What does OCC Bulletin 2011-12 say about AI in banking?

What are the key points of OCC Bulletin 2011-12?

• Defined a model broadly as a quantitative method that applies statistical, economic, financial, or mathematical theories and assumptions to process input data into quantitative estimates — a definition banks later extended to ML and AI systems.
• Established the three pillars of model risk management: robust development, implementation, and use; sound validation; and governance, policies, and controls.
• Required independent validation with 'effective challenge' — critical analysis by objective, informed parties with the incentives, competence, and influence to force changes.
• Validation components: evaluation of conceptual soundness, ongoing monitoring including benchmarking and process verification, and outcomes analysis including back-testing.
• Called for a firm-wide model inventory and board and senior-management oversight of aggregate model risk.
• Applied to vendor and third-party models, with expectations that banks understand and validate what they buy.
• Rescinded by OCC Bulletin 2026-13 on April 17, 2026; the text remains available in the OCC's rescinded-bulletins archive.

What did OCC Bulletin 2011-12 change for banks?

Because it was the only comprehensive federal statement on model governance, banks and examiners applied it to AI/ML models for over a decade even though it never mentioned AI. Its broad model definition and uniform validation expectations are what the 2026 revision deliberately trimmed. Banks still cite it for the vocabulary — effective challenge, conceptual soundness, outcomes analysis — that carries over into the 2026 guidance.

What did OCC Bulletin 2011-12 require for model risk management?

OCC Bulletin 2011-12, 'Sound Practices for Model Risk Management', asked every national bank and federal savings association that used models to manage model risk through three elements: robust model development, implementation and use; a sound, independent validation process; and governance, policies and controls, including board and senior-management oversight, a firm-wide model inventory and internal audit. Its guiding principle was 'effective challenge': critical analysis by objective, informed parties able to identify a model's limitations and produce appropriate changes. The guidance was principles-based supervisory guidance rather than a regulation, scaled to the materiality and complexity of a bank's model use, and it covered vendor models as well as in-house ones. It was rescinded on April 17, 2026.

The bulletin's definition of a model was deliberately broad: a quantitative method, system or approach that applies statistical, economic, financial or mathematical theories, techniques and assumptions to process input data into quantitative estimates, with three components (information input, processing and reporting). Approaches whose inputs were partly or wholly qualitative or based on expert judgment still counted, provided the output was quantitative. Model risk was the potential for adverse consequences from decisions based on incorrect or misused model outputs, arising either from fundamental errors or from a model being used outside its limits.

Examiners used Bulletin 2011-12 as the reference text for model reviews in credit, capital, stress testing, valuation and, later, BSA/AML systems. In August 2021 the OCC added a 'Model Risk Management' booklet to the Comptroller's Handbook (announced in Bulletin 2021-39) to tell examiners how to plan and conduct those reviews, and in October 2025 it told community banks (Bulletin 2025-26) that the guidance had been read too prescriptively: validation frequency and scope were the bank's to set in line with its risk. Both the 2011 bulletin and the Handbook booklet were rescinded by Bulletin 2026-13.

The disciplines themselves did not go away. Bulletin 2026-13 retains development and use, validation and monitoring, governance and controls, and vendor products as its four working sections, and the vocabulary banks built under 2011-12 (conceptual soundness, outcomes analysis, effective challenge, model inventory) is the vocabulary of the replacement.

WHAT THIS MEANS IN PRACTICE

• Policies that still cite OCC Bulletin 2011-12 should be re-pointed to Bulletin 2026-13; the 2011 text is history, available in the OCC's rescinded-bulletins archive.
• Keep the three-element structure in the model risk policy: it survives intact in the 2026 guidance and is what examiners, auditors and model validators are trained on.
• Use the 2026 definition of 'model' to re-scope the inventory, and record what left it and why.

Is OCC Bulletin 2011-12 rescinded, and what replaced it?

Yes. OCC Bulletin 2011-12 was rescinded on April 17, 2026 by OCC Bulletin 2026-13, which transmits revised interagency Model Risk Management guidance issued jointly with the Federal Reserve (SR 26-2) and the FDIC (FIL-15-2026). The same bulletin rescinded the 'Model Risk Management' booklet of the Comptroller's Handbook, Bulletin 1997-24 on credit scoring models and Bulletin 2021-19 on BSA/AML systems. The replacement is expected to be most relevant to banks with more than $30 billion in total assets, defines a model as a 'complex' quantitative method, places generative AI and agentic AI outside its scope, and states that non-compliance with the guidance will not result in supervisory criticism.

Between 2011 and 2026 the OCC layered three things on top of Bulletin 2011-12. The 2021 interagency statement on BSA/AML systems (Bulletin 2021-19) explained how the guidance applied to transaction monitoring and sanctions screening. The August 2021 Comptroller's Handbook booklet turned the guidance into examination procedures. And in October 2025, Bulletin 2025-26 told community banks, which the OCC defines as institutions with up to $30 billion in assets, that the guidance had been understood to impose prescriptive requirements it did not contain, such as a full validation of every model every year.

Bulletin 2026-13 completed that review. It says the agencies are 'updating and replacing the 2011 guidance' on the basis of supervisory experience, industry feedback and technological advances in modelling. The most consequential changes are the narrower model definition, which excludes simple arithmetic calculations such as those in spreadsheets and deterministic rule-based processes, the $30 billion relevance threshold, and the statement that generative and agentic AI models are 'novel and rapidly evolving' and therefore outside the guidance. The agencies said they plan to issue a request for information on model risk management and banks' use of AI, including generative and agentic AI.

The rescinded text remains on occ.gov in the rescinded-bulletins archive, stamped 'Replaced - See OCC 2026-13', which is why the bulletin number still matters: fifteen years of bank policies, validation reports and audit findings were written against it.

WHAT THIS MEANS IN PRACTICE

• Cite OCC Bulletin 2026-13 (and SR 26-2 or FIL-15-2026 where relevant) in new and refreshed policies.
• Historic validation reports and findings written against 2011-12 stay valid as records; map their sections to the 2026 guidance rather than rewriting them.
• Generative and agentic AI need a governance home outside the model risk policy, because the replacement guidance does not provide one.

How did OCC Bulletin 2011-12 apply to AI, machine-learning and generative models?

OCC Bulletin 2011-12 never mentions artificial intelligence, but its definition of a model was technology-neutral: any quantitative method that processes input data into quantitative estimates. A machine-learning credit, fraud or anti-money-laundering model met that definition, so banks inventoried, validated and monitored it like any other model, and the 2021 interagency BSA/AML statement confirmed that banks could test machine-learning approaches under the same principles. Generative models were never addressed by the 2011 text. Its April 2026 replacement, Bulletin 2026-13, keeps traditional and non-generative AI models in scope and states that generative AI and agentic AI models are not within the scope of the guidance.

In validation terms, the three core elements translated directly. Conceptual soundness became a review of training data, feature engineering and the choice of algorithm against simpler alternatives; ongoing monitoring became drift detection and benchmarking against a challenger model; outcomes analysis became back-testing against realised defaults, fraud losses or alert dispositions. The part of the 2011 text that machine learning strained hardest was documentation 'sufficiently detailed so that parties unfamiliar with a model can understand how the model operates', which is where explainability work entered bank validation.

For a national bank today the line runs between predictive and generative systems. A gradient-boosted underwriting model or a neural-network fraud score is a model under Bulletin 2026-13 and is validated in proportion to its materiality. A large language model that drafts text or an agent that takes actions is outside the guidance; the bank's own risk management and governance practices decide the controls, pending the agencies' promised request for information.

WHAT THIS MEANS IN PRACTICE

• Predictive machine-learning models keep the full development, validation and governance treatment that 2011-12 established.
• Do not file generative AI under the model risk policy by default: the 2026 guidance says it is out of scope, so examiners will look for an enterprise AI governance standard instead.

Where is the official OCC Bulletin 2011-12 PDF?

The official OCC Bulletin 2011-12 PDF is in the OCC's rescinded-bulletins archive at occ.gov/static/rescinded-bulletins/bulletin-2011-12.pdf. It is a 25-page file stamped 'Rescinded' and 'Replaced - See OCC 2026-13' and carries the full Supervisory Guidance on Model Risk Management, dated April 4, 2011, in seven sections: introduction, purpose and scope, overview of model risk management, model development, implementation and use, model validation, governance, policies and controls, and conclusion. The Federal Reserve publishes the same guidance as the 21-page attachment to SR 11-7. The current guidance is on the OCC Bulletin 2026-13 page.

WHAT THIS MEANS IN PRACTICE

• Link the occ.gov archive copy rather than third-party mirrors: it is the only version that shows the rescission stamp and the pointer to Bulletin 2026-13.

How does OCC Bulletin 2011-12 compare?

• SR 11-7 vs SR 26-2 — What Changed in Bank Model Risk Guidance

Which banks' AI programmes does OCC Bulletin 2011-12 reach?

4 of the 120 largest US banks profiled on this site cite OCC Bulletin 2011-12 among the documents their AI work answers to.