Var

Two big ones:

First, we are assuming a normal distribution. There is no reason at all why it should be a normal distribution.

Second, (and this is a huge one), even though there might only be a 1% chance of going below the limit (if we chose 99% confidence level). It will happen once in 100 years, and if that once happens to be next year then it could cause collapse of the bank.
(It is the fact that banks were using statistics like this that was part of the reason for the crisis in the banks a few years ago.)