United StatesOCC Bulletin 2025-26: Model Risk Management, Clarification for Community Banks
Guidance, not a law: the Office of the Comptroller of the Currency's reading of Safety and soundness standards for insured depository institutions: internal controls, information systems and internal audit systems. It binds nobody by itself; the law it reads does.
Guidance on an AI sector rules rule, addressed to private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- guidance published by a regulator
- Obligation class
- Governance
- Audit expectation
- none
As of .
What the regulator expects
- It reaches you if you are a national bank, federal savings association, covered savings association, or federal branch or agency of a foreign banking organization that the Office of the Comptroller of the Currency (OCC) treats as a community bank, meaning an institution with up to $30 billion in assets.
- Tailor your model risk management practices, including the frequency and nature of model validation, to your risk exposures, your business activities, and the complexity and extent of your model use.
- Set the frequency and scope of model validation by your own reasonable determination from those factors, without assuming that the OCC's guidance requires annual validation.
Who enforces it
Enforcement body
Office of the Comptroller of the Currency, as supervisor of national banks, federal savings associations, covered savings associations and federal branches and agencies of foreign banking organizations. The bulletin carries no enforcement action of its own.
What this law does
The Office of the Comptroller of the Currency (OCC) issued Bulletin 2025-26, Model Risk Management: Clarification for Community Banks, on . The bulletin identifies community banks as institutions with up to $30 billion in assets, citing OCC News Release 2025-89. It states that community banks have the flexibility to tailor their model risk management practices, including the appropriate frequency and nature of validation activities.
It states that the OCC's guidance on model risk management does not, and should not be interpreted to, require community banks to perform annual model validation. The OCC states that it will not provide negative supervisory feedback to a bank solely for the frequency or scope of the model validation that the bank reasonably determined to perform based on its risk exposures, its business activities, and the complexity and extent of its model use.
OCC Bulletin 2026-13 refers to this bulletin, noting that the OCC's guidance does not, and should not be interpreted to, require community banks to perform annual model validation. The OCC's codified statement on the role of supervisory guidance says that the OCC does not take enforcement actions based on supervisory guidance.