Guide
SR 11-7 and SR 26-2: US model risk management guidance explained (2026)
SR 11-7 was the US banking agencies’ model risk management guidance from 2011 until April 17, 2026, when the Federal Reserve, the OCC and the FDIC replaced it with SR 26-2, “Revised Guidance on Model Risk Management” [1]. SR 26-2 narrows what counts as a model, ties oversight to each model’s materiality, drops the annual validation cycle and the board-level detail, and leaves generative and agentic AI out of scope [2][11]. This guide explains both letters, compares them line by line with quotes from the agencies’ texts, and sets out what banks and their vendors should do now.
Reviewed 30 Oct 2026 · next review by 29 Dec 2026 · 21 sources · report an error
What was SR 11-7?
SR 11-7, “Guidance on Model Risk Management”, is a Federal Reserve supervisory letter dated April 4, 2011. The Federal Reserve and the OCC issued the guidance together, and said it “should be applied as appropriate to all banking organizations supervised by the Federal Reserve” [3]. The OCC issued the same text as OCC Bulletin 2011-12, “Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management” [6]. The FDIC adopted it in June 2017 through FIL-22-2017, with conforming changes, and said it did not expect the guidance to pertain to FDIC-supervised institutions with under $1 billion in total assets [5].
SR 11-7 defined a model as a quantitative method, system or approach that applies “statistical, economic, financial, or mathematical theories”, including approaches whose inputs are partly or wholly qualitative or based on expert judgment [3]. It defined model risk as “the potential for adverse consequences from decisions based on incorrect or misused model outputs and reports”, which can lead to financial loss, poor business and strategic decision-making, or damage to a banking organization’s reputation [3].
The letter named three key aspects of an effective model risk management framework, often called its three pillars: “robust model development, implementation, and use; effective validation; and sound governance, policies, and controls” [3].
| Pillar | What SR 11-7 asked for |
|---|---|
| Development, implementation and use | Sound development, with testing as “an integral part of model development” [3][4] |
| Validation | Validation that applies “equally to models developed in-house and to those purchased from or developed by vendors or consultants”; a review of each model “at least annually but more frequently if warranted” [3] |
| Governance, policies and controls | Governance “provided at the highest level by the board of directors and senior management”, an inventory of models, and internal audit of the framework’s overall effectiveness [3][4] |
The idea most associated with SR 11-7 is effective challenge: “critical analysis by objective, informed parties that can identify model limitations and produce appropriate changes”, which “depends on a combination of incentives, competence, and influence” [3]. In 2021 the agencies added SR 21-8, an interagency statement on model risk management for bank systems supporting Bank Secrecy Act and anti-money laundering compliance [1].
What is SR 26-2?
SR 26-2, “Revised Guidance on Model Risk Management”, is dated April 17, 2026. It is interagency guidance from the Federal Reserve Board, the OCC and the FDIC, and the Federal Reserve’s letter says it “supersedes and replaces SR letter 11-7” and also supersedes SR 21-8 [1][2]. The agencies say it reflects “supervisory experience and industry feedback accumulated over the past fifteen years” [2].
| Agency | Issuance | What it rescinded |
|---|---|---|
| Federal Reserve | SR 26-2, April 17, 2026 [1] | SR 11-7 and SR 21-8 [1] |
| OCC | Bulletin 2026-13, “Model Risk Management: Revised Guidance”, April 17, 2026 [6] | Bulletin 2011-12, Bulletin 2021-19 (BSA/AML model risk), Bulletin 1997-24 (credit scoring models) and the Comptroller’s Handbook “Model Risk Management” booklet [6] |
| FDIC | FIL-15-2026, April 17, 2026 [8] | FIL-22-2017 and FIL-27-2021 [8][9] |
Scope. SR 26-2 is “expected to be most relevant to banking organizations with over $30 billion in total assets” [1]. The guidance says that “generally excluding” smaller banks “is consistent with a tailored supervisory approach”, but that it may still be relevant to banking organizations with $30 billion or less that “have significant exposure to model risk because of the prevalence and complexity of their models” [2]. The FDIC says its letter applies to all FDIC-supervised institutions, with the same $30 billion expectation [8].
A narrower definition of a model. A model is now “a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates” [2]. The term “excludes simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use” [2]. Compared with SR 11-7, the word “complex” is new and “mathematical” theories are gone [3][11].
Risk-based, not prescriptive. SR 26-2 sets out “a risk-based approach to model risk management, tailored to a banking organization’s model risk profile” [2]. Models “deemed of higher materiality by the banking organization—either through model exposure or purpose—warrant more comprehensive and rigorous oversight”, while for immaterial models model risk management “may consist of identifying those models and monitoring model performance” [2]. The guidance “does not set forth enforceable standards or prescriptive requirements”, and “non-compliance with this guidance will not result in supervisory criticism” [2]. A footnote keeps the agencies’ power to act on violations of law or unsafe or unsound practices [2].
No effective date. Neither the Federal Reserve’s letter nor the FDIC’s letter states an effective date or a compliance timeline; the only date is the April 17, 2026 issue date [1][8].
The attached guidance has seven parts: introduction; purpose and scope; overview of model risk and model risk management; model development and model use; model validation and monitoring (conceptual soundness, outcomes analysis, ongoing monitoring); governance and controls (roles and responsibilities, model inventory, documentation); and vendor and other third-party products [2].
SR 11-7 vs SR 26-2: what changed
| Topic | SR 11-7 (2011) | SR 26-2 (2026) |
|---|---|---|
| Status | Superseded and replaced on April 17, 2026 [1] | Current interagency guidance, issued April 17, 2026 [1] |
| Issued by | Federal Reserve and OCC (OCC Bulletin 2011-12); FDIC adopted it in 2017 (FIL-22-2017) [3][5][6] | Federal Reserve, OCC (Bulletin 2026-13) and FDIC (FIL-15-2026) together [1][6][8] |
| Who it covers | “All banking organizations supervised by the Federal Reserve”, applied as appropriate; the FDIC did not expect it to pertain to institutions under $1 billion [3][5] | “Most relevant to banking organizations with over $30 billion in total assets”; smaller banks generally excluded unless they have significant model risk [1][2] |
| Definition of a model | Applies “statistical, economic, financial, or mathematical theories”; includes qualitative or expert-judgment inputs [3] | “A complex quantitative method, system, or approach”; excludes spreadsheet arithmetic and deterministic rule-based processes [2] |
| Definition of model risk | Adverse consequences from decisions based on incorrect or misused model outputs: financial loss, poor decisions or reputational damage [3] | “The potential for adverse financial consequences associated with models” [2] |
| Tailoring | As with other risks, materiality is “an important consideration” [3] | Higher-materiality models “warrant more comprehensive and rigorous oversight”; immaterial models may only need identifying and monitoring [2] |
| Validation frequency | Review each model “at least annually but more frequently if warranted” [3] | No fixed cycle: timing, nature and frequency “vary based on model purpose” [2] |
| Effective challenge | “Critical analysis by objective, informed parties”; depends on incentives, competence and influence [3] | “Critical analysis conducted by objective experts who evaluate model risk and effect appropriate changes”; needs independence and standing [2] |
| Board and senior management | Governance “provided at the highest level by the board of directors and senior management” [3] | No board or senior-management duties set out; governance should name who is responsible for key lifecycle activities [2][11] |
| Internal audit | Should assess the overall effectiveness of the framework [4] | “Would generally not duplicate model risk management activities such as model development or validation” [2] |
| Model inventory | Models in use, under development or recently retired [3] | An effective inventory “includes sufficient information to understand model risks” [2] |
| Vendor models | Validation applies equally to in-house and vendor-built models [3] | A separate section; vendor products validated “by internal or outside parties”, and principles still apply when code is proprietary [2] |
| AI | Not mentioned in the 2011 letter [3] | Generative and agentic AI out of scope; non-generative, non-agentic AI models in scope [2] |
| BSA/AML systems | Supplemented by SR 21-8 (April 9, 2021) [1] | SR 21-8 superseded as well [1] |
| Enforceability | Supervisory guidance, “applied as appropriate” [3] | No enforceable standards; non-compliance “will not result in supervisory criticism” [2] |
| Effective date | Issued April 4, 2011 [3] | Issued April 17, 2026; no effective date stated [1][8] |
Two changes matter most in practice. First, the narrower definition can take spreadsheet tools and rule engines out of the model inventory; our reading is that banks should record why each one was excluded, so the decision can be explained to examiners. Second, the end of the fixed annual review lets validation effort follow materiality. The OCC had already told community banks in October 2025, in Bulletin 2025-26, that its guidance “does not, and should not be interpreted to, require community banks to perform annual model validation” [10].
What stays the same
- Effective challenge. Still central. SR 26-2 says sound model risk management involves “effective challenge”, performed by people with the expertise, independence and organizational standing to effect change, and flags misaligned incentives between development and validation groups [2].
- Validation before use. “Validation generally occurs prior to a model’s first use”, though an urgent business need may justify using a model before validation is complete [2]. Validation still covers conceptual soundness, outcomes analysis (including back-testing) and ongoing monitoring [2].
- The model inventory. SR 26-2 calls a comprehensive set of model information “common industry practice” and says an effective inventory “includes sufficient information to understand model risks” [2].
- Vendor and third-party models. “An important element of model risk management is the validation of vendor products, either by internal or outside parties” [2]. Where a vendor keeps code proprietary, “the principles of model risk management remain applicable” [2], and banks should monitor whether vendor models are accurate [2].
- Documentation and use limits. “Adequate documentation helps to support effective model risk management”, and effective use “depends on a clear understanding of a model’s limitations”, with controls such as limits on use or closer monitoring [2].
How SR 26-2 treats AI
So a credit scorecard built with gradient boosting is in scope, while an LLM chatbot or an AI agent is not. For those, the text sends banks back to their own risk management and governance practices [2]. The OCC says the three agencies plan to issue “in the near future” a request for information on model risk management that considers, in particular, banks’ use of AI, “including generative AI and agentic AI and AI-based models” [7]. We had not seen it published when we last checked on October 30, 2026.
Until it arrives, these are the verified reference points banks are using for generative and agentic AI:
- NIST AI Risk Management Framework. Released on January 26, 2023 and “intended for voluntary use”. NIST says AI RMF 1.0 is being revised as part of the White House AI Action Plan [12]. Our NIST AI RMF page covers its functions.
- NIST AI 600-1, the Generative AI Profile. Published in July 2024 as “a cross-sectoral profile of and companion resource for the AI RMF 1.0 for Generative AI”. It lists 12 risks unique to or made worse by generative AI, including confabulation, information security, data privacy and value chain and component integration [13].
- Third-party risk guidance. On September 11, 2026 the Federal Reserve, FDIC, NCUA and OCC proposed new principles-based, non-binding third-party risk management guidance; when it is final, they plan to rescind the existing third-party guidance and replace it [21]. Most generative AI in banks comes from third parties, so this is where those contracts will be assessed.
- Canada. OSFI’s Guideline E-23 explicitly includes “AI/ML methods” in its definition of a model, from May 1, 2027 [14]. See the next section.
State AI laws can also reach banks’ automated decisions, such as lending. Requirements and dates differ by state and keep changing, so check our state AI law tracker and the Colorado AI law tools for financial services. For agents specifically, our AI agent governance guide sets out inventories, autonomy tiers, kill switches and oversight, and the AI readiness assessment scores where your program stands.
What banks and vendors should do now
SR 26-2 is not enforceable in itself [2], but examiners can still act on unsafe or unsound practices [2], and a program built on SR 11-7’s fixed rules may now be spending effort where it adds little. These steps are our suggested order of work.
- 01
- 02
Check whether you are in scope
Banking organizations over $30 billion are the main audience. Smaller banks are generally excluded, but should check whether the prevalence and complexity of their models give them significant model risk [2].
- 03
Re-scope the model inventory
Apply the new definition. Record which tools drop out as simple arithmetic or deterministic rules, and why. Keep enough information on each remaining model to understand its risks [2].
- 04
Tier models by materiality
Rate each model’s exposure and purpose, and scale development standards, validation depth and documentation to the tier. Immaterial models may only need identifying and monitoring [2].
- 05
- 06
Protect effective challenge
Check that validators have the expertise, independence and standing to force change, and that development and validation incentives are not misaligned [2].
- 07
- 08
- 09
- 10
Watch for the AI request for information
The agencies have said they will ask about banks’ use of generative and agentic AI [7]. Its answers may shape future expectations.
Model risk guidance outside the US
| Regime | Who it covers | Status | AI |
|---|---|---|---|
| SR 26-2 (US) | Most relevant to banking organizations over $30 billion [1] | Issued April 17, 2026; no effective date stated [1] | Generative and agentic AI out of scope [2] |
| OSFI Guideline E-23 (Canada) | All federally regulated financial institutions, including banks and insurers; applied in proportion to size, strategy, risk profile and complexity [14] | Final guideline dated September 11, 2025; effective May 1, 2027 [14] | Model definition explicitly includes “AI/ML methods” [14] |
| PRA SS1/23 (UK) | UK-incorporated banks and building societies with internal model approval to calculate regulatory capital [15] | Effective from May 17, 2024; a version with low-impact amendments has applied since April 23, 2026 [15] | Covers the risks of AI in modelling techniques, such as machine learning [15] |
SS1/23 sets five principles: model identification and model risk classification; governance; model development, implementation and use; independent model validation; and model risk mitigants [15]. A bank operating in more than one of these countries will find the US guidance now the narrowest of the three on AI: OSFI brings AI/ML methods into its definition of a model [14], while SR 26-2 leaves generative and agentic AI out [2].
Model risk management software and SR 26-2
When we checked on October 30, 2026, ValidMind was the only platform below to publish an SR 26-2 mapping; Fiddler, ModelOp, Monitaur and DataRobot still described their features in SR 11-7 terms. That does not mean the others can’t support SR 26-2, since most of what it asks for is unchanged, but ask for a mapping before you buy. Our ranked AI model risk management software list compares them in detail.
- 01
Best for: Teams that want a published SR 26-2 mapping
Its documentation has an SR 26-2 page that says SR 26-2 “supersedes SR 11-7” and maps features to six areas: telling models from non-models, materiality tiering, ongoing monitoring and outcomes analysis, development documentation, independent validation and governance. It also notes the generative and agentic AI exclusion.[16]
- 02
Best for: Monitoring predictive models and agents
Its governance, risk and compliance page names SR 11-7 among the regulations it supports and describes audit trails, drift and bias monitoring, guardrails and human approval steps. It did not mention SR 26-2 when we checked.[17]
- 03
Best for: Inventory-led AI governance
Publishes an SR 11-7 explainer built on the three pillars and its “Minimum Viable Governance” approach (inventory, lightweight controls, reporting). The page did not mention SR 26-2 or that SR 11-7 has been replaced when we checked.[18]
- 04
Best for: Control libraries mapped to several frameworks
Describes automated policy compliance with control libraries “including SR 11-7, NIST AI RMF, ISO 42001, and the EU AI Act”. No SR 26-2 mapping was published when we checked.[19]
- 05
Best for: Generating model documentation
Its compliance documentation feature generates editable model documentation, which DataRobot says helps banks with SR 11-7 requirements. The page did not mention SR 26-2 when we checked.[20]
Frequently asked questions
+Is SR 11-7 still in effect?
No. On April 17, 2026 the Federal Reserve issued SR 26-2, which “supersedes and replaces SR letter 11-7” [1]. The OCC rescinded its matching Bulletin 2011-12 and the FDIC rescinded FIL-22-2017 the same day [6][8].
+When did SR 26-2 take effect?
SR 26-2 was issued on April 17, 2026. Neither the Federal Reserve’s letter nor the FDIC’s letter states a separate effective date or compliance timeline [1][8], and the guidance is not enforceable in itself [2].
+Does SR 26-2 apply to small banks?
Generally not. It is “expected to be most relevant to banking organizations with over $30 billion in total assets” [1]. Smaller banks are generally excluded, but it may still be relevant to those with significant model risk because of the prevalence and complexity of their models [2].
+Does SR 26-2 cover generative AI?
No. Footnote 3 says generative and agentic AI models “are not within the scope of this guidance”, and that a bank’s own risk management and governance practices should guide controls for them. Traditional models and non-generative, non-agentic AI models remain in scope [2].
+Did OCC Bulletin 2011-12 change?
It was rescinded. OCC Bulletin 2026-13, “Model Risk Management: Revised Guidance”, issued on April 17, 2026, rescinds Bulletin 2011-12 along with Bulletins 2021-19 and 1997-24 and the Comptroller’s Handbook “Model Risk Management” booklet [6].
+What is effective challenge?
SR 26-2 defines it as “critical analysis conducted by objective experts who evaluate model risk and effect appropriate changes”, performed by people with sufficient independence and the standing and influence to effect change [2]. SR 11-7 used a similar definition and said it depends on incentives, competence and influence [3].
+What counts as a model under SR 26-2?
A “complex quantitative method, system, or approach” that applies statistical, economic or financial theories to turn input data into quantitative estimates. Simple spreadsheet arithmetic and deterministic rule-based processes with no such theory behind them are excluded [2].
+Is SR 26-2 mandatory?
No. It “does not set forth enforceable standards or prescriptive requirements”, and non-compliance “will not result in supervisory criticism” [2]. A footnote keeps the agencies’ power to act on violations of law or unsafe or unsound practices from weak model risk management [2].
+Does SR 26-2 still require annual model validation?
No. SR 11-7 asked for a review of each model “at least annually” [3]. SR 26-2 sets no fixed cycle: the timing, nature and frequency of validation “vary based on model purpose”, and validation generally happens before a model’s first use [2].
+What happened to SR 21-8 on BSA/AML models?
SR 26-2 supersedes SR 21-8, the 2021 interagency statement on model risk management for bank systems supporting BSA/AML compliance [1]. The OCC rescinded its version, Bulletin 2021-19, and the FDIC rescinded FIL-27-2021 [6][8].
+Do board members still have model risk duties under SR 26-2?
SR 26-2 does not set out board or senior management duties, unlike SR 11-7, which put governance “at the highest level” with the board and senior management [3]. It asks that governance identify who is responsible for key activities across the model lifecycle [2][11].
+How does SR 26-2 compare with OSFI E-23 and SS1/23?
All three are risk-based, but OSFI’s E-23 applies to all federally regulated financial institutions in Canada from May 1, 2027 and explicitly includes AI/ML methods [14]. The PRA’s SS1/23 applies to UK banks with internal model approval [15]. SR 26-2 leaves generative and agentic AI out [2].
Sources
- [1]Federal Reserve Board, SR 26-2: Revised Guidance on Model Risk Management (2026-04-17).
- [2]Federal Reserve Board, OCC and FDIC, SR 26-2 letter and attached Revised Guidance on Model Risk Management (PDF) (2026-04-17).
- [3]Federal Reserve Board, SR 11-7: Guidance on Model Risk Management (letter, PDF) (2011-04-04).
- [4]Federal Reserve Bank of San Francisco, Transmittal of SR 11-7, Guidance on Model Risk Management (2011).
- [5]FDIC, FIL-22-2017: Adoption of Supervisory Guidance on Model Risk Management (2017-06-07).
- [6]Office of the Comptroller of the Currency, OCC Bulletin 2026-13: Model Risk Management: Revised Guidance (2026-04-17).
- [7]Office of the Comptroller of the Currency, News Release 2026-29: OCC Issues Updated Model Risk Management Guidance (2026-04-17).
- [8]FDIC, FIL-15-2026: Agencies Revise the Interagency Model Risk Management Guidance (2026-04-17).
- [9]FDIC, Agencies issue revised model risk guidance (press release) (2026-04-17).
- [10]Office of the Comptroller of the Currency, OCC Bulletin 2025-26: Model Risk Management: Clarification for Community Banks (2025-10-06).
- [11]Orrick, Agencies Overhaul Model Risk Management Guidance for Banks: Here’s What Changed (2026-04-24).
- [12]NIST, AI Risk Management Framework.
- [13]NIST, NIST AI 600-1: Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (2024-07).
- [14]Office of the Superintendent of Financial Institutions (Canada), Guideline E-23: Model Risk Management (2027) (2025-09-11).
- [15]Bank of England (Prudential Regulation Authority), SS1/23: Model risk management principles for banks (2026-04-23).
- [16]ValidMind, SR 26-2 (ValidMind documentation).
- [17]Fiddler AI, Fiddler for AI Governance, Risk Management, and Compliance (GRC).
- [18]ModelOp, SR 11-7 Model Risk Management: Compliance, Validation & Governance.
- [19]Monitaur, Enterprise technical AI governance.
- [20]DataRobot, Generate compliance documentation (DataRobot docs).
- [21]Federal Reserve Board, Agencies seek comment on proposed third-party risk management guidance (2026-09-11).
How we keep this page current
Every claim links to its source. We re-check this page at least every 60 days, and sooner when a standard, law or vendor changes; vendor names, acquisitions and shutdowns update automatically from our directory. Vendors cannot pay to be included or ranked.