Early in 2012, a portfolio in JPMorgan Chase’s Chief Investment Office was running over its risk limits. Then the bank adopted a new value-at-risk model, and the problem seemed to go away. The new model roughly halved the portfolio’s reported risk.
Months later, the trades that became known as the “London Whale” had produced losses exceeding $6 billion. An internal review by the bank later found that the new model relied on spreadsheets populated through manual copy-and-paste steps and contained calculation errors.
The trades were risky. More unsettling was the number that declared them safe.
Here lies the paradox at the center of algorithmic trading risk management. Every risk system is itself a model, built by people, coded in software, and capable of being wrong. Surviving institutions have learned to pose a question most traders overlook. Who measures the measurer?
The Trouble With One Number
Value at risk became popular because it compresses a portfolio’s danger into one figure. The same simplicity is its greatest weakness. VaR captures losses in ordinary conditions but reveals little about how severe the worst days can become.
Regulators learned this too. The Basel Committee’s revised market risk framework moved bank capital models from VaR to expected shortfall, a measure that asks what the average loss looks like once you are already in the tail.
The principle applies far beyond banking. Serious quantitative trading research treats risk metrics with the same skepticism it applies to alpha signals. Metrics are tested against historical crises, their assumptions are documented, and any methodological change is independently reviewed. A risk model that cannot be challenged is just an opinion with decimals.
Constrain How You Trade, Not Only What You Hold
The Flash Crash struck U.S. markets on May 6, 2010. The joint SEC and CFTC report identified a key trigger: a sell program of 75,000 E-mini S&P 500 futures contracts, executed by an algorithm that targeted a share of trading volume without regard to price or time.
Nothing about the position was exotic. The execution simply had no constraints.
Institutions now write execution limits directly into AI trading system development. These include price collars that block orders far from the prevailing market, participation caps, order-rate throttles, and checks that pause an algorithm when conditions change faster than it was designed to handle. Exposure limits tell check here you how much you can lose. Execution limits decide how fast.
Layer the Defenses
Mature risk architectures rarely rely on one control. They stack them.
Pre-trade checks reject orders that violate size, price, or credit limits before those orders leave the firm. Intraday monitoring follows positions and losses in real time, using hard limits that stop trading and soft limits that trigger escalation. Post-trade review reconciles what happened against what was supposed to happen.
Each layer assumes the one before it might fail. That assumption is not pessimism. It is engineering.
Risk Logic Deserves Production Rigor
Ordinary software problems contributed to the London Whale model’s failure: manual processes, too little testing, and weak change control. In institutional algorithmic trading software development, risk logic now receives the same rigor as the trading engine itself. Changes are version-controlled and peer-reviewed, and a new model runs in parallel with the old one before it takes over.
Firms also run historical crises back through their systems to confirm that controls actually fire. Here AI trading infrastructure consulting often adds the most value, since an outside team with no attachment to the existing design can test whether safeguards hold under conditions their builders never imagined.
When a Limit Breaks
A limit is only as strong as the response when it is crossed. In disciplined institutions, a breach triggers escalation to people independent of the trading desk, and the default response is to reduce risk, not to revisit the limit.
In risk management, nothing is more dangerous than a breach that gets explained away.
A Four-Question Risk Check
Before trusting any risk framework, ask:
Was the risk model validated by people independent of its owners?
How does the system behave in the tail, not merely on an average day?
Could an algorithm lose money faster than a human can step in?
When a limit is breached, which changes: the portfolio or the limit?
The Number That Feels Like Safety
There is a strange emotional force in a risk number. It lets people sleep, lets committees sign off, and turns uncertainty into something resembling knowledge.
That comfort is exactly why institutions surround them with doubt.
The London Whale trades were never hidden. They sat in plain view, measured every day. The danger was never out of sight. It lived inside a number everyone wanted to trust.