SR 26-2 and OCC 2026-13 replaced SR 11-7 but exclude agentic AI. See what US banks still need to do for AI agents: inventory, tiering, validation, vendors.
For fifteen years, "model risk management" in a US bank meant SR 11-7. That letter is gone, and its replacement says in plain words that it does not cover generative or agentic AI. A bank that wants to deploy an AI agent therefore has no agent-specific supervisory guidance to follow, and it still has to show examiners that the agent is controlled. This post explains what changed on April 17, 2026, what that means for agents, and what a bank can put in place now using guidance that does apply.
The Federal Reserve, the OCC and the FDIC issued revised interagency model risk management guidance on the same day. The Federal Reserve's SR 26-2 says it supersedes SR 11-7 (April 4, 2011) and SR 21-8, the 2021 interagency statement on model risk management for BSA/AML systems. The OCC's Bulletin 2026-13 rescinds OCC Bulletin 2011-12, the Model Risk Management booklet of the Comptroller's Handbook, OCC Bulletin 1997-24 on credit scoring models, and OCC Bulletin 2021-19. The FDIC's notice rescinds FIL-22-2017 and FIL-27-2021.
Four points from the guidance matter for anyone planning agents:
The exclusion is not a safe harbor. It means no one has told banks how to validate an agent, so the burden of proof sits with the bank.
Traditional model risk management validates a model before use and re-checks it on a schedule. That works when a model produces a score and a person or process reviews it before anything changes. An agent can take the action itself.
Deloitte's analysis of agentic AI risks in banking makes a related point. It cites more than 350 risks from autonomous or agentic behavior in the MIT AI Risk Database, and says human-in-the-loop designs "may be insufficient, or even counterproductive" for agentic AI where a person at every step defeats the purpose. The practical reading is to keep people on the decisions that need them and put monitoring and hard limits at the point where the agent acts.
Three older risk types still apply, though their shape changes:
The third type changes most. A slow, occasional misuse can become a fast, recurring one.
Several pieces of existing guidance reach agents even though the new model risk letter does not.
Source | What it gives a bank for agents | Status |
|---|---|---|
Bank's own model risk and AI policy | Definitions, tiering, validation standards, ownership | Set by the bank; examiners review it |
OCC Bulletin 2023-17 (interagency third-party guidance) | A lifecycle for third-party risk, scaled to criticality, for agents bought from vendors | In effect since June 6, 2023 |
A voluntary structure for AI risk, plus the Generative AI Profile (NIST-AI-600-1, July 26, 2024) | Voluntary; NIST says AI RMF 1.0 is being revised | |
SR 26-2 and OCC 2026-13 | Principles for traditional models that an agent may call, such as a credit score | Excludes generative and agentic AI |
Existing operational, security and compliance programs | Access control, change management, logging, incident response | Apply to the agent as a system |
The last row is easy to miss. An agent that calls a credit model is still subject to the model risk guidance for that model. The agent wrapped around it is the part the guidance leaves open. Our guides on NIST AI RMF for AI agents and how to govern AI agents: 12 controls map these into controls.
Most banks do not need a new program. They need to extend the one they run, with the following additions.
We should be clear about what we can and cannot say. Zamp has no published banking or fintech customer case study, and nothing here describes a bank deployment. What follows is how our platform is built, from our published pages, and how those mechanisms map onto the controls above. Whether they satisfy a given bank's policy is for that bank to decide.
One agent, one procedure, one inventory entry.
Every AI employee has its own identity and exactly one agent operating procedure (AOP). The AOP records instructions, sources of truth, approval limits, escalation paths and scoped precedents, and it is versioned. That gives a model risk team a unit to inventory and an artifact that states what the agent may do.
Change control with evals.
Every change to an AOP, whoever makes it, happens on a branch, runs against evals including a golden set of behavior the agent must keep getting right, and merges only after review. Only the AOP changes. Model weights do not, and changes are auditable and reversible, per our self-learning system description.
Escalation rather than guessing.
When a case breaks a tolerance, lacks data or looks unfamiliar, the agent assigns Needs Attention and routes it to a person with context assembled. A PEV loop checks output before a case closes.
A trail in the team's own system.
Each action logs the input, sources, action, result, approval state and corrections. In a biopharma procurement deployment, the agent wrote its reasoning inside SAP Ariba.
Review rate as a launch control.
In that deployment, the agent sent 64% of requests to manual review in week one. As reviewed corrections accumulated, its decision rate rose to 85% and manual review fell to 15%. A bank would set its own tiers and approval limits and tighten or loosen them with evidence.
Deployment.
Regulated teams usually choose BYOC or on-premises so data and logs stay in infrastructure they already audit. Our trust and security page has the full model.
Begin with a list. Name every agent in use or in pilot, including ones inside vendor products, and record the owner, the systems it can reach and the actions it can take. Assign a risk tier to each. Then write the three lists for each agent: actions it may take alone, actions that need approval, and actions it may never take.
Next, decide where monitoring sits, assign owners before an incident, and ask vendors the OCC 2023-17 questions. Revisit the program when the agencies publish their planned request for information, since it may show where supervisors are heading. For the underlying term, see the model risk management glossary entry. For human checkpoints that remain, see where human judgment still belongs.
