How Panjer-Recursion Algorithms Build Aggregate Bank-Loss Distributions: Frequency–Severity Models, (a,b,0) Recursions, Discretization, Tail Quantiles and Operational-Risk Failure

Reader question: If a bank or risk analyst models how many loss events occur in a year and how large each loss is, how can those two distributions be combined into the full distribution of total annual loss without running millions of Monte Carlo paths or evaluating a long series of convolutions?

Panjer recursion answers that question for an important family of event-count distributions. It converts a discretized severity distribution and a frequency law from the (a,b,0) class into the aggregate-loss probability mass function one loss-grid point at a time.

This article owns one precise computational job: recursive evaluation of compound frequency–severity aggregate-loss distributions. It does not own bank regulatory operational-risk capital, event taxonomy, scenario governance, extreme-value theory, dependence aggregation or Monte Carlo simulation in general.

This is public mathematical and computational education. It is not financial advice, a capital recommendation or a claim that a fitted aggregate-loss model is an approved regulatory model.

1. The collective-loss model

Let N be the number of loss events in a period and X₁,…,X_N their severities.

Total loss is:

S = Σ_i=1^N X_i,

with S=0 when N=0.

Under the basic collective-risk assumptions:

• N is independent of severities;
• X_i are iid from one severity distribution F;
• the frequency law and severity law are stable over the period.

The aggregate distribution is the compound mixture:

P(S≤s)=Σ_n=0^∞P(N=n)P(X₁+…+X_n≤s).

Direct evaluation requires many n-fold convolutions. That is the computation Panjer recursion reorganises.

2. The (a,b,0) frequency class

A count distribution belongs to the Panjer (a,b,0) class when:

p_n = (a + b/n)p_n−1,   n≥1,

where p_n=P(N=n).

The principal non-degenerate members are:

• Poisson;
• binomial;
• negative binomial.

For Poisson(λ):

a=0,   b=λ.

This recursive structure in the event count is what makes the aggregate-loss recursion possible.

3. Severity must live on a lattice

Suppose severity has probability mass:

f_j=P(X=jh),   j=0,1,2,…

on loss-grid spacing h.

Let:

g_s=P(S=sh).

If the original severity distribution is continuous—lognormal, gamma, Pareto or another family—it must first be discretized onto the lattice.

The recursion is exact for the discretized model. Any error relative to the original continuous model includes the severity-discretization error.

4. The Panjer recursion

For an (a,b,0) frequency law, the aggregate probabilities satisfy:

g_s = 1/(1−af₀) Σ_j=1^s (a + bj/s) f_j g_s−j,   s≥1.

The starting probability g₀ depends on the frequency distribution.

For Poisson frequency:

g₀ = exp[−λ(1−f₀)].

If severity is strictly positive so f₀=0:

g₀=e^−λ=P(N=0).

5. Why this avoids repeated convolutions

To calculate g_s, the algorithm uses:

• known severity probabilities f₁,…,f_s;
• already-computed aggregate probabilities g₀,…,g_s−1.

There is no need to separately calculate F, F*F, F*F*F and all higher convolutions and then mix them by P(N=n).

Panjer’s 1981 result was important precisely because the recursion could reduce the computational burden of compound distributions by orders of magnitude for large portfolios under the applicable frequency family.

6. Compound Poisson simplifies further

For Poisson frequency, a=0 and b=λ. Therefore:

g_s = (λ/s) Σ_j=1^s j f_j g_s−j.

when f₀=0.

This makes the mechanism especially transparent: each aggregate-loss point is built from all ways one severity-lattice point j can combine with an already-computed residual aggregate loss s−j.

7. Moment checks provide an independent audit

For independent N and iid X:

E[S]=E[N]E[X].

And:

Var(S)=E[N]Var(X)+Var(N)(E[X])².

For Poisson frequency where Var(N)=E[N]=λ:

Var(S)=λE[X²].

After recursion, the numerical aggregate distribution should reproduce these moments within lattice/truncation tolerance.

Falsifier: if the summed PMF gives a mean or variance inconsistent with the analytical compound moments, investigate discretization, truncation or recursion code.

8. Discretizing a continuous severity distribution

Choose grid width h and map continuous losses to multiples of h.

Common discretization ideas include:

• rounding probability mass to the nearest lattice point;
• lower discretization;
• upper discretization;
• moment-matching schemes.

The choice controls bias.

A coarse h runs quickly but blurs the severity distribution. A small h improves resolution but increases the number of aggregate grid points and recursion cost.

9. Upper and lower discretizations can bound error

If every continuous severity is rounded downward to the lattice, aggregate losses tend to be understated.

If every severity is rounded upward, aggregate losses tend to be overstated.

Running both can create useful numerical brackets for aggregate quantiles where the ordering assumptions hold.

Diagnostic: shrink h until upper/lower quantile brackets are narrower than the tolerance required by the learning or analytical task.

10. Tail truncation is a second approximation

Even after severity discretization, the aggregate distribution is theoretically unbounded for common frequency/severity choices.

The recursion must stop at some maximum grid index M.

Then:

Σ_s=0^Mg_s < 1

if material tail probability lies beyond Mh.

Falsifier: report residual tail mass:

1−Σg_s.

Do not extract a 99.9% quantile from a grid that captures only 99.5% of total probability.

11. VaR from the aggregate distribution

Once g is computed, form:

G_s=Σ_k=0^sg_k.

The lattice VaR at level q is:

VaR_q=h × min{s:G_s≥q}.

This quantile belongs to the discretized aggregate model. Interpolation can make the reported number smoother, but interpolation does not create information absent from the lattice.

12. Expected Shortfall requires tail mass, not only the quantile

For a discrete aggregate distribution, Expected Shortfall must account carefully for probability mass at the VaR threshold.

A naive average of losses strictly above VaR can produce the wrong q-tail mean when G has a large jump at the quantile.

Diagnostic: implement ES with the exact discrete-tail definition and verify it against a brute-force PMF calculation.

13. Frequency–severity independence is a strong assumption

The basic model says the number of events does not change their severity distribution.

In real operational-loss environments, a system outage can produce:

• many related incidents;
• larger losses when event count is high;
• common dependence on business volume or stress.

Falsifier: test whether severity statistics change materially with event-count or regime variables. If they do, an independent compound model is structurally incomplete.

14. Poisson frequency is often too restrictive

Poisson implies:

Var(N)=E[N].

If observed annual or monthly counts are substantially overdispersed, negative-binomial frequency may be more appropriate.

Because negative binomial also belongs to the Panjer class, recursion remains available.

Falsifier: compare observed count variance, zero frequency and tail counts with fitted Poisson predictions.

15. Zero inflation can fall outside the simple model

Some operational-risk cells have many zero periods and occasional bursts.

A zero-inflated count model may fit better than standard Poisson/negative binomial.

But not every zero-inflated frequency law belongs directly to the basic (a,b,0) family.

Possible alternatives include mixture decomposition, extended recursions or simulation.

16. Heavy-tailed severities make quantiles fragile

Operational-loss severities can be strongly right-skewed. Pareto-type tails can place substantial probability on rare extreme losses.

A Panjer recursion can calculate the distribution implied by a heavy-tailed fitted severity, but it does not solve the statistical problem of estimating that tail from sparse data.

Public lesson: numerical exactness for a fitted model is not evidence that the fitted tail is correct.

17. Parameter uncertainty can dominate recursion error

Suppose h is so fine that numerical error is negligible.

If λ and the severity-tail parameters are estimated from only a few years of data, the 99.9% aggregate quantile can still have enormous uncertainty.

Useful diagnostics include:

• bootstrap parameter refits;
• Bayesian posterior predictive distributions;
• profile-likelihood intervals;
• scenario sensitivity.

The recursion should be rerun across parameter draws if parameter uncertainty is part of the question.

18. Multiple risk cells create a second aggregation problem

A bank can have separate loss processes for fraud, cyber, execution error, legal events and other categories.

Panjer recursion can compute each cell’s marginal aggregate distribution.

But combining cells requires an assumption about dependence.

If cells are independent, their aggregate distributions can be convolved. If they share common shocks, simple independence can materially understate the joint tail.

19. Common shocks break the simple cell-independence model

A cyberattack can trigger multiple business lines simultaneously.

Separate independent Poisson processes miss that cross-cell clustering.

Falsifier: inspect co-occurrence of large events and stress periods across cells. If common-shock dependence is material, use a multivariate frequency/dependence model or scenario framework.

20. Inputs and outputs

Inputs can include:

• frequency distribution and parameters;
• (a,b) coefficients;
• continuous or discrete severity distribution;
• severity grid width h;
• severity-discretization method;
• maximum aggregate loss Mh;
• target quantile levels;
• parameter uncertainty specification;
• cell-dependence assumptions if aggregating multiple cells.

Outputs can include:

• aggregate PMF g;
• aggregate CDF G;
• probability mass captured on the grid;
• mean and variance checks;
• VaR and ES estimates;
• upper/lower discretization brackets;
• grid-width sensitivity;
• tail-truncation diagnostics;
• parameter-uncertainty intervals;
• model-comparison results.

21. A minimal Panjer algorithm

1. Choose and fit an eligible frequency law.
2. Convert the frequency law to (a,b).
3. Discretize severity onto grid h and obtain f_j.
4. Compute the appropriate g₀.
5. For s=1,…,M, compute g_s from prior g values.
6. Accumulate the CDF.
7. Check total captured probability.
8. Check aggregate mean/variance against analytical moments.
9. Extract quantiles only after tail coverage is adequate.
10. Repeat at smaller h/larger M to test convergence.

22. Computational complexity

The direct recursion for each s sums over j=1,…,s, giving roughly:

O(M²)

arithmetic for a dense severity PMF up to M.

This can still be efficient for moderate grids and avoids Monte Carlo sampling noise.

For very large grids, FFT convolution or specialised fast recursion methods can be more efficient.

23. Panjer versus FFT

FFT methods evaluate compound distributions through transforms/convolutions and can be much faster on large regular grids.

But they introduce their own numerical issues:

• aliasing;
• wrap-around;
• grid truncation;
• transform normalization.

Panjer recursion is slower asymptotically but transparent and easy to audit term by term.

Falsifier: compare Panjer and FFT on the same discretized model. They should agree within numerical tolerance.

24. Panjer versus Monte Carlo

Monte Carlo algorithms can handle almost arbitrary frequency, severity and dependence structures.

But high tail quantiles can require very large path counts and confidence intervals.

Panjer gives a deterministic recursion for eligible compound models with discretized severity.

A good validation design compares both on the same model.

25. Importance sampling for extreme tails

When simulation is required and the target is an extreme loss quantile or rare tail probability, importance-sampling algorithms can reduce Monte Carlo variance.

That solves a different computational problem from Panjer recursion.

26. Numerical stability differs by frequency family

Panjer and Wang’s recursion-stability research found strong stability for compound Poisson and compound negative-binomial cases under their analysis, while compound-binomial recursion can exhibit instability requiring care.

Falsifier: do not assume one recursion has identical floating-point behaviour for every member of the (a,b,0) class.

27. Counterexample: lattice too coarse

A severity distribution has a median near $1,000, but h=$10,000.

Most ordinary events collapse into the zero or first lattice cell.

The aggregate quantile becomes a staircase dominated by discretization.

Falsifier: halve h repeatedly. Material quantile movement means the grid is not converged.

28. Counterexample: tail grid too short

A 99.9% quantile is requested, but the recursion stops where cumulative probability is 99.7%.

The requested quantile does not exist on the computed support.

Falsifier: require captured probability to exceed every target confidence level plus a safety margin.

29. Counterexample: severity cap hidden in preprocessing

Losses above a reporting cap are winsorized before fitting, but the aggregate model is described as if it represented uncapped loss severity.

Falsifier: preserve raw-data censoring/truncation rules and use appropriate censored-tail likelihoods where needed.

30. Counterexample: event splitting changes frequency and severity

One cyber incident is recorded as 50 small losses in one database and one aggregated event in another.

Frequency rises and average severity falls even though total economic loss is unchanged.

Falsifier: define the event unit before model fitting and maintain it consistently through time.

31. Counterexample: dependence on business volume

Transaction volume doubles. Both event frequency and possible severity increase, but the model keeps fixed λ and F.

Falsifier: test frequency/severity against exposure metrics and consider conditional models when scale changes materially.

32. Counterexample: negative-binomial fit hides regime switching

Overdispersion may be fitted with a negative binomial, but the true mechanism is alternating calm and crisis regimes.

The marginal count distribution can fit while temporal clustering remains wrong.

Falsifier: inspect serial dependence and regime covariates rather than validating only the unconditional count histogram.

33. Counterexample: exact recursion, wrong tail family

A lognormal severity is fitted because it is convenient, but extreme quantile diagnostics favour a Pareto-type tail.

Panjer computes the lognormal compound distribution exactly on the lattice—exactly for the wrong model.

Falsifier: compare tail QQ plots, threshold stability, predictive exceedances and alternative severity families.

34. Evidence polarity

Evidence for confidence includes:

• frequency distribution fits count data adequately;
• severity model fits body and tail diagnostics;
• frequency–severity dependence is weak or explicitly modelled;
• PMF sums close to one over the computed grid;
• moments agree with compound-model formulas;
• quantiles converge as h shrinks and M expands;
• Panjer agrees with FFT/Monte Carlo benchmarks;
• parameter-uncertainty intervals are reported when material.

Evidence against confidence includes:

• overdispersion under a Poisson model;
• strong event clustering or common shocks;
• tail fit driven by very few observations;
• quantiles change materially with grid width;
• meaningful probability mass lies beyond M;
• moments fail analytical checks;
• independent numerical methods disagree;
• capital/tail conclusions are dominated by parameter uncertainty.

35. Current Basel boundary

Panjer recursion and frequency–severity loss-distribution approaches are historically and mathematically important for operational-risk modelling.

However, the current Basel Framework uses a standardized approach for bank operational-risk capital based on the Business Indicator framework and prescribed loss-data treatment. It is not a rule that banks calculate current regulatory operational-risk capital by applying Panjer recursion to a compound loss model.

This distinction matters because an educational algorithm should not be presented as current regulatory methodology merely because it has banking applications.

36. Meaningful connections to the BTT knowledge estate

Hawkes-process algorithms provide one alternative when event arrivals cluster rather than follow an independent count model.

Importance sampling owns simulation efficiency for rare events.

Optimal-transport scenario algorithms represent a different route for scenario reweighting and distributional stress, not compound-loss recursion.

37. Alternatives

FFT compound-distribution algorithms: often faster on large regular grids.

Monte Carlo: flexible for arbitrary dependence and distributions, with sampling error.

Saddlepoint approximations: fast approximations when cumulant-generating functions behave well.

Translated-gamma/normal approximations: simple but can be poor in heavy tails.

Scenario analysis: necessary when rare structural losses cannot be learned reliably from historical frequency–severity data alone.

38. Weak links

• wrong event definition;
• frequency family outside the applicable recursion;
• frequency–severity dependence ignored;
• severity discretization too coarse;
• tail truncation too short;
• heavy-tail parameter uncertainty hidden;
• multiple risk cells assumed independent;
• regime changes ignored;
• numerical stability assumed identical across frequency families;
• historical modelling method confused with current regulatory capital rules.

39. What would falsify confidence?

Confidence should be withdrawn if the count/severity models fail predictive checks; if aggregate moments do not reconcile; if quantiles do not converge under grid refinement; if FFT or Monte Carlo benchmarks disagree; if common-shock dependence materially changes the tail; or if parameter uncertainty is so broad that the reported extreme quantile has little resolution.

40. Verification and update triggers

Preserve event definitions, raw count/severity data, frequency parameters, severity fit, discretization rule, h, M, (a,b), g₀, recursion code, tail mass, moment checks and benchmark outputs.

Revalidate when:

• loss taxonomy changes;
• reporting thresholds change;
• business volume changes materially;
• new large losses arrive;
• frequency overdispersion changes;
• tail-family diagnostics change;
• risk-cell dependence changes;
• the regulatory or educational use case changes.

41. Primary and high-quality references

• Harry H. Panjer, Recursive Evaluation of a Family of Compound Distributions, ASTIN Bulletin, 1981.
• Bjørn Sundt and William S. Jewell, Further Results on Recursive Evaluation of Compound Distributions, ASTIN Bulletin, 1981.
• Harry H. Panjer and Shaun Wang, On the Stability of Recursive Formulas, ASTIN Bulletin, 1993.
• D.C.M. Dickson, A Review of Panjer’s Recursion Formula and its Applications, British Actuarial Journal.
• Basel Committee on Banking Supervision, Calculation of RWA for Operational Risk, current Basel Framework.

Educational boundary: Panjer recursion is a deterministic numerical engine for a stated compound frequency–severity model. It does not validate the event taxonomy, frequency law, severity tail, dependence structure or regulatory use of the resulting loss distribution.