Model Risk Directory is a procurement-grade reference for bank and insurer model risk management. Understand what SR 26-2, SR 11-7, OCC Bulletin 2011-12/2026-13, PRA SS1/23, and the ECB Guide to Internal Models actually require, learn exactly what to verify before you retain an independent model validation firm, and explore a sourced reference to the real advisory firms and MRM governance software vendors active in the space. Procurement support, not a compliance guarantee.https://modelriskdirectory.com/en-ushttps://modelriskdirectory.com/insights/ai-model-risk-under-sr-26-2/https://modelriskdirectory.com/insights/ai-model-risk-under-sr-26-2/SR 26-2 applies its model risk principles to traditional statistical, quantitative, and non-generative, non-agentic AI models. Generative and agentic AI are outside this guidance's model scope, but they are not outside bank risk management.Wed, 29 Jul 2026 00:00:00 GMThttps://modelriskdirectory.com/insights/global-map-model-risk-management-frameworks/https://modelriskdirectory.com/insights/global-map-model-risk-management-frameworks/There is no single global MRM rulebook. This map separates enterprise model risk guidance from model-specific and adjacent controls so banks, insurers, and procurement teams can identify the right source before scoping validation work.Wed, 29 Jul 2026 00:00:00 GMThttps://modelriskdirectory.com/frameworks/apra-cpg-230/https://modelriskdirectory.com/frameworks/apra-cpg-230/CPG 230 explains APRA's view of sound practice for entities implementing Prudential Standard CPS 230 Operational Risk Management. It covers operational-risk governance, controls, business continuity, critical operations, and material service-provider arrangements across APRA-regulated industries. For model risk management, its practical relevance is the operating environment around models and third-party dependencies. It does not replace model validation, model inventory, or model-lifecycle standards and should not be presented as Australia's direct equivalent of SR 26-2.https://modelriskdirectory.com/frameworks/basel-core-principles-model-risk/https://modelriskdirectory.com/frameworks/basel-core-principles-model-risk/The Basel Core Principles provide a global baseline for banking supervision, including board oversight, comprehensive risk management, independent control functions, and supervisory review. Model-specific requirements sit throughout the consolidated Basel Framework, especially where banks use internal ratings, market-risk models, stress tests, and other methods to calculate risk or regulatory capital. This page treats Basel as a collection of model-governance requirements, not as a nonexistent standalone document called the 'Basel model risk management principles.'https://modelriskdirectory.com/frameworks/ecb-guide-to-internal-models/https://modelriskdirectory.com/frameworks/ecb-guide-to-internal-models/The Guide explains how the ECB interprets applicable EU and national law on internal models, creating a level playing field across significant institutions directly supervised by European banking supervision. It was originally developed through TRIM, a large-scale project (2016-2021) combining detailed methodological work with roughly 200 on-site internal model investigations at 65 institutions, and covers credit risk, market risk, and counterparty credit risk models along with general model governance topics.https://modelriskdirectory.com/frameworks/eiopa-guidelines-internal-models/https://modelriskdirectory.com/frameworks/eiopa-guidelines-internal-models/The EIOPA Guidelines support national supervisory authorities and insurance or reinsurance undertakings applying Solvency II internal-model requirements. They focus on models used to calculate all or part of the Solvency Capital Requirement and the governance needed to show that a model is embedded in decision-making, understood, documented, validated, and controlled. They are narrower than an enterprise-wide model inventory regime, but highly relevant to insurers' capital-model governance, validation, change, data, and use-test evidence.https://modelriskdirectory.com/frameworks/hkma-ca-g-4/https://modelriskdirectory.com/frameworks/hkma-ca-g-4/CA-G-4 is a current module of the HKMA Supervisory Policy Manual for validating risk-rating systems under the internal-ratings-based approach. It applies to authorized institutions using or seeking approval to use IRB approaches for credit-risk capital. The module addresses governance, responsibilities, model design, data, discriminatory power, calibration, overrides, benchmarking, backtesting, stress testing, validation independence, documentation, and remediation. Broader enterprise risk governance sits in other HKMA modules, including IC-1.https://modelriskdirectory.com/frameworks/mas-ai-model-risk-management/https://modelriskdirectory.com/frameworks/mas-ai-model-risk-management/MAS published Artificial Intelligence Model Risk Management: Observations from a Thematic Review in December 2024 after reviewing selected banks. The paper focuses on AI and generative-AI model controls across governance, identification, inventory, materiality, development, validation, deployment, monitoring, and third-party use. MAS later consulted on broader AI risk-management guidelines and supported an industry toolkit. This page covers the 2024 information paper and clearly separates observed good practices from binding requirements or later consultation proposals.https://modelriskdirectory.com/frameworks/occ-2011-12/https://modelriskdirectory.com/frameworks/occ-2011-12/OCC Bulletin 2011-12, 'Supervisory Guidance on Model Risk Management,' articulated the elements of a sound program for managing risk from quantitative models used in bank decision-making. Its text was substantively identical to the Federal Reserve's SR 11-7, reflecting that both agencies developed the guidance jointly, and it applied to national banks and federal savings associations supervised by the OCC.https://modelriskdirectory.com/frameworks/osfi-e-23/https://modelriskdirectory.com/frameworks/osfi-e-23/The final E-23 guideline applies to Canadian federally regulated financial institutions, including banks, foreign bank branches, insurers, and trust and loan companies. It expands model risk management beyond deposit-taking institutions and explicitly addresses AI and machine-learning models. Expectations are proportional to the institution's size, strategy, risk profile, operational complexity, and interconnectedness. The guideline organizes requirements around enterprise-wide governance, risk-based classification, model lifecycle controls, review, deployment, monitoring, and decommissioning.https://modelriskdirectory.com/frameworks/pra-ss1-23/https://modelriskdirectory.com/frameworks/pra-ss1-23/SS1/23 applies to UK-incorporated banks, building societies, and PRA-designated investment firms that have internal model approval to calculate regulatory capital requirements under Internal Ratings Based (credit risk), Internal Model Approach (market risk), or Internal Model Method (counterparty credit risk) approaches. It sets out five principles the PRA expects firms to embed as a strategic model risk discipline in its own right, comparable in spirit to SR 11-7/SR 26-2 but issued independently by the UK's prudential regulator.https://modelriskdirectory.com/frameworks/sr-11-7/https://modelriskdirectory.com/frameworks/sr-11-7/Issued April 4, 2011 jointly with the OCC (as Bulletin 2011-12), SR 11-7 set out supervisory expectations for how banks should manage the risk that quantitative models produce incorrect or misused results. It organized model risk management around three pillars: model development, implementation, and use; model validation; and governance, policies, and controls, and introduced 'effective challenge' as the guiding principle for meaningful independent review.https://modelriskdirectory.com/frameworks/sr-26-2/https://modelriskdirectory.com/frameworks/sr-26-2/SR 26-2 (issued by the Federal Reserve as a Supervisory Letter, and simultaneously as OCC Bulletin 2026-13 and an FDIC Financial Institution Letter) reflects fifteen years of supervisory experience since SR 11-7 and updates model risk management expectations for a risk-based, tailored era. It is expected to be most relevant to banking organizations with over $30 billion in total assets. The guidance retains the three foundational pillars, model development and use, validation and ongoing monitoring, and governance and controls, while replacing SR 11-7's de facto annual review cycle with revalidation frequency tied to model materiality, change velocity, and data availability, and expanding attention to vendor and third-party models.https://modelriskdirectory.com/guides/top-model-risk-management-firms/https://modelriskdirectory.com/guides/top-model-risk-management-firms/Compare sourced model risk management, independent validation, quantitative risk, and actuarial advisory firms without fake rankings or paid review scores.https://modelriskdirectory.com/guides/best-model-risk-management-software/https://modelriskdirectory.com/guides/best-model-risk-management-software/Compare sourced MRM software vendors by model inventory, workflow, validation, monitoring, evidence, integrations, security, and implementation fit.https://modelriskdirectory.com/guides/model-risk-management/https://modelriskdirectory.com/guides/model-risk-management/What model risk management advisory firms actually do, what to verify before you retain one, RFP questions to ask, and red flags. Grounded in SR 26-2, SR 11-7, and OCC guidance.https://modelriskdirectory.com/guides/model-risk-management-framework/https://modelriskdirectory.com/guides/model-risk-management-framework/How to design or audit a model risk management framework under SR 26-2: inventory, tiering, governance, and validation structure. What to verify before you sign off.https://modelriskdirectory.com/guides/model-risk-validation/https://modelriskdirectory.com/guides/model-risk-validation/What independent model validation covers under SR 26-2/SR 11-7, methods used (conceptual soundness, benchmarking, outcomes analysis), and what to verify before you retain a validator.https://modelriskdirectory.com/guides/occ-model-risk-management/https://modelriskdirectory.com/guides/occ-model-risk-management/What OCC-supervised banks need to know now that OCC Bulletin 2011-12 was rescinded and replaced by Bulletin 2026-13. What to verify before an exam, and how to source a firm.https://modelriskdirectory.com/guides/model-risk-management-software/https://modelriskdirectory.com/guides/model-risk-management-software/What MRM governance software actually does, how to evaluate model inventory and validation-workflow platforms, RFP questions, and red flags. Grounded in real vendor research.https://modelriskdirectory.com/guides/sr-11-7-compliance/https://modelriskdirectory.com/guides/sr-11-7-compliance/SR 11-7 was rescinded April 17, 2026 and replaced by SR 26-2. What that means for your MRM program, what examiners now expect, and how to update your compliance approach.