Model Risk Directory emblemModel Risk Directory
SR 26-2

SR 26-2 / OCC Bulletin 2026-13: Revised Guidance on Model Risk Management

SR 26-2 (issued by the Federal Reserve as a Supervisory Letter, and simultaneously as OCC Bulletin 2026-13 and an FDIC Financial Institution Letter) reflects fifteen years of supervisory experience since SR 11-7 and updates model risk management expectations for a risk-based, tailored era. It is expected to be most relevant to banking organizations with over $30 billion in total assets. The guidance retains the three foundational pillars, model development and use, validation and ongoing monitoring, and governance and controls, while replacing SR 11-7's de facto annual review cycle with revalidation frequency tied to model materiality, change velocity, and data availability, and expanding attention to vendor and third-party models.

Published: Last updated: Last reviewed by: Model Risk Directory editorial team
Quick answer

SR 26-2, issued jointly by the Federal Reserve, OCC, and FDIC on April 17, 2026, is the current US interagency guidance on model risk management. It supersedes SR 11-7 (2011) and SR 21-8 (2021), preserving core disciplines like effective challenge and independent validation while shifting to a risk-based approach tailored to an institution's model risk profile, size, and complexity.

Jurisdiction
United States
MRM relevance
Direct model risk management guidance
Effective date
Issued 17 April 2026
Issuing body
Federal Reserve, OCC, and FDIC (joint interagency guidance)
Official reference
www.federalreserve.gov/supervisionreg/srletters/SR2602.htm

What it covers

  • Supersedes and replaces SR 11-7 (2011) and SR 21-8 (2021) in full
  • Risk-based, tailored approach: revalidation frequency scales with model materiality, change velocity, and data availability rather than a uniform annual cycle
  • Expanded discussion of vendor and third-party model oversight, reflecting growing reliance on externally developed tools
  • Refines the definition of 'model' to require statistical, economic, or financial theory, and excludes simple spreadsheet arithmetic and deterministic rule-based processes
  • Explicitly excludes generative and agentic AI models from scope, to be addressed separately through future guidance
  • States it does not establish enforceable or prescriptive requirements; non-compliance alone will not result in supervisory criticism

Adoption status

Issued April 17, 2026, SR 26-2 is the current, operative US interagency model risk management standard as of this site's publication date, replacing both SR 11-7 and OCC Bulletin 2011-12. Because it is only months old, many institutions' MRM programs and vendor RFPs still reference SR 11-7 by name; buyers should confirm that any firm or software vendor's methodology has been updated to reflect SR 26-2's risk-based revalidation approach and expanded third-party model coverage, not just SR 11-7's older framework.

Reference only. This page explains what SR 26-2 covers; it is not a claim that Model Risk Directory or any listed vendor satisfies it. Verify alignment directly against the issuing body's own current text before relying on it.

Sources. source 1 · source 2 · source 3. Data as of 2026-07. See methodology.

Related content

GuideSR 11-7 ComplianceSR 11-7 was formally rescinded on April 17, 2026 and replaced by the interagency guidance SR 26-2. Institutions still describing their program as 'SR 11-7 compliant' should update to reference SR 26-2, which preserves SR 11-7's core disciplines, effective challenge, independent validation, governance, while shifting to a risk-based, tailored supervisory approach.GuideModel Risk Management FrameworkA model risk management framework is the documented set of policies, roles, and processes an institution uses to identify, tier, govern, and validate its models. Under SR 26-2, a sound framework covers model development and use, independent validation, and governance and controls, scaled to the institution's size and model risk profile rather than applied uniformly.GuideOCC Model Risk ManagementOCC-supervised national banks and federal savings associations are now governed by OCC Bulletin 2026-13, 'Model Risk Management: Revised Guidance,' issued jointly with the Federal Reserve and FDIC on April 17, 2026. It replaced the long-standing OCC Bulletin 2011-12, shifting to a risk-based approach while keeping the same foundational model development, validation, and governance disciplines.FrameworkSR 11-7 vs. SR 26-2: What Changed in the 2026 Model Risk Management GuidanceFor fifteen years, SR 11-7 was the reference point for US bank model risk management. On April 17, 2026, the Federal Reserve, OCC, and FDIC jointly rescinded it, replacing it with SR 26-2 (issued simultaneously as OCC Bulletin 2026-13). SR 26-2 keeps SR 11-7's foundational disciplines, effective challenge, independent validation, governance, but changes how they're applied. This page lays out the real, sourced differences so you know exactly what to update in your MRM program, policy documents, and vendor RFPs.FrameworkSR 26-2 vs OSFI E-23: US and Canadian model risk guidanceBoth frameworks use a risk-based approach to model governance, but they apply in different jurisdictions, use different structures, and have different effective timelines. This comparison is a planning aid, not a crosswalk or legal conclusion.FrameworkSR 26-2 vs PRA SS1/23: model risk principles comparedSR 26-2 and PRA SS1/23 both expect model risk to be governed across the lifecycle, but they organize the work differently and apply to different supervised populations. The table highlights procurement and implementation differences without claiming equivalence.