SR 11-7 vs. SR 26-2: What Changed in the 2026 Model Risk Management Guidance
For fifteen years, SR 11-7 was the reference point for US bank model risk management. On April 17, 2026, the Federal Reserve, OCC, and FDIC jointly rescinded it, replacing it with SR 26-2 (issued simultaneously as OCC Bulletin 2026-13). SR 26-2 keeps SR 11-7's foundational disciplines, effective challenge, independent validation, governance, but changes how they're applied. This page lays out the real, sourced differences so you know exactly what to update in your MRM program, policy documents, and vendor RFPs.
Decision factors
| Factor | SR 11-7 (2011, superseded) | SR 26-2 (2026, current) |
|---|---|---|
| Revalidation cadence | A de facto expectation of regular, often annual, revalidation for models regardless of materiality. | Risk-based: revalidation frequency is tied to model materiality, change velocity, and data availability, not a uniform calendar cycle. |
| Scope of applicability | Applied broadly across Fed- and OCC-supervised institutions with no explicit asset-size framing. | Expected to be most relevant to banking organizations with over $30 billion in total assets, while noting large-institution practices may not suit smaller banks. |
| Definition of 'model' | Broad definition covering quantitative methods applying statistical, economic, financial, or mathematical theory. | Refined to require the model apply statistical, economic, or financial theory, and explicitly excludes simple spreadsheet arithmetic and deterministic rule-based processes/software. |
| Vendor and third-party models | Addressed, but with limited emphasis relative to internally developed models. | Expanded discussion and emphasis, reflecting institutions' growing reliance on externally developed tools that still carry model risk. |
| AI and machine learning scope | Predates modern generative AI; silent on generative/agentic AI specifically. | Explicitly excludes generative and agentic AI models from scope; the agencies state these will be addressed separately through future guidance. |
| Enforceability posture | Widely treated by examiners and institutions as a de facto compliance baseline. | Explicitly states it does not establish enforceable or prescriptive requirements, and non-compliance alone will not result in supervisory criticism. |
| Issuing agencies | Federal Reserve (SR 11-7) and OCC (companion Bulletin 2011-12), issued jointly in April 2011. | Federal Reserve, OCC, and FDIC, issued jointly as SR 26-2 / OCC Bulletin 2026-13 / an FDIC Financial Institution Letter on April 17, 2026. |
Guidance
If your MRM program, policy manual, or vendor RFP still cites SR 11-7 as the current standard, update it to reference SR 26-2. The core disciplines, model inventory, tiering, effective challenge, independent validation, governance, carry forward largely unchanged, so a program built on SR 11-7 fundamentals is not starting from scratch. The practical work is updating revalidation scheduling from a calendar-driven cycle to a risk-based one, tightening the model inventory to capture vendor and third-party tools more systematically, and confirming your model definition and scope decisions (what counts as a 'model' at all) align with SR 26-2's narrower definition. Generative and agentic AI tools remain outside SR 26-2's scope for now; do not assume SR 26-2 gives you cover on those, since dedicated guidance is still pending. This is buyer education, not legal or regulatory advice, confirm interpretation with your regulator or counsel.
Related guides
Ready to source a firm? Send a procurement-safe scope and we route it toward qualified firms.
Request firms