Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2)
Issued by
Office of the Comptroller of the Currency, Federal Reserve Board, and FDIC
- September 30, 2026 · Correction — Corrected the entry to the joint OCC, Federal Reserve and FDIC guidance of 17 April 2026, which replaces SR 11-7. (Cody Maxwell)
- September 30, 2026 · Correction — Recorded that the guidance is non-enforceable, most relevant to banks over $30 billion, and excludes generative and agentic AI (fact-check finding). (Cody Maxwell)
- October 1, 2026 · Correction — Rewrote the practical steps, newsletter hook, search description, and audience fields to match the entry's corrected content. (Cody Maxwell)
US bank regulators' April 2026 model risk guidance replaces SR 11-7 with a tailored, principles-based approach. It is most relevant to banks with over $30 billion in assets. Generative and agentic AI models are outside its scope.
Applies To
Overview
On 17 April 2026 the OCC, the Federal Reserve, and the FDIC jointly issued revised model risk management guidance (OCC Bulletin 2026-13, Federal Reserve SR 26-2, FDIC FIL-15-2026). It replaces the 2011 guidance, OCC Bulletin 2011-12 and SR 11-7, and calls for model risk management tailored to each bank's model risk profile, size, and complexity. The guidance covers the full model lifecycle, including development, implementation, validation, ongoing monitoring, and retirement, It is expected to be most relevant to banks with over $30 billion in total assets, and to smaller banks with significant model risk. It covers independent model validation, documentation, and board oversight of model inventories, scaled to each model's risk. Generative AI and agentic AI models are outside its scope, and the agencies plan a separate request for information on banks' use of AI. The guidance also reinforces expectations for ongoing performance monitoring, requiring institutions to detect and respond to model degradation (a decline in a model's accuracy over time) in a timely manner. The guidance sets no enforceable standards or prescriptive requirements, and the agencies say non-compliance with it will not lead to supervisory criticism.
Key Requirements
- •The guidance is principles-based and sets no enforceable standards or prescriptive requirements.
- •Keep an inventory of models, with risk management scaled to each model's materiality.
- •Validate models independently, scaled to model risk.
- •Have the board or senior management oversee the model risk framework.
- •Monitor model performance on an ongoing basis.
- •Generative AI and agentic AI models are outside its scope.
What Your Organization Must Do
- →Compare your current model risk framework against the revised guidance, noting that it sets no enforceable standards.
- →Update internal policy references from the 2011 guidance, OCC Bulletin 2011-12 and SR 11-7, to the 2026 bulletins.
- →Review your model inventory and scale documentation and review effort to each model's materiality.
- →Check that independent model validation and ongoing performance monitoring can catch accuracy decline in time.
- →Track the planned request for information on banks' use of AI, since generative and agentic models sit outside this scope.
- →Brief the board or senior management on their oversight role for the model risk framework.