LLM Governance for Bank Complaint Responses: Runtime Controls and Evidence Under Revised Model Risk Guidance

Why model risk management alone leaves a per-interaction gap

The OCC issued Bulletin 2026-13, Model Risk Management: Revised Guidance, on April 17, 2026. The OCC, Federal Reserve and FDIC issued the revised guidance to clarify principles and to set a risk-based approach tailored to a bank's model risk profile, size and complexity. It covers model development and use, validation and monitoring, governance and controls, and vendor and other third-party products. It states that it sets no enforceable standards or prescriptive requirements. The OCC also notes that practices appropriate for one bank may be inappropriate for another with a different risk profile or a different use of a model.

For a risk leader, the practical consequence is that the bank has to document how it classified the complaint-drafting use case and why the chosen controls fit it. The guidance does not prescribe those controls. The bank's own risk management and governance practices decide them.

Pre-deployment validation and periodic review describe how a model behaves in aggregate. They do not show what the model was permitted to do on one complaint, or what it did. An examiner reviewing a single response will ask which data was retrieved, which rules applied, what was changed or withheld, and who approved release. Answering that requires controls in the execution path and records produced by those controls.

The CFPB's 2023 work on chatbots in consumer finance is a useful reference. It documented chatbot responses that fail to resolve issues and trap customers in loops with no route to a human. It covered customer-facing chatbots rather than back-office drafting. The lesson that a defined route to a person must exist still carries over to complaint workflows.

Policy rules and human approval categories

Write policy rules in terms of content, so each can be enforced and later explained. Allowed content typically includes statements drawn from account data retrieved for this complaint, approved template language and required disclosures. Redacted content includes personal data not needed for the response, full account identifiers and information about other parties. Blocked content includes refunds, fee waivers or outcomes the model has no authority to promise, statements of legal liability, and claims about account status that retrieved data does not support. A draft missing a required disclosure should be held or escalated, not released.

Consistent treatment is harder to enforce per interaction. A practical approach is to tie each complaint type to approved language and a policy version, then compare outcomes across similar complaints during monitoring. The version record shows which rules governed each response.

The bank's own risk assessment should decide which complaint categories need human approval. Candidates to consider include complaints alleging discrimination or unfair or deceptive treatment, disputed or unauthorized transactions, fraud, hardship, legal or regulatory references, requests for compensation, and complaints from customers who may be vulnerable. Whatever the list, keep a defined route to a human for any complaint the system cannot resolve within policy, and record when it was used. Review the category list on a schedule, because a list that never changes will drift from the complaints the bank actually receives.

Fitting the controls into model risk management and complaint handling

Treat the drafting system as a model use case within the existing inventory, with a documented risk classification. Validation should cover the policy rules and retrieval scope as well as the model: do the rules catch the failure modes above, and do they over-block? Ongoing monitoring can then draw on runtime signals such as block rates, escalation volumes and the frequency and nature of reviewer edits. Because the revised guidance addresses vendor and third-party products, assess any third-party model or enforcement component through the bank's third-party risk process.

Senior management accountability and independent challenge remain sound design practice. Someone independent of the team that wrote the policy rules should test them, and internal audit should be able to inspect the evidence directly. Personal data in prompts and outputs should also be covered by the bank's information security program.

On the complaint side, the AI-drafted response is still the bank's response. Existing complaint intake, categorization, escalation and record-keeping processes apply unchanged. The controls described here add a record of what happened inside the drafting step. They do not replace the bank's complaint procedures.