Model risk
Also called model error risk
Model risk is the risk of loss or bad decisions caused by a model that is wrong, poorly built or used outside its purpose. Banks rely on models for credit decisions, capital, pricing, fraud and financial crime monitoring. Errors in data, assumptions or code, or a model drifting as conditions change, can all create model risk.
How it works
Banks keep an inventory of every model and rate each by materiality. Developers document design, data and limits. An independent validation team challenges the model before use and at regular intervals. Owners monitor performance, and models that fail are recalibrated, restricted or retired. Models from vendors and AI models fall within the same framework.
Model risk matters because model outputs drive capital levels, lending decisions and alert volumes in transaction monitoring. A flawed model can understate risk across a whole portfolio at once. In the US, SR 26-2 replaced SR 11-7 from 17 April 2026. In the UK, PRA SS1/23 has applied to banks with internal model approval since 17 May 2024.
The rules
Replaces SR 11-7 and SR 21-8 with risk-based, proportionate guidance on model development, validation, governance and use.
Banking organisations, most relevant to Fed-regulated firms with over $30 billion in total assetsSets five principles covering model identification, governance, development, independent validation and risk mitigants.
UK banks and building societies with approval to use internal models for regulatory capitalCommon questions
What causes model risk?
Model risk comes from two sources. One is a model with fundamental errors in data, assumptions, methodology or code. The other is a sound model used incorrectly or outside the conditions it was built for.
What replaced SR 11-7?
SR 26-2, issued on 17 April 2026 by the Federal Reserve with the OCC and FDIC, superseded SR 11-7 and SR 21-8. It keeps the core principles but takes a more risk-based and proportionate approach.
Does model risk cover AI models?
Yes. Supervisors treat machine learning and AI systems used in decisions as models. They need inventory, validation and monitoring like any other model, with extra attention to explainability, bias and drift.
What is the difference between model risk and model risk management?
Model risk is the exposure itself. Model risk management is the framework a firm uses to control it, including the inventory, validation, governance and monitoring.
