Choosing a VaR Confidence Level

Value-at-Risk (VaR) answers "what loss will not be exceeded, with X% confidence, over a given horizon?" — but X itself is a choice, and different choices serve different purposes. A 95% VaR is exceeded, by construction, about one day in twenty; a 99% VaR about one day in a hundred; a 99.9% VaR about one day in a thousand. Higher confidence levels push further into the tail, which sounds strictly more conservative, but it comes at a cost: the further into the tail you go, the less data you have to estimate that point reliably, so a 99.9% VaR estimated from a few years of daily data is often built on a handful of extreme observations, or none at all, and relies heavily on distributional assumptions rather than direct evidence.

This is why regulators and risk desks typically use different confidence levels for different jobs. A 95% VaR, breached regularly, is useful for day-to-day risk budgeting and for backtesting the model itself, since with enough breaches you can statistically test whether the model's frequency of breaches matches what it claims. A 99% VaR is the common regulatory capital benchmark. Neither tells you how bad a breach is once it happens — VaR is silent about the size of the loss beyond the threshold, which is the specific gap that Expected Shortfall is designed to close.

Concrete illustration. A desk reports a 1-day 95% VaR of $2m and a 1-day 99% VaR of $4.5m on the same portfolio. Over a year of roughly 250 trading days, the 95% VaR should be breached about 12–13 times if the model is well-calibrated — few enough breaches to actually check statistically — while the 99% VaR should be breached only about 2–3 times, too rarely for a year of data alone to confirm the model is right, which is exactly why higher-confidence VaR models lean more on assumptions and backtest over much longer windows.