Reference · Model risk management
OCC Bulletin 2026-13: Model Risk Management Guidance for Banks
The OCC's adoption of the revised interagency model risk guidance
OCC Bulletin 2026-13, “Model Risk Management: Revised Guidance,” is the OCC's issuance of the interagency model risk management guidance published jointly with the Federal Reserve and FDIC on 17 April 2026. It carries the same guidance text the Federal Reserve issued as SR 26-2, and it retires the OCC's prior model risk framework — including Bulletin 2011-12, the OCC's counterpart to SR 11-7 — after fifteen years.
Who it applies to
National banks, federal savings associations, and federal branches and agencies of foreign banking organizations — the institutions the OCC supervises. The guidance states it is most relevant to banking organizations with over $30 billion in total assets, with expectations scaled to each institution's size, complexity, and model risk profile.
Institutions supervised by the Federal Reserve or FDIC receive the same guidance through those agencies' companion issuances; SR 26-2 is the Federal Reserve's. The substance is identical — the bulletin number determines which agency examines you against it, not what it says.
What it rescinds
- OCC Bulletin 2011-12, “Sound Practices for Model Risk Management” — the OCC's adoption of the 2011 supervisory guidance known at the Federal Reserve as SR 11-7.
- OCC Bulletin 2021-19, the interagency statement on model risk management for bank systems supporting BSA/AML compliance.
- OCC Bulletin 1997-24, “Credit Scoring Models: Examination Guidance,” including its appendix.
- The “Model Risk Management” booklet of the Comptroller's Handbook.
What it requires
The substance is the interagency guidance — covered in detail in the SR 26-2 entry. In brief: a model inventory against a narrower definition of “model” (excluding simple spreadsheet arithmetic and deterministic rule-based processes), validation built on conceptual soundness, ongoing monitoring, and outcomes analysis, risk-based review cadence in place of the de facto annual cycle, effective challenge, and governance over third-party models.
The guidance states that it does not set forth enforceable standards or prescriptive requirements, and that non-compliance will not by itself result in supervisory criticism. Generative AI and agentic AI are placed outside its scope, with institutions directed to govern them under existing risk-management principles.
Key dates
- May 1997OCC Bulletin 1997-24 on credit scoring models issued.
- 4 April 2011OCC Bulletin 2011-12 issued, adopting the guidance known as SR 11-7.
- 9 April 2021OCC Bulletin 2021-19, the interagency BSA/AML model risk statement, issued.
- 17 April 2026Bulletin 2026-13 issued, rescinding all of the above alongside the Comptroller's Handbook model risk booklet; the Federal Reserve issued the same guidance as SR 26-2.
Primary sources
Common gaps
Where OCC-supervised institutions most often trip during the transition.
- Citations updated for one agency but not the other. Institutions with both OCC- and Fed-supervised entities update SR 11-7 references and miss Bulletin 2011-12, or vice versa. Both are gone; sweep policies, charters, and vendor documents for all four rescinded issuances.
- Examination prep built on the retired handbook. The Comptroller's Handbook model risk booklet shaped how examinations ran. Programs organised around its workpapers need re-anchoring to the principles in the revised guidance.
- BSA/AML models left in limbo. Bulletin 2021-19 gave BSA/AML model systems their own interagency statement. Its rescission folds them back under the general framework — they still need inventory, validation, and monitoring.
- Reading non-binding as no expectations. The guidance disclaims enforceable standards, but examiners still assess model risk management. Less prescription means more burden to articulate and defend the approach chosen.
- No written position on generative and agentic AI. Out of scope does not mean ungoverned. The bulletin directs institutions to apply existing risk-management principles; with no written approach there is nothing to defend.
Related
Last reviewed August 24, 2026. This reference summarises publicly available regulatory guidance and is provided for general information. It is not legal advice. Obligations depend on an institution's charter, registration status, size, and activities. Verify against the primary sources cited above and consult counsel before relying on any summary here.