What does FDIC FIL-15-2026 say about AI in banking?

What are the key points of FDIC FIL-15-2026?

• Issued April 17, 2026 by the FDIC, OCC (Bulletin 2026-13), and Federal Reserve (SR 26-2) as a single interagency document.
• Rescinds FIL-22-2017 (FDIC adoption of the 2011 Supervisory Guidance on Model Risk Management) and FIL-27-2021 (BSA/AML and OFAC model risk statement).
• Applies to all FDIC-supervised institutions but is expected to be most relevant to organizations over $30 billion in total assets; banks under that size without significant or complex model use generally are not expected to apply it.
• Covers model development, validation, ongoing monitoring, and governance, including expectations for third-party vendor models.
• Non-prescriptive: the FIL states that non-compliance will not by itself result in supervisory criticism.
• Generative and agentic AI sit outside the scope of the interagency guidance and are left to banks' broader risk-management and governance programs (see OCC Bulletin 2026-13 for the agencies' scoping language).
• FDIC June 2026 testimony describes the revision as replacing 'overly prescriptive' 2011-era standards and serving as 'an avenue for the safe and sound adoption of technology.'

What did FDIC FIL-15-2026 change for banks?

For FDIC-supervised banks, the 2011 framework adopted through FIL-22-2017 is gone. Large banks keep the core disciplines of validation, effective challenge, and governance under a modernized, explicitly risk-based standard; community banks get clear relief unless their model use is significant or complex. The 2021 BSA/AML model-risk statement is also withdrawn, so AML/sanctions systems are now governed under the general framework. Generative and agentic AI remain an enterprise-risk-management question rather than a formal model-validation one.