On April 17, 2026, the Federal Reserve, FDIC and OCC rescinded SR 11-7, OCC 2011-12, FIL-22-2017 and related BSA/AML issuances, replacing them with a more explicitly risk-based, principles-driven framework for model risk management.

This is not a narrow technical update. It reflects a broader view that models are central to how banks make decisions, and that model risk must be governed with the same seriousness as credit or market risk.

For practitioners inside a bank, that translates into a concrete set of expectations: inventory is tiered by materiality, controls are applied proportionately, and our lifecycle is defensible end-to-end.

On a traditional stack, that answer is two to three quarters of sprint work: inventory migration, validation template rewrites, new monitoring pipelines, documentation refreshes, vendor-model onboarding, and parallel workstreams for GenAI and agentic systems that supervisors now treat as in-scope by principle. Every workstream is a project, a change ticket, and an audit exposure.

The real question is not "how do we build compliance to this guidance?" It is "what platform decision makes the next guidance change — and the one after that — a configuration exercise instead of a program?"

The 2026 revision is less a rewrite of controls than a re-segmentation of how we apply them. Five shifts matter for practitioners: