Do SR 26-2 Expectations Extend to Marketing Propensity and Next-Best-Offer Models?

What the guidance states and what is interpretation

On 17 April 2026 the OCC, in coordination with the Federal Reserve and FDIC, issued updated model risk management guidance. The Federal Reserve published it as SR 26-2. It covers factors that influence model risk, model development and use, validation and monitoring, and governance and controls.

Three statements matter most for scoping. First, the guidance says it may be useful for any type of model, but is expected to be most useful for models supporting significant business lines, operations, services and functions. Second, relevance depends on the nature, scale and use of models in relation to the business risks they touch, and higher-materiality models, through exposure or purpose, warrant more rigorous oversight. Third, the principles apply to traditional statistical and quantitative models and to non-generative, non-agentic AI models. For some cases, model risk management may consist of identifying those models and monitoring performance and the conditions under which their use may become material.

None of this is a list of in-scope use cases. Whether a propensity or next-best-offer model sits inside the inventory is a judgment the bank applies to its own facts. The guidance leaves each banking organization responsible for practices appropriate to its risks, which means an assumed exclusion carries more risk than a documented decision.

Does a propensity score meet the model definition?

The earlier 2017 guidance, as adopted by the FDIC, defined a model as a quantitative method, system or approach that applies statistical, economic, financial or mathematical theories, techniques and assumptions to process input data into quantitative estimates. It excluded simple mathematical tools, while still expecting reasonable controls over them, and it treated certain qualitative approaches as models. That wording is a useful reference point when reading the current text.

On its face, a propensity score fits. It takes customer and behavioral inputs, applies a statistical or machine learning technique, and outputs an estimate of likelihood. A next-best-offer engine that ranks products using such scores fits as well. A fixed rule such as an eligibility cutoff with no estimation step is closer to a simple tool, though it still needs reasonable controls.

The definition answers only whether the artifact is a model. It does not answer how much oversight it needs. That is a materiality question, and it is where most marketing models will differ from credit models.

A scoping worksheet for each marketing model

Record one worksheet per model, completed by the model owner and approved by someone independent of the business line. The worksheet should capture the factors below and end with a stated conclusion.

The central test is whether the output stays confined to marketing, or influences something more consequential. A score that only orders email send times differs from one that gates which customers see a credit offer or a rate. Where a lower-materiality conclusion is reached, keep the model identified in the inventory and state why. SR 26-2 contemplates identifying such models and monitoring for conditions under which they may become material.

• Model definition: Does the method process input data into quantitative estimates using statistical or AI techniques? Note whether it is non-generative or has generative or agentic components.
• Intended use and materiality: What decisions does the output drive, and what is the exposure or purpose? Assign a tier within the bank's existing framework for assessing model risk.
• Data inputs: List input sources, and note whether any are shared with other models, since the guidance treats common data, assumptions and methodologies as aggregate model risk.
• Customer impact: Does the score influence eligibility, pricing, credit or other treatment, or only message selection and timing?
• Vendor sourcing: Identify vendor-supplied models and confirm practices against the bank's own policies, as the FDIC examination module directs examiners to do.
• Reassessment triggers: Define events that force a new scoping decision, such as a propensity score beginning to affect eligibility or pricing. This is a suggested practice.

Keeping scoping separate from fair lending, UDAAP and privacy

A scoping conclusion under SR 26-2 is not a compliance conclusion. A model can be low materiality for model risk purposes and still raise fair lending, UDAAP or privacy questions. The reverse also holds: placing a model in scope does not by itself satisfy those obligations.

The supervisory material points to the connection without merging the two. The 2017 guidance asked institutions to be mindful of consumer compliance and fair lending requirements when using models. The FDIC examination module describes model risk management as mitigating the risk of incorrect or misused model-based decisions that may affect safety and soundness or result in apparent violations of consumer protection or other regulations. It also directs examiners to check vendor-model practices against institutional policy.

In practice, keep the scoping rationale as its own record, and cross-reference the separate fair lending, UDAAP and privacy analyses rather than folding them in. Each answers a different question, and examiners may ask for them separately.

Generative and agentic components need an explicit owner. The OCC describes these models as novel and rapidly evolving, and the agencies plan a request for information on model risk management and AI, including generative and agentic AI. Define approval, ownership and escalation for them now, and expect to revisit the position.

Runtime evidence an examiner may ask to see

Validation, according to the guidance, evaluates whether models perform as expected, including their reliability and limitations. That evidence is produced at development time and through periodic monitoring: conceptual soundness review, outcomes analysis, benchmarking and performance tracking. Runtime records do not replace any of it.

What development-time artifacts do not show is what a model or AI component was actually permitted to do in production, and what it did on a given day. For a propensity model, that might be which inputs it received and which actions its output could trigger. For a next-best-offer workflow with a generative component, it might be what content was produced, which tools were called, and which requests were stopped or sent for human approval. The guidance does not prescribe a runtime log format, so treat this as a practical complement to validation rather than a stated requirement.

Useful runtime evidence for in-scope marketing models generally answers four questions:

- What policy applied to this model or component at the time? - What did it receive and what did it attempt to do? - Was the action allowed, modified, blocked or escalated? - Who approved anything that was escalated?

Recording which upstream data and components feed several marketing models also supports the aggregate risk view the guidance describes.

Where policy enforcement in the execution path fits

Trussed enforces policy in the execution path of AI interactions and tool calls across models, agents, tools and MCP servers: allow, redact, block, rate limit, or escalate for human approval. Enforcement is applied at runtime, not reviewed after the fact, and each decision generates audit-ready evidence of what the AI was allowed to do and what it did. For a next-best-offer workflow with generative or tool-calling components, that supports the production-evidence questions above.

The scope is individual interactions and tool calls. Trussed does not provide model lineage or dataset provenance, so development-time validation and inventory records remain with the bank's own model risk process. Insurance is the regulated financial sector where Trussed is deepest, and the platform runs 100+ models under one policy plane, with 18+ months of continuous production in a regulated enterprise.