What SR 26-2 left out, and what banks should do in the meantime
On April 17, 2026, the Federal Reserve, the OCC and the FDIC replaced the model risk guidance banks had worked under since 2011. The new guidance, issued by the Fed as SR 26-2 and by the OCC as Bulletin 2026-13, is narrower and more principles-based. It is just as notable for what it leaves out.
Generative and agentic AI are out of scope. The agencies say these technologies are new and changing quickly, so the guidance does not cover them. Banks are told to govern them under their broader risk management practices instead.
A second change matters to AML teams in particular. The same release withdrew the agencies' 2021 statement on model risk management for systems that support BSA/AML compliance. That was the one piece of model guidance written for AML systems.
The agencies have said a request for information is coming "in the near future." It will cover model risk generally and banks' use of AI in particular, including generative and agentic AI. As of this writing it has not been published.
What this means in practice
The carve-out is not a pass. Examiners will still ask how a bank governs an AI agent that decides alerts. What has gone away is the shared playbook for answering. Until the request for information, and whatever follows it, each bank has to decide for itself what good looks like.
Five things worth doing now
- Know where your agents decide. List every place an AI agent makes or recommends a decision that takes effect: an alert closed, a case escalated, a customer cleared. Include vendor tools.
- Ask what checks each decision before it takes effect. Most controls today record what the agent did. Recording is not checking. For each decision point, write down what, if anything, tests the agent's decision independently before it is final.
- Keep records an examiner can verify. A log the agent wrote about itself is the agent's own account. Records the bank holds, showing what was checked, by what, and who decided, carry more weight.
- Keep the principle you already have. The new guidance still expects effective challenge: critical review by objective, informed people with the standing to force change. The guidance doesn't reach AI agents, but the principle applies to them naturally.
- Take part in the request for information when it opens. It is the industry's chance to shape what comes next.
The agencies were candid that these tools move faster than guidance can. That leaves the question with the banks: when an AI agent decides, who challenges it?
This post is general information, not legal or regulatory advice.