SR 26-2 vs ECOA Regulation B: Evidence for AI Credit Models After the 2026 Rule Change

Two obligations, two evidentiary questions

SR 26-2, issued by the Federal Reserve on April 17, 2026, is revised model risk management guidance. It sets out sound principles and recognizes that practices appropriately vary among banking organizations by risk profile and model usage. The OCC issued updated guidance the same day, describing practices that should be risk-based, tailored and commensurate with size, complexity and extent of model use. That guidance covers factors that influence model risk, model development and use, validation and monitoring, and governance and controls.

ECOA and Regulation B (12 CFR Part 1002) work differently. They require creditors to notify applicants of action taken, to give applicants who face adverse action a statement of specific reasons, and to retain records of credit applications. The CFPB has said these requirements apply equally to all credit decisions regardless of technology. Adverse action includes denying an application, terminating an account, making unfavorable changes to account terms, and refusing to increase a credit limit.

The practical consequence is that an examiner reviewing an AI credit process asks different things under each lens. Under model risk, the question is whether the institution can show control over the model. Under fair lending, the question is whether the institution can show what happened to applicants and why. Treating them as one workstream tends to produce a validation package that is strong on the first question and silent on the second.

SR 26-2 and ECOA/Regulation B side by side

The table compares what each lens centers on for an AI credit model. It treats the two as complementary rather than competing.

• Core question: SR 26-2: Is the model sound, governed and used within its purpose? ECOA/Regulation B: Did the creditor avoid discrimination and give accurate, specific reasons?
• Nature of the standard: SR 26-2: Risk-based guidance, tailored to risk profile and model usage. ECOA/Regulation B: Regulation that applies equally to all credit decisions, whatever the technology.
• Discrimination lens: SR 26-2: Not a fair lending test. ECOA/Regulation B: Disparate treatment remains; the effects test was removed in April 2026.
• Adverse action reasons: SR 26-2: Not its focus. ECOA/Regulation B: Reasons must be specific and accurate. An algorithm that cannot yield them cannot be used for that decision.
• Typical artifacts: SR 26-2: Validation reports, monitoring results, governance approvals, use controls. ECOA/Regulation B: Adverse action reason logic, notices, disparate treatment testing, application records.
• Revalidation: SR 26-2: Scaled to risk and model use. ECOA/Regulation B: Credit scoring systems must be revalidated often enough to stay statistically sound, with no fixed interval.

What changed in April 2026, and where the lenses overlap

On April 22, 2026, the CFPB issued a final rule amending Regulation B. It removed the effects test and stated that ECOA does not recognize disparate-impact liability. Older guidance and text that describe effects-based liability are superseded on that point. Disparate treatment remains: a practice that treats applicants differently on a prohibited basis violates the general rule. Adverse action specificity, notification and recordkeeping also remain. Fair lending testing scope and documentation should be confirmed with counsel and compliance rather than carried over from earlier examination procedures.

The overlap that remains is narrow and specific. Regulation B's criteria for an empirically derived, demonstrably and statistically sound credit scoring system touch data quality, model purpose, accepted statistical methods in development and validation, and periodic revalidation. These echo model risk principles. A model risk framework can also help identify which models may pose fair lending risk and warrant fair lending review.

Beyond that, the artifacts diverge. A validation report does not show that a denial notice stated the real reasons for a specific applicant. A fair lending test does not show that a model was monitored or that its use stayed within approved limits.

Which gaps runtime enforcement can address, and which it cannot

A frequent gap sits between what an AI system was approved to do and what it did in production. Validation documents describe the approved design. Neither lens is well served by evidence that is reconstructed later from scattered systems. A policy layer in the execution path of AI interactions that support credit workflows can record, for individual interactions and tool calls, whether each was allowed, redacted, blocked or escalated for human approval. Such records can support SR 26-2 questions about use controls and fair lending questions about what data or reasons reached a credit workflow. Whether they satisfy either lens depends on how the institution designs its process.

The limits matter as much as the capability. Runtime enforcement does not validate a model. It does not perform bias or fair lending testing. It does not determine adverse action reasons, and a human approval step is a documented control point, not a reason determination. It does not establish model lineage or dataset provenance. Those responsibilities stay with model validation, fair lending testing and adverse action processes.

Record formats and retention periods needed for Regulation B recordkeeping should be confirmed against the regulation before any evidence design is finalized.

Where Trussed fits

Trussed enforces policy in the execution path across models, agents, tools and MCP servers, with actions that include allow, redact, block and escalate for human approval, scoped to individual interactions and tool calls. That enforcement generates audit-ready evidence, with configurable retention and self-managed deployment in the customer cloud. It is enforced at runtime, not reviewed after the fact.

Trussed does not replace model validation, bias testing or adverse action determination, and it does not provide model lineage or dataset provenance. Insurance, a regulated financial sector, is where Trussed is deepest, and the platform has run continuously in a regulated enterprise for more than 18 months.