US Interagency MRM Guidance (SR 26-2, formerly SR 11-7)

• SR 11-7 is no longer current. On 17 April 2026 the Federal Reserve, OCC and FDIC issued revised "Supervisory Guidance on Model Risk Management" (Fed SR 26-2, OCC Bulletin 2026-13, FDIC FIL-15-2026). It rescinds and supersedes SR 11-7 (4 April 2011), OCC Bulletin 2011-12 and several related items.
• The new text is shorter and risk-based: practices should scale with each bank's model risk profile, size and complexity. It is expected to be most relevant to banking organisations with over USD 30 billion in total assets.
• It narrows the definition of a model to complex quantitative methods based on statistical, economic or financial theory, and excludes simple spreadsheet arithmetic and deterministic rule-based software.
• AI coverage is split: traditional statistical models and non-generative, non-agentic AI models (for example a gradient-boosted credit model) are in scope. Generative AI and agentic AI are out of scope because they are "novel and rapidly evolving"; banks should govern them through their general risk management. The OCC says the agencies plan a request for information (RFI) covering banks' use of AI; no issued RFI was found as of 2026-10-19 (secondary sources only).
• It is explicitly non-binding: it sets no enforceable standards, and non-compliance with the guidance alone will not produce supervisory criticism.

• Banking organisations supervised by the Federal Reserve, OCC and FDIC. The OCC version names national banks, federal savings associations and federal branches and agencies of foreign banking organisations; the FDIC version covers FDIC-supervised institutions.
• Expected to be most relevant above USD 30 billion in total assets. At or below that size it generally does not apply, unless the bank has significant model risk because of complex models or activities beyond traditional community banking.
• Most useful for models that support significant business lines, operations, services and functions.
• Vendors are not addressed directly; banks must validate and monitor vendor and third-party models (Section VII).
• Not extraterritorial. A non-US company is reached only as a vendor to a US banking organisation.

History: SR 11-7 (2011 to 2026)

• SR 11-7 "Guidance on Model Risk Management" was issued by the Federal Reserve on 4 April 2011, jointly with OCC Bulletin 2011-12; the FDIC adopted it in 2017 (FIL-22-2017).
• For fifteen years it was the global reference text for model risk management, organised around model development, implementation and use; model validation (including "effective challenge"); and governance, policies and controls.
• Its broad model definition and supervisory use meant AI and ML models in US banks were already routinely run through SR 11-7 inventories and validation.
• Status: rescinded on 17 April 2026. The SR 11-7 and OCC 2011-12 pages on federalreserve.gov and occ.gov returned "not found" when checked on 2026-10-19, so this history summary relies on the 2026 agency documents and general knowledge; the original text was not re-read.

• No penalties. The guidance states it sets no enforceable standards or prescriptive requirements, and non-compliance with it will not result in supervisory criticism (Section I).
• Footnote 1 points to the agencies' rules on the role of supervisory guidance (12 CFR Part 4 Subpart F Appendix A for the OCC, 12 CFR Part 262 Appendix A for the Board, 12 CFR Part 302 Appendix A for the FDIC).
• The same footnote keeps a real backstop: supervisory action may still follow for violations of law or unsafe or unsound practices that stem from poor model risk management.
• Separate laws still bite on model outputs, for example fair lending or BSA/AML rules; this guidance does not replace them.

• Indian banks with US branches or agencies: OCC-licensed federal branches of foreign banks are named in the OCC bulletin. Most such branches are likely below the USD 30 billion relevance line (check your own balance sheet), so the guidance will usually be a benchmark, not a central expectation. A branch with complex models (for example AML transaction monitoring or treasury pricing) should still keep a proportionate MRM framework.
• IT, analytics and AI vendors serving US banks: Section VII says banks should understand a vendor model's conceptual soundness, design, development data and performance even when code is proprietary, and run their own ongoing monitoring and outcomes analysis. Expect due diligence questionnaires, validation data requests and requests to document any customisation.
• GenAI and agent vendors: the carve-out does not mean US banks will skip diligence. Footnote 3 says banks should apply their broader risk management to tools outside the guidance, and the planned RFI signals future expectations. Keep model cards, red-team results and monitoring evidence ready.
• Comparison with RBI: RBI's draft model risk guidance (24 June 2026, still draft as of 2026-10-19) covers AI and ML models and builds on RBI FREE-AI. The US moved the other way: it narrowed scope and removed generative and agentic AI. An Indian bank or vendor working across both should design for the stricter scope (RBI draft, OSFI E-23, PRA SS1/23) and treat US guidance as the floor.
• Customers in New York may also ask about AI cyber risks under NYDFS AI Cybersecurity Letter 2024, which sits alongside this guidance.

The guidance uses "sound practice" language rather than "must"; these are supervisory expectations, not enforceable rules. References are to sections and footnotes of the SR 26-2 attachment.

• A scoping memo showing how the bank applied the USD 30 billion relevance line and its own model risk profile.
• The model definition in policy, with the rule for excluding spreadsheets and deterministic tools, and a separate governance route for generative and agentic AI.
• Model inventory extract with materiality, inherent risk rating, owner and validation status, plus an aggregate risk view.
• Development files with purpose statements, test results and data quality review.
• Validation reports covering conceptual soundness, outcomes analysis and limitations; records of any use before validation and the compensating controls.
• Monitoring reports, threshold breaches and overlay or redevelopment decisions.
• Role descriptions and evidence of conflict-of-interest handling between developers and validators.
• Internal audit reports on MRM effectiveness.
• Vendor model files: due diligence, validation evidence, ongoing monitoring and customisation records.

• Still citing SR 11-7 as current. It was rescinded on 17 April 2026; cite SR 26-2, OCC 2026-13 or FIL-15-2026.
• Reading the generative and agentic AI carve-out as "no rules for LLMs". Footnote 3 still expects governance and controls, and other laws and supervisory expectations still apply.
• Dropping non-generative AI models from validation; ML credit, fraud and AML models remain squarely in scope.
• Assuming "non-binding" means "ignore". Unsafe or unsound practices from weak model risk management can still draw supervisory action.
• Treating the USD 30 billion figure as a hard legal threshold; it is a relevance marker and smaller banks with complex models may still be expected to follow it.
• Accepting a vendor's proprietary black box without independent understanding or monitoring on the bank's own outcomes.

• SR letter: a Supervision and Regulation letter, the Federal Reserve's way of issuing guidance to examiners and banks.
• OCC Bulletin / FDIC FIL: the OCC's and FDIC's equivalents for publishing guidance (FIL means Financial Institution Letter).
• Model: in this guidance, a complex quantitative method that applies statistical, economic or financial theory to turn input data into estimates.
• Model risk: the chance of financial harm from decisions based on model output.
• Materiality: how much a model matters, judged from its exposure (size of business affected) and purpose (for example regulatory or risk use).
• Effective challenge: critical review by objective experts who have the authority to make changes happen.
• Outcomes analysis: comparing what a model predicted with what actually happened.
• Overlay: a manual adjustment applied on top of model output.
• Generative AI: AI that produces new content such as text or images (for example large language models).
• Agentic AI: AI that can plan and take actions on its own toward a goal.
• RFI (Request for Information): a public call by regulators for comments before deciding on policy.

• SR 11-7 is history: SR 26-2, OCC 2026-13 and FIL-15-2026 replaced it on 17 April 2026.
• The new guidance is principles-based, explicitly non-binding and aimed mainly at banks above USD 30 billion in assets.
• Predictive (non-generative, non-agentic) AI models stay in scope; generative and agentic AI are carved out pending a planned RFI.
• 25 supervisory expectations covering materiality, effective challenge, development, validation, monitoring, governance, inventory, documentation and vendor models.
• Indian vendors should expect US banks to keep asking for model documentation, development data and monitoring evidence, including for GenAI under general risk management.

• Federal Reserve SR 26-2, Revised Guidance on Model Risk Management (17 April 2026), accessed 2026-10-19
• SR 26-2 attachment, Supervisory Guidance on Model Risk Management (PDF), accessed 2026-10-19
• OCC Bulletin 2026-13, Model Risk Management: Revised Guidance, accessed 2026-10-19
• FDIC FIL-15-2026, Agencies Revise Interagency Model Risk Management Guidance, accessed 2026-10-19
• SR 11-7 (federalreserve.gov) and OCC Bulletin 2011-12 (occ.gov): original pages returned HTTP 404 on 2026-10-19; history taken from the 2026 rescission notices.