When Risk Models Create Risk

10 min read Keywords:  Daníelsson, endogenous risk, VaR, systemic risk, risk models, monoculture, macroprudential regulation, Taleb, Minsky, financial stability
An aerial view of endless white greenhouses covering the land to the horizon, a vast uniform agricultural monoculture
The greenhouses of El Ejido, Almería, Spain. Photo: kallerna, CC BY-SA 4.0, via Wikimedia Commons.

The last essay ended with Taleb’s objection. The tail is where the risk is, and the tail is exactly the part of the distribution the data refuses to pin down. If you cannot know the probability of ruin, stop pretending you can. Change your exposure instead.

Jón Daníelsson adds a colder institutional version of the same argument. He says something stronger than “risk models are inaccurate”: in finance, the act of measuring risk changes the risk. A model works less like a thermometer held up to the weather and more like a rule handed to people who then trade, hedge, deleverage, report, and regulate according to it. The number enters the system it tries to describe.

That is the final turn in this series. If everyone copies each other, small shocks cascade. If everyone uses the same risk model, the model itself becomes one of the things they copy.

#I. Risk is not weather

Daníelsson’s core distinction is simple. Some risks are mostly exogenous. A storm is coming whether you measure it or not. Your forecast can be wrong, but the forecast does not usually create the storm.

Financial risk is different. It is endogenous. It is generated by the interaction of people who watch the same prices, use similar models, face similar constraints, and react to one another. A small price move changes measured volatility. The change in measured volatility changes risk limits. The changed risk limits force sales. The forced sales move prices. The price move confirms the model’s warning and forces the next sale.

The inelastic-markets essay earlier in this series showed flows moving prices against a steep demand curve. This loop has a different trigger: the measured risk that every desk is watching and acting on at the same time.

A circular feedback diagram. A price fall raises measured risk, rising measured risk makes risk limits bind, binding limits force sales, sales thin liquidity, and thin liquidity feeds back into another price fall.

The risk model sits inside the market. Its output changes behavior, and that behavior changes the market the model is trying to measure.

This is the Millennium Bridge in market form. When the London bridge opened in 2000, pedestrians felt a tiny sideways sway and unconsciously adjusted their steps. Those synchronized steps amplified the sway, which synchronized the pedestrians further, which amplified it again. No one planned the movement. No outside shock had to keep pushing. The crowd and the bridge made the instability together.

Markets do the same thing with balance sheets.

#II. The model works until it matters

This is why Daníelsson’s 2002 paper, “The Emperor has no Clothes,” cuts deeper than an ordinary complaint about Value-at-Risk.

The usual criticism is that VaR misses the tails. True, but familiar. Daníelsson’s sharper point is that the data used to estimate risk comes mostly from ordinary times, when the system is not yet feeding back on itself. In those times, risk looks measurable. Volatility is low. Correlations behave. Historical losses seem bounded. The model passes its tests.

Then the crisis starts, and the object being measured changes character. Risk stops looking like a property of an asset and starts looking like a property of a crowd. People who were diversified discover they all own the same trade. People who thought they had risk limits discover everyone else’s risk limits trigger at the same time. The model that looked conservative in the calm becomes a lever in the panic.

So the failure is performative as well as statistical. A shared risk model can make the market more fragile by making everyone respond to the same signal in the same way.

#III. The hidden danger is uniformity

This is Daníelsson’s most useful addition to the story. Leverage matters, but monoculture is the deeper danger.

Regulators like common rules because common rules look fair. Same assets, same risk weights, same capital formulas, same stress tests. No one gets special treatment. Everyone is comparable. The system becomes legible.

But a legible system can be a synchronized system. If every bank measures risk the same way, every bank sees risk fall in the boom. If every bank sees risk fall, every bank is allowed to expand. If every bank expands, prices rise, losses look even less likely, and the model approves still more balance-sheet growth. Then the sign flips. Measured risk rises, capital becomes scarce, and everyone tries to shrink at once.

A plot of system-wide selling pressure through time. A red spike shows monoculture, where institutions sell at the same moment. A green, lower, wider curve shows diverse models and constraints spreading the response over time.

A common model turns many balance sheets into one reflex. Heterogeneous rules spread the same shock across time and reduce the peak pressure.

That is one giant common error, copied across institutions.

August 2007 is the clean example. In the second week of the month, quantitative equity funds running similar statistical-arbitrage models all hit the wall at once. As one large fund deleveraged, it pushed down exactly the stocks the others held, whose models then flagged the same risk and forced them to sell too, a domino none of them could see from inside. Goldman’s Global Equity Opportunities fund lost nearly a third of its value, and its CFO explained the week as “25 standard deviation moves, several days in a row,” events the models said should not happen across the lifetime of the universe. They were not freak draws. They were the signature of many institutions running one kind of model and selling into each other. Amir Khandani and Andrew Lo later reconstructed the mechanism and called it the unwind.

The lesson is uncomfortable because it runs against the administrative instinct. A financial system made of heterogeneous institutions, different models, different constraints, different time horizons, different kinds of wrongness, looks messy. It is harder to supervise. It is harder to compare. But the mess is doing work. Diversity breaks synchronization. A market where everyone disagrees is annoying. A market where everyone agrees is dangerous.

#IV. Microprudential is not macroprudential

The distinction matters.

Microprudential regulation asks whether each institution is safe on its own. Does this bank have enough capital? Is this portfolio inside its VaR limit? Did this desk pass its stress test?

Macroprudential regulation asks what happens when all those individually sensible actions are taken together. If every bank sells the risky asset to reduce risk, who buys it? If every model raises margin at once, who supplies liquidity? If every institution tries to become safer by shrinking the balance sheet, does the system become safer or does it crash the price of the thing everyone is selling?

This is Minsky in regulatory language. Stability lowers measured risk. Low measured risk invites leverage. Leverage makes the next disturbance more dangerous. When the disturbance arrives, the same risk controls that looked prudent institution by institution can force a collective deleveraging.

The solution keeps measurement and demotes it. Stop confusing a bank’s measured safety with the system’s safety. A rule that makes one institution safer can make the system more fragile if everyone follows it at once.

#V. What a better system looks like

Daníelsson’s answer is structural, not predictive.

First, preserve diversity. Do not force every institution onto the same model, the same risk horizon, the same trading rule, the same capital response. A market needs different kinds of balance sheets the way an ecosystem needs different species. Uniformity is efficient right up to the moment it becomes a cascade.

Second, lean against procyclicality. If measured risk is lowest in the boom, that is exactly when buffers should rise, not fall. Capital and liquidity should be built when they look least necessary, because that is when the system is quietly loading itself.

Third, build slack. Redundancy, liquidity, circuit breakers, slower feedback loops, and limits on tight coupling all look wasteful in calm periods. That is why they matter. Slack exists to keep normal times from becoming the launch ramp for a crisis.

Fourth, treat model outputs as signals, not commands. A risk number should start a conversation, not end one. The moment the number becomes a mechanical instruction, it can become a synchronization device.

#VI. The AI version of the same problem

There is a new version of this problem forming.

If every bank builds its own small model, they will be wrong in different ways. If every bank and regulator leans on the same handful of foundation models, the errors can become correlated. The model recommends similar hedges, flags similar risks, summarizes similar news, writes similar stress scenarios, and nudges similar decisions across institutions that believe they are acting independently.

That is endogenous risk with a faster nervous system.

The danger is persuasion, centralization, and shared use. A common machine can become a common reflex. And in a market, a common reflex is how a small move becomes a stampede.

#VII. The final lesson

The series began with a market crash that had no cause large enough to explain it. It moved through magnets, sandpiles, bubbles, Hawkes processes, warning signs, and fat-tailed ignorance. Daníelsson gives the institutional moral of the whole thing.

Do not build a system whose safety depends on everyone trusting the same fragile number.

Taleb’s advice is personal: do not stand where the tail lands. Daníelsson’s advice is institutional: do not make everyone stand in the same place. The first protects the individual from ruin. The second protects the system from synchronized ruin.

Measure anyway. Fit the tail, watch the branching ratio, track the bubble, look for slowing recovery, use every instrument this series has described. Just keep the instruments in their place. They exist to help you build slack, diversity, and convexity before the cascade starts, rather than to certify that the cascade cannot happen.

The edge is real. The number is unstable. The system is watching the number. That is why the design matters more than the estimate.

#Further reading

On endogenous risk:

On the Millennium Bridge:

On the 2007 quant quake:

On the institutional argument:

On AI as the new monoculture: