The criticism of the Value at Risk concept, along with the statistical apparatus accompanying it, already has a rich tradition. Artzner et al. (1999), Danielsson (2000), Danielsson et al. (2001), among others, have repeatedly pointed out that the estimation of distant distribution quantiles — such as 0.99 or 0.999 — is a task lying at the very limit of what available statistical methods can accomplish, one burdened by errors reaching entire orders of magnitude. This problem, well recognized and repeatedly described in the literature, is not the subject of the present paper. This article poses a different, narrower question — one that, it would seem, has not thus far been addressed directly: not whether we are able to reliably estimate the value located at the 0.999 quantile, but rather how the interpretation of the 0.999 quantile as an event occurring "once in 1,000 years" is to be understood. In other words, the object of the analysis is not the quality of estimation at the distant quantiles of distributions, but the validity of the temporal interpretation itself that is ascribed to the results of such estimation.

This distinction is key to understanding the contribution of this paper. Even if one had at one's disposal an ideal risk model, free of estimation error, the question of what the claim that its result corresponds to a 1,000-year event actually means would remain open. The temporal interpretation of the quantile is not, as this article seeks to demonstrate, a necessary element, nor one that follows intrinsically from the construction of such a model. It is a convention — borrowed, though never explicitly identified as such, from an entirely different field: hydrology, where, at the turn of the nineteenth and twentieth centuries, the concept of the return period was developed to describe phenomena such as the hundred-year flood. This convention, however, requires an additional assumption — the indexing of successive realizations of the phenomenon, of successive random variables, by means of time — the validity of which, in the world of socio-economic phenomena, is considerably more difficult to justify than in the world of physical phenomena, governed by fixed astronomical cycles. What is more, hydrology itself, faced with years of criticism (Pielke, 1999; Read and Vogel, 2015; Stedinger, Vogel and Foufoula-Georgiou, 1993), has already revised the way in which this concept is communicated, pointing to its misleading nature. The world of finance, it would seem, has not yet undertaken this reflection.

The 0.999 quantile relates directly to the systematic factor M in the ASRF model, corresponding to a 99.9% confidence level, which can be written as (Jorion, 2007): "P(− M ≤ m) = 0.999, or M = N⁻¹(0.999)." The value of the 99.9% quantile in the IRB model is thus a level of extremity established within the calculation formula itself, for systematic risk shared by all market participants. In the domain of operational risk, for the internal model (AMA), the safety level and the time horizon were formulated in the document (EU, CRR, 2013), Article 322(2)(a): "The operational risk measure shall capture potentially severe tail events, achieving a soundness standard comparable to a 99.9% confidence interval over a one year period." The supervisor borrowed this calibration level from credit risk: "[…] soundness standard comparable to that of the internal ratings-based approach for credit risk, (i.e. comparable to a one year holding period and a 99.9th percentile confidence interval)."

For both risks — credit and operational — an annual time horizon was set. For market risk, which is addressed to a lesser extent in this paper (there is no talk here of a 1,000-year event), the safety level was set at the 0.99 quantile, at a 10-day time horizon. Temporal interpretations were not included in the principal supervisory documents.

The temporal interpretation of the 0.999 quantile for operational risk models (AMA) appears in a lower-order document, the guidelines (BIS, BCBS, 2011): "Just in limited cases, for example when the biggest data point is demonstrated to be larger or equal in amount to the event that occurs less than once in 1000 years […]"

In operational risk, then, following the interpretation developed in the domain of credit risk, the same manner of defining extremity was adopted — as an event occurring no more frequently than once in 1,000 years. Importantly, here too no reasoning is presented for such an approach, and this interpretation of the quantile is not justified.

As can be seen, the regulator has explicitly indicated how the values at the 0.999 quantile are to be read — as once-in-1,000-year events. This, however, does not resolve the problem of model verification derived earlier. For how is one to imagine a 1,000-year event? It may be worth verifying the correctness of such an interpretation within the academic literature.

The Widespread Interpretation of the 0.999 Quantile as Once in 1,000 Years

When we turn to the academic literature, it becomes apparent that the interpretation of distant quantiles as 1,000-year events is widespread. Jorion (2007) essentially repeats the regulator's formula:

Hull (2018) does the same: the capital "should be sufficient to cover unexpected losses of a magnitude that, over the coming year, should not, with 99.9% probability, be exceeded. WCDR denotes the probability of default at a level that (theoretically) occurs once every thousand years." Genest and Brie (2013): "That's why the confidence level is set at 99.9%. It means a bank can have losses that exceed its tier 1 and tier 2 capital on average once in a thousand years." Milonas and van Vuuren (2024): "[…] a confidence level of 99.9% is sufficient since losses that exceed the ULs are predicted to occur only every 1000 years because the PDs used are annual PDs." Similar temporal interpretations — likewise applied to other quantile levels — can be found in the works of Danielsson (2000), Reinhart and Rogoff (2009), Laubsch and Ulmer (1999), and Kiema and Jokivuolle (2013).

The temporal interpretation of quantiles is thus widespread. Interestingly, it is difficult to find any derivation for precisely this temporal understanding of such extreme quantiles.

Let us return, however, to the problem of verifying the model's consistency — its 0.999 quantile — against reality:

How, then, is one to imagine a 1,000-year event? It was decided to seek the answer more broadly, in other domains, where similar definitions might operate.

The return period for such an event is:

For an exceedance probability of 1 − p = 0.01, the return period amounts to 100. What remains is the question of the unit for T = 100. It is worth noting that flow researchers made use of the so-called block maxima method (EVT I is likewise built on this method). This means that, from all flow observations, only a single one is selected — the maximum for a given period (block). The period is most often a year. From this, T = 100 years emerges naturally, giving us a 100-year event.

It should be added here that the return period T is the expected return period. In reality, this value is described by a distribution — the binomial distribution, which is the distribution of binary variables (exceedance, no exceedance). For large samples, this may, of course, be approximated by the Poisson or normal distribution.

Table 3: Probability of the first exceedance occurring exactly in year k, and the probability of the first exceedance occurring by year k, for the 100-year event (with period T = 100 years) and the 1,000-year event (with period T = 1,000 years)

Source: own elaboration

We thus have:

The key parameter here is the predefined extremity level, the quantile p. If we take p to be, say, 0.999, then the exceedance probability is 1 − p = 0.001. The level p is also referred to as the confidence level.

It is precisely on this concept — Value at Risk — that the financial safety architecture has been built. Credit, operational, and market risk models, as well as various modeling constructs within the domain of internal capital, derive their final readings precisely by means of the VaR method. The key parameter is the extremity level p, predefined at the following levels: 0.999 for credit and operational risk, 0.99 for market risk.

From the VaR formula, the definition of the return period can likewise be derived. Let us assume that a model describes a bank's risk profile, the variable R. This risk may materialize with the probabilities embedded within the very definition of this variable. For instance, with probability \(p = 0.001\), an extreme value — the VaR level — may materialize. An exceedance of the VaR level may thus occur. We may also consider a sequence of different risk profiles \((R_i)\). This can likewise be written as a sequence of binary variables \(\left(I_{\{R_i > VaR\}}\right)\). This, in turn, can take on only two values:

One can ask the question: which of the risk profiles R belonging to the index set I will assume a value higher than the VaR level. This can be written as:

which will denote the index of the risk profile at which an exceedance of the VaR level — that is, for instance, an exceedance of the 0.999 quantile — occurs for the first time. Now, if we adopt the assumption that the index in this sequence is time, and that the horizon is annual, then, for p = 0.999, we have an exceedance chance of 0.001, meaning an exceedance occurring once every 1,000 occurrences — that is, once every 1,000 annual periods. The concept of the 1,000-year event thus emerges.

Statistical Properties versus the Question of Time

A distinction needs to be drawn between the statistical properties from which probability readings derive, and the temporal interpretation, which does not follow from these properties, but arises in a different — "non-statistical" — manner. A reading of the exceedance probability, say 0.001, derives from the binomial or geometric distribution — depending on what one wishes to read off. These distributions, in turn, are formed from the aggregate phenomenon of many binary variables (exceedance, no exceedance). These binary variables simply compose into such distributions. What remains is the question of indexing these binary variables. This can be done in various ways, and the appropriate definition of the return period emerges depending on the method chosen. If we assign no interpretation at all, we speak of a "1,000-index" event — the expected value of the exceedance occurs at the 1,000th binary variable (marked with index i = 1,000). If we use the index to denote different institutions and their risk profiles, we obtain an event occurring once every 1,000 institutions; if, instead, we build 1,000 different models for a risk profile, the exceedance occurs at the 1,000th model. As can be seen, indexing by time is merely a convention, and it is only under this convention that a 1,000-year event can arise. What matters here is that the emergence of the 1,000-year event does not follow from the statistical properties, but precisely from the indexing convention.

Indexing by Time - Tacit Assumption

Embrechts, Klüppelberg, and Mikosch (1997), in deriving an example illustrating the concept of the return period, write: "Here we tacitly assumed that a structure failure for each year i can be modeled through the event \(\{X_i > u\}\)." We thus see the operation of a "tacit assumption" of indexing by time. In hydrology, this assumption is justified. The block maxima method adopted there imposes annual periods — annual maximum flows are modeled. This is consistent with the astronomical cycles of nature — the Earth's orbital motion. In the case of socio-economic phenomena, this is no longer so self-evident. It is difficult to say how long individual phenomena last — those that underlie the binary variables which, taken together, form the binomial (or geometric) distribution. In order to compose such a distribution, however, the independence of these variables is required. They must play themselves out, must exhaust their probabilities (much as a game of poker must be played through to its end — and each game, together with its associated probabilities, may take a different amount of time). If they are not played through to completion, the probabilities will bleed into one another across these variables, and they will not, in that case, be independent. It is then impossible to compose a binomial distribution. Nor is it possible, in that case, to obtain a reliable quantile reading from such a distribution — there is, accordingly, no 1,000-year event. How long do socio-economic phenomena last, and is this duration constant? It is not known. This is difficult to calculate. It is also doubtful that it would always be the same duration. The world, after all, is accelerating, and phenomena that once took many years to unfold may now play themselves out over a matter of months.

Notwithstanding this, the world of economics applies precisely this "tacit assumption" of indexing by time, deriving from it concepts such as the 1,000-year event.

The concept of the 1,000-year event arises outside the model (or the risk profile) — only once we carry out the mechanics of composing risk profiles into a sequence, and index that sequence by time, under the "tacit assumption."

If, then, the concept of the T-period event is not written into the mechanics of the model — if it is an external object — what purpose is served by a definition formulated in this way, and by the underlying process of sequencing the variables on which it rests? What is its practical application?

Backtesting — The Natural Domain for the T-Period Event

The application of the mechanics described above became sanctioned within the world of finance in the context of the problem of verifying extreme value models. Reasoning of this kind was already presented in the J.P. Morgan (1996) study, as well as in the work of Kupiec (1995). Testing exceedances precisely by arranging independent binary variables into a sequence, along the time axis, relates directly to these mechanics. The supervisor sanctioned such a backtesting method for market risk. There, exceedances of the 0.99 quantile of risk models, observable in days, are tested. This gives rise to the concept of a T-day event — for instance, a 100-day event. A problem of stationarity naturally arises here, though for periods measured in days this would seem to be a solvable one. For credit and operational risk — where, on account of the higher level of difficulty (the 0.999 quantile at an annual horizon), a verification tool of this kind would be of even greater usefulness — the supervisor formulated no backtesting methods. This is, of course, understandable. For how, indeed, is one to test a 1,000-year event? Institutions building such models were nonetheless left without recourse. No tools exist for verifying these super-extreme models. Jorion (2007) commented on this, anticipating, as it were, the course of events to come, writing: "The true test of these new models will come during a major economic downturn."

With respect to the concept of the 1,000-year event, it must be noted here that, owing to the absence of a natural domain within which such an event could be derived — the domain of the backtesting procedure (where the concept of the 100-day event was, precisely, derived) — this definition vanishes. There is no way to derive a 1,000-year event.

Model Calibration Invalidates the "Once in 1,000 Years" Definition

What, however, if we did have such a test at our disposal — for instance, by shifting the tested quantile to the 0.9 level, which would make it feasible, in that case, to test a 10-year event? We would then still need to ensure stationarity over such a ten-year period. This, however, may prove difficult. Perhaps, though, this is not a problem at all. Let us note that models are calibrated on a continuous basis. This, in turn, anchors the model in current reality. The model, through calibration, shifts along with a changing reality. Each time, after every such shift, it indicates the probability of a VaR exceedance here and now, over the coming year. The requirement of calibration thus removes, from the conceptual space, any notion of a T-period event whatsoever. What concerns us is current reality, to which we adapt on a continuous basis.

Let us note that matters stand differently in the world of hydrology. Flood barriers cannot be recalibrated every year; they cannot be raised and lowered on such cycles — this would be too costly. Such barriers must, therefore, be resilient over a certain time horizon. There, then, the concept of a T-period event — say, the 100-year flood — is considerably more natural.

Much suggests, then, that we are dealing with an axiomatic vacuum surrounding the definition of the 1,000-year event. This is not, of course, a matter of the broadly understood axiomatic field. On an extensive map of concepts and definitions, the 1,000-year event can indeed be derived — as it was, for instance, within the Dyke Project, in the construction of flood-defense dikes. What is at issue here, rather, is the regulatory space of axioms, practical definitions, and applied approaches. On this particular map, it is difficult to find any sound derivation of the concept of the 1,000-year event as a point of reference for the safety level to which risk models ought to be calibrated.

It would thus seem that the concept of the "once in 1,000 years" event, so widespread in the world of finance, is merely a certain artifact [1] , and, moreover, an empty one. This concept appears to have no explicable application whatsoever. Nor does it add any value — it does not help us better interpret model results against the map of reality as it actually operates, and as it manifests itself in the form of losses recorded on accounting ledgers. Perhaps, then, this concept is simply unnecessary?

Pielke likewise emphasized the practical significance of the misunderstandings that arise from such erroneous definitions:

Read and Vogel (2015), meanwhile, address the social consequences of the misunderstanding of risk:

Read and Vogel conclude that the definition of the return period, and the communication of risk by means of it, is problematic even under conditions of stationarity. This definition does not communicate the true risk of catastrophe. In addition, stakeholders — including policymakers, engineers, insurers, and ordinary citizens — misinterpret the return period precisely as "once in 100 years." Under conditions of non-stationarity [2] , they argue, matters are worse still. The return period no longer depends on a fixed probability p; p now varies over time, which entails an instability in the interpretation of the so-called 100-year flood.

Pielke (1999) states that the only correct definition for the 100-year event is: "[…] flood that has a one percent chance of being exceeded in any given year." He goes on to point out that the 100-year flood is not a natural concept, arising from properties inherent in nature. It is, rather, a definition constructed by scientists and engineers, developed on the basis of historical observations — one that ought to be dynamic, given changing natural conditions and the emergence of new observations. Pielke advocates a return to a legitimate, probability-based communication of risk (a 0.01 chance of exceedance). He notes, however, that supervisory definitions are not easy to change.

Banks Develop Their Own Definitions → Dispersion of Model Results

Ultimately, faced with difficulties in adopting an adequate definition of the 0.999 quantile, each bank, one may presume, develops its own individual definitions. This results in a manner of feeding data into the model that corresponds to the definition adopted for its own purposes — data suited to estimating the value at a quantile understood in this particular, bank-specific way. This, in turn, may lead to discrepancies in capital estimates, potentially reaching entire orders of magnitude, even among very similar banks. Since no clear definition exists, each bank can, after all, conduct its own investigation into the interpretation of the 1,000-year event concept, in its own particular manner.

It is worth recalling, at this point, that the construction of the anti-crisis barrier, unlike a physically existing flood-defense dike, is a virtual object. At the level of the individual institution, this barrier exists as protective capital — an entry on an account — and the magnitude of this entry is determined precisely by risk models. Given the ambiguity of the supervisory definitions, an imagined object of this kind is easy to negotiate. Since it is unclear what we are actually protecting ourselves against, and since no tool exists to anchor the model and its results to reality, one can, without much difficulty, find justifications for widely differing results — differing even by an order of magnitude — at the 0.999 quantile of such a model. Perhaps, then, it is precisely this unclear system of definitions and concepts that ought to be regarded as the main component of the aggregate termed model risk. Perhaps it is precisely the materialization of this risk that the regulator noted in its reflections (BIS, BCBS, 2017):

What Does the Unexpected Situation Look Like at the 0.999 Quantile?

An additional problem is the absence of any debate concerning the shape of the unexpected situation for the individual risks. Threats ought to be named, and their mechanics described. Only then, in verifying a model, could the safety level determined by that model be related to the situation to which this level is meant to correspond.

In the case of the IRB model, described on the normal distribution, the mechanics can be read off through a structural analysis of the calculation formula. The unexpected situation here is a bank being flooded by the sheer number of defaults, rather than by their value — this latter parameter is not stressed here. Matters stand differently in the case of the AMA method for operational risk. There, the unexpected situation was meant to take shape on its own, as the outcome of a play of forces that had to be accounted for within this actuarial concept: the frequency of events, the severity of events. What effects could arise from this "play" is described in the article (Buczak, 2026b). The final object of such a model — the aggregate distribution — could assume a shape entirely surprising to supervisors. The unexpected situation emerging from it could likewise present a rather non-obvious picture. The 0.999 quantile thus acquired new, hitherto unknown meanings and interpretations.

The problem, then, lies in the possible absence, within the regulatory conceptual system, of fundamental structures — such as, for instance, the shape of the unexpected situation corresponding to each of the risks catalogued under Pillar I. The existence of definitions of extreme situations, and of the mechanics underlying their formation, might help in constructing better-suited frameworks, and, equally importantly, would allow those to whom these regulations are addressed to better understand the shape of the dangers involved, and to calibrate the models they build accordingly.

And What If the Problem Lies Even Deeper: Perhaps Risk Is Endogenous?

Perhaps all of the definitions and methods discussed above ought to be invalidated altogether. If risk is endogenous, as Danielsson argues in his well-known article "The Emperor Has No Clothes" (2000), [4] , the situation is substantially "simplified." If it is market participants themselves who generate risk — with regulations and levels of the 0.999 type serving merely as a parameter within this very process of risk generation — this means that risk is not an external phenomenon. It cannot, therefore, be modeled from the position of an independent observer whose actions have no bearing on its level. The entire line of reasoning pursued thus far would, accordingly, be beside the point.

If risk is endogenous, it is not random. We cannot, then, model it by means of a random variable, in accordance with the rules of combinatorics, or of probability theory more generally. The binary variable flagging exceedances is likewise not a random variable, and it is thus not possible to compose a sequence of such variables into a binomial, Poisson, or geometric distribution (when speaking of the time to first exceedance). A consequence of this is the impossibility of formulating events of the T-indexed, T-period, or 1,000-year type. In a single stroke, then, we may invalidate the entire conceptual system. We are left, in that case, without any statistical tools for determining risk levels and establishing safety levels.