6 minute read | April.24.2026
On April 17, 2026, the OCC, Federal Reserve and FDIC jointly issued “Revised Guidance on Model Risk Management,” replacing the framework that had governed bank model risk practices since 2011.
The revised guidance rescinds:
Banks and their service providers have relied heavily on the prior guidance, originally a joint OCC-Fed issuance from 2011 that was later adopted by the FDIC in 2017, in developing and deploying models. It drove substantial compliance investment, particularly around periodic validation cycles, documentation standards and organizational structures for model risk management. However, industry feedback and recent OCC commentary indicated that the guidance was being applied more prescriptively than intended, especially at community banks.
The revised guidance represents a meaningful recalibration of the prudential regulators’ expectations for model risk management:
The guidance is now framed as “most relevant to” organizations with over $30 billion in total assets, a significant shift from the prior guidance indicating that it would be most relevant to institutions with $1 billion or more in total assets. However, the new guidance notes that organizations at or below the new $30 billion threshold may nevertheless find it useful if they have significant model risk exposure from the prevalence, complexity or nature of their institution’s model use.
The guidance makes clear that it “does not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with this guidance will not result in supervisory criticism against a banking organization.” A footnote preserves the agencies’ authority to take action for violations of law or unsafe or unsound practices stemming from insufficient model risk management.
The guidance revises the definition of “model” to require complexity. Specifically, a model is defined as “a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates.” The new definition no longer encompasses methods, systems or approaches that apply “mathematical” theories. It also adds explicit carve-outs for simple arithmetic calculations (including spreadsheets), deterministic rule-based processes, and software without underlying statistical, economic or financial theories.
The guidance also includes a footnote that excludes generative and agentic AI models from its scope, based on the agencies’ view that such technologies are “novel and rapidly evolving.” For tools like generative and agentic AI models that are expressly outside the scope of the guidance, banking organizations should continue to rely on their broader risk management and governance practices to determine appropriate controls. In parallel, the agencies have announced plans to issue a request for information on banks’ use of AI, including generative and agentic AI and AI‑based models, which may inform future expectations.
The new guidance introduces a framework for measuring the overall magnitude of model risk by considering a model’s inherent risk in the context of its materiality. Materiality, in turn, comprises a model’s exposure (significance to a bank’s business decisions) and purpose (the model’s nature and qualitative importance, including for risk management). Under this framework, a bank could classify a model as immaterial with low inherent risk and apply lighter-touch oversight — such as limited to identification and performance monitoring — while reserving more rigorous practices for higher-materiality models.
The prior guidance’s concept of “effective challenge” remains in the new issuance, though reformulated. Previously, the agencies took the position that effective challenge depended on a combination of “incentives, competence, and influence.” Under the new guidance, effective challenge instead requires appropriate expertise, sufficient independence to permit objectivity, and organizational standing and influence to effect change when appropriate.
The new guidance retains the three core validation components (conceptual soundness, outcomes analysis and ongoing monitoring) but treats each far more concisely. For example, the guidance no longer contains detailed discussions of VaR backtesting, parallel outcomes analysis, early warning metrics, process verification of computer code, override analysis and specific benchmarking procedures. Rather, the guidance highlights that “validation approaches may differ across models based on their characteristics and use” (while noting that it generally occurs pre-deployment).
Validation independence is also de-emphasized. The new guidance states that the quality of the validation process “depends on the rigor and effectiveness of the review rather than on organizational structure.” This is a notable shift from the prior guidance’s detailed treatment of reporting-line separation, compensation practices and explicit authority to challenge developers.
The new guidance replaces detailed expectations for board and senior management duties, annual policy review and enumerated internal audit tasks with higher-level governance principles, such as clear roles and responsibilities, accountability, and maintaining effective policies, procedures and a risk assessment framework. The contemplated role for internal audit is comparatively limited, with the guidance indicating that this function is generally responsible for evaluating whether model risk management practices are “rigorous and effective.”
The new guidance includes a stand-alone section on vendor/third-party risk management, which recognizes that “the principles of model risk management remain applicable” even where banks are unable to validate third-party models or receive requested information from their developers. The guidance notes that where vendor models are customized for a bank’s particular needs, the institution’s validation process should involve documenting, justifying and evaluating any adjustments.
The 2021 interagency statement on BSA/AML model risk management has been rescinded without a replacement. BSA/AML models within the revised definition are covered by the general framework. The specific clarifications from 2021 — regarding system categorization, duplicative testing and flexibility for rapid updates — are no longer addressed in stand-alone guidance.
The revised guidance is part of a broader interagency effort to reduce prescriptive supervisory expectations and refocus on material financial risk. In alignment with the new guidance, banking organizations should consider:
For questions about how the revised guidance affects your institution's model risk management program, or to discuss strategies for reassessing your model inventory and preparing for forthcoming AI-related rulemaking, please contact one of the authors or another member of Orrick’s Financial & Fintech Advisory team.