What are the SR 26-2 validation requirements and how do they differ from SR 11-7 model validation?

SR 26-2 validation requirements represent the Federal Reserve's updated supervisory guidance on model risk management, replacing and modernizing the long-standing SR 11-7 framework that governed banks since 2011. The updated guidance, issued alongside the interagency effort involving the OCC and FDIC, expands the definition of what counts as a model, tightens expectations around validation independence, documentation, and ongoing monitoring, and explicitly brings spreadsheets, AI/ML systems, and third-party vendor models into scope. For banks, this means validation is no longer a one-time approval event but a continuous, evidence-driven lifecycle discipline. For auditors and financial professionals, it creates a much larger surface area for finding discrepancies between what a bank claims about its models and what its documentation actually shows.

What SR 26-2 Actually Requires for Model Validation

Also worth reading: What Are the Best AI Model Validation Controls for Financial Services in 2026? · What Are the Definitive DAC8 Crypto Reporting Requirements for 2026 Compliance? · What are the mandatory audit committee charter requirements for public companies in 2026?

At its core, SR 26-2 requires that every model used in decision-making or regulatory reporting undergo validation commensurate with its risk. Validation must include three traditional components: conceptual soundness review, ongoing monitoring, and outcomes analysis (back-testing against actual results). What changed under SR 26-2 is the breadth and rigor of these components. Conceptual soundness now must address data lineage, assumption testing, and, for machine learning models, explainability and bias testing. Ongoing monitoring must be documented with defined thresholds and escalation triggers, not merely asserted. Outcomes analysis must be performed at a frequency tied to model materiality, with high-impact models typically requiring quarterly or semi-annual review.

The guidance also formalizes the requirement that validation be performed by qualified parties who are independent of model development and use. For large institutions, this generally means a dedicated model validation group outside the first line of defense. For community banks, the Fed accepts that third-party validators may perform this role, but the bank remains accountable for the quality and independence of that work. A validation that merely rubber-stamps a vendor's own testing will not satisfy examiners, and this is precisely where auditors frequently find discrepancies: banks pay for a validation report, file it, and never verify whether the validator actually had access to underlying data and code.

How SR 26-2 Differs from SR 11-7

The clearest way to understand the new requirements is to compare them directly against the 2011 framework they replace. SR 11-7 was written in an era when models meant credit scorecards, VaR engines, and interest rate models. SR 26-2 was written in an era of gradient boosting, generative AI, and sprawling Excel estates. The scope expansion is the single biggest change, and it catches many institutions off guard because their model inventories were built around SR 11-7 definitions.

This table matters for audit planning because each row is a potential discrepancy point. An institution that claims SR 26-2 compliance but has no spreadsheet inventory, no bias testing for its ML underwriting models, or no evidence of independent vendor validation is carrying unmitigated supervisory risk. Auditors who understand these deltas can move beyond checking that a validation report exists and start testing whether the validation actually meets the standard.

Why the Regulators Modernized the Framework

The push for updated guidance came from several converging pressures. First, the 2011 guidance predated the mainstream adoption of machine learning in credit decisioning, fraud detection, AML transaction monitoring, and capital modeling. Examiners found themselves applying a framework written for linear regression to neural networks, with predictable gaps. Second, a series of industry incidents involving spreadsheet errors in regulatory reporting, including well-publicized cases where banks restated capital figures due to Excel formula errors, demonstrated that the informal treatment of end-user computing was untenable. Third, third-party model proliferation through cloud vendors and fintech partnerships created situations where banks used models they could not explain to examiners because the vendor would not disclose internals.

There is also a supervisory consistency motive. The OCC, Federal Reserve, and FDIC each had their own guidance documents, and multinational institutions faced duplicative or inconsistent expectations across regulators. The interagency approach behind SR 26-2 aims to align expectations so that a model validated once to the new standard satisfies all three agencies. In practice, alignment is imperfect, and institutions operating across multiple regulators should still map their validation programs to each agency's specific examination procedures rather than assuming a single program satisfies everyone.

Practical Steps to Meet SR 26-2 Validation Requirements

Institutions approaching SR 26-2 compliance should start with a complete model inventory rebuild. This means identifying every quantitative tool, spreadsheet, and vendor system that influences a material decision or regulatory report, then tiering each by materiality and risk. A common tiering scheme assigns Tier 1 to models affecting capital, liquidity, or credit decisions above defined dollar thresholds, requiring full independent validation on a 12-to-24-month cycle. Tier 2 covers models with moderate impact, validated every 24 to 36 months with lighter documentation. Tier 3 covers low-impact tools requiring basic documentation and periodic review. The exact thresholds vary by institution size, but the tiering logic must be documented and board-approved.

Second, institutions must establish or strengthen the independence of validation. If the second line lacks the technical skills to challenge ML models, the bank needs to either hire, train, or contract qualified validators. Third, documentation standards must be raised: every validation should produce a report covering model purpose, data quality assessment, assumption testing, performance metrics with acceptance thresholds, limitations, and compensating controls. Fourth, ongoing monitoring must be operationalized with dashboards tracking population stability indices, drift metrics, and back-testing exceptions, with automatic escalation when thresholds are breached. Finally, the board and senior management must receive regular reporting on model risk exposure, validation findings, and remediation status. Auditors should test each of these steps for evidence, not just existence: a monitoring dashboard that nobody reviews is a finding, not a control.

Common Mistakes and Audit Red Flags

The most frequent failure pattern is inventory incompleteness. Banks routinely undercount spreadsheets because end-user computing tools are created informally and never registered. Industry surveys have suggested that large financial institutions may have tens of thousands of spreadsheets in production use, with only a small fraction under any governance. An auditor who samples a business unit's shared drives and finds material financial models absent from the inventory has found a direct SR 26-2 gap.

The second common mistake is treating validation as a document rather than a process. A validation report dated 2023 sitting in a policy folder, with no monitoring evidence since, fails the ongoing monitoring requirement regardless of the report's quality. Third, institutions often accept vendor certifications as validation. SR 26-2 makes clear that the using institution owns model risk even when the model is built by a third party; relying solely on a vendor's SOC 2 report or marketing materials is not independent validation. Fourth, AI/ML models frequently lack documented explainability analysis, bias testing across protected classes, or challenger model comparisons. Fifth, remediation of validation findings often stalls: auditors should track the aging of open findings, since findings open beyond their committed remediation dates indicate governance weakness that examiners will cite. Each of these patterns is a discrepancy an audit can quantify, and quantification, not anecdote, is what makes an audit finding actionable.

When to Act and What Non-Compliance Costs

The timing question is straightforward: the guidance is in effect, and supervisory expectations apply to current examination cycles. Institutions should not wait for an exam finding to begin remediation. A realistic remediation program for a mid-sized bank takes 12 to 18 months: roughly 3 months for inventory and tiering, 3 to 6 months for policy and governance redesign, and 6 to 12 months to work through the validation backlog, prioritizing Tier 1 models. Large institutions with hundreds of models may need 24 to 36 months and dedicated budget.

Costs vary widely. A third-party validation of a single complex model typically runs $25,000 to $150,000 depending on complexity, while a full MRM program build for a mid-sized bank can range from $500,000 to several million dollars including staffing, tooling, and external validation fees. Community banks can often meet requirements for $50,000 to $200,000 annually using outsourced validators and lighter tooling. Against these costs, weigh the downside: supervisory findings can lead to consent orders, restrictions on acquisitions or dividends, MRAs that raise capital planning scrutiny, and in severe cases enforcement actions. The 2011-era history of model risk enforcement shows that regulators escalate quickly when validation failures touch capital or credit decisions.

The Audit Angle: Finding Discrepancies in SR 26-2 Programs

For auditors, SR 26-2 is an unusually fertile testing ground because model risk programs generate abundant documentation that can be verified against reality. Effective audit procedures include reconciling the model inventory against actual systems and file shares, testing a sample of validation reports for the required elements, tracing monitoring thresholds to actual breach events and escalations, verifying validator independence through org charts and compensation analysis, and testing whether validation findings were remediated by their committed dates. For AI/ML models, auditors should request the bias testing results, drift monitoring logs, and challenger model performance comparisons, and verify they exist rather than accepting policy language asserting they do.

The spreadsheet angle deserves special emphasis. Because SR 26-2 explicitly brings material spreadsheets into model scope, an audit that samples financial reporting spreadsheets, checks them against the model inventory, and tests key formulas for errors can produce findings with direct regulatory relevance. Version control, access controls, and change logs are the typical weak points. An auditor who documents that a spreadsheet feeding a regulatory capital report has no version control, no independent review, and no inventory entry has identified a concrete, quantifiable SR 26-2 deficiency that management cannot dismiss as theoretical.

Building a Sustainable Validation Program

The institutions that handle SR 26-2 well treat validation as a lifecycle discipline embedded in model development, not a compliance gate at the end. That means developers document assumptions as they build, monitoring is configured at deployment, and revalidation triggers fire automatically when performance degrades or the model's use changes. It also means the model inventory is a living database with owners, tiering, validation dates, and finding status, reviewed quarterly by a model risk committee. Technology helps: MRM platforms can automate inventory tracking, monitoring dashboards, and finding workflows, though tools alone do not satisfy the independence and expertise requirements.

Skepticism is warranted about the compliance industry's response to SR 26-2. Vendors will sell validation-as-a-service packages of varying quality, and some will produce templated reports that satisfy the letter of documentation requirements without genuine challenge. Banks should evaluate validators on the depth of their technical questioning, their access to data and code, and their willingness to issue adverse findings. A validation report with zero findings across a complex model portfolio is more often a red flag than a comfort. The goal of SR 26-2 is not paperwork; it is demonstrable control over the models that increasingly run the financial system. Auditors, validators, and bank management all serve that goal best by testing claims against evidence, and by treating every gap between the two as a finding worth quantifying.