SR 26-2 Banking: What the New Model Risk Guidance Changes — and What It Doesn't Cover

The Core Question This Article Actually Answers: What Governs GenAI When Your Model Risk Letter Doesn't?

SR 11-7, issued in 2011 by the Federal Reserve and the OCC (as OCC Bulletin 2011-12), has been the reference document for US bank model risk management for over a decade. Its three pillars — sound development, independent validation, effective governance — are baked into how most large banks' MRM functions are structured. ****

Whatever the eventual successor guidance is formally called, the underlying governance problem the article is pointing at is real and worth taking seriously on its own: traditional MRM letters were written for statistical and quantitative models, and generative AI, RAG systems, and autonomous agents do not fit cleanly inside that definition. Examiners are asking banks how they govern that gap today, regardless of what letter number eventually formalizes the answer.

What a Risk-Based Materiality Framework Would Actually Change

A materiality-tiered approach to validation depth — calibrating documentation, validation rigor, and monitoring frequency to a model's risk tier rather than applying one validation standard across the whole portfolio — is a sound and increasingly common MRM design pattern, whether or not it arrives through a specific numbered letter. The practical effect: a low-materiality internal support model does not need the same independent validation depth as a credit decisioning model, but the bank needs a documented, defensible methodology for assigning that tier to every model in scope. A materiality framework without that documentation is just an excuse to skip validation on inconvenient models.

Why Narrowing the Definition of "Model" Cuts Both Ways

Any narrowing of what counts as an in-scope "model" — focused on quantitative methods whose output feeds consequential decisions, rather than SR 11-7's broader historical definition — reduces scope creep onto things like simple spreadsheets. It also creates a new classification burden: every tool and system in the AI portfolio now needs a documented rationale for why it is, or is not, in scope. A bank that narrows its definition without documenting the exclusion rationale for each borderline system has just created an examination finding waiting to be discovered.

Ongoing Monitoring as an Equal Pillar, Not a Periodic Afterthought

Treating ongoing monitoring and outcomes analysis as equally weighted to development and validation — rather than a secondary governance element — is the single most operationally demanding shift any MRM modernization brings. It means the model risk function has to run a continuous monitoring program across the full inventory, with documented performance metrics, population stability tracking, and formal escalation when thresholds breach — not a once-a-year revalidation cycle. Institutions that have under-resourced ongoing monitoring relative to pre-deployment validation will feel this shift the hardest.

Generative AI and Agentic AI: The Gap That Matters Regardless of the Letter Number

Whatever the formal successor to SR 11-7 ultimately says, the practical reality for most large banks today is that LLMs in customer service, RAG systems for compliance research, and autonomous agents in loan processing and fraud workflows are not cleanly covered by traditional MRM letters written for quantitative statistical models. That gap does not mean these systems are ungoverned — it means the bank has to build the governance framework itself, from other sources, rather than inheriting it from a single letter.

General safety and soundness expectations apply to every AI system a bank runs, letter or no letter — an examiner's question is never "does a specific letter cover this," it's "does the bank have a coherent governance framework for it." CFPB guidance on AI in consumer credit and customer service applies fair lending, adverse-action, and consumer protection obligations to LLM-based consumer-facing systems regardless of MRM letter scope. The NIST AI Risk Management Framework is voluntary but increasingly referenced by examiners as evidence of a credible governance approach for generative AI specifically. ISO/IEC 42001 certification is becoming a reference point institutions cite when asked how they govern AI outside traditional MRM scope.

India BFSI Context: RBI's Framework Doesn't Carve Out GenAI the Way US Guidance Does

India's regulatory posture on this gap is structurally different from the US situation this article describes, and that difference matters for Indian banks with US operations. RBI's FREE-AI Committee report (published August 2025, following the committee's constitution in December 2023) addresses AI governance — including generative and advanced-analytics systems — as part of one coherent framework rather than carving genAI out of scope the way SR 11-7-era US guidance historically has. **** The DPDP Act 2023 applies to automated personal-data processing broadly, which includes LLM-based systems handling customer queries, without a genAI carveout.

The practical implication for Indian banks: don't import a US-style genAI carveout into your domestic governance just because a US letter (whatever it ends up being called) excludes it. India's direction of travel treats genAI as in scope from the start. Banks that have historically used SR 11-7 as a best-practice reference should keep tracking US MRM developments for risk-tiering and monitoring design ideas, but should govern generative and agentic AI under the FREE-AI-aligned framework regardless of what the US carves out.

Action Checklist Regardless of What the Final US Letter Is Called

1. Verify any specific US MRM letter citation — number, date, issuing agencies — against the Federal Reserve's own SR letter index before repeating it in a board or regulatory document.
2. Build (or confirm you already have) a documented, risk-tiered materiality methodology covering every model and AI system in your inventory, including a rationale for anything ruled out of scope.
3. Treat ongoing monitoring as a standing operational program, not a periodic revalidation exercise — staff it accordingly.
4. Build a governance framework for generative and agentic AI now, sourced from NIST AI RMF, ISO 42001, and your domestic regulator's direction, rather than waiting for a specific numbered letter to force the issue.
5. For Indian institutions: align to the FREE-AI Committee's recommendations now, since RBI's domestic framework does not carve out genAI the way some international frameworks do.