SR 26-2 / OCC Bulletin 2026-13: Revised Guidance on Model Risk Management
SR 26-2 (issued by the Federal Reserve as a Supervisory Letter, and simultaneously as OCC Bulletin 2026-13 and an FDIC Financial Institution Letter) reflects fifteen years of supervisory experience since SR 11-7 and updates model risk management expectations for a risk-based, tailored era. It is expected to be most relevant to banking organizations with over $30 billion in total assets. The guidance retains the three foundational pillars, model development and use, validation and ongoing monitoring, and governance and controls, while replacing SR 11-7's de facto annual review cycle with revalidation frequency tied to model materiality, change velocity, and data availability, and expanding attention to vendor and third-party models.
SR 26-2, issued jointly by the Federal Reserve, OCC, and FDIC on April 17, 2026, is the current US interagency guidance on model risk management. It supersedes SR 11-7 (2011) and SR 21-8 (2021), preserving core disciplines like effective challenge and independent validation while shifting to a risk-based approach tailored to an institution's model risk profile, size, and complexity.
- Issuing body
- Federal Reserve, OCC, and FDIC (joint interagency guidance)
- Official reference
- www.federalreserve.gov/supervisionreg/srletters/SR2602.htm
What it covers
- Supersedes and replaces SR 11-7 (2011) and SR 21-8 (2021) in full
- Risk-based, tailored approach: revalidation frequency scales with model materiality, change velocity, and data availability rather than a uniform annual cycle
- Expanded discussion of vendor and third-party model oversight, reflecting growing reliance on externally developed tools
- Refines the definition of 'model' to require statistical, economic, or financial theory, and excludes simple spreadsheet arithmetic and deterministic rule-based processes
- Explicitly excludes generative and agentic AI models from scope, to be addressed separately through future guidance
- States it does not establish enforceable or prescriptive requirements; non-compliance alone will not result in supervisory criticism
Adoption status
Issued April 17, 2026, SR 26-2 is the current, operative US interagency model risk management standard as of this site's publication date, replacing both SR 11-7 and OCC Bulletin 2011-12. Because it is only months old, many institutions' MRM programs and vendor RFPs still reference SR 11-7 by name; buyers should confirm that any firm or software vendor's methodology has been updated to reflect SR 26-2's risk-based revalidation approach and expanded third-party model coverage, not just SR 11-7's older framework.
Reference only. This page explains what SR 26-2 covers; it is not a claim that Model Risk Directory or any listed vendor satisfies it. Verify alignment directly against the issuing body's own current text before relying on it.
Sources. source 1 · source 2 · source 3. Data as of 2026-07. See methodology.