SR 26-2 and FDIC-Supervised State Non-Member Banks: What Applies as of November 2026

What changed and when

Many risk teams still frame this question around a split: Federal Reserve SR letters for Fed-supervised institutions, and separate FDIC guidance for everyone else. For model risk management, that split no longer describes the current position.

On April 17, 2026, the FDIC, the OCC and the Federal Reserve Board issued revised model risk management guidance. The Federal Reserve distributes it as SR 26-2, which supersedes and replaces SR 11-7 and SR 21-8. The FDIC distributes it by FIL. In connection with that release, the FDIC rescinded FIL-22-2017, which had adopted the 2011 SR 11-7 guidance, and FIL-27-2021, the FDIC's Bank Secrecy Act model risk issuance whose Federal Reserve counterpart was SR 21-8.

The practical consequence is that a state non-member bank should not be looking for an FDIC document that stands in place of SR 26-2. The FDIC's own FIL carries the same revised guidance.

How SR letters are scoped, and why that does not end the analysis

SR letters are Federal Reserve transmittals. Taken alone, an SR letter is addressed through the Federal Reserve's supervisory channel. The FDIC delivers its equivalent guidance through FILs. Supervisory guidance in general is scoped by regulator and by charter or membership status. The information security guidelines show the pattern: 12 CFR Part 364 Appendix B covers FDIC-insured banks other than members of the Federal Reserve System, while Appendix D-2 to Part 208 covers state member banks and cross-references Part 353 for state non-member banks.

For model risk, the scoping question is answered by the FDIC FIL. Its Statement of Applicability says its contents, and the material it references, apply to all FDIC-supervised financial institutions. A state non-member bank should cite the FDIC FIL as the FDIC-issued vehicle and describe the guidance as jointly issued. It should not describe SR 26-2 as binding on an FDIC-supervised bank by itself.

Current and rescinded issuances at a glance

The table separates the current guidance from the issuances a model risk policy may still cite.

• SR 26-2 (Federal Reserve): Transmits the jointly issued revised guidance. Supersedes SR 11-7 and SR 21-8.
• FDIC FIL, April 2026: Issues the same revised guidance. States that it applies to all FDIC-supervised financial institutions and sets out a risk-based approach tailored to model risk profile and the size and complexity of operations.
• FIL-22-2017 (rescinded): Adopted SR 11-7 and OCC Bulletin 2011-12. Expected the guidance generally to pertain to institutions with $1 billion or more in total assets.
• FIL-27-2021 (rescinded): FDIC Bank Secrecy Act model risk issuance, rescinded in connection with the April 2026 release.

Where expectations now overlap

Because the Board, OCC and FDIC issued one document, the main expectations are the same whichever supervisor examines the bank. The guidance covers factors influencing model risk, model development and use, model validation and monitoring, and governance and controls. It recognizes that practices appropriately vary among banking organizations based on their risk profiles and model usage.

Two points deserve attention from FDIC-supervised banks. First, the $1 billion asset expectation under FIL-22-2017 is no longer the reference point. Under the new FIL, the guidance applies to all FDIC-supervised institutions, with a risk-based approach tailored to the institution. Smaller banks should not assume the guidance falls away below a size line, and should document how they tailored their program.

Second, a policy that cites FIL-22-2017 or FIL-27-2021 as current is out of date. Updating citations is a small task, but it is the first thing a reviewer of the policy will see.

A separate regime applies where AI touches customer information. The information security guidelines in Part 364 Appendix B cover customer information maintained by or on behalf of the institution. The interagency computer-security incident notification rule requires notification as soon as possible and no later than 36 hours after a notification incident is determined. Whether an AI-related event qualifies is a classification to confirm with counsel.

Bringing AI systems into the model risk program

The guidance is described in terms of models generally: development and use, validation and monitoring, governance and controls. Treating AI interactions, tool-using agents and AI-enabled applications as models within that framework is an interpretation the institution has to make and defend. It is not something the guidance text settles for you.

The defensible approach is to make the decision explicit. Decide whether each AI system sits in the model inventory, record the rationale, and assign a risk tier. Because the guidance is risk-based, the tier should drive the depth of validation, the monitoring frequency and the approval path. Assign accountable ownership for these decisions and record how risk-based tailoring was determined.

The evidence question follows from the same logic. Documentation that shows what an AI system was permitted to do, what it did, and how that was monitored maps naturally onto the guidance's themes. A bank that can produce that record for a specific interaction or tool call is in a stronger position than one that can only describe intended behavior in a policy document.

Where runtime enforcement supports the evidence position

Trussed enforces policy in the execution path of AI interactions and tool calls: allow, redact, block, rate limit, or escalate for human approval. Enforcement happens at runtime, not through review after the fact, and each decision produces audit-ready evidence at the point of control. A reviewer can then reconstruct what was enforced on a given interaction without rebuilding the record afterward.

This supports documentation. It does not satisfy a specific requirement in the guidance, and it does not replace model inventory, tiering, validation or governance decisions that the bank owns. Retained monitoring outputs and change history still need to be kept to align with the validation, monitoring, and governance and controls themes.

On proof, Trussed has run continuously in production in a regulated enterprise for more than 18 months, with 99.95% uptime on live production traffic. Insurance is where Trussed is deepest. It does not claim bank or other financial-services deployments, so banks should evaluate any runtime control on how well its evidence maps to their own examination narrative.