On April 17, 2026, the OCC, in coordination with the Federal Reserve System and the FDIC, issued updated model risk management guidance for OCC-supervised institutions. This is part of the OCC’s ongoing efforts to reduce unnecessary burden and promote risk-based examination across institutions of all sizes.
According to the OCC, the updated guidance:
Serves in part to rescind prior model risk management guidance and other issuances and to clarify that model risk management practices should be risk-based, tailored, and commensurate with a banking organization’s size, complexity, and extent of model use;
Does not set forth enforceable standards or prescriptive requirements, and non-compliance will not result in supervisory criticism;
Highlights sound principles for effective model risk management; and
Discusses considerations specific to vendor and other third-party products, including validation of these products.
The OCC clarified that the updated guidance primarily applies to banking organizations with over $30 billion in assets, but may also be relevant to smaller institutions with significant model risk exposure. It does not cover generative or agentic AI models, which remain outside its scope due to their rapidly evolving nature.
With the updated guidance, the OCC is rescinding the following prior issuances:
OCC Bulletin 2011-12, “Supervisory Guidance on Model Risk Management,”
OCC Bulletin 2021-19, “Bank Secrecy Act/Anti-Money Laundering: Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance and Request for Information”
OCC Bulletin 1997-24, “Credit Scoring Models: Examination Guidance,” including the Appendix, “Safety and Soundness and Compliance Issues on Credit Scoring Models”
“Model Risk Management” booklet of the Comptroller’s Handbook
Read the OCC’s press release here.
The full guidance can be found here.