The Federal Reserve Board, the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC) jointly issued revised interagency guidance on model risk management on April 17, 2026. The updated framework, which serves as the primary supervisory standard as of April 20, 2026, rescinds and replaces the long-standing SR Letter 11-7 and SR Letter 21-8. This update marks the first major revision to model risk standards since 2011, reflecting significant advancements in financial technology and modeling practices over the past fifteen years.
The revised guidance emphasizes a risk-based approach, clarifying that model risk management (MRM) practices should be tailored to a banking organization’s size, complexity, and specific model risk profile. According to the agencies, the new principles are intended to provide flexibility and reduce unnecessary regulatory burden, particularly for institutions with simpler operations. The guidance explicitly states that it does not establish enforceable standards or prescriptive requirements. Consequently, a banking organization’s failure to align with these principles will not result in formal supervisory criticism or enforcement actions.
The applicability of the new guidance is primarily focused on banking organizations with total consolidated assets exceeding $30 billion. However, regulators noted that the framework remains relevant for smaller institutions that maintain significant model risk exposure due to the complexity of their internal systems or the prevalence of their model use. The updated text also includes specific considerations for the use of vendor and third-party products. It requires banks to validate these external models with a level of rigor commensurate with the risk they pose to the institution’s safety and soundness.
A key component of the update addresses the evolving role of artificial intelligence in the financial sector. While the revised guidance provides a foundation for traditional models, the agencies announced plans to issue a formal Request for Information (RFI) in the near future. This RFI will specifically target the use of generative AI and agentic AI in banking, areas that were not contemplated in the 2011 standards. The agencies aim to gather data on how these emerging technologies fit within the broader MRM framework without hindering the industry's ability to innovate.
Industry reaction to the update has been largely positive. Rob Nichols, President and CEO of the American Bankers Association (ABA), stated that the prior guidance predated major technological developments, creating regulatory uncertainty that adversely impacted the ability of banks to innovate. Nichols noted that the revised guidance will help banks of all sizes, particularly community banks, continue to pursue responsible innovation. The agencies also rescinded several specific bulletins, including OCC Bulletin 2011-12 and OCC Bulletin 2021-19, to streamline the regulatory landscape and provide a more cohesive set of expectations for supervised institutions.