The London Whale

JPMorgan went over its own risk limits more than 330 times. Every warning was reported. None stopped the trading. $6.2 billion followed.
Invariance | Arc · March 2026

What happened and what failed

JPMorgan's Chief Investment Office built a large credit derivatives position that expanded rapidly in early 2012. The losses were significant, and repeated internal limit breaches allowed the exposure to grow further.

Why warnings did not stop it

The bank had measurement, reporting, and escalation. It did not have a control that could turn warning into constraint once the portfolio moved outside approved limits.

What the structural lesson shows

This case shows that visibility does not control consequence. The critical gap was at the point where new exposure became binding on the organization.

The Implication: Access, alerts, and escalation were present. Authority over consequential action was not structurally enforced.

Sources

[1] U.S. Senate Permanent Subcommittee on Investigations, "JPMorgan Chase Whale Trades: A Case History of Derivatives Risks and Abuses," Report, March 15, 2013, pp. 1-301. Portfolio grew from $51 billion to $157 billion notional in Q1 2012.

[2] JPMorgan Chase & Co., Report of the Management Task Force Regarding 2012 CIO Losses, January 16, 2013. Total losses of $6.2 billion confirmed by year-end 2012.

[3] Senate PSI Report, Exhibit 1i and findings summary. "From Jan. 1, through April 30, 2012, CIO risk limits and advisories were breached more than 330 times." Breaches were routinely reported but did not trigger remedial action.

[4] Senate PSI Report, pp. 12-13, 170-176. New VaR model adopted in late January 2012, during active limit breach, "artificially lowered calculated risk by 50%" overnight. The bank did not obtain OCC approval as required.

[5] Senate PSI Report, pp. 170-176; Zeissler, A.G. and Metrick, A., "JPMorgan Chase London Whale C: Risk Limits, Metrics, and Models," Journal of Financial Crises, 2019. Model relied on manual data entry in Excel spreadsheets; errors compounded risk understatement.

[6] Senate PSI Report, pp. 231-245. OCC was notified of risk limit breaches but "failed to investigate multiple, sustained risk limit breaches; tolerated incomplete and missing reports from JPMorgan; failed to question the bank's new value-at-risk model."

[7] JPMorgan Chase & Co., 2012 Form 10-K; CFTC Docket No. 14-01, October 16, 2013. JPMorgan agreed to pay $920 million in fines to U.S. and U.K. authorities. CFTC charged the bank with "manipulative conduct" in connection with the trades.

Related briefs

Browse all insights

Claude Code: The Publish That Changed Every Enterprise's Security Posture

When Agents Learn to Cooperate