They’re using VaR as a risk measure. In fact, it’s outdated and being phased out in financial stress-test simulations due to its inability to capture tail risk in favour of Expected Shortfall.
Just to give some perspective here is a quote from “A revised market risk framework” published by the Basel Committee on Banking Supervision (kinda regulation/overseeing body for word’s central banks):
Move from Value-at-Risk (VaR) to Expected Shortfall (ES): A number of weaknesses have been identified with using VaR for determining regulatory capital requirements, including its inability to capture “tail risk”. For this reason, the Committee proposed in May 2012 to replace VaR with ES. ES measures the riskiness of a position by considering both the size and the likelihood of losses above a certain confidence level. The Committee has agreed to use a 97.5% ES for the internal models-based approach and has also used that approach to calibrate capital requirements under the revised market risk standardised approach.
That was almost 10 years ago.