How SR 26-2 Applies to KYC and Identity Verification Models

What counts as a model in KYC workflows

SR 26-2 is the Federal Reserve's revised model risk management guidance, issued April 17, 2026. The OCC announced updated guidance the same day, in coordination with the Federal Reserve and the FDIC. It is supervisory guidance. The OCC says it may also be relevant to smaller institutions with significant model risk exposure. Each institution should confirm which supervisor's version applies to it.

The guidance defines a model as a complex quantitative method, system or approach that applies statistical, economic or financial theories to process input data into quantitative estimates. It excludes simple arithmetic calculations and deterministic rule-based processes and software that have no such theories underpinning their design or use.

For KYC, the test is therefore about how a component is built, not where it sits in the onboarding flow. A fixed threshold rule is different from a trained classifier, even when both feed the same customer identification decision.

The principles are stated to apply to traditional statistical and quantitative models and to non-generative, non-agentic AI. Generative and agentic AI are described as novel and rapidly evolving, and the OCC, Federal Reserve and FDIC plan to issue a request for information on model risk management, with particular attention to AI. Controls on those systems in onboarding workflows are best documented as bank-chosen safeguards, and expectations may change as of November 2026.

Likely scope treatment by component

Classification of each component is the bank's judgment, and the rationale should be written down. The table shows a reasonable starting position, not a regulatory determination.

• Fixed field matching and threshold rules: Likely outside the definition if no statistical theory underpins the design. Document the exclusion and why.
• Document authenticity classifiers: Likely in scope when they are statistical or machine learning methods.
• Biometric matching: Likely in scope for the same reason. Vendor-supplied versions are still inventoried.
• Customer risk rating scores: Likely in scope when built on statistical methods. Rules-only scorecards need a documented decision.
• Fuzzy name matching and hybrid rules-plus-ML systems: Needs a component-level decision. Classify each part and the combined decision path.
• Generative or agentic assistants around onboarding: Outside the stated principle scope. Document the safeguards the bank chooses to apply.

Inventory, validation and vendor oversight

Inventory is where scope decisions become auditable. List every KYC and identity component, including CIP verification, document and biometric checks, sanctions and watchlist screening, and customer risk rating. Record whether each meets the model definition and why. Excluded components belong in the record too, because an examiner can ask how an exclusion was reached.

For in-scope models, the guidance ties oversight to materiality. Models of higher materiality, through exposure or purpose, warrant more comprehensive and rigorous oversight. Identity and onboarding models can be tiered on the significance of their output to business decisions and on their purpose. The guidance also points to aggregate risk from interactions among models, including shared assumptions, data or methodologies. A single vendor data source feeding several KYC components is a concrete example to track.

Validation depth and monitoring frequency should follow the tier. The interagency statement on model risk management for BSA/AML systems says validators need sufficient expertise and appropriate independence from development and implementation, and that effective challenge is a central principle. Keep records of the critical analysis and of how findings were resolved. Because the guidance says practices appropriately vary with risk profile and model usage, document the rationale for the rigor chosen.

The same statement says banks remain responsible for BSA/AML compliance when they use third-party models. For vendor identity and screening models, confirm what validation evidence, documentation and change notices the bank can obtain, and how current they are.

Ongoing monitoring and the evidence examiners can be expected to request

The CIP rule requires risk-based procedures that enable a reasonable belief that the bank knows each customer's true identity, with verification within a reasonable time after the account is opened. The rule does not mention models, but identity models support that outcome. Mapping each in-scope model to the CIP procedure it supports lets a bank trace model output to the reasonable belief standard.

No source describes what examiners have requested for automated KYC decisions, so the following is an inference from the general guidance. Across the lifecycle, a reasonable evidence set includes the inventory with scope rationale, tiering logic, validation reports and challenge records, vendor documentation, and ongoing monitoring results with the actions taken on them.

The harder gap is production behavior. Pre-deployment validation shows design and performance at a point in time. It does not show what a model or AI tool was permitted to do, or what it did, on an individual onboarding decision. Reconstructing that after the fact from scattered application records is slow and often incomplete. For a given decision, a bank should ask whether it can retrieve the model version, inputs, outputs, thresholds applied, policy in force and any human override.

Where runtime policy enforcement fits

SR 26-2 does not require runtime policy enforcement. The mapping below is an interpretation: it relates to the ongoing monitoring and controls portion of a model risk framework.

Trussed enforces policy in the execution path for AI interactions and tool calls: allow, redact, block, or escalate for human approval. Enforced at runtime, not reviewed after the fact, each enforcement decision produces audit-ready evidence of what the AI was permitted to do and what it did. For AI used around onboarding and identity work, such as an assistant that calls tools to retrieve customer records, that gives a bank per-interaction evidence to put in front of an examiner. It does not replace validation, and it does not provide model lineage or dataset provenance.

Trussed makes no claim of bank or financial-services deployments. Insurance is the regulated financial sector where it is deepest, with 18+ months of continuous production in a regulated enterprise. For a bank, the relevance is the evidence pattern under examiner scrutiny, and any such controls should be documented as the bank's chosen safeguards.