The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →AI model risk management in banking is the discipline of identifying, assessing, controlling and monitoring the chance that a model’s assumptions, data, code, implementation or use will produce harmful decisions or financial losses. It covers the full model lifecycle—not just an independent validation report.
For U.S. banks, the current interagency reference is the Supervisory Guidance on Model Risk Management, issued April 17, 2026 by the Federal Reserve, Office of the Comptroller of the Currency and Federal Deposit Insurance Corporation. The guidance replaces Federal Reserve SR 11-7 and the 2021 interagency statement on model risk management for Bank Secrecy Act/anti-money-laundering systems. It takes a risk-based approach: controls should match a model’s risk, materiality, intended purpose and the institution’s size and complexity. Read the full interagency guidance and SR 26-2 for the official text.
As an Amazon Associate I earn from qualifying purchases.
What counts as a model under the banking guidance?
The guidance defines a model as a complex quantitative method, system or approach that applies statistical, economic or financial theories to input data to produce quantitative estimates. A spreadsheet or application that performs simple arithmetic, or a deterministic rule process without those theoretical underpinnings, is outside that definition.
The scope includes traditional statistical and quantitative models and non-generative, non-agentic AI models. Examples can include a machine-learning credit-risk score, a fraud-detection classifier or a loss-forecasting model when the system produces estimates from data and theory. Classification depends on how the system works and is used, not on whether a vendor labels it “AI.”
#1 Best Overall
The boundary for generative and agentic AI
Generative and agentic AI are expressly excluded from the April 2026 guidance. The document says, “Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance.” Federal Reserve Vice Chair for Supervision Michelle W. Bowman repeated that point in a May 1, 2026 speech, explaining that other risk-management and governance practices should support adoption of those technologies. The exclusion does not mean those systems are risk-free or ungoverned; it means SR 26-2 is not the rulebook that directly covers them.
Why model risk matters to a bank
Model risk is the possibility of adverse consequences because a model is wrong, misunderstood or used inappropriately. A bad output can contribute to credit losses, inaccurate regulatory or financial reporting, flawed pricing, poor capital decisions, ineffective anti-money-laundering monitoring or other unsafe choices. The risk can arise even when the software runs exactly as designed: assumptions may not fit current conditions, input data may be incomplete, or users may apply the output to a purpose the developer never evaluated.
Risk also grows through dependence. Several models may use the same economic scenario, vendor data feed, probability assumption or transformation code. A shared defect can therefore affect many decisions at once. A bank needs to consider each model and the combined exposure created by interactions and common dependencies.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWho should apply the 2026 guidance?
The agencies expect the guidance to be most relevant to banking organizations with more than $30 billion in assets. That figure is a supervisory scope indicator, not a safe harbor. A smaller bank may still face significant model risk if it relies heavily on automated underwriting, complex forecasts, third-party models or systems that influence material financial or regulatory decisions.
The guidance is supervisory guidance rather than a prescriptive regulation. It does not establish enforceable standards, and failure to follow guidance alone will not result in supervisory criticism. However, a bank can face supervisory action for violating law or engaging in unsafe or unsound practices that result from insufficient model-risk management. Each organization remains responsible for choosing practices that are effective for the risks it actually faces.
How a bank sets the right level of oversight
The 2026 approach avoids identical controls for every model. A bank evaluates inherent risk, exposure and purpose, then uses those factors to determine materiality and the depth of oversight.
| Risk dimension | Questions to ask | Effect on oversight |
|---|---|---|
| Assumptions, complexity and data | How complex is the method? Are assumptions difficult to test? Are data quality, coverage or availability constrained? | More complex methods, fragile assumptions or weak data call for more rigorous development testing, documentation and monitoring. |
| Exposure | How much money, portfolio volume or business activity depends on the output? Could an error affect customers, capital or reporting? | Greater business impact increases materiality and the need for comprehensive controls. |
| Purpose | Does the model support regulatory compliance, financial-risk management or another consequential decision? | Regulatory and financial-risk uses generally receive higher scrutiny than low-consequence uses. |
| Actual versus intended use | Are users applying the model only within its approved purpose, population, time horizon and decision process? | Extensions or workarounds require analysis of the new uncertainty and review of controls. |
| Institutional complexity | How large and operationally complex is the bank, and how many models, vendors and shared platforms does it operate? | Governance, inventory and aggregate-risk practices should scale with the organization’s model-risk profile. |
Risk should be assessed both individually and in aggregate. A low-risk model in isolation may become important when it feeds a high-materiality model or shares a data source with many other systems.
The model-risk lifecycle, step by step
1. Define the purpose and intended use
Start with a written statement of what the model is meant to do, who will use it, which decisions it supports, the population and data period it covers, and what it is not approved to do. Business purpose should drive the choice of data, method, assumptions and performance thresholds. Development is not merely a coding exercise: judgment about design and inputs is itself a source of risk.
2. Develop and test proportionately
Testing should match complexity and materiality. Useful evidence can include out-of-sample testing on observations not used for development, out-of-time testing on a later period, comparison of alternative assumptions or methods, and checks of data quality, relevance and representativeness. A bank should record why the selected approach is suitable and what results would indicate deterioration or failure.
3. Control use and communicate limitations
Users need a practical explanation of what the output means, how it was produced and where it can be wrong. Documentation should state material limitations, excluded populations, sensitivity to key inputs, known instability and required human judgment. Using a model outside its intended purpose adds uncertainty. Before expanding use, the bank should analyze the new use case, test whether performance remains acceptable and obtain the required governance approval.
4. Validate before first use when feasible
Validation is an objective assessment of whether the model performs as expected, is reliable for its intended use and has understood limitations. It normally occurs before initial production use. An urgent business need may justify temporary use before validation is complete, but that exception requires clear communication of limitations, compensating controls and heightened attention to the outstanding validation work.
Free tools Windows power users keep installed
One-click scans. No signup required.
Validation should examine conceptual soundness, data and implementation, outcomes and limitations—not simply reproduce the developer’s calculations. The guidance emphasizes that “the quality of validation process depends on the rigor and effectiveness of the review rather than on organizational structure of the banking organization’s risk management function.” Independence and expertise matter because a reviewer must be able to challenge design choices and influence corrective action.
5. Monitor performance and outcomes continuously
Post-deployment monitoring looks for deterioration, persistent deviations from expected results, data drift, changes in the economic environment and breaks in implementation. Outcome analysis compares predictions with what actually happened and checks whether errors are concentrated in particular segments. Triggers should specify when the bank will investigate, restrict use, recalibrate, adjust inputs or redevelop the model. Monitoring frequency and thresholds should reflect materiality and the speed at which conditions can change.
6. Govern, inventory and document
Policies should assign accountability across development, validation, approval, monitoring, issue remediation and retirement. A model inventory should contain enough information to understand risk both for each model and across the portfolio. Typical fields include owner, purpose, materiality rating, methodology, key data sources, dependencies, validation status, approved uses, limitations, monitoring schedule, open findings, exceptions and retirement date.
Documentation provides continuity when staff, vendors or systems change. It should allow a new reviewer to reconstruct design decisions, testing, approvals, limitations, monitoring results and remediation. Exceptions and validation recommendations need owners, due dates and escalation when they remain unresolved.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Effective challenge and independence
Effective challenge means critical analysis by people with appropriate technical and business expertise, enough independence to remain objective and sufficient standing to require change. The exact organizational chart can vary by bank; the essential test is whether challenge is rigorous and influential. Developers should not be the only people deciding whether their own assumptions, code or results are acceptable.
Best Value
Challenge should continue after approval. A reviewer or oversight committee may question a performance threshold, an unexplained change in data, a request to extend the model to a new product or a decision to keep using a model after a monitoring breach. The bank should preserve evidence of the question, response, decision and any compensating control.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Managing third-party and vendor models
Buying a model does not transfer responsibility for its risk. Proprietary software may restrict access to source code, training data or detailed methodology, but the bank still needs enough understanding to judge conceptual soundness, development data, performance and limitations.
- Obtain available technical documentation, validation evidence, change logs, performance reports and user instructions.
- Assess whether the vendor’s data, assumptions and population match the bank’s products, geography and intended use.
- Test implementation, interfaces, parameter settings and any data transformations performed inside the bank.
- Monitor outcomes and vendor updates over time rather than relying only on an initial due-diligence package.
- Document and evaluate every customization, override, calibration or local data substitution.
- Define contractual access, notification, support, incident and exit arrangements so the bank can investigate problems or replace the product.
How to handle generative and agentic AI
Do not label a generative chatbot or autonomous agent as covered by SR 26-2 merely because it produces a numerical answer. The April 2026 guidance excludes generative and agentic AI models. A bank should instead use its broader risk-management and governance framework to determine controls appropriate to the system’s risks, such as decision authority, data handling, security, consumer impact, monitoring and human escalation. The exact control set should reflect the use case and applicable law; the interagency model guidance does not prescribe it.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsA practical implementation roadmap
- Inventory first. Identify every in-scope statistical, quantitative and non-generative AI model, including embedded vendor models and models used by subsidiaries or shared services.
- Classify risk and materiality. Rate complexity, assumptions, data constraints, exposure, purpose, dependencies and institutional impact. Record why the rating is reasonable.
- Map the lifecycle. Assign owners for development, independent validation, approval, monitoring, issue management and retirement.
- Set evidence requirements. Specify the testing, documentation, validation and monitoring needed for each risk tier instead of applying a single checklist to all models.
- Approve intended use. Put approved populations, decisions, thresholds and limitations where users can see them, and require review for extensions.
- Establish monitoring triggers. Define metrics, frequency, tolerance bands, escalation contacts and actions such as recalibration, restriction or redevelopment.
- Aggregate dependencies. Analyze shared data, assumptions, platforms and vendors to detect concentration risk across the model inventory.
- Close the loop. Track findings and exceptions to resolution, report material issues to the appropriate committee and update the inventory when a model changes or retires.
Common failure modes and their fixes
- “Validation is the whole program.” Fix: treat validation as one control in a lifecycle that also includes sound development, approved use, monitoring, governance and documentation.
- “A vendor is responsible for the model.” Fix: obtain enough evidence to understand and monitor the product, and test local implementation and customizations.
- “The model passed once, so it is safe forever.” Fix: perform ongoing outcome analysis and define conditions that trigger recalibration or redevelopment.
- “The same controls fit every model.” Fix: scale testing, review depth and monitoring to materiality, complexity, exposure and purpose.
- “A convenient new use is harmless.” Fix: assess the new purpose and population before extending use, and document the decision.
- “Generative AI is automatically covered by SR 26-2.” Fix: recognize the explicit scope boundary and apply broader governance and risk-management practices instead.
What smaller banks should take from the guidance
A bank below $30 billion in assets does not need to copy a large institution’s bureaucracy. It does need controls that are effective for its own exposure. A small organization with a few low-impact calculators may need limited documentation and periodic review; a smaller lender that depends on complex automated credit, fraud or capital models may need formal inventory, independent challenge, validation and continuous monitoring. The deciding question is the bank’s model-risk profile, not its asset size alone.
The central principle is accountability: the organization chooses a proportionate framework, demonstrates that it understands the models on which decisions depend, and acts when evidence shows that assumptions, data, implementation or outcomes no longer support safe use.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
