Fitting Fat Tails to Funding Spreads

Why Gaussian models say 2008 can't happen, how CIR dynamics generate the right tail weight, and what one missing square root does to your transfer price.

In September 2008, the Moody's Baa-minus-Aaa corporate spread hit 338 basis points. Its long-run average, measured over four decades, sits near 90 basis points. That spike was roughly 3.5 times the mean. Run the number through a Gaussian model calibrated to historical volatility and you get a z-score somewhere north of six. A six-sigma event has a probability of about two in a billion. It happened. Then it happened again in March 2020, when the same spread blew past 250 basis points during the initial weeks of the pandemic sell-off. Two supposedly impossible events in twelve years. At what point do we stop blaming the market and start blaming the model?

The problem is not that spreads moved. Spreads are supposed to move. The problem is that every institution running a Gaussian volatility assumption on its funding cost is implicitly telling its board that crisis-scale moves cannot occur within any planning horizon that matters. The transfer price built on that model systematically undercharges the tail. And the tail is exactly where the institution's survival gets tested.

This is not an abstract statistical curiosity. If your funds transfer pricing framework charges for expected funding cost and some measure of volatility around it, then the shape of the distribution you assume is the price. Get the tail wrong and you underprice every loan on the book. Get it right and you can actually defend the charge when the CFO asks why your FTP rate is 16 basis points above the naive estimate.

What "Fat Tail" Actually Means

Before reaching for stochastic calculus, it is worth staring at the data. The Moody's Baa-Aaa spread series runs from the mid-1980s to the present, roughly forty years of weekly observations. The average sits near 90 basis points. The standard deviation is about 45 basis points. In a Gaussian world, a three-sigma move would take the spread to roughly 225 basis points, and you would expect that to happen about once every 740 weeks, or once every fourteen years. Fair enough. But the actual data shows the spread exceeding 300 basis points on multiple occasions, and spending extended periods above 200. The empirical distribution has a right tail that is visibly heavier than anything a normal curve can produce.

What does this look like? Consider the time series itself.

The shaded band in Figure 1 marks the region a Gaussian model considers plausible at the three-sigma level. Both crisis spikes punch through it. The 2008 event sits so far above the band that a normal distribution would need roughly 14 billion years of weekly draws to produce it once. Are we really comfortable pricing loans with a model that gives those odds to something that actually happened twice in our careers?

The Pull Home: Mean Reversion in Spread Data

Before tackling the tail, we need to establish the center. Funding spreads are not a random walk. They wander, sometimes dramatically, but they come back. Every crisis in the historical record is followed by a compression. Every period of unusually tight spreads is followed by a widening. The spread oscillates around a level that, across four decades, has remained remarkably stable near 90 basis points.

This is not an assumption imposed for mathematical convenience. It is an empirical observation you can verify with a simple regression. Take the weekly change in the spread and regress it against the lagged level. The slope coefficient is negative and statistically significant. When spreads are high, the expected change is downward. When spreads are low, the expected change is upward. The data pulls itself home.

In continuous-time notation, this pull is captured by two parameters. The speed of mean reversion, typically written as kappa (the Greek letter), measures how fast the process returns. A kappa of 0.15 means the spread closes roughly 15 percent of the gap between its current level and the long-run mean each year. The long-run mean itself is theta -- the level the process orbits around. For the Moody's Baa-Aaa series, theta sits near 96 basis points, slightly above the raw average because the mean-reversion dynamics weight recent observations differently from a simple arithmetic mean.

Why does this matter for the tail? Because mean reversion determines how long the process can stay in crisis territory. Without it, a model that reaches 300 basis points might stay there forever. With kappa at 0.15, the half-life of a deviation is about 4.6 years. A 300-basis-point spike will, on average, be halfway back to theta within five years. The tail is real, but it is not permanent. Any model that captures the fat tail must also capture this gravitational pull, or it will overstate the duration of stress even as it correctly states its magnitude.

Two Models, One Letter Apart

The standard mean-reverting process in finance is the Vasicek model, borrowed from interest rate theory and applied to spreads by analogy. Its dynamics are disarmingly simple:

The first term pulls the spread toward theta. The second term adds noise scaled by a constant sigma. The noise does not know or care what level the spread is at. Whether spreads sit at 50 basis points or 350, the weekly perturbation is drawn from the same distribution with the same standard deviation. The result is a Gaussian, symmetric process that can wander below zero and produces thin tails.

Now change exactly one thing. Replace the constant sigma with sigma times the square root of the current spread level:

This is the Cox-Ingersoll-Ross process. The mean-reversion term is identical. The only difference is that the volatility of the noise now scales with the square root of the spread level. That single coupling -- the square root of S multiplying the Brownian increment -- changes everything about the tail.

Why does the square root matter so much?

Consider what happens in calm markets. If the spread is at 50 basis points, the volatility multiplier is proportional to the square root of 50, roughly 7.1. Now suppose a crisis arrives and spreads jump to 300 basis points. The multiplier is now proportional to the square root of 300, roughly 17.3. That is 2.4 times larger. The process is generating moves that are 2.4 times as volatile during the crisis as during calm periods -- not because someone turned up a dial, but because the dynamics themselves produce this scaling automatically.

In a Vasicek model, the same crisis sees the spread at 300, but the volatility is unchanged. The model produces the same size random moves at 300 as it did at 50. It cannot generate the explosive widening and sharp reversals that characterize actual spread crises. The constant-volatility assumption acts as a straitjacket on the tail.

What does this mean for the shape of the distribution? The CIR process produces a stationary distribution that is a non-central chi-squared (or equivalently, a scaled Gamma distribution). This distribution is right-skewed: its right tail is heavier than its left tail. It cannot go below zero. And its tail weight depends directly on the relationship between the mean-reversion parameters and the volatility parameter. The Vasicek process, by contrast, produces a Gaussian stationary distribution: symmetric, thin-tailed, and perfectly happy to visit negative territory.

The visual contrast in Figure 2 is stark. The Gaussian model assigns essentially zero probability to the 300+ region -- the region where actual crises live. The CIR process assigns real, non-trivial density to that region. This is not because someone forced it to; it is a mathematical consequence of coupling the volatility to the level. When spreads are high, the process can make large moves in either direction, which naturally generates the right-skewed, fat-tailed shape.

So: two models, both mean-reverting, both calibrated to the same long-run average and mean-reversion speed. The only difference is whether the volatility scales with the square root of the level. And that one difference determines whether your model can or cannot produce the crisis your institution lived through.

Calibration: Fitting the CIR to Real Spread Data

Suppose you are sitting in Avelmont's ALM desk with forty years of weekly Moody's Baa-Aaa data on your screen. How do you actually fit a CIR process to this series?

The discretized CIR dynamics say that the change in the spread from one week to the next is approximately:

where the epsilon terms are independent standard normals and delta-t is 1/52 for weekly data. Rearrange, and you have a regression problem:

The intercept a equals kappa times theta times delta-t. The slope b equals minus kappa times delta-t. From these two coefficients, you extract kappa and theta directly:

• kappa = −b / Δt
• theta = −a / b

For Avelmont's data, this regression yields kappa of approximately 0.1517 (about 15% of the gap closed per year) and theta of approximately 0.96% (96 basis points). So far, this is identical to what you would do for a Vasicek model. The difference comes in the next step.

The critical step: extracting sigma

Here is where practitioners fall into the trap. You have the regression residuals -- the unexplained noise after removing the mean-reversion drift. In a Vasicek model, you would estimate sigma directly from the standard deviation of these residuals. But in a CIR model, the residuals are not homoskedastic. Their variance is proportional to the level of the spread at each observation.

The correct procedure is to divide each residual by the square root of the lagged spread before computing the standard deviation:

For Avelmont, this gives sigma of approximately 0.333.

Figure 3 is the diagnostic that separates a correct CIR calibration from a disguised Vasicek. If your residual plot looks like the left panel -- roughly constant scatter regardless of the spread level -- you have correctly removed the level-dependent volatility and are fitting the right model. If it looks like the right panel, the square root term is still hiding in your noise, and your sigma estimate is wrong.

The Feller Condition: A Sanity Check You Cannot Skip

Once you have kappa, theta, and sigma, there is one more test before you declare victory. The CIR process has a mathematical boundary condition, discovered by William Feller, that determines whether the process can reach zero. The condition is:

If this inequality holds, the drift toward theta is strong enough relative to the volatility that the process bounces off zero before touching it. If it fails, the process can reach zero and the square root becomes imaginary -- the model breaks.

For Avelmont's calibration:

Wait. That does not look right. The Feller condition requires 2-kappa-theta to exceed sigma-squared, but 0.00291 is far less than 0.111. What happened?

The issue is units. If we work in percentage terms (theta = 0.96), the Feller check becomes:

The condition holds, comfortably. Avelmont's CIR process will stay positive. But notice how easy it is to get the units wrong. If you mix decimal spreads in the drift with percentage-based sigma (or vice versa), the Feller check will either fail spuriously or pass when it should not. Unit discipline is not optional here -- it is the difference between a model that works and one that produces negative spreads in simulation.

From One Factor to the Whole Ladder

So far we have a beautifully calibrated CIR process for a single spread series. But Avelmont does not fund at a single tenor. It has a ladder: 3-month commercial paper, 6-month floating rate notes, 1-year term deposits, 2-year medium-term notes. Each tenor has its own spread, and those spreads move together -- but not in lockstep.

Here is the problem. The 40-year Moody's series that gave us reliable tail estimates exists only for a single aggregate measure. Multi-tenor funding spread data, the kind specific to an institution's actual issuance, typically covers three to five years at best. Three years is not enough to see a tail. You need decades for that. But three years of cross-tenor data is exactly what you need to understand the shape of co-movement across maturities.

The solution is to use each data source for what it does well. Use the long single series for the level dynamics: kappa, theta, sigma, and the fat-tail weight. Use the short multi-tenor panel for the cross-sectional structure: how each tenor loads on the common factor.

PCA on rate-plus-spread changes

Take Avelmont's weekly changes in funding cost (base rate plus spread) across four tenors over the last three years. Stack them into a matrix and run a principal component analysis. The first principal component -- the level factor -- typically explains 75 to 85 percent of total variance. It is the common movement that pushes all tenors in the same direction when funding conditions tighten or ease.

The second component -- the slope or spread factor -- captures the differential: short tenors might widen more or less than long tenors during a stress event. It typically explains another 10 to 15 percent.

What matters for the funding cost model is the loading of each tenor on the first factor. These loadings tell you how much each tenor moves when the common factor moves by one unit.

What does Figure 4 tell us? When the common funding factor moves by 100 basis points, Avelmont's 3-month paper moves by about 35, while its 2-year notes move by about 58.5. The 2-year tenor is roughly 67% more sensitive to the common shock than the 3-month. This makes intuitive sense: longer-term funding embeds more credit risk, more liquidity risk, and more uncertainty about the issuer's condition at maturity.

The operational trick is to drive the CIR process for the common factor using the 40-year calibration (with its fat tail), and then fan each simulated path across the tenor ladder using the loadings. This gives you a multi-tenor simulation where the tail weight comes from the long historical record and the cross-sectional shape comes from recent data. Neither data source is asked to do something it cannot do.

But how, exactly, does that fanning work? The sentence "multiply by the loadings" hides enough machinery to fill a whiteboard. It is worth opening it up.

Inside the Multi-Tenor Simulation

The single CIR factor X_t is a latent variable — it represents the overall state of wholesale funding conditions. It is not, by itself, the spread at any particular tenor. The spread at each tenor i on the ladder is given by an affine mapping:

Three ingredients, each doing a different job:

• A_i is the base spread — what tenor i costs today, read directly off the bank's own funding curve. For Avelmont: A_3M = 9 bps, A_6M = 14, A_1Y = 22, A_2Y = 34.
• B_i is the loading — how much of the common shock tenor i absorbs. This comes from the PCA. It tells you that the 2-year rung moves 17% more than average when funding tightens, while the 3-month rung moves 30% less.
• X_t / X₀ is the multiplicative shock ratio — how much the common factor has moved relative to its starting level. This is the key design choice: what travels from the proxy (Moody's) to the bank is the change, not the level. The bank's own curve provides the level. The proxy provides the dynamics.

Why a ratio, and not an absolute shift? Because the Moody's Baa-minus-Aaa spread sits near 90 basis points while Avelmont's 2-year funding spread sits at 34. If the proxy spikes from 90 to 350 in a crisis, we do not read 350 for the bank. We read the relative shock — the factor roughly quadrupled — and apply that multiplication to each tenor through its loading. The bank's level stays anchored; only the dynamics cross.

What happens inside one simulation step

The simulation runs on monthly steps (Δt = 1/12). At each step, the factor evolves under the Euler-Maruyama discretization of the CIR:

where Z_t is a standard normal draw. The max(Xt, 0) is a full truncation guard: even though the Feller condition ensures the continuous process stays positive, the discrete step can momentarily overshoot below zero. Clamping to zero before taking the square root prevents the simulation from crashing.

Once X_t+1 is known, every tenor's spread updates simultaneously:

One random draw, one factor update, four tenor spreads. That is the affine structure at work: the entire ladder follows from a single stochastic path. No matrix algebra per step, no tenor-by-tenor process, no cross-tenor correlation matrix to invert. The co-movement is built in — all tenors load on the same factor.

Why one factor and not four independent processes?

This is worth addressing directly, because it is a natural objection. Why not fit a separate CIR to each tenor and let them evolve independently, perhaps correlated through a Cholesky decomposition?

Two reasons, one practical and one empirical. The practical reason: four separate processes require four sets of (κ, θ, σ) plus six pairwise correlations — eighteen parameters. With only three years of multi-tenor data, the estimation is fragile. Overfitting is almost guaranteed, and the correlation estimates carry enormous standard errors.

The empirical reason is more decisive: separate processes would let tenors diversify each other. A bad quarter for the 3-month rung might coincide with a calm quarter for the 2-year, and the blended cost would smooth out. But one issuer's funding spreads do not behave that way. When wholesale funding gets expensive, it gets expensive across the entire ladder. The 2008 crisis did not hit some maturities while sparing others. A single factor enforces this: when the factor spikes, every tenor spikes — proportionally to its loading, but without diversification relief.

If you allow cross-tenor diversification, you underestimate the tail of the blended cost. The single-factor architecture is a conservative, data-consistent choice: it says "I do not have enough data to prove that tenors diversify, so I will not grant that relief."

A worked example: what happens when the factor doubles

Suppose Avelmont's common factor starts at X₀ = 90 bps and, on one simulated path, reaches X_t = 180 bps after two years (the factor has doubled). The multiplicative shock ratio is 180/90 = 2.0. What happens to each tenor?

Wait — these numbers seem small. A factor doubling only adds about 1 basis point? That is because the loadings as presented are normalized eigenvector components, not direct sensitivities. In practice, the loadings are scaled so that the book-weighted average loading equals 1.0, and the A_i values absorb the base level. The multiplicative shock ratio X_t/X₀ acts as a scaling factor on the entire tenor curve: when the ratio is 2.0, the spread curve roughly doubles. When it is 3.5 (2008-scale), the curve roughly triples.

To make this concrete in absolute terms: if the factor triples (X_t/X₀ = 3.5, a 2008-scale event), the 3-month spread goes from 9 to roughly 9 × 3.5 = 32 bps, and the 2-year goes from 34 to roughly 34 × 3.5 × 1.17 = 139 bps. The 2-year absorbs 17% more shock than a proportional scaling would suggest — and that extra sensitivity matters in the tail.

Validation: Three Tests Before You Trust the Model

A calibrated model is not a validated model. Before Avelmont deploys this CIR framework in production, three tests must pass.

1. Rolling-window stability

Refit the CIR parameters on overlapping 5-year windows across the full sample. Does kappa stay in the range 0.10 to 0.25? Does theta stay between 70 and 120 basis points? If the parameters jump wildly from window to window, the model is not stable enough to drive a pricing decision that locks in for years. In Avelmont's case, kappa ranges from 0.09 to 0.22 across windows -- some drift, but no structural break. Theta stays between 78 and 112 basis points. Acceptable.

2. Level access

Simulate 10,000 paths of the calibrated CIR out to a 5-year horizon. Do any paths reach 300 basis points? They should. If the model cannot produce the level that actually occurred in 2008, it is not capturing the tail you calibrated it for. For Avelmont's parameters, roughly 2.5% of 5-year paths exceed 300 basis points at some point during the horizon. Not frequent, but real. A Vasicek model with matched unconditional variance would show roughly 0.3% of paths reaching that level -- an order of magnitude less.

3. Legacy benchmark comparison

Many institutions historically measured funding spread as commercial-paper-minus-fed-funds. This seems intuitive: CP is your short-term funding cost, fed funds is the risk-free anchor, the difference is the spread. But this series has a fatal flaw. It can go negative. During periods when the Fed is lending at elevated rates and CP markets are calm, the difference dips below zero. And when you try to fit a CIR process to a series that goes negative, the square root explodes -- sigma becomes imaginary, the Feller check is meaningless, the entire framework collapses.

What "Fat Tail" Means on the Loan

All of the preceding mathematics exists for one purpose: to produce a number that goes on the loan. Avelmont originates a 3-year floating-rate facility. The loan will be funded by rolling 6-month paper. At each roll date, the funding spread is uncertain. The transfer price must charge enough to cover the expected cost of those rolls plus a risk charge for the possibility that the rolls are more expensive than expected.

Avelmont simulates 10,000 CIR paths, applies the 6-month tenor loading from the PCA, and computes the roll cost at each reset. The results:

The expected cost is the same. Both models agree on the center of the distribution because they are calibrated to the same mean. The difference is entirely in the tail. The CIR model, with its right-skewed distribution, assigns meaningful probability to roll costs in the 40-60 basis point range -- the range that corresponds to funding during a credit stress. The Gaussian model says those outcomes are too improbable to matter.

The funding cost risk charge -- the difference between the tail measure and the expected cost -- is 16 basis points under CIR and 8 basis points under Gaussian. The Gaussian model underprices the tail risk by half.

Does 8 basis points matter? On a $100 million loan book, 8 basis points is $80,000 per year. Over the 3-year life of the facility, that is $240,000 of unpriced risk, per $100 million, compounding across the entire balance sheet. For an institution with $10 billion in floating-rate assets, the annual underpricing reaches $8 million. That is not a rounding error. That is a line item on the income statement that everyone thought was profit but was actually uncompensated risk.

The tail charge is not a tax on the business. It is the price of being able to fund through a crisis without discovering that your transfer price was a fiction.

The Model Is a Choice

None of this is to say that the CIR process is the final word on spread dynamics. It is not. It assumes a single regime, a constant speed of mean reversion, and a specific functional form for the level-volatility coupling. More sophisticated models -- regime-switching processes, stochastic-volatility extensions, jump-diffusion hybrids -- can capture features that CIR misses. But each added layer of complexity requires additional parameters, longer calibration windows, and harder validation.

The CIR process earns its place not by being perfect but by being minimally honest. It acknowledges the one empirical fact that the Gaussian model refuses to see: when spreads are high, volatility is high. That single acknowledgment -- expressed mathematically as a square root, implemented practically as one extra division in the calibration, and verified by a two-line Feller check -- transforms the tail of the distribution from a theoretical impossibility into a priced risk.

Any model that keeps volatility constant while spreads triple is lying about the tail. And the tail is exactly what the transfer price is trying to charge. The question is not whether you can afford to build a fat-tailed model. The question is whether you can afford not to -- and whether, the next time spreads spike to 300 basis points, your institution's pricing will have anticipated it or will be scrambling to explain why the FTP rate was too low all along.

The square root of S is not a mathematical decoration. It is the difference between a price that works and a price that fails precisely when it matters most.