Value at risk software takes a fund's positions, prices and history and returns its VaR, its component VaR by position, backtests and what-if revaluations. For a fund under SEC Rule 18f-4 that is necessary and nowhere near sufficient: the rule requires the VaR to be compared with a reference portfolio every business day, a breach to be fixed promptly, the board to be told in writing after five business days and Form N-RN filed within one business day after that, with five years of records behind every number. The SEC itself observed that VaR tools "are widely available" and that many advisers already had them. The expensive failures happen around the engine, not inside it: a price patched by hand that hides a breach, a correct breach that nobody counts, a filing that disagrees with the run. The SEC's own figures show the scale, from $2,420 to prepare a Form N-RN to a $400,000 civil penalty in an order that included late ones. Botminds' Derivatives Risk Management Program is the layer that sits on top of the VaR software a firm already uses, and this guide is honest about where that layer helps and where it does not.
Costs on this page are the SEC's own estimates and its enforcement order, plus clearly labelled arithmetic. Software vendors do not publish their prices, and no regulator or independent study collects them, so none are quoted. Sample screens show a fictional firm.
The filing costs $2,420; the order that included two late ones cost $400,000
What does value at risk software do, and what does Rule 18f-4 need after it?
VaR software, often called a risk engine, revalues a portfolio under many market scenarios and reports the loss at a chosen percentile, usually with attribution by position or factor and tools for backtesting and stress testing. Rule 18f-4 fixes the parameters it must run with: 99% confidence, 20 trading days, at least three years of data, and every significant risk factor including options' nonlinearity and volatility. The SEC chose not to prescribe a model and allowed a fund to "obtain the VaR from a third-party vendor instead of analyzing it in-house" (adopting release).
Everything after the number is the program. The rule requires the fund to compare its VaR with its designated reference portfolio's at least once each business day, come back into compliance "promptly", escalate material risks to portfolio managers, count five business days, report to the board in writing, file Form N-RN, backtest and stress test weekly, review the model annually and keep it all for five years (17 CFR 270.18f-4). An engine produces one input to each of those steps; none of them is the engine's output.
What does a derivatives risk management program cost?
The SEC's estimate, made when it adopted the rule in 2020, is $150,000 to $500,000 per fund to establish a program and $97,500 to $375,000 a year to run it, the lower end better reflecting funds in a complex that share the work. It expected about 2,766 funds to need a program and put the industry's first-year cost at up to $684,585,000. These are the SEC's estimates, not surveys, and they are six years old; no regulator or independent study has published a newer figure.
The SEC's cost estimates for a derivatives risk management program
$150k–$500k
one-time cost per fund to establish the program
$97.5k–$375k
ongoing cost per fund per year, 65% to 75% of the one-time cost
2,766
funds expected to need a program, about 21% of funds
$684.6m
upper estimate of the industry’s first-year cost
The SEC also said where the money goes. The one-time list runs from assessing whether a fund is in scope, through writing guidelines and processes for stress testing, backtesting, escalation and review, to "recruiting and hiring a derivatives risks manager". The ongoing list is monitoring, reviewing the models and the reference portfolio, board reports, training and, where needed, the derivatives risk manager's salary. Almost none of it is buying a VaR engine; the SEC noted that some "third-party data used in the program's stress tests may not vary much across funds".
What does a VaR breach cost a fund?
A breach that is cured inside five business days costs a trade and some attention; one that is not, or is cured badly, can cost far more. The SEC's July 2026 order against Simplify Asset Management shows both sides. When an ETF's VaR test failed on April 26, 2024, its portfolio manager first bought calls to reduce the exposure; the ratio kept rising, to as high as 291%, and on May 2 the fund fell by more than 8% in one day, mainly because the position was partly unwound (Release IC-36269; settled, findings neither admitted nor denied).
The cost of a cure depends on the choice of trade, and that choice needs prices. In the fictional sample firm's data, the risk engine priced three ways back under the limit for a fund at 214%: cutting 1,450 euro rate futures, to 191% for about $0.21 million in trading cost; a mixed cut of rate and bond futures, to 193%; or buying put options on euro rates, to 197% for about $1.9 million in premium. The portfolio manager chose the first. A program that sees a breach on day one has time to compare options; one that sees it on day four takes whatever trade is fastest.
Every breach on its five-day clock, with the ways back priced
What is the cost of a late Form N-RN?
Preparing the form is cheap: the SEC estimates about four hours of lawyer and programmer time, $2,420 a filing, and expects roughly 31 filings a year across all the events the form covers (91 FR 58935). Filing it late is where the cost lies. In the Simplify order, the fund's two breaches each lasted five business days or more; the board heard on August 8, 2024 and the filings came on August 9, about three months after the first was due. The order found the adviser caused violations of Section 18(f)(1) and Rule 30b1-10, and one $400,000 penalty covered those findings and several unrelated ones.
The form's confidentiality does not protect a late filer. General Instruction A(1) says the SEC does not intend to publish information identifiable to a registrant, but reserves the right to use what a fund reports in enforcement (Form N-RN). The Form N-RN instructions, read through that breach day by day, show where the clock was lost.
Four ways a VaR day goes wrong, and what each costs
Most wrong days fall into four kinds, and they differ in who notices and when. Two of them produce a wrong number; two produce a right number that nobody acts on correctly. Software that only computes VaR can prevent none of the four on its own.
Four errors around a daily VaR test, and their consequences
| Error | How it happens | What it costs | Who notices, and when |
|---|---|---|---|
| A hidden breach | A patched price, stale index weights or a missing position lets a failing fund pass. | A breach that runs past five business days unreported: late board reports and Form N-RN, and a record that shows a passing day that was not. | Often only at backtesting, a later review or an examination. |
| A false breach | Bad data makes a passing fund fail. | An unnecessary remediation trade at market cost, and a portfolio manager who trusts the next alert less. | The portfolio manager, the next morning, if the data error is found. |
| A lost count | A real breach is counted on the wrong calendar or from the wrong first day. | A board report or a filing a day late, or a filing made when none was due. | The board, the SEC or nobody. |
| A mismatch | A ratio retyped into the limit report, the board report or the filing differs from the run. | Board materials and regulatory filings that cannot be reconciled with five years of daily records. | An auditor or examiner, comparing documents. |
The first is the most dangerous because the program records it as a good day. It is also why a second, independent calculation matters more than a faster engine: an engine run twice on the same patched price gives the same wrong answer twice. One VaR ratio traced from positions to the board report follows where each of these errors can enter.
Is VaR software enough for Rule 18f-4?
No, and the SEC did not expect it to be. In proposing the rule it observed that "VaR calculation tools are widely available, and many advisers that enter into derivatives transactions ... already use risk management or portfolio management platforms that include VaR capability." The rule's costs and its failures are in the parts no platform's VaR function covers: deciding what is normal, escalating, counting, reporting and keeping the evidence.
The stakes are rising with use. Registered funds held about $5.7 trillion of derivatives notional in March 2026, up from about $5.0 trillion in April 2025, unadjusted for delta or duration, and the number of ETFs with equity options notional above 5% of net assets rose from 606 to 801 over the same year (SEC Registered Fund Statistics). More funds near the line means more breaches to count and more board reports to write.
What to look for in value at risk software for funds
Judge VaR software by what it gives the program, not only by its model. The engine must meet the rule's parameters and capture options properly; beyond that, the questions are whether its outputs can be checked, explained and reused without retyping.
What to ask of value at risk software for a Rule 18f-4 program
- The rule’s parameters, locked
99%, 20 trading days, at least three years, with full revaluation of options and a volatility factor.
- Two VaRs from one model
A 20-day VaR for the limit and a one-day VaR for the weekly backtest, on the same positions.
- The reference portfolio’s VaR
From the index provider’s weights or index levels for the test date, with the blend’s history.
- Component VaR and what-ifs
Attribution by position to explain a breach, and re-pricing of proposed trades before anyone trades.
- Outputs a second process can check
Results and inputs exported with run identifiers, so an independent calculation and the reports can cite them.
- Five years, any day
Every day’s fund VaR, reference VaR, ratio and model version retrievable, as the rule’s records require.
How to measure the cost of a wrong VaR day on your own funds
No regulator or independent study publishes how often fund VaR tests go wrong, so the honest number is your own. A year of a program's records is enough to estimate it, using four counts that any firm can take from its runs, emails and board materials.
First, count the days a fund was tested on incomplete or corrected inputs: prices filled forward, net assets replaced the next morning, index weights from the wrong date. Second, re-run a sample of past days independently and count the ratios that do not reproduce within a stated tolerance. Third, list every breach and its timeline: first failed test, first notice to the portfolio manager, board notice, filing, and back in compliance. Fourth, compare the figures in each quarterly board report and each N-PORT median with the daily runs they summarise.
Then price the time. The SEC's own Form N-RN estimate uses a blended rate of $605 an hour, from $774 for a lawyer and $436 for a computer programmer, derived from Bureau of Labor Statistics wage data (91 FR 58935); the same rates give a defensible price for the hours spent reconstructing a day, re-running a test or rewriting a report. Add the trading cost of any remediation done in a hurry. The total is a firm's own cost of error, and the four counts show which of the four errors it comes from.
Where Derivatives Risk Management Program fits, and where it does not
It does not replace VaR software. Derivatives Risk Management Program has no VaR model of its own: its Test agent runs each fund's test on the firm's risk engine, and its Verifier agent recomputes the ratio from that engine's component VaRs and the index provider's weights. A firm without an engine needs one first.
What it adds is the program around the number, aimed at the four errors above. The Data agent holds a fund with missing prices instead of testing it on yesterday's. The Verifier stops a ratio it cannot reproduce. The Escalation agent counts business days on the exchange calendar from the first failed test. The Reporting agent carries the same figures into the board report and Form N-RN, and every step lands on a sealed audit trail.
Derivatives Risk Management Program keeps every test, hold, decision and filing on one sealed trail
The solution's results are design targets on sample data, not measured customer outcomes: every breach and backtest exception explained in plain words, and no late Form N-RN, because the clock is counted and the filing drafted before it is due. How it sits beside an existing engine, order management system and fund accounting is the subject of software for managing investment risk: keep the VaR engine; the program itself is on the Derivatives Risk Management Program page.
Questions people ask
How much does value at risk software cost?
Vendors do not publish list prices, and no regulator or independent study collects them. The SEC's 2020 estimate for a whole derivatives risk management program, of which VaR software is one part, is $150,000 to $500,000 per fund to set up and $97,500 to $375,000 a year to run, with the lower end more typical for funds in a complex.
Does the SEC require a particular VaR model or vendor?
No. Rule 18f-4 fixes the confidence level, horizon, minimum history and risk factors, and leaves the model to the fund. A fund may compute VaR in-house or obtain it from a third-party vendor, and need not use the same model for its reference portfolio.
What does value at risk software for mutual funds need that bank VaR software may not?
A reference portfolio VaR for the relative test, results expressed against net assets, a 20-day horizon on at least three years of data, and outputs that feed Form N-PORT, Form N-RN and board reports. Software built for bank trading books follows bank capital rules, which, for example, backtest one-day VaR over 250 business days for a capital multiplier; the fund-specific pieces usually have to be configured or added.
What happens if a VaR breach is cured within five business days?
No Form N-RN is due and no five-day board report is triggered. The fund must still come back "promptly", inform portfolio management under its program, and include the exceedance in the derivatives risk manager's regular reports to the board.
Can a VaR engine run the whole Rule 18f-4 program?
It can run the calculations: the daily VaR, the backtests and the stress scenarios. The rule's other requirements, from escalation and the five-day count to board reports, Form N-RN and five years of records, are processes and decisions that sit outside the engine and need people, workflow and evidence around it.