US Treasury Financial Services AI Risk Management Framework 2026: 230 Control Objectives, AI Lexicon, NIST AI RMF Alignment, and Banking Compliance

A new US framework, if it lands as described, would be unusually operational

Reporting indicates the US Treasury released a Financial Services AI Risk Management Framework (FS AI RMF) alongside a companion AI Lexicon in early 2026, developed with input from a large group of financial institutions and organised around the same four functions NIST AI RMF uses: Govern, Map, Measure, Manage. We have not been able to independently verify the precise control count or contributor figures attributed to it, and a bank's compliance team should confirm the primary source before citing specific numbers internally. What's clear directionally is less in dispute: Treasury has been signalling for several years that financial-sector AI governance needs sector-specific operational guidance beyond NIST's general-purpose framework, and a lexicon problem is real — "AI governance failures frequently stem from inconsistent terminology across functions and with regulators" is a pattern examiners and institutions both recognise independent of any single document.

So what: don't wait for confirmation of the exact control count to start the work a framework like this would require anyway — a documented AI inventory, risk classification, and a shared internal vocabulary for AI terms are table stakes regardless of which specific US publication ultimately codifies them.

If the four-function structure holds, here's what each function should cover

Govern would cover board and senior-management AI oversight, documented risk appetite, named accountability, and governance policy — the institutional scaffolding that has to exist before anything else does.

Map would cover AI inventory and classification, risk identification by deployment context, stakeholder impact assessment, and training-data lineage — the "what do we actually have, and who does it affect" layer.

Measure would cover performance testing, fairness and bias measurement, adversarial robustness testing (prompt injection, model poisoning), explainability assessment, and drift detection — the evidence layer that any examiner will ask to see first.

Manage would cover incident response, remediation workflows, model retirement, regulatory reporting, and — notably, if accurately reported — specific protocols for agentic AI override and shutdown, which is the piece most legacy US guidance has not addressed at all.

So what: regardless of the final shape of any single Treasury document, build your AI governance program around these four functions now. NIST AI RMF already uses this structure, and every major framework we track — RBI's FREE-AI, MAS's toolkit, FSB's sound practices — maps cleanly onto it. A four-function build is defensible no matter which specific sectoral guidance eventually lands on top of it.

The agentic AI gap is the real story, independent of any one framework's exact numbers

What's consistent across every piece of 2025–2026 US regulatory signalling we can verify is this: traditional model risk guidance, including the decade-old SR 11-7, was built around a model that produces a single validated output, not around an agent that takes a sequence of autonomous actions. That gap is real and widely acknowledged by US supervisors, independent of whatever specific successor guidance eventually formalises how to close it.

Banks are not waiting for the paperwork. Loan origination agents, compliance-review agents, and customer-service agents are already in production at major US institutions in 2026, ahead of any framework built specifically to govern them.

So what: if your institution operates in the US, or has a US-regulated affiliate, document your own agentic AI governance approach now — mapping whatever model risk principles you currently follow explicitly onto agentic deployment characteristics — rather than waiting for a final rule. Examiners reward institutions that can show a principled approach that predates the guidance, not a scramble that follows it.

India-US dual-regulated entities need a crosswalk regardless of which US framework wins

US banks with India operations — and India banks with US-dollar-denominated activity such as trade finance, correspondent banking, or NRI banking — sit under two sets of AI governance expectations simultaneously. The structural answer doesn't depend on the exact shape of the final US framework: build your AI governance layer around NIST AI RMF's four functions, since RBI's FREE-AI explicitly references NIST, and generate jurisdiction-specific documentation (RBI's model inventory and validation requirements on one side, whatever US sectoral guidance applies on the other) from that shared base rather than running two parallel governance programs from scratch.

So what: don't build an India-only governance stack and a US-only governance stack as separate projects. Build one NIST-aligned core and treat each jurisdiction's specific requirements as an overlay — it's considerably cheaper to maintain and it's the approach that survives whichever version of the US framework actually ships.

A four-point action checklist

1. Confirm the primary source and exact scope of any Treasury AI framework you cite internally before using specific figures in board or examiner-facing materials — verify against Treasury's own publication, not secondary summaries.
2. Build your AI governance program around the Govern/Map/Measure/Manage structure now, since it's shared across NIST, RBI's FREE-AI, and MAS's toolkit regardless of what US sectoral guidance ultimately formalises.
3. Document your current approach to agentic AI governance explicitly, even in the absence of final agentic-specific guidance — a dated internal memo showing a principled approach is worth more at examination time than silence.
4. If you operate across US and India jurisdictions, build one NIST-aligned governance core and treat RBI and US-specific obligations as overlays on it, not separate programs.