Reference · Model risk management

SR 11-7 to SR 26-2: What Changed

What changed, and what did not

Last reviewed October 11, 2026

SR 11-7 was superseded on 17 April 2026, when the Federal Reserve, the OCC and the FDIC jointly issued SR 26-2, Revised Guidance on Model Risk Management. SR 26-2 also replaces SR 21-8, the 2021 interagency statement on model risk for bank systems supporting BSA/AML compliance.SR 26-2 The OCC and the FDIC rescinded their own issuances of the old guidance the same day.OCC Bulletin 2026-13 FDIC FIL-16-2026

The validation components, effective challenge and the vendor principles carry forward. The definition of a model, the scope, the legal effect and the review cycle changed, and generative and agentic AI are now named and left out. Every difference, with the section and page of each source, is in a table to download: SR 11-7 to SR 26-2 comparison (CSV).

To see where a program built on SR 11-7 stands against the new guidance, work through the SR 26-2 gap self-assessment checklist.

SR 26-2 narrows where model risk management reaches

The SR 26-2 attachment runs to 12 pages; the SR 11-7 attachment ran to 21.SR 26-2 attachment SR 11-7 attachment

Before and after

SR 11-7 and SR 26-2, side by side

SR 11-7 (2011)SR 26-2 (2026)

Issued by: Fed and OCC (FDIC from 2017); →; Fed, OCC and FDIC
Scope: All banks, as appropriate; →; Most relevant over $30 billion
What counts as a model: Quantitative methods and theories; →; Complex quantitative methods
Legal effect: Supervisory expectations; →; No enforceable standards
Review cycle: At least annual review; →; Set by risk
Validator independence: Apart from developers and users; →; Rigor of the review
Board and senior management: Assigned responsibilities; →; Not mentioned
Generative and agentic AI: Not addressed; →; Out of scope

From the SR 11-7 attachment (archived copy), the SR 26-2 attachment and FDIC FIL-22-2017. Each row, with page references, is in the CSV.

A narrower definition of a model

SR 11-7 defined a model as a quantitative method, system or approach applying "statistical, economic, financial, or mathematical theories, techniques, and assumptions" to produce quantitative estimates. It counted approaches with qualitative or expert-judgment inputs when the output was quantitative.SR 11-7 attachment · p. 3

SR 26-2 adds the word complex, drops mathematical theories, techniques and assumptions, and excludes simple arithmetic such as spreadsheet calculations, along with deterministic rule-based processes and software that have no statistical, economic or financial theory behind them.SR 26-2 attachment · Section II, p. 3

SR 11-7 said approaches outside its definition should still be subject to a rigorous control process.SR 11-7 attachment · p. 3, footnote 3 SR 26-2 leaves the controls for anything it does not cover to the institution's own risk management and governance practices.SR 26-2 attachment · footnote 3

A $30 billion line, and no enforceable standards

SR 11-7 was to be applied as appropriate to all banking organizations the Federal Reserve supervised, taking into account size, nature, complexity and the extent of model use.SR 11-7 The FDIC, which adopted it in 2017, expected it to pertain generally to institutions with $1 billion or more in total assets.FDIC FIL-22-2017 SR 26-2 is expected to be most relevant above $30 billion, and may still be relevant to a smaller organization with significant exposure to model risk.SR 26-2 attachment · Section II, pp. 2-3

SR 11-7 told banks to ensure their policies and procedures were consistent with "the risk management principles and supervisory expectations" in the guidance.SR 11-7 attachment · p. 2 SR 26-2 sets no enforceable standards or prescriptive requirements, and non-compliance with it will not result in supervisory criticism.SR 26-2 attachment · Section I, p. 2

Supervisory action can still follow from violations of law, or from unsafe or unsound practices stemming from insufficient management of model risk.SR 26-2 attachment · footnote 1 For institutions the OCC and the FDIC supervise, a final rule effective 2 November 2026 defines that term by likely material harm to the institution's financial condition.91 FR 56004 · 12 CFR 4.92, 305.1

Validation timing is set by risk, with no annual review

SR 11-7 called for a periodic review of each model "at least annually but more frequently if warranted," and described full validation of all models at a fixed interval as good practice.SR 11-7 attachment · p. 10

SR 26-2 states no interval. The timing, nature and frequency of validation vary with model purpose, methodology, the frequency and scope of model changes, data limitations and other practical constraints.SR 26-2 attachment · Section V, p. 7 The OCC had already said in 2025 that its guidance did not require community banks to perform annual model validation.OCC Bulletin 2026-13 · footnote 4

Use before validation changed as well. SR 11-7 allowed it where data paucity or other limitations made validation infeasible, with documentation and compensating controls.SR 11-7 attachment · p. 10 SR 26-2 names an urgent business need as a reason, with attention to limitations, notice to stakeholders, and controls such as limits on use or closer monitoring.SR 26-2 attachment · Section V, pp. 7-8

Independence is judged by the quality of the review

Under SR 11-7, validation was generally to be done by people with no responsibility for a model's development or use and no stake in whether it was found valid, with independence judged by actions and outcomes as well as reporting lines.SR 11-7 attachment · p. 9

SR 26-2 ties the quality of validation to the rigor and effectiveness of the review rather than to the organizational structure of the risk function.SR 26-2 attachment · Section V, p. 8 Effective challenge still requires sufficient independence to maintain objectivity.SR 26-2 attachment · Section III, p. 5

The board and senior management drop out of the text

SR 11-7 made the board ultimately responsible for model risk, gave senior management the job of executing and maintaining the framework, and asked the board or its delegates to approve model risk policies and review them annually.SR 11-7 attachment · p. 17 SR 26-2 does not mention the board of directors or senior management. It describes governance through clear policies, effective controls, and roles with well-defined accountability.SR 26-2 attachment · Section VI, p. 10

The inventory moved from instruction to observation. SR 11-7 said banks "should maintain a comprehensive set of information" on models in use, under development or recently retired.SR 11-7 attachment · p. 20 SR 26-2 describes an inventory as common industry practice that holds enough information to understand model risk individually and in aggregate.SR 26-2 attachment · Section VI, p. 11

Generative and agentic AI are named, and left out

SR 11-7 does not address generative or agentic AI.SR 11-7 attachment SR 26-2 places generative and agentic AI models outside its scope in footnote 3 and keeps traditional statistical and quantitative models and non-generative, non-agentic AI models inside it.SR 26-2 attachment · footnote 3 What still reaches those systems is in the carve-out entry.

What carried forward

Validation built on conceptual soundness and outcomes analysis, with ongoing monitoring.SR 11-7 attachment · p. 11 SR 26-2 attachment · Section V
Effective challenge by objective parties with the competence and influence to effect change.SR 11-7 attachment · p. 4 SR 26-2 attachment · Section III
Model risk assessed for individual models and in aggregate.SR 11-7 attachment · p. 4 SR 26-2 attachment · Section III
Internal audit evaluating model risk management without duplicating it.SR 11-7 attachment · p. 19 SR 26-2 attachment · Section VI
Vendor models held to the principles of model risk management, with validation, ongoing monitoring and outcomes analysis of the bank's own use.SR 11-7 attachment · pp. 15-16 SR 26-2 attachment · Section VII

Eight issuances retired across three agencies

The Federal Reserve superseded two letters, the OCC rescinded four issuances, and the FDIC rescinded two.SR 26-2 OCC Bulletin 2026-13 · Rescissions FDIC FIL-16-2026 Policies, model charters, validation templates, vendor questionnaires and audit programs that cite any of them need updating.

Federal Reserve: SR 11-7, Guidance on Model Risk Management (4 April 2011), and SR 21-8, the BSA/AML model risk statement (9 April 2021).
OCC: Bulletin 2011-12, its issuance of the 2011 guidance; Bulletin 2021-19, the BSA/AML statement and request for information; Bulletin 1997-24 on credit scoring models; and the Model Risk Management booklet of the Comptroller's Handbook.
FDIC: FIL-22-2017, its 2017 adoption of the 2011 guidance, and FIL-27-2021, its issuance of the BSA/AML statement.

What a model risk program needs to update

Re-scope the inventory against the narrower definition, and record what left it, what stays under internal controls, and why.
Replace calendar-driven review with documented, risk-based triggers, and keep a record of each trigger that fired.
Replace citations to all eight retired issuances in policies, charters, validation templates and vendor questionnaires.
Decide which SR 11-7 practices, such as annual board review of model risk policy, the program keeps as its own choice, and record the decision.
Write down how the institution governs generative and agentic AI, which the guidance leaves to its own risk management and governance practices.SR 26-2 attachment · footnote 3

Key dates

Timeline, drawn to scale

From SR 11-7 to SR 26-2

IssuedSupersedes and rescinds the rest

Issue dates from the SR 26-2 letter, OCC Bulletin 2026-13 and FDIC FIL-16-2026. Status as of October 11, 2026.

4 April 2011SR 11-7 issued by the Federal Reserve and, as Bulletin 2011-12, by the OCC.
7 June 2017The FDIC adopts the 2011 guidance (FIL-22-2017).
9 April 2021SR 21-8 and FDIC FIL-27-2021 issued, the interagency statement on model risk for BSA/AML systems; the OCC follows with Bulletin 2021-19 on 12 April.
18 August 2021The OCC issues the Model Risk Management booklet of the Comptroller's Handbook (Bulletin 2021-39).
17 April 2026SR 26-2, OCC Bulletin 2026-13 and FDIC FIL-16-2026 issued, superseding or rescinding all of the above.

Sources cited

Common gaps

What tends to be missed during migration.

Stale citations. SR 11-7 appears in policies, charters, vendor questionnaires, audit programs and marketing. SR 21-8, the OCC and FDIC issuances and the Comptroller's Handbook booklet are retired too, and are missed more often.
Treating no supervisory criticism as no expectations. Disclaiming enforceable standards leaves supervisory action for violations of law and unsafe or unsound practices in place. Relaxing controls leaves less to show and the same amount to prove.
Removing the annual review before the replacement works. Risk-based triggers need monitoring behind them; drop the calendar first and nothing starts a review.
Reading the independence change as permission to merge functions. Tying validation quality to the rigor of the review raises the bar on evidencing objectivity in substance.
No record of the transition. Migration decisions are examinable. A dated memo covering what was re-scoped, what was retained and why is worth more than the changes alone.

In practice

How Meilynx maps to the model risk guidance →

Last reviewed October 11, 2026. This reference summarises publicly available regulatory guidance and is provided for general information. It is not legal advice. Obligations depend on an institution's charter, registration status, size, and activities. Verify against the primary sources cited above and consult counsel before relying on any summary here.