Model Risk Management

Applying model risk management to fraud models after SR 26-2 replaced SR 11-7 in April 2026: inventory, materiality tiering, validation, drift monitoring, vendor models, explainability, and where GenAI sits.

Core components

What changed in 2026

Topic	SR 11-7 (2011)	SR 26-2 / OCC 2026-13 (2026)
Status	Supervisory guidance, widely treated as the standard	Explicitly non-binding; non-compliance alone does not trigger supervisory criticism (unsafe practices still can)
Applicability	Broadly applied, including smaller banks	"Most relevant" to banking organizations over $30B in total assets, or smaller ones with significant model risk
Model definition	Quantitative method using statistical, economic, financial or mathematical theories; included qualitative-input approaches with quantitative output	A complex quantitative method grounded in statistical, economic or financial theory; excludes simple arithmetic and deterministic rule-based processes
Risk tiering	Implicit	Explicit: inherent risk plus materiality (exposure and purpose) drive the rigor of oversight; immaterial models may need only monitoring
Validation	Conceptual soundness, ongoing monitoring, outcomes analysis; detailed techniques	The same three components, described briefly; approach varies by model; generally validate before use, with controls if urgent early use is needed
Effective challenge	Incentives, competence, influence	Expertise, independence, standing to effect change
Vendor models	Covered within the guidance	Standalone section: principles apply even when the bank can't fully see inside; customizations documented and justified
BSA/AML models	Separate 2021 interagency statement (SR 21-8 / OCC 2021-19)	SR 21-8 superseded, with no replacement
Generative and agentic AI	Not addressed	Explicitly excluded; the agencies plan a request for information on AI

Which fraud artifacts are "models"?

Artifact	Likely classification	Governance home
Supervised ML fraud score (GBM, neural net)	Model	MRM
Vendor risk score (device, identity, consortium)	Model (third-party)	MRM, plus vendor management (see Vendor Selection and Evaluation)
Graph-based risk propagation scores	Model	MRM
Anomaly detection (unsupervised)	Model	MRM; outcomes analysis is harder
Rules with hand-set thresholds	Not a model (deterministic)	Rule governance (see Rule Governance and Change Management)
Rules with statistically optimized thresholds	Gray area; document your classification	Rule governance, with MRM-style review if material
Score thresholds applied to a model	Part of model use	MRM (use) + rule governance (configuration)
GenAI case summarization, agentic investigation assistants	Excluded from SR 26-2 scope	Broader risk management / AI governance; QA (see Fraud QA Program)

How to build it

Model inventory

Minimum fields: model ID, name, purpose, money path and decision point, owner, developer (internal or vendor), materiality tier, status, inputs and data sources, output and how it's used (thresholds, actions), validation date and findings, monitoring dashboard, known limitations, dependencies (which other models or rules consume it).

SR 26-2 also asks for an aggregate view: models that share data, features or assumptions can fail together. A device-reputation vendor outage that degrades three fraud models at once is aggregate model risk.

Materiality tiering (illustrative)

Tier	Criteria	Validation depth	Monitoring
High	Drives automated declines or holds on high-value money paths; large share of volume; regulatory relevance	Full independent review before production; revalidation on material change and periodically	Daily/weekly automated monitoring; monthly review
Medium	Drives review routing or step-up; moderate exposure	Focused review	Weekly/monthly
Low	Flags, features or analytics with no direct action	Light review	Periodic checks to catch growing materiality

Validation for fraud models

Conceptual soundness

Is the target definition right? (Which fraud types, and what label sources and maturity windows? See Fraud Labeling and Feedback Loops.)
Is the training data representative? Is it biased by existing controls? Fraud that was blocked never got labeled.
Features available at decision time (no leakage)?
Are features appropriate on privacy and fairness grounds (see Privacy and Data Use in Fraud Prevention)?

Outcomes analysis

Performance on out-of-time samples with matured labels
Dollar-weighted metrics (dollar recall, dollar precision) alongside counts
Performance by segment: tenure, geography, product, channel
Comparison against a benchmark (current production model, or rules)
Counterfactual performance from holdouts where available (see Experimentation and Champion-Challenger)

Ongoing monitoring

Input drift: feature distributions, null rates, vendor signal availability
Score drift: distribution shift, share above thresholds
Outcome drift: precision and recall as labels mature
Operational: latency, timeouts, fallback rates (see Real-Time Decisioning Architecture)
Adversarial adaptation: sudden drops in catch on a segment, or attack volume moving to just below a threshold

Effective challenge

SR 26-2 frames effective challenge around expertise, independence and standing. Practical options by size:

Organization	Who challenges
Large bank	Second-line MRM / validation team
Mid-size fintech with sponsor bank	Internal DS peer review by someone not on the model team, plus periodic external validation; sponsor bank review
Small company	Peer review by a DS or senior strategist not involved in building it; external review for high-materiality models

Vendor models

Ask for development documentation, performance evidence on populations like yours, known limitations, and change notifications
Validate on your data: backtest, then shadow, before relying on it (see Vendor Selection and Evaluation)
Monitor outputs continuously; vendor model updates can shift your score distribution overnight
Document any customization: thresholds, overlays, feature selections
Contract for change notice, performance reporting and audit cooperation

Explainability

Reason codes for customer-facing actions and support scripts
Analyst-facing explanations (top contributing features) in the review UI, so analysts can judge whether a score makes sense before acting on it
Model documentation a validator can follow
Be careful about what you expose. Detailed explanations given to customers can teach attackers what to change. Keep customer messaging general.

Generative and agentic AI

SR 26-2 excludes GenAI and agentic AI. Fraud teams are adopting them anyway, even as attackers use the same technology against them (see Generative AI and Deepfake Fraud). Common defensive uses: case summarization, narrative drafting, investigation assistants, synthetic data. Govern them under your broader AI or technology risk framework:

Inventory them alongside models
Human accountability for any decision they inform
QA for omissions and invented facts in summaries (see Fraud QA Program)
Data access controls and logging
Don't let them make money-movement decisions without explicit approval and monitoring

Artifacts and templates

Model documentation outline

Purpose and intended use; decision point and actions
Target definition and label sources; maturity windows
Data: sources, time windows, exclusions, known biases
Features: list, rationale, availability at decision time, privacy review
Methodology and alternatives considered
Performance: out-of-time, by segment, dollar-weighted, vs benchmark
Thresholds and business impact (catch, FPR, review volume, friction)
Limitations and compensating controls
Monitoring plan: metrics, thresholds, owners
Change log
Validation findings and responses

Model change classification

Change	Example	Required
Material	New features, new algorithm, new target, new population	Validation before deploy; shadow; approval
Moderate	Retrain on new data with the same design	Performance comparison vs current; shadow; approval
Minor	Threshold adjustment within a pre-approved range	Logged; post-change monitoring
Emergency	Threshold change during an incident	IC authority; logged; post-incident review

Monitoring dashboard checklist

Score distribution vs baseline (PSI or similar)
Feature null and out-of-range rates
Vendor signal availability
Share above each action threshold
Precision and recall by maturity cohort
Segment-level performance
Latency and fallback rates
Alert routing to the model owner

Metrics

Metric	Why
Models in inventory with current validation	Coverage
Models past validation or review date	Hygiene
Open validation findings, by severity and age	Remediation
Monitoring alerts and time to resolution	Ongoing control
Performance vs validation baseline	Decay
Vendor model changes received with notice vs without	Third-party control

Pitfalls

Validating at launch and never again. Fraud models decay faster than most because adversaries adapt.
Count-based metrics only. A model that catches many small frauds and misses the big ones looks fine on AUC.
Ignoring the threshold. Most fraud model incidents come from threshold or use changes while the model itself stays the same.
Vendor trust without verification. Vendor validation on other clients' data doesn't tell you how the model performs on yours.
Black-box review UI. If analysts can't see why a score is high, they either rubber-stamp it or ignore it. Both are model risk.
Treating the 2026 guidance as deregulation. It's a chance to tailor. Material fraud models still need rigor.

Sources and further reading

Federal Reserve SR 26-2, Revised Guidance on Model Risk Management (April 17, 2026): supersedes SR 11-7 and SR 21-8; most relevant above $30B in assets
Revised Guidance on Model Risk Management, attachment (SR 26-2): model definition, materiality, validation components, effective challenge, vendor models, AI exclusion
OCC Bulletin 2026-13, Model Risk Management: Revised Guidance: OCC issuance; rescinds OCC 2011-12, 2021-19, 1997-24 and the Comptroller's Handbook booklet; non-enforceable
Federal Reserve SR 11-7, Guidance on Model Risk Management (2011): the original framework: effective challenge, three validation elements, inventory
JD Supra, Agencies Overhaul Model Risk Management Guidance for Banks: side-by-side of what changed from SR 11-7
Abrigo, What SR 26-2 means for financial institutions: implications for fraud and AML analytics, inventory and tiering