million, inside the 115% ceiling set in section 4.

Recompute: 2.5 x 2.0 = 5.0; 2.5 x 0.8 = 2.0; 2.5 x 1.2 = 3.0; 2.5 x 0.5 = 1.25. As a share of the annual revenue budget: 5.0 / 9.0 = 55.6%; 2.0 / 4.0 = 50.0%; 3.0 / 5.5 = 54.5%; 1.25 / 2.0 = 62.5%. Every stop-loss is below the desk's annual revenue budget, so no explicit Market Risk Committee acceptance under the rule above is needed. The year-to-date trading book stop-loss (MRL-004, EUR 12.0 million) is 58.5% of the combined revenue budget of EUR 20.5 million and three times the Level 2 VaR limit.

7. Limit schedule

The schedule below is the controlled list of all market risk limits. Each limit has a unique ID in the format MRL-NNN, used in the daily report, the excess log and audit testing. Utilisation is shown at the reference date. The early-warning threshold is 80% of the limit unless the row says otherwise.

On the reference date the four standalone desk VaRs sum to EUR 3.10 million (1.65 + 0.45 + 0.70 + 0.30), while the diversified trading book VaR is EUR 2.70 million. The diversification benefit is EUR 0.40 million, or 12.9% of the standalone sum. FB-RAT is above its early-warning threshold at 82.5%, which triggers the early-warning steps in section 9.

8. Measurement, monitoring and reporting

Market Risk calculates official utilisation once a day on end-of-day positions and validated closing market data. Before publication, the analyst checks that position counts and P&L reconcile to Product Control, that no market data series is stale beyond its tolerance, and that day-on-day VaR moves above [20%] are explained. The signed daily report is distributed by [09:00] local time on the next business day.

If the official run fails, Market Risk publishes a proxy using the previous day's VaR adjusted by the change in sensitivities, labels it as a proxy, and reruns as soon as the issue is fixed. Any desk that appears to be in excess on the proxy is treated as in excess until the official run shows otherwise.

Intraday, desks use pre-trade checks against sensitivity and notional limits. Trades that a desk head expects to take a hard limit above 100% must be pre-cleared with Market Risk as a temporary increase under section 10.

9. Early warnings, excesses and breaches

The framework uses four states:

• Early warning: utilisation at or above the early-warning threshold but at or below 100%. The desk head confirms in writing on the same day whether the position is planned and how much headroom remains needed. No approval is required.
• Approved excess: utilisation above 100% within a temporary increase approved in advance under section 10. Not a breach.
• Passive excess: utilisation above 100% caused only by market moves, model or data changes, with no new risk-increasing trade. The desk must not add risk and must present a plan by the end of the next business day. It becomes a breach if not cured or approved within [three] business days.
• Breach: any other utilisation above 100%, including excesses caused by new trades without prior approval and passive excesses not cured in time.

Every excess and breach gets an ID in the format EXC-YYYY-NNN and an entry in the excess log. The owner records the cause, the action, the date the position returned inside the limit and the approval reference. Repeat excesses on the same limit within a quarter are reported to the Market Risk Committee as a theme, because they usually mean the limit, the desk strategy or the hedging practice needs review.

Breaches have consequences. A breach is considered in the desk's performance review and in the risk adjustment of variable remuneration, under the bank's remuneration policy. A Level 1 breach is reported to the board without delay and assessed for supervisory notification.

Example: EXC-2026-031. On 2026-09-17 the FB-RAT desk VaR was EUR 2.12 million against a limit of EUR 2.0 million (106.0%). The cause was a large client receiver swap executed late in the day together with a rise in EUR swap volatility. Because a new trade contributed, the excess was classified as a breach. The desk hedged with futures on 2026-09-18 and VaR returned to EUR 1.71 million on 2026-09-19. The Head of Market Risk recorded the breach, the Market Risk Committee reviewed it on 2026-09-24 and asked the desk to pre-clear large client trades that would take it above 90% of the limit.

10. Temporary increases, new limits and delegated authority

A desk may request a temporary increase when a known client transaction or market event will take it above a hard limit. The request states the limit ID, the amount, the duration, the business reason and how the position will be brought back. Increases are granted for a stated number of business days and lapse automatically. A second consecutive increase on the same limit requires approval one level higher, and a third prompts a recalibration review.

New products and new desks receive limits through the new product approval process. Until Market Risk has validated the measurement of the new risk factors, the desk operates under notional limits only, set conservatively, and the Market Risk Committee reviews them after three months of trading.

Example: TLI-2026-004. FB-CRD requested an increase of the CS01 limit MRL-031 from EUR 40k to EUR 48k per basis point (20%) for 10 business days from 2026-10-05, to hold inventory from a covered bond issue for which the bank was a co-manager. The Head of Market Risk approved it with the condition that the desk keeps single-issuer exposure inside MRL-032.

11. Stop-loss and drawdown management

Stop-losses complement VaR. A VaR model may underestimate risk in a new regime, on concentrated positions or when correlations break down; cumulative losses show that problem directly. Stop-losses are measured on Product Control's official daily P&L, including valuation adjustments and excluding client fees booked to the desk.

The bank uses two stop-loss horizons. The monthly desk stop-loss resets on the first business day of each month. The year-to-date trading book stop-loss does not reset and captures a sequence of moderate monthly losses. A desk reaching 80% of its monthly stop-loss must present a review to the Head of Market Risk. At 100% the desk is restricted to risk-reducing trades until the Head of Market Risk and the Head of Markets agree a restart plan. At 100% of the year-to-date stop-loss the CRO decides whether trading continues and reports to the Board Risk Committee.

Drawdown from peak is reported alongside stop-losses. A desk whose cumulative P&L falls more than [its monthly stop-loss] from its year-to-date peak is placed on the calibration watch list even if no month has reached its trigger.

12. Regulatory status and transition

Market risk rules are changing in all three major jurisdictions, at different speeds. The table records the status as of 2026-10; check the official sources at each review, because further deferrals and transitional measures have been adopted at short notice.

Until the revised framework applies, the bank's own funds requirements for market risk remain those of the current CRR approach, including Article 366 backtesting where an internal model is used. The limit framework is nonetheless prepared for the change: desks are already defined as regulatory trading desks, management ES is monitored as a trigger, and desk-level backtesting and P&L attribution results are produced in parallel and reported in the VaR Backtesting Report (finance/var-backtesting-report).

Plan the limit changes for the application date now. At that date the bank expects to replace MRL-005 (ES trigger) with a hard ES limit, add limits for the default risk charge and the residual risk add-on where the standardised approach applies, and review whether VaR remains a Level 2 limit or becomes a monitoring metric only.

13. Model dependencies, review and assurance

The VaR, stressed VaR, ES and sensitivity engines are models in the model inventory. Each is validated under the Model Risk Management Policy (finance/model-risk-management-policy), with findings recorded in the Model Validation Report (ai-data/model-validation-report). Where a model has an open finding that could understate risk, the Head of Market Risk applies a compensating control: a tighter limit, an additional notional limit, or an add-on in the limit calculation. Record the control in the table below and remove it only when the finding is closed.

Backtesting results inform calibration. A rising number of exceptions, or exceptions concentrated on one desk, is a signal that limits based on that model may be too loose in risk terms even when utilisation looks comfortable.

The framework is reviewed at least annually and whenever the business strategy, desk structure, model approach or regulation changes materially. Internal audit tests the framework on a risk-based cycle, including a sample of excesses, temporary increases and data controls.

14. Glossary and references

Glossary

References

• Regulation (EU) No 575/2013 (Capital Requirements Regulation), Articles 102 to 104 (trading book), Part Three, Title IV (own funds for market risk), Article 366 (regulatory backtesting and multiplication factors); check the consolidated text on EUR-Lex.
• Regulation (EU) 2024/1623 (CRR3), amending the CRR, Official Journal 2024-06-19.
• Commission Delegated Regulation (EU) 2025/1496 on the date of application of the own funds requirements for market risk (deferral to 2027-01-01).
• European Commission, questions and answers on the banking package amending market risk requirements, 2026-06-04.
• Basel Committee on Banking Supervision, Basel Framework, MAR standard: MAR11, MAR12, MAR30, MAR31, MAR32, MAR33, MAR99 (chapter IDs and names only).
• Prudential Regulation Authority, Basel 3.1 final rules (check the current policy statement for application dates).
• Federal Reserve Board, FDIC and OCC, joint press release "Agencies request comment on proposals to modernize the regulatory capital framework and maintain the strength of the banking system", 2026-03-19 (proposal).
• Related templates: Risk Appetite Statement (finance/risk-appetite-statement), VaR Backtesting Report (finance/var-backtesting-report), Stress Testing Programme (finance/stress-testing-programme), Model Risk Management Policy (finance/model-risk-management-policy), KRI Framework Specification (finance/kri-framework-spec), ICAAP Report (finance/icaap-report).

Standard and licence note

Based on Regulation (EU) No 575/2013 as amended (including Regulation (EU) 2024/1623) and the published statements of the European Commission, the Federal Reserve Board, the FDIC and the OCC. Structure aligned with the market risk chapters of the Basel Framework (MAR), which are cited by chapter ID and name only; no Basel Committee text or table is reproduced, and the Basel Committee does not endorse this template. The limit hierarchy, states, calibration method, worked example and all wording are original. Regulatory dates move: check the current official version of each regulation, delegated act and supervisory publication before use. Fernhollow Bank and every figure are fictional. Template licence: MIT.