SR 26-2 Applicability: Asset Threshold and Scope for Banks

What SR 26-2 says about who it applies to

The Federal Reserve published SR 26-2 on April 17, 2026, as revised model risk management guidance. Its applicability note says the letter is expected to be most relevant to banking organizations with over $30 billion in total assets that are regulated by the Federal Reserve. The letter also says the guidance highlights sound principles for effective model risk management and that practices appropriately vary among banking organizations based on their specific risk profiles and model usage.

The wording matters. "Expected to be most relevant" describes where supervisory attention is likely to concentrate. It is not a mandatory coverage test, and it should not be written into internal policy as a bright line.

The guidance itself is principles-based. It addresses the factors that influence model risk, features of effective model development and use, model validation and monitoring, and governance and controls. Each banking organization remains responsible for adopting model risk management practices that are appropriate and effective for the specific risks it faces or is likely to face.

How the three agency issuances describe applicability

The Federal Reserve, OCC and FDIC each published revised model risk management materials on April 17, 2026. A bank holding company with entities under different supervisors should read each agency's statement rather than assume one wording covers the group.

• Federal Reserve (SR 26-2): Expected to be most relevant to Federal Reserve-regulated banking organizations with over $30 billion in total assets. Practices vary with risk profile and model usage.
• OCC (news release on updated guidance): Practices should be risk-based, tailored and commensurate with size, complexity and extent of model use. The release says it rescinds prior model risk management guidance and other issuances in part.
• FDIC (financial institution letter): States that its contents and referenced material apply to all FDIC-supervised financial institutions.

Treating the $30 billion figure correctly

For a Federal Reserve-regulated organization above $30 billion, the working assumption should be that SR 26-2 is directly relevant, and the program should be able to show how it meets the guidance. For an organization below that level, the more defensible position is a documented judgment, not an assumption of exemption. The OCC frames expectations as commensurate with size, complexity and extent of model use, so a smaller institution with significant or complex model use has reason to assess itself against the guidance.

Asset size should be measured and recorded consistently inside the institution. Pick a measurement basis and date, document it, and have it approved under the governance framework. Thresholds from other regimes, such as stress testing or capital planning rules, have their own calculation conventions. They should not be applied to SR 26-2 by analogy.

History adds one caution for FDIC-supervised institutions. In 2017 the FDIC adopted the earlier model risk guidance and stated it was not expected to pertain to institutions under $1 billion in total assets unless model use was significant, complex or posed elevated risk. The 2026 letter states applicability to all FDIC-supervised institutions, so any scoping decision that relied on the earlier statement should be revisited.

Scoping models and AI-enabled systems into the inventory

Once an institution is within the guidance, scope shifts from the entity to the model inventory. The institution's own model definition, read against the full guidance text, decides what is a model. AI-enabled systems are reasonable candidates for that inventory and should be assessed individually, not excluded by default. Vendor-supplied models belong in the same assessment, because the institution remains responsible for its model risk management practices even when it does not own the underlying code.

AI systems that act through tools raise a practical design question. A single application may call several models and invoke several tools, and a record of the application alone may not show which models were actually used. Institutions may want an inventory that records each model call and tool integration. That is a design consideration, not a stated requirement of SR 26-2.

Over-scoping and under-scoping both carry cost. Over-scoping dilutes validation resources across low-risk tools. Under-scoping leaves consequential systems outside governance and validation. The risk-based framing in the guidance supports tiering: assign depth of validation and monitoring according to the model's use and potential impact, and record the reasoning.

Evidence for in-scope AI systems, and where runtime enforcement fits

The guidance puts validation, monitoring, governance and controls at the center of model risk management. For AI systems that call models and tools, ongoing monitoring depends on records of what the system did in production. Runtime records of model use and outcomes can support that monitoring. SR 26-2 does not prescribe evidence formats, so specific artifacts should be treated as institutional design choices, not examiner requirements.

This is where runtime policy enforcement is relevant, as market practice rather than a regulatory requirement. Trussed enforces policy in the execution path of AI interactions and tool calls: allow, redact, block, rate limit, or escalate for human approval. Because enforcement happens at runtime, not through review after the fact, each decision produces audit-ready evidence of what the AI was allowed to do and what it did. Trussed runs self-managed in the customer cloud, with configurable retention and data residency, and has run 100+ models under one policy plane.

Trussed does not determine regulatory applicability. Scope remains a decision for the institution and its supervisor's guidance. Trussed's depth is in insurance, a regulated financial sector, and it does not claim bank deployments. What it offers a risk team is a way to turn written controls over AI behavior into evidence that can be reviewed during examination.