SR 26-2 model risk management: what changed and what to do now
SR 26-2, issued on 17 April 2026 by the Federal Reserve, OCC and FDIC, replaces SR 11-7 and SR 21-8. It keeps effective challenge, validation and inventories, but makes model risk management explicitly risk-based: rigour should follow model materiality (exposure and purpose). It targets banks over $30 billion in assets and excludes generative and agentic AI, which need separate governance.
The revised guidance is shorter and more proportionate than SR 11-7, but it does not lower the bar for material models. It also moves generative and agentic AI out of model risk scope, which means many institutions now need a second, AI-specific governance track.
What is SR 26-2?
SR 26-2 is the revised interagency supervisory guidance on model risk management issued by the Federal Reserve Board, the OCC and the FDIC on 17 April 2026. It supersedes SR 11-7 (2011) and SR 21-8 (2021, on BSA/AML models). The guidance itself says it does not create enforceable standards and that non-compliance with it alone will not lead to supervisory criticism, although unsafe or unsound practices in managing model risk still can.
How is SR 26-2 different from SR 11-7?
| Topic | SR 11-7 (2011) | SR 26-2 (2026) |
|---|---|---|
| Approach | Comprehensive expectations applied broadly | Explicitly risk-based and tailored to the model risk profile, size and complexity |
| What drives rigour | Model risk generally | Four named drivers: inherent risk, exposure, purpose and use; exposure plus purpose = materiality |
| Definition of a model | Broad, often captured spreadsheets and rules | Excludes simple arithmetic, spreadsheets and deterministic rule-based processes |
| Generative and agentic AI | Not addressed | Out of scope; govern through the institution's wider risk practices |
| Who it targets | All supervised banks | Most relevant to banks with over $30 billion in assets; smaller banks if model use is complex |
| Aggregate model risk | Mentioned | Given more prominence: shared data, assumptions and dependencies across models |
| BSA/AML models | Separate statement SR 21-8 | Folded into the single guidance |
Does SR 26-2 cover AI models?
Partly. It applies to traditional statistical and quantitative models and to non-generative, non-agentic AI, such as machine-learning credit scores or fraud models. Generative and agentic AI are excluded because they are novel and rapidly evolving, but the guidance says the institution's own risk management and governance should still decide the controls for them. In practice that means an AI policy, an AI inventory and controls such as human oversight and kill switches, which this site covers in the agentic AI and generative AI guides.
What should banks do now?
- Run a gap assessment of your model risk policy against SR 26-2, starting with the model definition and the materiality method.
- Re-tier the model inventory using exposure and purpose, and set validation depth and monitoring frequency by tier.
- Write down what happens when a model is used before validation is complete: use limits, extra monitoring and stakeholder notice.
- Keep effective challenge independent and senior enough to force changes.
- Create a separate governance track for generative and agentic AI and link it to the model inventory.
- Validate vendor models: reliance on a vendor does not transfer responsibility for model risk.
What does this mean outside the United States?
SR 26-2 binds only US-supervised institutions, but it is widely used as a benchmark. Institutions in Pakistan, the GCC and Asia that follow international practice can use its materiality approach as a proportionate design for their own model risk frameworks, alongside local rules and the MAS and FSB AI guidance.
Primary sources (reviewed 17 Oct 2026)
- Federal Reserve, OCC and FDIC: SR 26-2, Revised Guidance on Model Risk Management (17 April 2026)
- Financial Stability Board: Sound Practices for Responsible Adoption of Artificial Intelligence, final report (15 October 2026)
This page explains supervisory guidance in plain language. It is not legal advice; confirm how each text applies to your institution and jurisdiction.
Frequently asked questions
Is SR 26-2 mandatory?
SR 26-2 is supervisory guidance, not a regulation. It says non-compliance with the guidance itself will not result in supervisory criticism, but supervisory action can still follow from unsafe or unsound practices caused by poor model risk management.
Does SR 26-2 apply to small banks?
It is most relevant to banking organisations with more than $30 billion in total assets. Smaller banks may still find it relevant if they have significant model risk because of complex models or activities beyond traditional community banking.
Are spreadsheets models under SR 26-2?
No. The guidance excludes simple arithmetic calculations such as those in spreadsheets, and deterministic rule-based processes with no statistical, economic or financial theory behind them.
Put these controls to work this month
Start on the cloud risk management software within 24 hours, or ask for training or advice tailored to your institution.