The risk management function measures risk amounts and reports any situation in which a limit has been breached. The front office manages its positions within the limits allocated to it.

How risk appetite differs from limits

A risk appetite is a statement, for the institution as a whole, of the types and amount of risk it is willing to take within its risk capacity to achieve its strategy and business plan. Risk capacity is the maximum level of risk the institution can take. It is measured so that the institution does not breach the regulatory capital and liquidity requirements, the operating environment, or obligations to depositors, shareholders and others1. For example, it decides which of interest rate, foreign exchange, equity and complex structured product risks to take, and how far2.

A limit (in the FSA's supervisory guidelines, a "limit frame") is a numerically measurable upper bound that allocates this risk appetite to business units, legal entities, risk types and concentrations (counterparties, industries, countries and regions, types of collateral, products and so on)1. The risk appetite statement also includes policy on risks that are hard to measure numerically, such as reputation1. Because a limit is set in a form whose usage can be measured and checked, it prevents a market move from pushing the institution past its risk capacity without anyone noticing3.

In the principles the Financial Stability Board (FSB) published in 2013, the "risk appetite framework" is the whole of the policies, processes, controls and systems through which risk appetite is established, communicated and monitored. It includes the risk appetite statement, the limits, and an outline of the roles and responsibilities of those who oversee implementation and monitoring1. The Financial Services Agency's "Comprehensive Guidelines for Supervision of Major Banks, etc." (hereafter, the supervisory guidelines) calls limits on market risk "limit frames." Bank of Japan documents call them "risk frames" and similar terms4.

Allocating from appetite to limits

Risk capital is a concept that a financial institution defines internally to manage its risk-taking, after considering the level of regulatory capital5. In the Bank of Japan document's account, the allocation from risk appetite to limits proceeds as follows, as one example. Step 2 corresponds to the first stage (the allocation of risk capital and the setting of overall limits), and step 3 to the second stage (the setting of the various limits and loss limits)5.

  1. The board of directors weighs risk against return and financial strength, decides the strategy and risk appetite, and decides the risk management policy6.
  2. The board allocates risk capital to each risk type, such as credit, market and operational risk, and sets an overall limit for each7.
  3. For market risk, individual limits and, where necessary, loss limits are placed on each managed target, such as interest rate risk on bonds or equity risk. The form can be one that the front office (sales and trading) finds easy to manage, with appropriate involvement of senior management and approval by the organization8.

Individual limits need not use the same measure as the overall limit, as long as they are consistent with it9. The Bank of Japan document's worked examples include a case where the individual limits add up to the overall limit and a case where they add up to more than the overall limit10.

Consider a hypothetical example in which the total risk capital is 30 billion yen.

Item How the limit is set Amount
Allocation of risk capital A total of 30 billion yen is divided among credit, market, operational and a buffer Credit 12 billion yen, market 10 billion yen, operational 3 billion yen, buffer 5 billion yen
Overall limit for market risk Set by VaR VaR 4 billion yen
Limits by unit Set by VaR for each desk Interest rate desk 2 billion yen, equity desk 2.5 billion yen (total 4.5 billion yen)
Loss limits Set for each desk as a quarterly loss amount Interest rate desk 0.8 billion yen, equity desk 0.6 billion yen (total 1.4 billion yen)

A loss limit is an upper bound on actual losses, separate from VaR, which is an expected loss amount. The total of 1.4 billion yen is not added to or compared with the overall VaR limit (4 billion yen).

In this example, the overall limit is set after taking into account the estimated loss from stress testing (9 billion yen), which fits within the allocation to market risk (10 billion yen)11.

In this example, the total of the VaR limits by unit (4.5 billion yen) is larger than the overall limit (4 billion yen). When you take the correlation between the units' price movements into account, the VaR of the whole can be smaller than the sum of the VaRs of the units12. There are also designs in which the total exceeds the overall limit10. In such a design, the overall limit would be exceeded if every desk used its limit in full, so the usage of the whole has to be checked separately.

After limits have been allocated, a new business opportunity, for example, may call for a higher limit for a business unit or legal entity. The FSB principles require that this can be accommodated within the overall risk appetite, subject to the approval of senior management and the board where appropriate13. Ways to keep it within range include increasing risk capacity, reducing the risk of other units or entities, and reallocating unused limit from other units or entities13.

Types of limits and how to use them

Limits can be classified by what they cap, as in the table below. Several types may be combined for a single risk14.

Type What it caps Example of use
Position Sensitivity, notional amount, balance BPV (DV01) for the interest rate risk of bond investments, balance for equities14
Risk measure Expected loss amounts such as VaR VaR for market risk as a whole. For structured bonds and similar products, an example that sets the limit on the simple sum of the VaR of each issue11
Loss limit Loss amounts, including valuation losses An example that sets the loss limit for bond investments at a fixed percentage of the market division's earnings plan15
Concentration Counterparty, industry, country and region, type of collateral, product Limits are set on concentrations as well as on business units and legal entities16

Limits are also often expressed as levels relative to earnings, capital, liquidity and so on16.

The supervisory guidelines list position limits (upper bounds on interest rate sensitivity, notional amount and so on), risk limits (upper bounds on expected loss amounts such as VaR), loss limits and stress testing as the items to be set for market risk4. Of these, stress testing is an estimate of losses, not an upper bound11.

Loss limits are often set to keep a loss, including valuation losses, from having a large direct effect on period profit or loss or on the capital ratio15.

Risks that cannot be measured numerically are also within the scope of risk appetite. The FSB principles require that limits for hard-to-measure risks, such as reputation, also be set in a form that can be measured through qualitative assessment17.

Setting limits and reviewing them

The supervisory guidelines require a bank's board of directors to define clearly, as a risk management policy, the basic approach to setting position limits, risk limits, loss limits and stress testing. They also require the board and others to review the content of each division's business at regular intervals (at least once each period) and to review the settings4.

The benchmark for setting limits is the capacity left after what other risks need. The Bank of Japan document says to roughly work out the upper bounds on the risk amounts of the other risk categories, calculate the "spare financial strength" that can be allocated to market risk, and set market risk limits and loss limits within that range. If the risk amounts of the other risks cannot be worked out, the market risk limits cannot be set on a rational basis either18.

There are also points to watch when deciding the level of limits. The supervisory guidelines require the risk management function to do more than set risk capital and limits mechanically for each division. This function is the part of the middle office that looks at risk amounts and limits. It is to grasp risk on its own initiative and use that in day-to-day management19.

The FSB principles require that limits satisfy the following20.

  • They are set for each business unit and legal entity, and keep the institution within its risk appetite.
  • They do not simply reuse peer comparisons or regulatory levels.
  • They are not made complex or vague, and do not rely on subjective judgment.
  • They are checked regularly.

The number of limits is decided by balancing comprehensiveness against the cost and effectiveness of monitoring21.

Daily monitoring and reporting

Board of directorsFront officeRisk managementSets risk capitalandthe overall limitLimits, plus losslimits if needed,set with approvalMeasures andwatches riskamountsReports wherelimits have beenbreachedReceives thereport
Figure 1From setting limits to reporting on usage
Figure description

The front office lane shows the side on which limits are set. The setting is approved by the organization with the involvement of senior management.

The risk management function measures and watches risk amounts and reports to the board of directors any situation in which a limit has been breached. When the market environment changes and a breach of a limit is a concern, it reports and consults flexibly as the situation requires22. The FSB principles likewise say that the chief risk officer independently monitors the limits of business units and legal entities and the risk of the whole23. The daily work of measurement and reporting is covered in Daily Risk Management Operations.

For investment in a new product or a large transaction, the risk management function checks the impact in advance and tells the board. As of 2019, a growing number of financial institutions were considering making this advance check a rule24.

Reporting and response to a breach

The supervisory guidelines require that the reporting lines and authority (policies and procedures) for reporting to managers when a limit is exceeded, or is likely to be, be clearly defined in advance26.

The FSB principles require the chief risk officer to promptly report to the board and the chief executive officer any material breach that could exceed the risk appetite27. They also require the chief executive officer to have a policy of notifying the board and the supervisors of a serious breach28.

What is done after a breach depends on the type of limit. There are hard limits and soft limits. A hard limit requires the position to be forcibly reduced or closed once the limit is exceeded. A soft limit requires the institution to reconsider its market view and discuss its management policy once the limit is exceeded. Because it does not require a forced reduction, it allows a flexible response29.

An alarm point, set at a level lower than the limit (such as 50% or 75% of the limit), is a marker to draw attention and prompt a discussion of management policy29.

Consider a hypothetical example in which the VaR limit of Bank A's interest rate desk is 2 billion yen and the alarm point is 75% (1.5 billion yen). The limit is the same as in the allocation table. If VaR on a given day is 1.6 billion yen, it is within the limit but above the alarm point, so the desk's management policy is discussed. If VaR rises to 2.1 billion yen the next day, the limit has been exceeded.

  • With a hard limit, the position is reduced or closed immediately. After that, it can be bought back30.
  • With a soft limit, a discussion begins. If the market moves while the discussion is under way, the loss may grow30.

The Bank of Japan document (September 2019) says that Japanese financial institutions often set soft limits for market risk, and that, given the characteristics of market risk, hard limits should be used effectively in combination with alarm points30.

Where the authority to close a position sits also differs between institutions. The same document gives four examples of arrangements decided in advance31.

  • The risk management function only advises, and the front office closes the position under its own responsibility.
  • The risk management function has the authority to close it.
  • The board or a similar body decides.
  • The parties concerned decide by consultation.

What internal audit checks, and differences in form

The limits of business units and legal entities must be consistent with the institution-wide risk appetite statement32.

The setting and operation of limits are also subject to internal audit. The Bank of Japan document says that internal audit checks three points33. The first is whether the allocation of capital and the setting of limits are consistent with the risk appetite and the risk management policy. The second is whether the middle office reports at an appropriate timing and frequency. The third is whether the front office stays out of risk measurement.

The form in which risk capital is allocated and overall limits are set differs between financial institutions. The Bank of Japan document says that what matters more than the form is that the organization can give a rational explanation of how it checked that its financial strength is sufficient34. The figures and structure shown here are not a single standard.

Notes

  1. FSB, "Principles for An Effective Risk Appetite Framework" (November 18, 2013), the definitions table at the start (pages 2–3): "Risk appetite framework," "Risk appetite statement," "Risk capacity," "Risk appetite" and "Risk limits." ↩ ↩2 ↩3 ↩4

  2. Bank of Japan Financial System and Bank Examination Department, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (Building a market risk management framework) (September 2019, in Japanese), "戦略、リスクアペタイト、リスク管理方針の決定" (Determining strategy, risk appetite and risk management policy) (page 8). ↩

  3. FSB, "Principles for An Effective Risk Appetite Framework" (November 18, 2013), section 3, "Risk limits" (page 6). ↩

  4. Financial Services Agency, "主要行等向けの総合的な監督指針" (Comprehensive Guidelines for Supervision of Major Banks, etc.) (October 2026, in Japanese), III-2-3-3-2 (2) item 7 (page 125), and Bank of Japan Financial System and Bank Examination Department, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (Building a market risk management framework) (September 2019, in Japanese), page 14. The original terms are 限度枠 (in the guidelines) and リスク枠 (in the Bank of Japan document). ↩ ↩2 ↩3

  5. Bank of Japan Financial System and Bank Examination Department, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (September 2019, in Japanese), page 14, the figure and notes on page 15, and the figure on page 17. ↩ ↩2

  6. The same document, "３．取締役会の役割" (3. Role of the board of directors) (page 7). ↩

  7. The same document, "市場リスク全体枠：設定の考え方" (Overall market risk limit: the approach to setting) (page 16). ↩

  8. The same document, "各種リスク枠、損失限度：設定の考え方" (Various risk limits and loss limits: the approach to setting) (page 18). ↩

  9. The same document, "留意事項：各種リスク枠の設定" (Points to note: setting the various risk limits) (page 19). ↩

  10. The same document, "事例①の解説例" (Explanatory example of case 1) (page 24) and "事例②の解説例" (Explanatory example of case 2) (page 25). ↩ ↩2

  11. The same document, "（事例①）リスクを許容し管理する枠組み" ((Case 1) Framework for accepting and managing risk) (page 21). ↩ ↩2 ↩3

  12. The same document, "事例①の解説例" (page 24). ↩

  13. FSB, "Principles for An Effective Risk Appetite Framework" (November 18, 2013), section 1.1 f) (pages 4–5) and footnote 7 (page 5). ↩ ↩2

  14. Bank of Japan Financial System and Bank Examination Department, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (Building a market risk management framework) (September 2019, in Japanese), "留意事項：各種リスク枠の設定" (Points to note: setting the various risk limits) (page 19). ↩ ↩2

  15. The same document, "留意事項：損失限度の設定" (Points to note: setting loss limits) (page 20). ↩ ↩2

  16. FSB, "Principles for An Effective Risk Appetite Framework" (November 18, 2013), sections 3.1 b) and c) (pages 6–7), and section 2, "Risk appetite statement" (page 5; quantitative measures expressed in terms of earnings, capital, liquidity-at-risk and so on). ↩ ↩2

  17. FSB, "Principles for An Effective Risk Appetite Framework" (November 18, 2013), footnote 9 to section 3, "Risk limits" (page 6). ↩

  18. Bank of Japan Financial System and Bank Examination Department, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (September 2019, in Japanese), "留意事項：他のリスクカテゴリのリスク量の上限を把握する" (Points to note: work out the upper bounds on the risk amounts of the other risk categories) (page 28). The original term for "spare financial strength" is 経営体力の余力. ↩

  19. Financial Services Agency, "主要行等向けの総合的な監督指針" (Comprehensive Guidelines for Supervision of Major Banks, etc.) (October 2026, in Japanese), III-2-3-3-2 (1) item 7 (page 124). ↩

  20. FSB, "Principles for An Effective Risk Appetite Framework" (November 18, 2013), sections 3.1 a), b), d), e) and f) (pages 6–7). ↩

  21. The same document, section 3, "Risk limits" (page 6). ↩

  22. Bank of Japan Financial System and Bank Examination Department, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (September 2019, in Japanese), "６．リスク管理部門の役割" (6. Role of the risk management function) (page 34) and "市場リスクの把握と報告" (Grasping and reporting market risk) (page 35). ↩

  23. FSB, "Principles for An Effective Risk Appetite Framework" (November 18, 2013), section 4.3 g) (page 10). ↩

  24. Bank of Japan Financial System and Bank Examination Department, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (September 2019, in Japanese), "リスクコミュニケーションの中核となる" (Becoming the core of risk communication) (page 36). ↩

  25. FSB, "Principles for An Effective Risk Appetite Framework" (November 18, 2013), sections 4.5 a), d), e), f) and h) (page 11). ↩

  26. Financial Services Agency, "主要行等向けの総合的な監督指針" (Comprehensive Guidelines for Supervision of Major Banks, etc.) (October 2026, in Japanese), III-2-3-3-2 (2) item 8 (page 125). ↩

  27. FSB, "Principles for An Effective Risk Appetite Framework" (November 18, 2013), section 4.3 i) (page 10). ↩

  28. FSB, "Principles for An Effective Risk Appetite Framework" (November 18, 2013), section 4.2 j) (page 10). ↩

  29. Bank of Japan Financial System and Bank Examination Department, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (September 2019, in Japanese), "ハードリミット、ソフトリミット、アラームポイント" (Hard limits, soft limits and alarm points) (page 26). ↩ ↩2

  30. Bank of Japan Financial System and Bank Examination Department, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (September 2019, in Japanese), "ハードリミットの有効な活用" (Effective use of hard limits) (page 27). ↩ ↩2 ↩3

  31. Bank of Japan Financial System and Bank Examination Department, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (September 2019, in Japanese), "過大なリスクテイクが判明したときはどうするのか" (What to do when excessive risk-taking comes to light) (page 38). ↩

  32. FSB, "Principles for An Effective Risk Appetite Framework" (November 18, 2013), section 2.1 g) (page 6). ↩

  33. Bank of Japan Financial System and Bank Examination Department, Center for Advanced Financial Technology, "市場リスク管理態勢の整備" (September 2019, in Japanese), "内部監査のポイント" (Points for internal audit) (page 41) and "内部監査のポイント（続き）" (Points for internal audit, continued) (page 42). ↩

  34. The same document, "市場リスク全体枠：設定の考え方" (page 16). ↩