Trading Risk Transfer Authority Failure Through Position-Taker Modifying Its Own Risk Measurement Model at JPMorgan Chief Investment Office

JPMorgan's Chief Investment Office was responsible for managing the bank's excess deposits — approximately $350 billion in assets. Its stated purpose was to invest conservatively and hedge the bank's overall credit exposure. The CIO operated under the same risk management framework as the bank's trading operations: position limits, Value at Risk calculations, risk committee reporting, and internal audit. VaR — a statistical measure estimating the maximum expected loss over a specified time period at a given confidence level — served as the primary metric for constraining how much risk the CIO's trading activities could take.

By late 2011, the CIO's Synthetic Credit Portfolio, managed by Bruno Iksil in London, had accumulated large positions in credit default swap indices. The positions were growing to a size that made Iksil's trades visible to the broader market — counterparties and hedge funds began noticing the concentrated activity. The positions were also approaching or exceeding the CIO's VaR limits. Rather than reducing the positions to comply with the limits, the CIO proposed a change to its VaR model.

In January 2012, the CIO implemented a new VaR model that approximately halved the reported risk of the Synthetic Credit Portfolio's existing positions. Under the old model, the CIO was at or breaching its VaR limit. Under the new model, the same positions fell comfortably within the limit. The model change was formally proposed and approved through JPMorgan's model governance framework. The new model used different calculation methodologies producing lower volatility estimates for the types of positions the CIO held, allowing it to maintain and expand positions without triggering limit breaches.

In April 2012, Bloomberg News and the Wall Street Journal reported on unusually large credit derivative positions from JPMorgan's London office, with market participants calling the unknown trader "the London Whale." CEO Jamie Dimon dismissed the concern as "a complete tempest in a teapot" on an earnings call. By May, the positions had deteriorated sharply. On May 10, JPMorgan disclosed losses of approximately $2 billion, a figure that would grow to $6.2 billion as positions were unwound.

The VaR limit existed as a constraint on the CIO's risk-taking. The VaR model measured whether the CIO was within its limit. The CIO proposed the change to the model that measured its own compliance with the limit. The model governance process approved the change. The structural problem was not that the model change was unauthorized — it was formally approved. The problem was that the entity being constrained was permitted to initiate changes to the measurement that determined whether it was in compliance. The model governance process evaluated whether the new model was methodologically defensible. It did not evaluate — or did not weight sufficiently — the fact that the entity proposing the change was the entity whose positions would appear less risky under the new model.

The JPMorgan Task Force report, commissioned by the bank's board, subsequently found that the new VaR model contained an operational error — a formula implemented in a spreadsheet divided by the sum of two numbers instead of their average, effectively halving the volatility input. Whether this was intentional manipulation or an error that happened to benefit the CIO's position reporting became a subject of dispute. The structural finding was independent of intent: the risk control framework allowed the controlled entity to modify the measurement that determined whether it was within its constraints, and the model governance process did not treat the conflict of interest inherent in that arrangement as a basis for heightened scrutiny or independent validation.

JPMorgan restated the CIO's VaR figures, reverting to the prior model. The CIO was restructured and its risk mandate reduced. Ina Drew resigned. Two CIO traders — Martin-Artajo and Julien Grout — were indicted for concealing the extent of losses through mismarking positions; Martin-Artajo was acquitted and Grout's charges were eventually dropped. JPMorgan paid over $1 billion in regulatory fines across multiple agencies including the SEC, OCC, Federal Reserve, and the UK's Financial Conduct Authority. The Senate Permanent Subcommittee on Investigations published a detailed report finding that the CIO had breached risk limits hundreds of times and that the VaR model change had been used to mask the breaches. The case established the principle that risk model governance must enforce independence between the entity being measured and the entity proposing measurement changes.