A limit breach occurs when risk or activity crosses a permitted boundary. Compare a fictional VaR estimate with its limit, then distinguish escalation from realised loss.
Limit breach
A limit breach occurs when an exposure, risk measure or activity falls outside a formally permitted boundary. A desk whose measured risk exceeds its approved risk limit has a control event to report and address, even if its trades are profitable.
Limits translate risk appetite into constraints that can be monitored. They may cap position size, counterparty exposure, concentration, a sensitivity or a modelled loss measure. A minimum liquidity requirement can also be breached by falling below its floor. The direction and precise trigger belong in the policy.
Read the comparison before reading the alarm
Consider a fictional desk with an approved upper limit of USD 1.00 million on its one-day 95% value-at-risk (VaR). At 16:00 UTC, its measured VaR is USD 1.20 million. The estimate and limit refer to the same portfolio, currency, horizon, confidence level and approved measurement method.
For this example the policy defines a breach as M>L, where M is measured VaR and L>0 is the approved limit. Then
The desk is 20% above its limit. It has used 120% of the permitted risk budget; the excess is not 120%. Equality would be at the limit under this particular strict-inequality rule. A policy can prescribe earlier warning thresholds or a different boundary convention, so the trigger must be explicit.
Fictional one-day 95 percent VaR comparison: approved limit USD 1.00 million, measured VaR USD 1.20 million, utilisation 120 percent and excess USD 0.20 million.
Same-basis comparison at 16:00 UTC. The extension beyond the dashed limit is the USD 0.20 million excess; the bar shows estimated VaR, not realised loss.
A number without its reference basis is insufficient to establish this comparison:
Check
Why it matters
Portfolio and legal entity
A desk estimate and a group limit can cover different positions and permitted netting.
Metric, sign and units
Gross notional, net exposure and VaR answer different questions. A signed sensitivity may have both upper and lower bounds.
Horizon, confidence and method
Different VaR specifications need not be comparable. A model change can alter utilisation without any new trade.
Valuation time and limit version
Stale positions or a superseded approval can create a misleading exception report.
A breach is a decision record
The Basel Framework's risk-management chapter calls for banks to assign clear authority, escalate and address internal position-limit breaches, and promptly report them with appropriate follow-up. Those principles do not prescribe one universal trade for every breach.
An operational response needs to answer concrete questions: is the reading valid, who must be notified, who can authorise an exception, and what happens until the exposure is back within its permitted boundary? Depending on the applicable policy and mandate, action might include blocking additional risk, reducing or hedging positions, or a documented temporary exception approved by the designated authority. A statutory or contractual restriction cannot be waived merely because an internal manager accepts the risk.
A useful incident record preserves the original observation and limit version, the cause, notification times, decision-maker, action owner, deadline and evidence of closure. If temporary permission is available, record its scope and expiry. Raising a limit after observing the excess should not silently rewrite the earlier event as compliant.
This is where the distinction between a risk report and a risk process becomes visible. The Risk pathway's capstone evidence plan asks learners to log breaches and responses and replay decisions using information available at the time. The full lesson requires membership; a public preview introduces the work.
Do not confuse the event with its outcome
A VaR limit breach compares a risk estimate with an approved budget. A VaR backtesting exceedance compares a subsequent loss with an earlier forecast. Either can occur without the other. The USD 1.20 million estimate is neither a booked loss nor a guarantee of the worst possible loss.
A breach also does not, by itself, establish misconduct or model risk: market movements, changing volatility, new positions or a measurement fault can require different diagnoses. Equally, a profitable outcome does not erase an unauthorised exposure. Hull's discussion of risk limits stresses that enforcing them only when losses occur rewards the wrong behaviour.
John C. Hull, Risk Management and Financial Institutions, 4th edition, Wiley, 2015, §28.1, pp. 577–579: unambiguous risk limits, monitoring and the problem of overlooking profitable violations.
