Fair Lending Controls for Bank LLMs Outside SR 26-2: What Still Applies as of November 2026

What the SR 26-2 exclusion changes, and what it does not

SR 26-2 is revised model risk management guidance dated April 17, 2026. It emphasizes a risk-based approach tailored to a bank's model risk profile and the size and complexity of its operations, and is expected to be most relevant to banking organizations with over $30 billion in total assets. In a May 2026 speech, a Federal Reserve governor said the Federal Reserve, OCC and FDIC had amended the guidance to clarify that it does not apply to generative or agentic AI.

For risk leaders, the practical consequence is narrow. The Federal Reserve's published model risk management guidance says a banking organization's own risk management and governance practices should determine the controls for tools, processes or systems it does not cover. It also states that it sets no enforceable standards and that non-compliance will not result in supervisory criticism. An LLM outside scope therefore does not fall into a rule-free zone. It falls to the bank's own standard.

The exclusion also does nothing to the statutes that govern lending. It is reasonable to expect that examination of an excluded LLM will rest on fair lending and consumer protection law and on the bank's compliance management rather than on model risk guidance. That is an inference, not a stated agency position, but it is the safer planning assumption.

Fair lending requirements that apply regardless of scope

Regulation B (12 CFR Part 1002) prohibits creditor practices that discriminate on the listed factors. It requires creditors to notify applicants of action taken on applications and to retain records of credit applications. None of these duties depends on whether a system is a model under SR 26-2. If an LLM drafts a status message, summarizes an application for an underwriter or helps explain a decision, the bank's Regulation B obligations attach to that activity as they would to any other process.

The OCC's fair lending handbook booklet focuses on compliance with the Fair Housing Act, ECOA and Regulation B, so those are the frameworks an OCC examination of LLM-assisted lending would start from. The CFPB has also said it monitors compliance with ECOA and the Consumer Financial Protection Act, which prohibits unfair, deceptive or abusive acts or practices, and that the same principles apply when firms use advanced technology for lending and underwriting. Customer communications, marketing, servicing and complaint handling are all within reach of that reasoning.

One point has changed. The CFPB now states that, consistent with Executive Order 14281, it no longer uses disparate impact in its supervision or enforcement of fair lending laws. This supersedes its 2024 position that robust testing should include disparate impact testing. The CFPB's change does not establish how other agencies or other legal channels will treat disparate impact. Governance documents should state which fair lending theories and standards the bank applies to LLM-assisted activities, and should be reviewed as positions evolve. Disparate treatment remains squarely in view, including prohibited-basis information reaching or shaping an LLM interaction.

Mapping fair lending exposure to LLM control points

A workable approach is to treat each LLM-assisted activity as three surfaces: what goes in, what comes out, and what the system can do. Inputs include prompts, retrieved documents and customer data that may carry prohibited-basis information. Outputs include customer-facing text, underwriting support summaries and decision explanations. Tool calls include reads and writes to origination, servicing, CRM and complaint systems.

Runtime enforcement acts on one interaction or tool call at a time, with four possible actions: allow, redact, block or escalate for human approval. Examples include redacting prohibited-basis attributes before they reach the model or a downstream tool, blocking an output that references them, and escalating adverse-action-related actions to a person. Scoping matters as much as filtering. A marketing assistant should not be able to reach underwriting data, and a servicing assistant should not trigger credit decision actions without escalation.

Runtime enforcement has a hard boundary. It does not measure statistical outcomes across populations. Disparate treatment testing, bias measurement and fair lending outcome analysis need pre-deployment testing and periodic review, and these remain the bank's responsibility outside the runtime layer. Evidence from enforcement shows what a system was allowed to do and what it did. It is not model-level provenance and should not be presented as such.

Evidence an examiner could reasonably ask for

No source defines what examiners will require for LLM interactions, so the package below is a design recommendation, not a stated requirement. It follows from Regulation B's duties to notify applicants of action taken and to retain application records, which give a concrete basis for recording LLM-assisted decisions and communications.

For a single interaction or tool call, a risk leader should be able to show the policy version applied, the action taken (allow, redact, block or escalate), the tool call and its parameters, any human approver, and timestamps. Redaction of inputs and blocking of outputs should be separate policies so each can be evidenced on its own. The evidence store should sit apart from the model and the application, with retention set by compliance counsel.

Trussed enforces policy in the execution path and produces audit-ready evidence at the level of individual interactions and tool calls. It does not perform fair lending outcome testing, bias measurement or model-level provenance, so the bank's testing results should be kept alongside runtime evidence. The examiner-facing package then covers scope rationale, policy set, sample interaction and tool-call records, escalation and approval history, and policy change history.