Early in 2012, a portfolio in JPMorgan Chase’s Chief Investment Office was running over its risk limits. Then a new value-at-risk model arrived, and the problem seemed to vanish. The new model cut the portfolio’s reported risk roughly in half.

Months later, the trades that became known as the “London Whale” had produced losses exceeding $6 billion. When the bank investigated, its own review found that the model ran on spreadsheets fed by manual copy-and-paste steps, and that its calculations contained errors.

The trades themselves were dangerous. Far more unsettling was the figure that called them safe.

This contradiction sits at the heart of algorithmic trading risk management. Every risk system is also a model: designed by people, written in software, and capable of error. The institutions that endure have learned to ask what most traders never do: who measures the measurer?

Why VaR Is Not Enough

The appeal of value at risk is that it condenses a portfolio’s danger into one number. That simplicity is also its weakness. It describes what losses look like on ordinary days and says almost nothing about how bad the worst days can get.

Regulators absorbed the lesson. In its revised market risk framework, the Basel Committee moved bank capital models from VaR to expected shortfall, which measures the average loss once you are already in the tail.

The principle reaches well beyond banks. Rigorous quantitative trading research doubts its risk metrics as much as it doubts its alpha signals. Every metric is tested against historical crises, its assumptions are written down, and changes to its methodology go through independent review. An unchallengeable risk model is just an opinion with decimals.

Constrain How You Trade, Not Only What You Hold

On May 6, 2010, U.S. markets suffered the Flash Crash. According to the joint SEC and CFTC report, a key trigger was a sell program of 75,000 E-mini S&P 500 futures contracts. The algorithm executing it targeted a share of trading volume without regard to price or time.

The position was not exotic. The execution was unconstrained.

Institutions now build execution limits directly into AI trading system development. The toolkit includes price collars that reject orders far from the prevailing market, participation caps, order-rate throttles, and checks that pause an algorithm whenever conditions change faster than its design anticipated. Exposure limits tell you how much you can lose. Execution limits decide how fast.

Defense in Layers

No mature risk architecture trusts a single control. Controls are stacked.

Pre-trade checks reject orders that violate size, price, or credit limits before those orders leave the firm. Intraday monitoring tracks positions and losses in real time, with hard limits that halt trading and soft limits that trigger escalation. Post-trade review reconciles what happened against what was supposed to happen.

Each layer is built on the assumption that the layer before it could fail. That assumption is not pessimism; it is engineering.

Risk Logic Deserves Production Rigor

Ordinary software problems contributed to the London Whale model’s failure: manual processes, too little testing, and weak change control. In institutional algorithmic trading software development, risk logic now receives the same rigor as the trading engine itself. Every change goes through version control and peer review, and new models run alongside check here old ones before any switch is made.

Firms also replay historical crises through their systems to confirm that controls actually trigger. This is where AI trading infrastructure consulting often adds the most value. An outside team with no attachment to the existing design can test whether the safeguards hold under conditions their builders never imagined.

When a Limit Breaks

A limit is only as strong as what happens when it is crossed. Disciplined institutions escalate breaches to people independent of the trading desk, and their default is to reduce risk, never to rewrite the limit.

In risk management, nothing is more dangerous than a breach that gets explained away.

A Four-Question Risk Check

Before trusting any risk framework, ask:

Who validated the risk model, and were they independent of its owners?
How does the system behave in the tail, not merely on an average day?
Could an algorithm lose money faster than a human can step in?
When a limit is breached, which changes: the portfolio or the limit?
Why Risk Numbers Need Doubt

Risk numbers carry a strange emotional power. They let people sleep. They let committees approve. They turn uncertainty into something that looks like knowledge.

That comfort is exactly why institutions surround them with doubt.

The London Whale trades were never hidden. They sat in plain view, measured every day. The danger was never invisible. It was recorded in a number everyone wanted to believe.