In The Devil’s Derivatives, I tried to answer two questions at the heart of the financial crisis. Why did the trading aspect of banking (the ‘casino’) get to grow so big? And why did regulators allow that to happen? My answer hinged upon something called Value-at-Risk that gave bankers and regulators confidence that risks were measurable, were small compared to trading positions and could be controlled.

It’s now the twentieth anniversary of the invention of VaR at JP Morgan in the early 1990s, and I recently had the opportunity to Longerstaey Q&A, who was one of its principal inventors.

The basic story has been told many times. Dennis Weatherstone, the English-born chairman of JP Morgan wanted to understand the risks of the bank’s fast-growing trading business. “At the end of the day, I want one number”, Weatherstone told Longerstaey and the risk team. The result was VaR.

What fascinated me was that in the fullness of time, Longerstaey was prepared to speak frankly about the real business context behind VaR. An explanation was needed because having invented what was seen as a sophisticated risk management tool putting it light years ahead of other trading firms, JP Morgan decided in 1994 to do something surprising. The bank put this valuable intellectual property in the public domain, publishing what it called the Riskmetrics technical document, which Longerstaey co-authored.

“Nobody at the time really understood the main objective of the firm”, he said. “Usually when banks offer something for free there’s a reason behind it”. The reason was regulation. It’s worth quoting Longerstaey’s words in full.

“The regulators at the time were starting to think about moving on from the Basel I framework and impose capital requirements on trading books. The first incarnations were very simplistic and didn’t take into account any diversification, and therefore would have been very punitive for the bank. So Riskmetrics was more than a client tool, it was a way to popularise these methodologies so that all the banks would go to the regulators and ask to be allowed to use internal models to lower their capital requirements. This is one of those things that may have had positives and negatives”.

In other words, a regulated US bank with access to Fed liquidity and deposit insurance wanted to break into the trading casino and build up trillions of dollars of positions in swaps and other derivatives. By releasing a free tool that clients and competitors would start using to manage risk, JP Morgan would enlist an entire industry to lobby on its behalf.

The ploy was wildly successful. Only a couple of years after VaR entered the public domain, the Basel committee amended its rules to allow banks to use VaR models to calculate their trading book capital. As Longerstaey points out, there wasn’t more to VaR than a statistical significance test combined with Harry Markowitz’s theory of portfolio diversification.

The trick was that once adopted by regulators, that single number demanded by Weatherstone became a sliver of capital underpinning enormous, complex balance sheets, creating a grotesquely over-leveraged bonus machine that eventually stampeded over a cliff in 2008, the year that Weatherstone died. “Dennis, you created a monster by asking for that one number” is how Longerstaey puts it today.

For me, the JP Morgan strategy of encasing a regulatory payload in a sugar-coated pill of a ‘free’ gift to the industry evokes examples from technology and biology. In computing we have ‘trojans’, where attractive software applications contain a hidden payload that serves some nefarious interest. Examples abound, from the Stuxnet worm that ravaged Iranian nuclear plants, to the surveillance worms that UK companies are exporting to authoritarian regimes in the Gulf.

In evolutionary biology, we have the selfish gene that hands out attractive freebies in order to perpetuate itself. Sex and orgasms are examples of fun stuff that our DNA packages into our bodies to keep itself going. You could say that JP Morgan’s VaR freebie persuaded regulators to bless marriages such as Deutsche Bank-Bankers Trust in 1998 and JP Morgan-Chase Manhattan in 2001, watershed moments for the success of giant bank DNA.

Although VaR is supposedly ‘discredited’ at a moment when regulators are ensuring it is more powerful than ever, spreading from banking into insurance and fund management. Plus ça change: Deutsche Bank is currently refining its internal model to reduce its capital requirements, while JP Morgan, having lost five billion of dollars more than its VaR a few months ago in its CIO unit, just announced some ‘improvements’ to its model that increased the VaR number by $30 million.

So what would happen if VaR was taken out of bank regulation? Immediately, the intellectual crutch for highly-leveraged complex banks would disappear. Deprived of their fancy radar screens, regulators would have to break up large banks that they could no longer pretend to understand, while increasing their capital to the level of a typical hedge fund.

That’s unlikely to happen though. Like sex and computer viruses, it’s very hard to stop stuff like this once it gets started.