On April 17, 2026 the OCC, Federal Reserve, and FDIC issued revised interagency Model Risk Management guidance (OCC Bulletin 2026-13; Fed SR 26-2; FDIC FIL-15-2026), replacing the 2011 framework that had governed bank models for 15 years. The OCC rescinded Bulletins 2011-12, 1997-24, and 2021-19 and the Comptroller's Handbook 'Model Risk Management' booklet. The guidance narrows the definition of 'model,' states that generative AI and agentic AI models are 'novel and rapidly evolving' and outside its scope, and promises a forthcoming interagency request for information on model risk management and banks' use of AI.
OFFICIAL TEXT: occ.gov ↗ · IN FORCE · OCC
| Document | OCC Bulletin 2026-13 — Model Risk Management: Revised Guidance |
| Issued by | Office of the Comptroller of the Currency |
| Type | Guidance |
| Status | In force |
| Published | Apr 17, 2026 |
| Effective | Apr 17, 2026 |
| Applies to | All OCC-supervised national banks, federal savings associations, and federal branches and agencies of foreign banks; most directly relevant to banking organizations with more than $30 billion in total assets, and to smaller banks with significant model risk from model prevalence, complexity, or non-traditional activities |
| Supersedes | OCC Bulletin 2011-12, OCC Bulletin 1997-24, OCC Bulletin 2021-19, SR 11-7 |
| Also issued as | SR 26-2, FDIC FIL-15-2026 |
| Official source | occ.gov ↗ |
| Use cases | Model risk management · Generative & agentic AI · Third-party & vendor AI · AI governance (general) · Credit scoring & underwriting |
What are the key points of OCC Bulletin 2026-13?
- Defines a model as 'a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates'; simple spreadsheet calculations and deterministic rule-based processes are out of scope.
- Generative AI and agentic AI models are explicitly excluded from the guidance as 'novel and rapidly evolving'; banks are expected to manage them through broader risk-management and governance programs.
- Risk-based approach: model risk management should be commensurate with the bank's size, complexity, and model materiality, rather than a uniform validation standard for every model.
- Most directly relevant to banking organizations with more than $30 billion in total assets; smaller banks are covered only where model risk is significant.
- Covers model development and use, validation and ongoing monitoring, governance and controls, and vendor/third-party models.
- Rescinds OCC Bulletin 2011-12, OCC Bulletin 1997-24, OCC Bulletin 2021-19, and the 'Model Risk Management' booklet of the Comptroller's Handbook.
- Supervisory guidance, not a rule: the agencies state that non-compliance is not itself a basis for supervisory criticism or enforcement action.
- The OCC, Fed, and FDIC say they plan to issue 'in the near future' a request for information on model risk management and banks' use of AI, including generative AI, agentic AI, and AI-based models.
What did OCC Bulletin 2026-13 change for banks?
Before April 2026, SR 11-7 / OCC 2011-12 was applied broadly, and many banks stretched it to cover every algorithm including machine-learning and generative-AI tools. The revised guidance narrows what counts as a model, tilts expectations toward proportionality (with a $30 billion asset marker), and deliberately leaves generative and agentic AI outside formal model-validation requirements. In practice, banks now need two tracks: a slimmer model-risk program for quantitative models, and an enterprise AI governance program for generative and agentic systems that examiners will still probe under safety-and-soundness expectations.
Does OCC Bulletin 2026-13 apply to generative AI?
No. The guidance states that generative AI and agentic AI models are 'novel and rapidly evolving' and are not within its scope. Banks are expected to govern them through broader risk-management and governance programs, and the agencies have promised a request for information on AI and model risk.
Which banks does the revised model risk guidance apply to?
It applies to all OCC-supervised institutions but is most directly relevant to banking organizations with more than $30 billion in total assets, plus smaller banks whose model use is significant because of prevalence, complexity, or non-traditional activities.
Is SR 11-7 still in effect at national banks?
No. OCC Bulletin 2011-12, which transmitted the 2011 guidance (the Fed's SR 11-7), was rescinded on April 17, 2026 and replaced by Bulletin 2026-13.
How does OCC Bulletin 2026-13 compare?
- SR 11-7 vs SR 26-2 — What Changed in Bank Model Risk Guidance
- OCC vs CFPB on AI lending — Model Risk vs Consumer Law
- PRA SS1/23 vs SR 26-2 — UK and US Model Risk Compared
| Date | Document | Status |
|---|---|---|
| Apr 4, 2011 | OCC Bulletin 2011-12 — Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management | Superseded |
| May 20, 1997 | OCC Bulletin 1997-24 — Credit Scoring Models: Examination Guidance | Superseded |
| Apr 9, 2021 | OCC Bulletin 2021-19 — Bank Secrecy Act/Anti-Money Laundering: Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance and Request for Information | Superseded |
| Apr 4, 2011 | SR 11-7 — Supervisory Guidance on Model Risk Management | Superseded |
| May 7, 2026 | OCC Semiannual Risk Perspective, Spring 2026 — Semiannual Risk Perspective from the National Risk Committee, Spring 2026 | Final |
| Apr 29, 2025 | Acting Comptroller Hood, 'AI in Financial Services' (Apr 2025) — Remarks by Acting Comptroller Rodney E. Hood at the National Fair Housing Alliance's Responsible AI Symposium: 'AI in Financial Services' | Final |
Which banks' AI programmes does OCC Bulletin 2026-13 reach?
46 of the 120 largest US banks profiled on this site cite OCC Bulletin 2026-13 among the documents their AI work answers to.
Which AI tools for banks does OCC Bulletin 2026-13 apply to?
The buyer's guides in the AI tools directory name OCC Bulletin 2026-13 among the rules that apply when a bank uses software in these 5 categories.
- Fraud detection — Model risk management (SR 26-2 / OCC 2026-13 / FIL-15-2026)
- AML compliance — Model risk management
- Credit decisioning — Model risk management (SR 26-2 / OCC 2026-13 / FIL-15-2026)
- Model risk and AI governance — Model risk management (SR 26-2 / OCC 2026-13 / FIL-15-2026)
- Banking platforms — Model risk management
Follow every document these regulators publish
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning