The revised interagency guidance on model risk management is written for banks, but it is the closest thing to a published standard for how any US financial firm should govern the quantitative models it relies on, and it leaves generative and agentic AI to be dealt with separately.
What the guidance is
The Federal Reserve, the OCC and the FDIC issued revised interagency guidance on model risk management, which the Federal Reserve transmitted to its Reserve Banks as SR letter 26-2. The letter is dated April 17, 2026. The OCC issued the same guidance to the banks it supervises as Bulletin 2026-13. SR 26-2 supersedes SR letter 11-7 of April 4, 2011, and SR letter 21-8 of April 9, 2021, the interagency statement on model risk management for bank systems supporting BSA/AML compliance. The OCC is rescinding its own prior issuances, including OCC Bulletin 2011-12, its version of the 2011 guidance, and OCC Bulletin 2021-19. OCC Bulletin 1997-24 on credit scoring models and the Model Risk Management booklet of the Comptroller’s Handbook go with them.
SR 11-7 was the reference document for model governance in US finance for fifteen years, and its vocabulary of inventory, validation, effective challenge and model owner spread well beyond banks. The Federal Reserve says the revision “reflects supervisory experience and industry feedback accumulated over the past fifteen years, as well as significant advancements in modeling practices.” The FDIC had adopted the 2011 guidance in June 2017 with technical conforming changes, so the three agencies are now replacing a single shared text.
What counts as a model
The guidance defines a model as a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates. It excludes simple arithmetic calculations such as those found within spreadsheets, and it excludes deterministic rule-based processes and software where no statistical, economic or financial theory underpins their design or use.
That definition is the most portable part of the document. A non-bank firm can adopt it word for word. It draws a line that many firms struggle to draw on their own: a pricing engine that applies a statistical fit is a model, a rules table that routes orders by size is not, and a spreadsheet that sums positions is not. The test is whether a theory sits between the inputs and the estimate. If it does, the thing can be wrong in ways that are hard to see, and that is what model risk management exists to catch.
Who the guidance is written for
The letter says it is expected to be most relevant to banking organizations with over $30 billion in total assets regulated by the Federal Reserve. The OCC bulletin adds that, in some situations, the guidance “also may be relevant to banking organizations with total assets of $30 billion or less that have significant exposure to model risk because of the prevalence and complexity of their models or because of activities outside the scope of traditional community banking.” The OCC bulletin states that the guidance is applicable to all community banks, subject to the limitations discussed in the guidance.
None of that reaches a registered adviser, a private fund or a fintech that is not itself a banking organization. In our reading, such a firm is not bound by the guidance, and no part of the text says otherwise. Two caveats apply. A fintech that originates or services loans on a bank’s balance sheet is likely to meet the guidance through the bank’s third-party risk program, because the bank’s own expectations tend to flow down through the contract. And a firm that later becomes a bank affiliate, or acquires a charter, will likely find that the supervisor’s starting point is this document.
There is a second feature non-banks should notice. The guidance does not set forth enforceable standards or prescriptive requirements, and non-compliance with it will not result in supervisory criticism against a banking organization. The OCC frames the issuance as part of its efforts to tailor its supervisory framework to reduce unnecessary burden and promote risk-based examination across institutions of all sizes. So even for banks, this is a statement of sound principles rather than a rule. For a non-bank it is better read as a benchmark: a description of what competent model governance looks like, published by three agencies, that a counterparty, an auditor or an investor may hold up against your program.
What the guidance covers
The guidance describes the features of effective model development and model use, including model testing; model validation and monitoring, including validating conceptual soundness and outcomes analyses; and governance and controls, including clear policies and roles and responsibilities. It also discusses considerations specific to vendor and other third-party products, including validation of those products.
The organizing idea is proportionality. The agencies describe “a risk-based approach to model risk management that is tailored to a banking organization’s model risk profile and the size and complexity of its operations.” The OCC bulletin puts it directly: “Practices that are appropriate and effective for one banking organization may be inappropriate and ineffective for a banking organization with a different risk profile or that uses a model for a different purpose.” The general expectation is that the guidance will be most useful for models supporting a banking organization’s significant business lines, operations, services, and functions. The OCC had already clarified in Bulletin 2025-26 that its “guidance on model risk management does not, and should not be interpreted to, require community banks to perform annual model validation.”
For a non-bank, proportionality is permission to be small. An adviser with a handful of material models does not need a model risk department. It needs an inventory, a tiering decision, a validation that matches the tier, and a named person accountable for each line.
The AI gap
The guidance states that generative AI and agentic AI models are novel and rapidly evolving and, as such, are not within its scope. The agencies plan to issue a request for information that addresses model risk management generally and considers in particular banks’ use of AI, including generative AI, agentic AI and AI-based models.
This is the part that most needs interpretation. The carve-out is not a permission slip; it is an admission that the agencies have not yet written the standard. The move suggests the agencies did not want to freeze expectations around a technology still changing shape, and that a separate framework may follow the request for information. It does not mean that a language model used to draft suitability notes, summarize client calls or screen transactions carries no model risk. In our reading, a firm that runs generative or agentic tools in a decision path should expect the same questions the guidance asks of a conventional model, with different answers: what the tool is for, what it was tested against, what it is not allowed to do, who checks its output, and how it is switched off.
The carve-out is not a permission slip; it is an admission that the agencies have not yet written the standard.
Translating the bank expectations to a non-bank
| Element | What the guidance describes for banks | A proportionate version for an adviser, fund or fintech |
|---|---|---|
| Definition | A complex quantitative method applying statistical, economic or financial theory to produce estimates | Adopt the definition verbatim; add a materiality threshold so trivial tools do not clog the inventory |
| Inventory | Models supporting significant business lines, operations, services and functions | One list, one owner per model, with purpose, tier and last review date |
| Development and use | Testing before use, documented design, known limitations | A short design note per model with assumptions, data, limits and the owner’s sign-off |
| Validation | Conceptual soundness and outcomes analysis | For high-tier models, review by someone who did not build it; for low-tier models, owner self-assessment with periodic sampling |
| Monitoring | Ongoing checks that the model still performs | Pre-set thresholds and an exceptions log; escalate when a threshold is crossed |
| Governance and controls | Clear policies, roles and responsibilities | A short policy, a named accountable executive, periodic reporting to the board or managing partners |
| Third-party products | Validation of vendor models | Collect vendor evidence, test on your own data, record what you could not verify |
| Generative and agentic AI | Out of scope; request for information to follow | A separate register, use-case approval, human review of output in client-facing or decision paths, and testing of outputs |
The right-hand column is Taft’s suggestion, not the agencies’ text. The point is that each element has a version that fits a firm of any size.
Implementation steps
- Write down what a model is for your firm. Take the agencies’ definition and add a materiality rule: a model matters if its output moves a client’s money, a fund’s valuation, a credit decision or a regulatory filing. Everything else is a tool and is governed as software.
- Build the inventory. List every model that passes the test, with its owner, purpose, inputs, outputs, vendor if any, and the date it was last reviewed. If the list runs to more than a page, you likely have more model risk than you thought.
- Tier the inventory. Two or three tiers are enough. The tier decides the depth of validation, the frequency of monitoring and the level at which exceptions are reported.
- Validate to the tier. The guidance’s two tests, conceptual soundness and outcomes analysis, apply at every size. For the top tier, the reviewer should not be the builder. For lower tiers, a documented self-assessment with periodic sampling is a defensible approach, and the cadence should be a decision you can explain rather than a reflex.
- Deal with third-party models. Ask the vendor for its own validation evidence, test the product on your data, and write down what you could not verify. A vendor’s claim that its product was built to SR 11-7 no longer answers the question; ask how it maps to the revised guidance’s areas instead.
- Govern generative and agentic AI on a separate track. Keep a register of the tools in use, approve each use case, decide where a human must review output before it reaches a client or a decision, test outputs against known cases, and record the configuration and permissions each tool runs with. Taft’s AI and Automation Studio is built around this track.
- Report. Once a year at minimum, put the inventory, the validation status and the open exceptions in front of the board, the managing partners or the equivalent, and minute the discussion.
Questions firms ask
Does SR 26-2 apply to my adviser or fund? Not by its terms. It is addressed to banking organizations, and its own text says it is expected to be most relevant to those with over $30 billion in assets. You are likely to encounter it through a bank partner’s due diligence, an auditor’s control testing or an investor’s operational review.
My vendor says its model is SR 11-7 compliant. Does that still mean anything? It describes a document that has been superseded. The substance of good practice has not changed much, so the claim is not worthless, but you should ask the vendor to show how its evidence maps to development and use, validation and monitoring, governance and controls, and third-party considerations under the revised guidance.
Do I need annual validation? The guidance does not prescribe it, and the OCC has said its guidance does not require community banks to perform annual model validation. A non-bank sets its own cadence. Tie it to the tier, write the reason down, and keep to it.
Is my generative AI tool a model? By the agencies’ text, generative and agentic AI models are outside the scope of the guidance. That does not make them exempt from your own governance. It means the published standard does not yet cover them, and you have to write the controls yourself until it does.
Should I wait for the request for information? No. A request for information is a question, not an answer, and it may take time to turn into guidance. Firms that have an AI register and a review process in place are likely to find it easier to respond to whatever follows.
Where Taft helps
Taft helps advisers, funds and fintechs build a model inventory, tier it, and write the policy and validation standard that fit the firm’s size. Through the AI and Automation Studio, Taft also sets up the separate governance track for generative and agentic AI tools that the bank guidance leaves out. Where a question turns on legal interpretation, Taft will say so and point the firm to counsel.
Questions
Does SR 26-2 apply to a registered adviser, a private fund or a fintech?
Not by its terms. The letter says it is expected to be most relevant to banking organizations with over $30 billion in total assets regulated by the Federal Reserve, and even for banks it does not set forth enforceable standards. A non-bank firm is not bound by it, but it is likely to meet it through bank partners, auditors or investors who use it as a benchmark.
What replaced SR 11-7?
SR letter 26-2, dated April 17, 2026, supersedes SR letter 11-7 of April 4, 2011, and SR letter 21-8 of April 9, 2021. The OCC issued the same guidance as Bulletin 2026-13 and rescinded its own prior issuances, including OCC Bulletin 2011-12 and OCC Bulletin 2021-19.
Are generative AI and agentic AI tools covered by the revised guidance?
No. The guidance states that generative AI and agentic AI models are novel and rapidly evolving and are not within its scope. The agencies plan a request for information on model risk management that considers banks' use of AI, including generative and agentic AI. A firm should govern those tools on a separate track rather than treat the carve-out as an exemption.
Does the revised guidance require annual model validation?
The guidance does not set forth prescriptive requirements, and the OCC had already clarified in Bulletin 2025-26 that its model risk guidance does not require community banks to perform annual model validation. A non-bank firm should set a validation cadence that follows the tier of each model.
Sources
- FRB: Supervisory Letter SR 26-2 on Revised Guidance on Model Risk Management -- April 17, 2026, Federal Reserve Board
- OCC Issues Updated Model Risk Management Guidance, OCC
- Model Risk Management: Revised Guidance, OCC
Taft does not provide legal advice. Content is for informational purposes only and subject to regulatory guidance.