Regulators condition bank capital on risk but struggle to measure risk accurately. Capital requirements thus rely on inputs from banks’ internal risk models, and banks have discretion over modeling choices. Using novel hand-collected data we show that reported bank risk varies systematically with simulation method, holding period, and historical data size. Hence, modeling choices can be a significant channel of underreporting of risk. Consistent with this presumption we find that less-capitalized banks tend to choose less conservative methods. Moreover, banks using a softer simulation method display higher actual market risk, while reporting lower market risk to regulators.