Large banks assess their regulatory capital for market risk using complex, firm-wide Value-at-Risk (VaR) models. In their 'bottom-up' approach to VaR there are many sources of model risk. A recent amendment to banking regulations requires additional market risk capital to cover all these model risks but, as yet, there is no accepted framework for computing such an add-on. We introduce a top-down approach to quantifying VaR model risk in a rigorous statistical framework and derive a corresponding adjustment to regulatory capital that is relatively straightforward to implement.