---
title: "What Is SR 11-7, and What Changed With SR 26-2? | Dawiso"
description: "SR 11-7 is the 2011 Fed and OCC guidance on model risk management. Learn what it required, why SR 26-2 replaced it in 2026, and what changed for banks."
url: "https://www.dawiso.com/glossary/sr-11-7"
language: "en"
---

October 30, 2026

SR 11-7SR 26-2model risk managementmodel validationOCC 2011-12effective challengemodel inventory

# What Is SR 11-7, and What Changed With SR 26-2?

**SR 11-7** is the Supervisory Guidance on Model Risk Management that the Federal Reserve and the Office of the Comptroller of the Currency (OCC) issued on April 4, 2011. For fifteen years it was the reference document for [model risk management](https://www.dawiso.com/glossary/model-risk-management) in US banking: it defined what a model is, named the two ways a model creates risk, and set out what sound development, validation, and governance look like. The OCC published the same text as Bulletin 2011-12, and the FDIC adopted it in 2017.

SR 11-7 is no longer the current guidance. On April 17, 2026, the Federal Reserve, the OCC, and the FDIC jointly issued **SR 26-2, Revised Guidance on Model Risk Management**, which supersedes SR 11-7. People still search for SR 11-7 because it shaped how every model risk program in the country is built, and most of those programs are now being rewritten against the new text. This article explains what SR 11-7 required, what SR 26-2 changed, and what carried over.

TL;DR

**SR 11-7** (2011) is the Fed and OCC guidance that defined US model risk management: a broad model definition, **effective challenge**, independent validation built on conceptual soundness, ongoing monitoring, and outcomes analysis, a firm-wide model inventory, and a periodic review of every model at least annually. It was **superseded on April 17, 2026 by SR 26-2** (OCC Bulletin 2026-13, FDIC FIL-15-2026). The new guidance is shorter, risk-based, explicitly non-enforceable, most relevant to banks with over $30 billion in assets, scales control depth by **model materiality**, drops the annual review rule, and places generative and agentic AI **outside its scope**. The data expectations survive the rewrite: both documents ask for a critical assessment of the data that feeds every model.

## What Is SR 11-7?

SR letters are the Federal Reserve's supervision and regulation letters, numbered by year. SR 11-7 was the seventh of 2011. It was written in the aftermath of the 2008 financial crisis, when banks had learned how much damage a wrong or misused model could do to capital, pricing, and risk reporting. The guidance was intended for use by banking organizations and by the supervisors who examine them.

Three ideas from SR 11-7 became the vocabulary of the field:

- **A broad model definition.** A model is "a quantitative method, system, or approach that applies statistical, economic, financial, or mathematical theories, techniques, and assumptions to process input data into quantitative estimates." SR 11-7 split every model into three components: an input component that delivers data and assumptions, a processing component that turns inputs into estimates, and a reporting component that turns estimates into business information.
- **Two sources of model risk.** Model risk arises primarily because a model may have fundamental errors and produce inaccurate outputs, or because a model may be used incorrectly or inappropriately. A correct model pointed at the wrong decision is still a risk.
- **Effective challenge.** The guiding principle for managing model risk is "critical analysis by objective, informed parties who can identify model limitations and assumptions and produce appropriate changes." SR 11-7 tied it to a combination of incentives, competence, and influence.

SR 11-7 scaled its expectations to how extensively a bank used models: a program at a bank with relatively few models of moderate complexity could be significantly less involved than one at a bank with extensive or complex model use. When the FDIC adopted the guidance in June 2017 through FIL-22-2017, it scoped it generally to the institutions it supervises with $1 billion or more in total assets, plus smaller banks whose model use is significant or complex.

## What Did SR 11-7 Require?

SR 11-7 organized its expectations into three areas. Each became a standard workstream in bank model risk functions.

### Model development, implementation, and use

Models had to be built on a clear statement of purpose, sound theory, and documented assumptions, and tested before use. SR 11-7 was explicit that data matters as much as math: "there should be rigorous assessment of data quality and relevance, and appropriate documentation," and developers should be able to show that the data is suitable for the model and consistent with its theory.

### Model validation

Validation had to involve "a degree of independence from model development and use." In the guidance's words, it should generally be done "by people who are not responsible for development or use and do not have a stake in whether a model is determined to be valid." All model components, input, processing, and reporting, were subject to validation, whether the model was built in-house or bought from a vendor. A complete validation framework had three core elements:

- **Evaluation of conceptual soundness**, including developmental evidence.
- **Ongoing monitoring**, including process verification and benchmarking.
- **Outcomes analysis**, including back-testing.

SR 11-7 also set the rule that most programs built their calendars around: banks "should conduct a periodic review - at least annually but more frequently if warranted - of each model" to decide whether it still works as intended.

### Governance, policies, and controls

The board of directors and senior management were responsible for a bank-wide approach to model risk that fit the broader risk management framework. SR 11-7 expected written policies, clear roles, an internal audit review of the whole framework, and a **model inventory**: "a comprehensive set of information for models implemented for use, under development for implementation, or recently retired," with a specific party charged with maintaining a firm-wide view.

## Is SR 11-7 Still in Effect?

No. SR 11-7 was superseded on April 17, 2026. The three federal banking agencies issued one revised guidance under three numbers:

- **Federal Reserve:** SR 26-2, which supersedes SR 11-7 and SR 21-8, the 2021 interagency statement on model risk management for systems supporting Bank Secrecy Act and anti-money laundering compliance.
- **OCC:** Bulletin 2026-13, which rescinds OCC Bulletin 2011-12, Bulletin 1997-24 on credit scoring models, Bulletin 2021-19 on BSA/AML models, and the "Model Risk Management" booklet of the Comptroller's Handbook.
- **FDIC:** FIL-15-2026, which rescinds FIL-22-2017 and FIL-27-2021.

In practice, SR 11-7 still matters for two reasons. First, internal model risk policies, validation templates, and audit programs at most US banks were written against its text, and they do not update themselves. Second, much of the vocabulary survived, so understanding SR 11-7 is still the fastest way to read SR 26-2 and see what actually moved.

## SR 11-7 vs SR 26-2

SR 26-2 is not a light edit. The agencies describe it as a risk-based approach "tailored to a banking organization's model risk profile and the size and complexity of its operations," and the attachment shrank from 21 pages to 12. The table compares the points that most often drive changes to an existing program.

| Topic | SR 11-7 (2011) | SR 26-2 (2026) |
| --- | --- | --- |
| Status and tone | Supervisory guidance written as expectations ("banks should") | Framed as sound practice; states it "does not set forth enforceable standards or prescriptive requirements" and that non-compliance with the guidance will not result in supervisory criticism |
| Who it targets | Scaled to the extent and complexity of model use; FDIC adoption generally at $1 billion or more in assets | Expected to be most relevant to banking organizations with over $30 billion in total assets; may apply to smaller banks with significant model risk |
| Model definition | Quantitative method applying statistical, economic, financial, or mathematical theories, techniques, and assumptions | A *complex* quantitative method applying statistical, economic, or financial theories; explicitly excludes spreadsheet arithmetic and deterministic rule-based processes |
| AI | Technology-neutral definition; no specific AI language | Applies to traditional models and non-generative, non-agentic AI models; generative and agentic AI are out of scope |
| Proportionality | Rigor commensurate with model use and complexity | Built on **model materiality**, the combination of model exposure and model purpose; immaterial models may only need to be identified and monitored |
| Review cadence | Periodic review of each model at least annually | No fixed annual cycle; timing, nature, and frequency of validation vary with purpose, methodology, changes, and data limitations |
| Validation before use | Validation activities prior to first use, in line with the model's risk; any gap documented and reported | Generally before first use, but an urgent business need may justify earlier use with extra controls and disclosure of limitations |
| Independence | Validation generally by people not responsible for development or use | Quality "depends on the rigor and effectiveness of the review rather than on organizational structure"; effective challenge still requires sufficient independence |
| Model inventory | Banks should maintain a comprehensive inventory, including recently retired models | Described as common industry practice, with detail that can vary by model complexity |
| Governance | Dedicated board of directors and senior management section | Roles and responsibilities with clear accountability and attention to conflicts of interest between development and validation |

One sentence in SR 26-2 is worth reading twice. Non-compliance with the guidance does not trigger supervisory criticism, but a footnote keeps the door open: "supervisory action may result for any violations of law or unsafe or unsound practices stemming from insufficient management of model risk." The guidance relaxed the checklist, not the accountability.

## What Stays the Same in SR 26-2

A bank that built a serious program on SR 11-7 does not start over. The core of the discipline carries across almost intact:

- **Effective challenge.** SR 26-2 keeps the concept and spells out its three conditions: appropriate expertise, sufficient independence to stay objective, and the organizational standing to force change.
- **The validation components.** Conceptual soundness, outcomes analysis, and ongoing monitoring remain the building blocks. Benchmarking and interpretability measures now appear as practical alternatives to evaluating theoretical construction.
- **Misuse as a risk.** SR 26-2 states that "even a fundamentally sound model producing accurate outputs" can carry high model risk if it is misapplied or misused, the same second source of risk SR 11-7 named.
- **Aggregate risk.** Both documents ask banks to look at model risk across models, including reliance on common assumptions, data, or methodologies that could fail together.
- **Vendor models.** Buying a model does not transfer accountability. SR 26-2 still expects banks to understand vendor models, validate them, and monitor them, even when the vendor withholds code or data.
- **Inventory and documentation.** The inventory must hold enough information to understand model risk at the individual and aggregate level, and documentation still exists to support continuity and remediation.

## SR 11-7 and AI Models

Because its model definition was technology-neutral, SR 11-7 was the framework banks reached for when machine learning models arrived in credit, fraud, and anti-money laundering. That made SR 11-7 the de facto AI governance framework for many US banks, even though it never mentioned AI.

SR 26-2 ends that ambiguity in one footnote. Its principles apply to "traditional statistical and quantitative models and non-generative, non-agentic AI models." Generative AI and agentic AI "are not within the scope of this guidance," although a bank's own risk management and governance practices should still determine the controls for tools and systems the guidance does not cover. The OCC bulletin adds that the agencies plan to issue a request for information on model risk management that considers banks' use of AI.

For a bank, that leaves two programs that must fit together. Classical models and predictive machine learning stay in model risk management under SR 26-2. Large language models, retrieval pipelines, and [AI agents](https://www.dawiso.com/glossary/agentic-ai) need an [AI governance](https://www.dawiso.com/glossary/ai-governance) framework, such as the [NIST AI Risk Management Framework](https://www.dawiso.com/glossary/nist-ai-rmf), with the same muscles: an inventory, [risk tiering](https://www.dawiso.com/glossary/ai-risk-tiering), ownership, approval, and monitoring. The comparison of the two is covered in more depth in [What Is Model Risk Management (MRM)?](https://www.dawiso.com/glossary/model-risk-management)

## What SR 11-7 Means for Data Teams

Model risk guidance reads like a document for quants and validators, but a large share of the evidence it asks for is data evidence. SR 11-7 required a rigorous assessment of data quality and relevance. SR 26-2 places "a critical assessment of data quality, relevance, and inputs" inside model testing and lists the quality of inputs and data constraints among the drivers of a model's inherent risk. Under either text, a validator will ask the same questions:

- **Which data fed this model, and is it the authoritative source?** That is a question for a [data catalog](https://www.dawiso.com/glossary/data-catalog) that records which tables and features are approved.
- **What does each input mean?** A field called "default" or "exposure" must mean the same thing in the model, in finance, and in the regulatory report. That is a [business glossary](https://www.dawiso.com/glossary/business-glossary) question.
- **Where did the input come from, and what changed upstream?** That is [data lineage](https://www.dawiso.com/glossary/data-lineage), which also exposes the shared data sources that create aggregate model risk.
- **Who owns it?** Named [data ownership](https://www.dawiso.com/glossary/data-ownership) gives the model owner someone accountable for each input, the same discipline that [critical data elements](https://www.dawiso.com/glossary/critical-data-elements) apply to regulatory reporting.

Dawiso works on this data side of the boundary. It is not a model validation platform and does not replace a model risk system of record. What it provides is the governed context validation depends on: a [catalog](https://www.dawiso.com/product/data-catalog) of data assets with ownership, a [business glossary](https://www.dawiso.com/product/business-glossary) with one definition per term, and [interactive lineage](https://www.dawiso.com/product/interactive-data-lineage) from source to report. When the guidance changes, as it just did, that evidence does not need to be rebuilt, because it already describes the data every model depends on.

## Conclusion

SR 11-7 defined model risk management in the United States for fifteen years, and its ideas still run through every bank's program: effective challenge, independent validation, a firm-wide inventory, and the recognition that a correct model can be misused. SR 26-2 keeps those ideas and changes how they are applied. Governance depth now follows model materiality, the annual review rule is gone, the guidance targets the largest banks, and generative and agentic AI are left to separate AI governance. For teams updating their policies, the practical work is to map each SR 11-7 control to the new text, keep what still earns its cost, and make sure the data evidence behind every model is ready for the next validation, whichever letter it cites.

## Sources

- Board of Governors of the Federal Reserve System - [SR 26-2: Revised Guidance on Model Risk Management (April 17, 2026)](https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm) and [the attached Supervisory Guidance on Model Risk Management](https://www.federalreserve.gov/supervisionreg/srletters/SR2602a1.pdf)
- Board of Governors of the Federal Reserve System - [SR 11-7: Guidance on Model Risk Management (April 4, 2011, superseded)](https://www.federalreserve.gov/boarddocs/srletters/2011/sr1107.htm)
- Office of the Comptroller of the Currency - [OCC Bulletin 2026-13, Model Risk Management: Revised Guidance (April 17, 2026)](https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html)
- Federal Deposit Insurance Corporation - [FIL-15-2026, Agencies Revise Interagency Model Risk Management Guidance (April 17, 2026)](https://www.fdic.gov/news/financial-institution-letters/2026/agencies-revise-interagency-model-risk-management-guidance)
- Federal Deposit Insurance Corporation - [FIL-22-2017, Adoption of Supervisory Guidance on Model Risk Management (June 7, 2017, rescinded)](https://www.fdic.gov/news/financial-institution-letters/2017/fil17022.html), including the full text of the 2011 guidance

[See it in action](https://www.dawiso.com/solutions/ai-governance)

AI Governance

Trust and transparency in your AI use cases.

### Table of contents

What Is SR 11-7?What Did SR 11-7 Require?Is SR 11-7 Still in Effect?SR 11-7 vs SR 26-2What Stays the Same in SR 26-2SR 11-7 and AI ModelsWhat SR 11-7 Means for Data TeamsSources

## Related Terms

### [What Is Model Risk Management (MRM)?](https://www.dawiso.com/glossary/model-risk-management)

Model risk management treats every model as a risk-bearing system with an owner, independent challenge, and monitoring proportionate to what rides on it.

Read more →

### [What Is Risk Assessment in Data Management?](https://www.dawiso.com/glossary/risk-assessment)

Risk assessment is the process of identifying, analyzing, and prioritizing risks to your data - privacy, quality, security, and compliance. Learn how it works.

Read more →