Reference · Model risk management

SR 26-2 Explained: The Model Risk Guidance Replacing SR 11-7

Revised Guidance on Model Risk Management, issued 17 April 2026

Last reviewed October 11, 2026

At a glance

Issued: 17 April 2026
Issued by: Federal Reserve (SR 26-2), OCC (Bulletin 2026-13) and FDIC (FIL-16-2026), jointly
Replaces: SR 11-7 (2011) and SR 21-8 (2021)
Most relevant to: Banking organizations with over $30 billion in total assets
Legal effect: No enforceable standards or prescriptive requirements
Out of scope: Generative AI and agentic AI models (footnote 3)
Official text: Revised Guidance on Model Risk Management (PDF)

SR 26-2 is the Federal Reserve letter that issued the Revised Guidance on Model Risk Management on 17 April 2026, jointly with the OCC and the FDIC. It supersedes SR 11-7, the 2011 guidance, and SR 21-8, the 2021 interagency statement on models used for BSA/AML compliance.SR 26-2 The OCC issued the same guidance as Bulletin 2026-13 and the FDIC as FIL-16-2026.OCC Bulletin 2026-13 FDIC FIL-16-2026

The guidance keeps validation, ongoing monitoring, effective challenge and governance at the center of model risk management, and narrows where they apply: a tighter definition of a model, a $30 billion line, no enforceable standards, and no coverage of generative or agentic AI.Revised Guidance Each difference from SR 11-7, with the page that makes it, is in SR 11-7 to SR 26-2: what changed.

To rate your own program against the practices the guidance describes, use the SR 26-2 gap self-assessment checklist. It covers eight areas and returns the gap and one action for each.

A model is a complex method grounded in statistical, economic or financial theory

The guidance defines a model as "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates."Revised Guidance · Section II

Three kinds of system fall outside it. Simple arithmetic, such as spreadsheet calculations, and deterministic rule-based processes and software with no statistical, economic or financial theory behind them are excluded by the definition itself.Revised Guidance · Section II Generative and agentic AI models are excluded by footnote 3, which keeps traditional statistical and quantitative models and non-generative, non-agentic AI models in scope.Revised Guidance · footnote 3

Materiality then sets how much oversight a model in scope receives. Model purpose and model exposure together determine it: an immaterial model may need no more than identification and monitoring, and a material one warrants more comprehensive and rigorous oversight.Revised Guidance · Section III

Flow

Does SR 26-2 reach this system?

DefinitionComplex quantitative methodApplies statistical, economic or financial theory to produce estimates
ExclusionMore than arithmetic or fixed rulesSpreadsheet arithmetic and deterministic rule-based software are out
Footnote 3Neither generative nor agenticThose go to the institution's own governance
RelevanceOver $30 billion in assetsSmaller banks with significant model risk can be in scope too
MaterialityPurpose and exposure set the rigorImmaterial models: identify them and monitor

Each test is from Sections II and III and footnote 3 of the Revised Guidance on Model Risk Management. The guidance states them separately; the order is ours.

Most relevant above $30 billion in total assets

The guidance is expected to be most relevant to banking organizations with over $30 billion in total assets. Below that line, models are typically governed by internal practices suited to the institution's size and risk profile, and leaving them out is consistent with a tailored supervisory approach.Revised Guidance · Section II

Smaller organizations can still be in scope. The guidance may be relevant to one with significant exposure to model risk, because its models are prevalent and complex or because it operates outside traditional community banking.Revised Guidance · Section II

SR 11-7 was to be applied, as appropriate, to every banking organization the Federal Reserve supervised.SR 11-7 The FDIC, which adopted it in 2017, expected it to pertain generally to institutions with $1 billion or more in total assets.FDIC FIL-22-2017

No enforceable standards, with the law and safety and soundness intact

The guidance "does not set forth enforceable standards or prescriptive requirements," and non-compliance with it will not result in supervisory criticism.Revised Guidance · Section I Its first footnote points to each agency's rule on the role of supervisory guidance, and adds that supervisory action may still result from violations of law or unsafe or unsound practices stemming from insufficient management of model risk.Revised Guidance · footnote 1

For institutions the OCC and the FDIC supervise, a final rule effective 2 November 2026 defines an unsafe or unsound practice as one contrary to generally accepted standards of prudent operation that is likely to materially harm the institution's financial condition or present a material risk of loss to the Deposit Insurance Fund, or that already has harmed it. The same rule limits matters requiring attention to such practices and to actual violations of banking or banking-related law.91 FR 56004 · 12 CFR 4.92, 305.1

Validation scales with materiality and has no fixed cycle

Validation assesses whether a model performs as expected, including its reliability and its limitations, with a nature and rigor aligned to the model's approach, use and materiality. Its components are conceptual soundness and outcomes analysis, alongside ongoing monitoring of whether the model still performs as expected as products, exposures, data and markets change.Revised Guidance · Section V

The timing, nature and frequency of validation vary with model purpose, methodology, the frequency and scope of model changes, and data limitations. Validation generally comes before first use; an urgent business need can justify using a model first, with closer attention to its limitations, notice to stakeholders, and controls such as limits on use.Revised Guidance · Section V

Effective challenge stays the organizing principle: critical analysis by objective experts with the expertise to challenge, sufficient independence to maintain objectivity, and the standing and influence to effect change.Revised Guidance · Section III The guidance judges validation by the rigor and effectiveness of the review, whatever the organizational structure of the risk function.Revised Guidance · Section V

Governance rests on roles, an inventory and documentation

Policies set expectations and a framework for assessing model risk, and procedures put them into effect. Roles carry well-defined accountability, including for conflicts of interest between development and validation, and internal audit evaluates whether model risk management is rigorous and effective without duplicating development or validation.Revised Guidance · Section VI

The guidance describes a model inventory as common industry practice and expects it to hold enough information to understand model risk for each model and in aggregate. Documentation supports continuity of operations and the tracking of recommendations, responses and exceptions.Revised Guidance · Section VI

Vendor models stay inside the framework

Vendor products remain subject to the principles of model risk management when the institution does not receive the code, data or methodology behind them.Revised Guidance · Section VII Sound practice is to validate the product, internally or through outside parties, by understanding its conceptual soundness, design, development data and performance, and to run ongoing monitoring and outcomes analysis on it. Customizations are documented, justified and evaluated as part of validation.Revised Guidance · Section VII

The relationship with the vendor sits under third-party risk management, covered in What a bank's third-party risk review asks an AI vendor.

Generative and agentic AI sit outside it, by footnote

Footnote 3 reads: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." It goes on to say that a banking organization's own risk management and governance practices should guide the controls for any tools, processes or systems the guidance does not cover.Revised Guidance · footnote 3

The OCC's bulletin adds that the agencies plan to issue a request for information on model risk management that considers banks' use of AI, including generative and agentic AI. As of 11 October 2026 it has not appeared in the Federal Register.OCC Bulletin 2026-13 Federal Register What reaches these systems in the meantime, including AI agents that call tools, is in SR 26-2 and generative and agentic AI: the carve-out explained.

Control mapping

What a reviewer expects to be able to see.

Obligation	What the system must do	Evidence a reviewer expects
Model inventory	Hold enough information on each model in scope to understand its risk individually and in aggregate	Inventory with owner, purpose, materiality, dependencies and change history
Materiality	Set oversight by model purpose and exposure	Tiering rationale per model, and monitoring of immaterial models for change
Validation	Validate conceptual soundness and outcomes, with ongoing monitoring	Validation reports with scope, findings, limitations and remediation status
Risk-based timing	Time validation by purpose, methodology, model change and data limits	A documented cadence policy and records showing the triggers fired
Effective challenge	Have objective experts with standing challenge the model	Records of what was questioned, by whom, and how it was resolved
Use before validation	Control any use that urgent need puts ahead of validation	Recorded limitations, notice to stakeholders, and limits or added monitoring
Vendor models	Validate vendor products and monitor their outcomes	Vendor documentation, validation scope, monitoring results and customization records
Generative and agentic AI	Govern under the institution's own risk management and governance practices	A written approach, its rationale, and evidence it operates

Key dates

Timeline, drawn to scale

Fifteen years of interagency model risk guidance

IssuedReplaces the other three

Issue dates from the SR 26-2 letter and OCC Bulletin 2026-13. Status as of October 11, 2026.

4 April 2011SR 11-7 issued by the Federal Reserve and, as Bulletin 2011-12, by the OCC.
7 June 2017The FDIC adopts the 2011 guidance (FIL-22-2017).
9 April 2021SR 21-8, the interagency statement on model risk for bank systems supporting BSA/AML compliance, issued.
17 April 2026SR 26-2 issued, superseding SR 11-7 and SR 21-8; the OCC issues the same guidance as Bulletin 2026-13 and the FDIC as FIL-16-2026.
2 November 2026The OCC and FDIC final rule defining unsafe or unsound practices and limiting matters requiring attention takes effect.

Sources cited

Common gaps

Where institutions most often struggle when examined against this guidance.

Scope drift. The narrower definition moves spreadsheets and rule engines out of scope. A dated record of what left the inventory, and why, keeps the change explainable.
Triggers with no firing history. Risk-based timing is only defensible with records showing the triggers were monitored and acted on. A trigger policy with no evidence reads worse than a calendar.
Challenge that leaves no trace. Challenge is evidenced by records of the objections raised and how they were resolved. Minutes alone show only that a committee met.
No supervisory criticism read as no supervision. The guidance carries no enforceable standards. Supervisory action for violations of law and unsafe or unsound practices remains, and model risk management is still examined.
No stated position on generative and agentic AI. The guidance leaves these systems to the institution's own risk management and governance. With no written approach there is neither a rulebook to cite nor a decision to defend.
Vendor models held to a lower standard. The principles apply when the vendor withholds code, data or methodology, and missing provider documentation is the institution's problem.

In practice

How Meilynx maps to the model risk guidance →

Last reviewed October 11, 2026. This reference summarises publicly available regulatory guidance and is provided for general information. It is not legal advice. Obligations depend on an institution's charter, registration status, size, and activities. Verify against the primary sources cited above and consult counsel before relying on any summary here.