SR 11-7 model risk guidance is the Federal Reserve’s historical 4 April 2011 supervisory framework for managing model risk in banking. It connected model development, validation and governance: a pricing formula could work correctly while its use still exposed a bank to loss.
Current status, checked 29 October 2026: SR 26-2, issued 17 April 2026, superseded and replaced SR 11-7 and SR 21-8. Read SR 11-7 to understand historical references; use the replacement when assessing current US interagency guidance.
What the historical framework meant
The 2011 attachment, §§II–VI, described models through inputs, processing and reporting. It distinguished flawed models from sound models used inappropriately. Validation covered conceptual soundness, ongoing monitoring and outcomes analysis. Its independence principle allowed developer work to contribute, subject to independent critical review. Effective challenge meant informed, objective scrutiny with enough influence to produce changes.
The original Fed letter addressed Federal Reserve-supervised banking organizations, with application tailored to size, complexity and model use; the joint attachment also addressed OCC-supervised institutions. This was US banking supervision, rather than a worldwide rule for every quant. Governance included board and senior-management oversight, policies, documentation, model inventory and internal audit. See the original transmittal.
Follow a fictional pricing model through the decision
Consider a fictional bank developing a European-option pricer. The following workflow illustrates the ideas; its controls are example choices, not a prescribed regulatory checklist.
Development: define what the output is for. The desk proposes using a Black–Scholes model for a specified set of European contracts under documented carry assumptions. The development pack identifies market-data timestamps, volatility inputs, contract terms, numerical implementation and report units. Tests include known limiting cases and independently reproduced calculations. Passing them supports implementation quality; it does not show that the market follows the assumed dynamics.
Independent validation: challenge the evidence. A reviewer separate from development and use examines whether the assumptions suit those contracts and the proposed pricing and hedging decisions. The reviewer compares alternative implementations and assumptions, investigates discrepancies, and checks that a quote per unit is not reported as a whole-position value. Agreement with a second implementation is weaker evidence if both contain the same assumption error. Model validation therefore reaches beyond replaying the developer’s tests.
Effective challenge: change the decision when needed. Suppose the desk requests permission to apply the pricer to a barrier contract. The reviewer identifies that its exercise and path features differ from the approved European payoff. An influential challenge results in a restricted product scope and further analysis before expansion. A report that records the issue while the desk silently proceeds has not achieved that result.
Governance: make the boundary operational. In this example, the bank records a model owner, the reviewed version, permitted products, unresolved findings and the person authorized to approve use. A restriction must reach the booking and reporting process, not sit only in a memo. The internal-audit question is whether that control system works; rerunning the pricing test alone does not answer it.
Ongoing monitoring: revisit the judgment. The bank tracks input quality, pricing discrepancies, hedge behavior and changes in actual use. A new dividend treatment or a changed product population can prompt renewed review even when the software is unchanged. Sparse observable prices limit direct outcomes evidence; a challenger’s price is not automatically the true price.
Original fictional workflow. Governance spans the process, and monitoring feeds findings back into review. The diagram does not represent regulatory approval or a mandated sequence.
Read the replacement on its own terms
The 2026 attachment, §§I–II, says the guidance is most relevant to banking organizations above USD 30 billion in total assets; some smaller organizations with significant model exposure may also find it relevant. It does not set enforceable standards or prescriptive requirements, although violations of law or unsafe or unsound practices can still lead to supervisory action.
Its scoped model definition excludes simple arithmetic spreadsheet calculations and deterministic rules without underlying statistical, economic or financial theory. Generative and agentic AI are outside its scope. Sections III–VI retain effective challenge and risk-based development, validation, monitoring and governance, with rigor and timing tailored to risk and use.
Neither a universal numerical validation cutoff nor a single revalidation calendar follows from that framework. A bank’s chosen tolerance needs a rationale connected to model purpose, exposure and limitations. Approval remains a judgment about a particular use, not proof that model risk has disappeared.
Sources
- Federal Reserve (2011), SR 11-7 transmittal, 4 April 2011: historical scope and framework summary.
- Federal Reserve and OCC (2011), Supervisory Guidance on Model Risk Management, §§II–VI: historical framework, independent review and effective challenge. Superseded in 2026.
- Federal Reserve (2026), SR 26-2, 17 April 2026: express replacement of SR 11-7 and SR 21-8.
- Federal Reserve, OCC and FDIC (2026), revised model-risk guidance, §§I–VI and footnotes 1–3: scope, legal status, tailoring and lifecycle principles.