# OCC Bulletin 2026-13: Model Risk Management: Revised Guidance

Source: https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2026-13
Last updated: Aug 26, 2026

On April 17, 2026 the OCC, Federal Reserve, and FDIC issued revised interagency Model Risk Management guidance (OCC Bulletin 2026-13; Fed SR 26-2; FDIC FIL-15-2026), replacing the 2011 framework that had governed bank models for 15 years. The OCC rescinded Bulletins 2011-12, 1997-24, and 2021-19 and the Comptroller's Handbook 'Model Risk Management' booklet. The guidance narrows the definition of 'model,' states that generative AI and agentic AI models are 'novel and rapidly evolving' and outside its scope, and promises a forthcoming interagency request for information on model risk management and banks' use of AI.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [OCC](https://www.bankingnewsai.com/ai-regulation/occ) |
| Type | Guidance |
| Status | In force |
| Published | Apr 17, 2026 |
| Effective | Apr 17, 2026 |
| Applies to | All OCC-supervised national banks, federal savings associations, and federal branches and agencies of foreign banks; most directly relevant to banking organizations with more than $30 billion in total assets, and to smaller banks with significant model risk from model prevalence, complexity, or non-traditional activities |
| Official text | https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html |

## Key points

- Defines a model as 'a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates'; simple spreadsheet calculations and deterministic rule-based processes are out of scope.
- Generative AI and agentic AI models are explicitly excluded from the guidance as 'novel and rapidly evolving'; banks are expected to manage them through broader risk-management and governance programs.
- Risk-based approach: model risk management should be commensurate with the bank's size, complexity, and model materiality, rather than a uniform validation standard for every model.
- Most directly relevant to banking organizations with more than $30 billion in total assets; smaller banks are covered only where model risk is significant.
- Covers model development and use, validation and ongoing monitoring, governance and controls, and vendor/third-party models.
- Rescinds OCC Bulletin 2011-12, OCC Bulletin 1997-24, OCC Bulletin 2021-19, and the 'Model Risk Management' booklet of the Comptroller's Handbook.
- Supervisory guidance, not a rule: the agencies state that non-compliance is not itself a basis for supervisory criticism or enforcement action.
- The OCC, Fed, and FDIC say they plan to issue 'in the near future' a request for information on model risk management and banks' use of AI, including generative AI, agentic AI, and AI-based models.

## What changed for banks

Before April 2026, SR 11-7 / OCC 2011-12 was applied broadly, and many banks stretched it to cover every algorithm including machine-learning and generative-AI tools. The revised guidance narrows what counts as a model, tilts expectations toward proportionality (with a $30 billion asset marker), and deliberately leaves generative and agentic AI outside formal model-validation requirements. In practice, banks now need two tracks: a slimmer model-risk program for quantitative models, and an enterprise AI governance program for generative and agentic systems that examiners will still probe under safety-and-soundness expectations.

## Use cases it governs

- [Model risk management](https://www.bankingnewsai.com/ai-regulation/by-use-case#model-risk)
- [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai)
- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Credit scoring & underwriting](https://www.bankingnewsai.com/ai-regulation/by-use-case#credit-underwriting)

Supersedes: [OCC Bulletin 2011-12](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2011-12), [OCC Bulletin 1997-24](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-1997-24), [OCC Bulletin 2021-19](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2021-19), [SR 11-7](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-11-7).

Same interagency text issued as: [SR 26-2](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-26-2), [FDIC FIL-15-2026](https://www.bankingnewsai.com/ai-regulation/documents/fdic-fil-15-2026).

## FAQ

### Does OCC Bulletin 2026-13 apply to generative AI?

No. The guidance states that generative AI and agentic AI models are 'novel and rapidly evolving' and are not within its scope. Banks are expected to govern them through broader risk-management and governance programs, and the agencies have promised a request for information on AI and model risk.

### Which banks does the revised model risk guidance apply to?

It applies to all OCC-supervised institutions but is most directly relevant to banking organizations with more than $30 billion in total assets, plus smaller banks whose model use is significant because of prevalence, complexity, or non-traditional activities.

### Is SR 11-7 still in effect at national banks?

No. OCC Bulletin 2011-12, which transmitted the 2011 guidance (the Fed's SR 11-7), was rescinded on April 17, 2026 and replaced by Bulletin 2026-13.

## Compare

- [SR 11-7 vs SR 26-2](https://www.bankingnewsai.com/ai-regulation/compare/sr-11-7-vs-sr-26-2): SR 11-7 vs SR 26-2: What Changed in Bank Model Risk Guidance
- [OCC vs CFPB on AI lending](https://www.bankingnewsai.com/ai-regulation/compare/occ-vs-cfpb-ai-lending): OCC vs CFPB on AI in Lending: Model Risk vs Consumer Law
- [PRA SS1/23 vs SR 26-2](https://www.bankingnewsai.com/ai-regulation/compare/pra-ss1-23-vs-sr-26-2): PRA SS1/23 vs SR 26-2: UK and US Model Risk Compared

## Which AI tools for banks does OCC Bulletin 2026-13 apply to?

- [Fraud detection](https://www.bankingnewsai.com/ai-tools/fraud-detection) — Model risk management (SR 26-2 / OCC 2026-13 / FIL-15-2026)
- [AML compliance](https://www.bankingnewsai.com/ai-tools/aml-compliance) — Model risk management
- [Credit decisioning](https://www.bankingnewsai.com/ai-tools/credit-decisioning) — Model risk management (SR 26-2 / OCC 2026-13 / FIL-15-2026)
- [Model risk and AI governance](https://www.bankingnewsai.com/ai-tools/model-risk-governance) — Model risk management (SR 26-2 / OCC 2026-13 / FIL-15-2026)
- [Banking platforms](https://www.bankingnewsai.com/ai-tools/banking-platforms) — Model risk management

## Related documents

- [OCC Bulletin 2011-12](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2011-12) — Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management (Apr 4, 2011)
- [OCC Bulletin 1997-24](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-1997-24) — Credit Scoring Models: Examination Guidance (May 20, 1997)
- [OCC Bulletin 2021-19](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2021-19) — Bank Secrecy Act/Anti-Money Laundering: Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance and Request for Information (Apr 9, 2021)
- [SR 11-7](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-11-7) — Supervisory Guidance on Model Risk Management (Apr 4, 2011)
- [OCC Semiannual Risk Perspective, Spring 2026](https://www.bankingnewsai.com/ai-regulation/documents/occ-semiannual-risk-perspective-spring-2026) — Semiannual Risk Perspective from the National Risk Committee, Spring 2026 (May 7, 2026)
- [Acting Comptroller Hood, 'AI in Financial Services' (Apr 2025)](https://www.bankingnewsai.com/ai-regulation/documents/occ-hood-responsible-ai-speech-2025) — Remarks by Acting Comptroller Rodney E. Hood at the National Fair Housing Alliance's Responsible AI Symposium: 'AI in Financial Services' (Apr 29, 2025)
- [OCC Bulletin 2023-17](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2023-17) — Third-Party Relationships: Interagency Guidance on Risk Management (Jun 6, 2023)
- [2021 Interagency AI RFI (OCC Bulletin 2021-17)](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2021-17-ai-rfi) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021)

Last reviewed Aug 26, 2026. Cite the official text (https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2026-13
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.