# SR 26-2: Revised Guidance on Model Risk Management

Source: https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-26-2
Last updated: Aug 26, 2026

SR 26-2, issued April 17, 2026 jointly by the Federal Reserve, OCC (Bulletin 2026-13), and FDIC, replaces SR 11-7 (2011) and the 2021 BSA/AML model risk statement (SR 21-8) with a risk-based, materiality-driven model risk management framework. It is expected to be most relevant to banking organizations with over $30 billion in total assets. It states that generative AI and agentic AI models 'are novel and rapidly evolving' and 'are not within the scope of this guidance', directing banks to use broader risk management and governance practices for them, and the agencies said they would issue a request for information on AI and model risk 'in the near future'.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [Federal Reserve](https://www.bankingnewsai.com/ai-regulation/federal-reserve) |
| Type | Guidance |
| Status | In force |
| Published | Apr 17, 2026 |
| Effective | Apr 17, 2026 |
| Applies to | All Fed-supervised banking organizations; expected to be most relevant to those with over $30 billion in total assets, and to smaller institutions with significant model exposure |
| Official text | https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm |

## Key points

- Supersedes SR 11-7 (April 4, 2011) and SR 21-8 (April 9, 2021); the OCC also rescinded Bulletins 2011-12, 2021-19, and 1997-24 and its Model Risk Management handbook booklet
- Defines a model as a complex quantitative method that applies statistical, economic, or financial theories to process input data into quantitative estimates; simple arithmetic and deterministic rule-based processes are excluded
- Explicitly excludes generative AI and agentic AI models from scope as 'novel and rapidly evolving', while telling banks to apply broader risk-management and governance practices to tools not covered
- Adopts a risk-based approach tailored to a bank's model risk profile, size, and complexity, with materiality driving the intensity of validation and monitoring
- Retains the core disciplines of SR 11-7: sound development and testing, independent validation including outcomes analysis, effective challenge, and board/senior-management governance
- Covers vendor and third-party models, expecting banks to understand and validate purchased models consistent with third-party risk management (SR 23-4)
- Most relevant to banking organizations over $30 billion in assets, but smaller banks with prevalent or complex models are expected to apply it proportionately

## What changed for banks

For traditional and machine-learning models, banks get relief from one-size-fits-all validation: materiality now governs how much rigor a model needs, and low-risk deterministic tools drop out of the model inventory. For generative and agentic AI the guidance creates a deliberate gap — no model-validation mandate, but an expectation that enterprise risk, vendor risk, data governance, and board oversight cover these systems until the promised interagency RFI and any follow-on guidance arrive.

## Use cases it governs

- [Model risk management](https://www.bankingnewsai.com/ai-regulation/by-use-case#model-risk)
- [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai)
- [Credit scoring & underwriting](https://www.bankingnewsai.com/ai-regulation/by-use-case#credit-underwriting)
- [AML / KYC](https://www.bankingnewsai.com/ai-regulation/by-use-case#aml-kyc)
- [Fraud detection](https://www.bankingnewsai.com/ai-regulation/by-use-case#fraud)
- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)

Supersedes: [SR 11-7](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-11-7), [2021 BSA/AML Model Risk Statement](https://www.bankingnewsai.com/ai-regulation/documents/fed-bsa-aml-model-risk-statement-2021).

Same interagency text issued as: [OCC Bulletin 2026-13](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2026-13), [FDIC FIL-15-2026](https://www.bankingnewsai.com/ai-regulation/documents/fdic-fil-15-2026).

## FAQ

### Does SR 26-2 apply to generative AI?

No. SR 26-2 states that generative AI and agentic AI models are novel and rapidly evolving and are not within its scope. Banks are instead expected to govern them through broader risk-management and governance practices, and the Fed, OCC, and FDIC said they would issue a request for information on AI and model risk.

### Which banks does SR 26-2 apply to?

All Fed-supervised banking organizations, but the letter says it is expected to be most relevant to those with more than $30 billion in total assets. Smaller banks with significant model exposure should apply it in proportion to their risk.

### What did SR 26-2 replace?

SR 11-7 (the 2011 model risk management guidance) and SR 21-8 (the 2021 interagency statement on model risk management for BSA/AML systems). At the OCC it replaced Bulletins 2011-12, 2021-19, and 1997-24.

## Compare

- [SR 11-7 vs SR 26-2](https://www.bankingnewsai.com/ai-regulation/compare/sr-11-7-vs-sr-26-2): SR 11-7 vs SR 26-2: What Changed in Bank Model Risk Guidance
- [PRA SS1/23 vs SR 26-2](https://www.bankingnewsai.com/ai-regulation/compare/pra-ss1-23-vs-sr-26-2): PRA SS1/23 vs SR 26-2: UK and US Model Risk Compared

## Which AI tools for banks does SR 26-2 apply to?

- [Fraud detection](https://www.bankingnewsai.com/ai-tools/fraud-detection) — Model risk management (SR 26-2 / OCC 2026-13 / FIL-15-2026)
- [AML compliance](https://www.bankingnewsai.com/ai-tools/aml-compliance) — Model risk management
- [Credit decisioning](https://www.bankingnewsai.com/ai-tools/credit-decisioning) — Model risk management (SR 26-2 / OCC 2026-13 / FIL-15-2026)
- [Enterprise AI assistants](https://www.bankingnewsai.com/ai-tools/enterprise-ai-assistants) — Generative AI risk management
- [Model risk and AI governance](https://www.bankingnewsai.com/ai-tools/model-risk-governance) — Model risk management (SR 26-2 / OCC 2026-13 / FIL-15-2026)
- [Banking platforms](https://www.bankingnewsai.com/ai-tools/banking-platforms) — Model risk management

## Related documents

- [SR 11-7](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-11-7) — Supervisory Guidance on Model Risk Management (Apr 4, 2011)
- [2021 BSA/AML Model Risk Statement](https://www.bankingnewsai.com/ai-regulation/documents/fed-bsa-aml-model-risk-statement-2021) — Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance (Apr 9, 2021)
- [Cook: Opportunities and Risks of AI (May 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fed-cook-speech-ai-economy-financial-system-2026) — The Opportunities and Risks AI Presents for the Economy and Financial System — Governor Lisa D. Cook (May 27, 2026)
- [Bowman: AI in the Financial System (May 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fed-bowman-speech-ai-financial-system-2026) — Artificial Intelligence in the Financial System — Vice Chair for Supervision Michelle W. Bowman (May 1, 2026)
- [SR 23-4](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-23-4) — Interagency Guidance on Third-Party Relationships: Risk Management (Jun 7, 2023)
- [2021 Interagency AI RFI](https://www.bankingnewsai.com/ai-regulation/documents/fed-interagency-ai-rfi-2021) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021)
- [Regulation (EU) 2026/1744 (Digital Omnibus on AI)](https://www.bankingnewsai.com/ai-regulation/documents/eu-digital-omnibus-ai-regulation-2026-1744) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Jul 24, 2026)
- [RBI draft Guidance on Regulatory Principles for Model Risk Management](https://www.bankingnewsai.com/ai-regulation/documents/rbi-model-risk-management-guidance-2026) — Guidance on Regulatory Principles for Model Risk Management, 2026 (draft released for public comments) (Jun 24, 2026)

Last reviewed Aug 26, 2026. Cite the official text (https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-26-2
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.