Model validation
Also called independent model validation, model review
Model validation is the independent review that checks whether a model is sound, works as intended and suits its use. At banks it covers credit, capital and transaction monitoring models. Validators test the design, the data, the outputs and the limits, and report findings that the model owner has to fix.
How it works
A validation team separate from the model's developers reviews the model's theory and assumptions, tests input data quality and replicates results. It runs outcomes analysis such as back-testing and benchmarking against alternatives. For transaction monitoring, it checks scenario logic, thresholds and data feeds. Findings are rated by severity and tracked until closed. Higher-risk models are validated more often and in more depth.
Supervisors treat validation as a core control against model risk, the risk of losses from wrong or misused models. A monitoring model with a broken data feed or stale threshold can miss suspicious activity for months. US banking agencies set expectations in SR 26-2. The PRA applies SS1/23 to UK banks with internal model approval.
The rules
Supersedes SR 11-7 and SR 21-8 and takes a risk-based approach in which validation scope and frequency reflect each model's materiality and use.
Banking organisations, most relevant above $30bn in total assetsSets five principles for model risk management, including independent validation; in effect since 17 May 2024 and updated in April 2026.
UK banks, building societies and PRA-designated investment firms with internal model approvalCommon questions
Who performs model validation?
Staff or a third party independent of the model's development and use. Many banks have a dedicated validation team in the second line. Internal audit then checks that the validation process itself works.
How often are models validated?
It depends on risk. US guidance in SR 26-2 says the timing and frequency of validation vary with the model's purpose, methodology, changes and materiality, with no fixed calendar. High-risk models are reviewed more often, with ongoing monitoring between full reviews.
Does model validation apply to AML systems?
Yes. Transaction monitoring and sanctions screening systems use models and rules that supervisors expect to be validated. SR 26-2 replaced the earlier US statement on BSA/AML model risk, SR 21-8.
