Visual memo: Key changes under the federal banking agencies’ revised model risk management guidance
The OCC, Federal Reserve, and FDIC released updated guidance on model risk management, which rescinds and supersedes prior guidance to establish a more principles-based approach. Our visual memorandum unpacks the changes that financial institutions should know and consider.
On April 17, 2026, the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), and the Board of Governors of the Federal Reserve System (the Federal Reserve and collectively, the Agencies) issued revised interagency guidance on model risk management (the 2026 MRM Guidance), which aims to clarify and update model risk management principles for regulated institutions. The 2026 MRM Guidance supersedes and replaces the Agencies’ prior model risk management guidance, including the OCC and Federal Reserve’s Guidance on Model Risk Management issued in 2011 (the 2011 MRM Guidance) and separate guidance issued by the FDIC.[1]
According to the Agencies, the 2026 MRM Guidance responds to industry feedback and supervisory experience over the past 15 years, and, more broadly, reflects the Agencies’ efforts “to reduce unnecessary burden and promote risk-based examination across institutions of all sizes.”[2] Our visual memorandum provides an overview of the key changes introduced by the 2026 MRM Guidance.
The 2026 MRM Guidance underscores many longstanding supervisory expectations for model risk management practices but represents a notable shift from the 2011 MRM Guidance. Key takeaways include:
- The 2026 MRM Guidance explicitly clarifies that it does not establish enforceable legal requirements. This is a deliberate departure from the Agencies’ enforcement posture with respect to the 2011 MRM Guidance, which examiners long treated as if it carried the force of law. Notably, however, the 2026 MRM Guidance preserves a backstop clarifying that supervisory action may result from violations of law or unsafe or unsound practices stemming from insufficient management of model risk.
- The 2026 MRM Guidance refocuses standards towards a principles-based approach. The 2011 MRM Guidance was widely viewed as overly prescriptive while lacking clarity in key areas. The 2026 MRM Guidance is intended to establish a more principles-based framework that focuses on “sound principles for effective model risk management” tailored to a banking organization’s “model risk profile and the size and complexity of its operations.”
- Model risk management principles regarding artificial intelligence (AI) will be set out in future guidance. The 2026 MRM Guidance clarifies that “generative AI and agentic AI models are novel and rapidly evolving” and “are not within the scope of this guidance.” The Agencies committed to releasing a request for information that addresses model risk management with respect to banks’ use of AI, including generative AI and agentic AI and AI-based models, “in the near future.”
Our visual memorandum provides an easy-to-read guide on the 2026 MRM Guidance, including key takeaways and a comparative analysis relative to the 2011 MRM Guidance.
[1] The 2026 MRM Guidance supersedes and replaces various guidance documents and interagency statements released by the Agencies, including SR letter 11-7, Guidance on Model Risk Management (April 4, 2011) and SR letter 21-8, Interagency Statement on Model Risk Management for Bank Systems Supporting Bank Secrecy Act/Anti-Money Laundering Compliance (April 9, 2021), as well as FDIC guidance including FIL-22-2017, Adoption of Supervisory Guidance on Model Risk Management (June 7, 2017) and FIL 27-2021, Bank Secrecy Act: Agencies Address Model Risk Management for Bank Models and Systems Supporting Bank Secrecy Act/Anti-Money Laundering and Office of Foreign Assets Control Compliance (April 9, 2021).
[2] OCC, Press Release, OCC Issues Updated Model Risk Management Guidance (April 17, 2026), https://www.occ.treas.gov/news-issuances/news-releases/2026/nr-occ-2026-29.html.