The federal banking agencies today rescinded existing risk management model guidance and replaced it with revised principles that they said better account for a financial institution’s size and complexity.
The new guidance by the Federal Reserve, FDIC and Office of the Comptroller of the Currency “clarifies that model risk management should be tailored commensurately to the size, complexity and model risk profile of a banking organization,” according to a statement. The revised guidance highlights sound principles for effective model risk management, and it discusses considerations specific to vendor and other third-party products.
The guidance does not establish enforceable standards or prescriptive requirements, and non-compliance will not result in supervisory criticism, the agencies said.
In a statement, American Bankers Association President and CEO Rob Nichols thanks the agencies for “issuing necessary, practical and actionable updates to their model risk management guidance.”
“In many cases, banks’ use of artificial intelligence is evaluated under this framework, and prior guidance predated significant technological developments, including generative AI,” he said. “This created a great deal of regulatory uncertainty and adversely impacted banks’ ability to innovate.”
Nichols added that ABA has consistently urged regulators to update the guidance to provide additional clarity about regulatory expectations given developments in the market, the broader AI technology stack and bank internal controls.
“The revised guidance will help banks of all sizes, particularly community banks, continue to pursue responsible innovation by making it clear generative and agentic AI are outside the scope of the guidance,” he said. “We appreciate that the federal banking agencies are planning to issue a request for information focusing on banks’ use of AI, including generative AI and agentic AI.”
