The Office of the Comptroller of the Currency (OCC) along with other federal financial regulators issued updated model risk management guidance for OCC-supervised institutions.
The updated guidance clarifies that model risk management practices should be risk-based, tailored, and commensurate with a banking organization’s size, complexity, and extent of model use. It rescinds prior model risk management guidance.
However, the guidance does not set forth enforceable standards or prescriptive requirements. Further, non-compliance will not result in supervisory criticism.
The guidance, done in conjunction with the Federal Reserve Board and the Federal Deposit Insurance Corporation (FDIC), highlights sound principles for effective model risk management. In particular, it discusses the factors that influence model risk and the features of effective model development and model use; model validation and monitoring; and governance and controls. Further, it discusses considerations specific to vendors and other third-party products, including validation of these products.
The updated guidance will be most relevant to banking organizations with over $30 billion in total assets. However, the guidance may also be relevant to smaller institutions with significant model risk exposure due to the prevalence and complexity of their models.
In the near future, the OCC, Federal Reserve Board, and FDIC plan to issue a request for information that addresses model risk management regarding banks’ use of AI—including generative AI and agentic AI and AI-based models.