SR 26-2 Applicability to Community Banks Below the Asset Threshold

What the guidance says about scope and the $30 billion reference

The OCC and FDIC each stated on April 17, 2026 that the updated model risk management guidance is expected to be most relevant to banking organizations with over $30 billion in total assets. The guidance rescinds prior model risk management guidance and other issuances. It frames practices as risk-based, tailored and commensurate with a banking organization's size, complexity and extent of model use.

The FDIC adds a qualification that matters for community banks. It states the guidance generally does not apply to models used by banking organizations with $30 billion or less in total assets, to the extent those institutions do not have significant exposure to model risk. The carve-out is therefore conditional on model risk exposure, not on asset size alone. A bank below the threshold that relies heavily on models, including vendor-supplied AI, cannot treat asset size as the whole answer.

The OCC describes the guidance as covering factors that influence model risk, model development and use, model validation and monitoring, and governance and controls. It also states that the guidance sets no enforceable standards or prescriptive requirements, and that non-compliance will not result in supervisory criticism.

One point of caution on history. The earlier FDIC statement that model risk guidance was not expected to pertain to FDIC-supervised institutions under $1 billion, unless model use was significant, complex or elevated risk, now sits on an inactive page. Treat it as historical and use the 2026 guidance as the current reference.

Applicability, expectation and proportionality are different questions

Risk teams often collapse three distinct questions into one. Separating them gives a clearer basis for deciding how much to build.

• Formal applicability: Answered by the guidance's scope language: the $30 billion reference and, per the FDIC, whether a bank has significant model risk exposure. Record total assets and your exposure assessment.
• Supervisory expectation: What an examiner may reasonably ask about models and AI tools in use, regardless of formal scope. The OCC lists governance and controls, validation and monitoring, and development and use as the topics the guidance addresses.
• Proportionality: Both agencies describe tailoring to size, complexity and extent of model use. In October 2025 the OCC stated its guidance should not be read to require annual model validation at community banks.

Proportionate practice for a below-threshold bank

A non-enforceable guidance document does not remove the need to explain your own risk decisions. The practical position for a below-threshold bank is to document why its model risk exposure is or is not significant, and to size controls accordingly.

Start with an inventory scoped to what the bank actually uses, including vendor models and AI-enabled services embedded in other products. An inventory that is short and accurate is more defensible than a long one nobody maintains. Record the business purpose of each tool and the decisions it influences.

Then set validation frequency and depth by risk exposure, business activity and model complexity, rather than defaulting to an annual cycle. A low-impact tool may warrant a light review at onboarding and a periodic check. A model that influences credit decisions warrants more, and a duty to give reasons for credit decisions applies at every institution size.

Finally, keep a governance record of the tailoring rationale: what is in inventory scope, why the validation cadence was chosen, and how monitoring is performed. If an examiner asks why a bank invested less than a larger peer, a written rationale tied to exposure is the answer that holds up.

Vendor models and AI-enabled tools

Community banks rely heavily on third parties. A 2021 interagency request for information noted that community institutions may be more likely to use third-party AI approaches or rely on third-party services that use AI. It also noted that assessing the quality and suitability of model data may matter more for AI. A public commenter on the guidance observed that banks may not receive a vendor's underlying code, data or methodology.

That opacity shapes what evidence a bank can realistically produce. Where the vendor will not disclose methodology, the bank's evidence is limited to what it can capture at its own boundary and what its contract requires the vendor to retain and provide. Review vendor contracts for data retention, information-sharing and record-access terms, and align vendor oversight with the 2023 interagency third-party relationships guidance.

The agencies have not issued guidance specifying AI runtime controls or an AI-specific evidence format. What the guidance does provide is the set of themes, governance and controls, and validation and monitoring, under which an examiner's questions about AI would plausibly fall. A bank that can show, for a given AI interaction, what the system was permitted to do and what it did, has a direct answer to those questions. That framing is an inference from the guidance's structure, not a stated examiner requirement.

Where runtime enforcement and audit-ready evidence become relevant

For a bank with limited or low-impact model use, inventory, vendor diligence and a documented rationale may be sufficient. Runtime enforcement becomes relevant when AI systems act rather than only advise: when they call tools, touch customer data, or take steps in a workflow without a person reviewing each one. At that point, a policy document describes intent but does not show behavior.

Trussed addresses this narrow area. It enforces policy in the execution path of AI interactions and tool calls: allow, redact, block, rate limit, or escalate for human approval. Policy is enforced at runtime, not reviewed after the fact, and that enforcement produces audit-ready evidence of what the AI was allowed to do and what it did. Self-managed deployment in the customer cloud supports configurable retention and data residency. Trussed has run continuously in a regulated enterprise for more than 18 months, and its deepest experience is in insurance, a regulated financial sector.

No agency text requires this approach. It is one way to support the governance, controls and monitoring record for AI use, and it is most relevant where AI activity is material enough that a bank would otherwise struggle to reconstruct events for an examiner.