SR 26-2 vs FDIC FIL-22-2017: What Replaced It for FDIC-Supervised Banks

What changed and when

On April 17, 2026, the FDIC, OCC and Federal Reserve Board issued revised model risk management guidance. The Federal Reserve designates it SR 26-2, titled Revised Guidance on Model Risk Management. The FDIC issued the same guidance through a financial institution letter titled Agencies Revise the Interagency Model Risk Management Guidance, so there is no FDIC-numbered SR 26-2. Policies should cite the guidance by its FDIC title and, where useful, the Federal Reserve designation.

In connection with the release, the FDIC rescinded FIL-22-2017 and FIL-27-2021, which addressed Bank Secrecy Act model risk management. On the Federal Reserve side, SR 26-2 supersedes SR 11-7 and SR 21-8. FIL-22-2017 had itself adopted SR 11-7 and OCC Bulletin 2011-12, so the guidance it carried forward has been replaced at its source. The practical consequence is that any policy, procedure or exam-prep binder that cites FIL-22-2017 now cites an inactive document.

Side-by-side by requirement area

The table separates what each document states from what a bank must interpret. Where the revised guidance is descriptive or risk-based, the bank carries the burden of justifying its own approach.

• Status: FIL-22-2017: issued June 7, 2017, now rescinded and inactive. SR 26-2: issued April 17, 2026 by the FDIC, OCC and Federal Reserve.
• Origin: FIL-22-2017: adopted SR 11-7 and OCC Bulletin 2011-12 with technical conforming changes. SR 26-2: revised interagency guidance that supersedes SR 11-7 and SR 21-8.
• Applicability: FIL-22-2017: generally expected to pertain to institutions with $1 billion or more in total assets, and to smaller institutions only if model use was significant, complex or elevated risk. Revised FIL: states that it applies to all FDIC-supervised financial institutions.
• Approach: Revised guidance: risk-based, tailored to model risk profile and to the size and complexity of operations. Practices may vary, and each bank is responsible for practices that are appropriate and effective for its risks.
• Governance and controls: Revised guidance: lifecycle governance supported by clear policies and effective controls. Policies define expectations and a framework for assessing the magnitude of model risk.
• Validation, monitoring and documentation: Revised guidance: addresses validation and monitoring, and describes comprehensive documentation as common industry practice. The wording on documentation is descriptive, not prescriptive.

Scope, applicability and the model inventory

The clearest textual difference is applicability. FIL-22-2017 tied expectations to an asset size of $1 billion, with an exception for significant, complex or elevated-risk model use. The revised FIL states that its contents apply to all FDIC-supervised financial institutions, alongside language that scales practices to risk profile, size and complexity.

Banks that used the $1 billion expectation to limit inventory breadth or validation depth should revisit that reasoning. The more defensible position under a risk-based approach is a documented rationale: which models exist, how model risk was assessed, and why the resulting practices are proportionate. Interpreting how proportionality applies is the bank's responsibility, and the rationale should be recorded with the date and basis of any change.

The inventory deserves the same treatment. Test the bank's working definition of a model against the revised guidance's definition and scope language, and confirm that tools such as AI systems are captured or that their exclusion is reasoned. Banks with BSA/AML or OFAC models should also note that FIL-27-2021 is rescinded and check where the revised guidance now addresses those systems.

Governance, validation, monitoring and documentation

The revised guidance discusses factors that influence model risk, features of effective model development and use, model validation and monitoring, and governance and controls. Existing programs built on FIL-22-2017 can be mapped to that structure, and most will find familiar elements. The work is in confirming that each control still has a current reference and a defensible rationale.

On monitoring, the guidance says an effective ongoing plan may include regularly assessing model limitations at the development stage and over time, along with procedures for responding to issues before and after a model is approved for use. That points to evidence of responses, not only of scheduled reviews.

On documentation, the guidance describes a comprehensive set of information for models under development or in use as common industry practice. It says adequate documentation supports continuity of operations, tracking of recommendations, responses and exceptions, and remediation. The FDIC examination manual's Model Risk Management core analysis includes a step to determine whether model documentation aligns with the institution's own policies and procedures. Whatever a bank's policy promises, its records should be able to show.

Where runtime enforcement supports these expectations

Validation and development documentation describe how a model was built and tested. They do not by themselves show behavior in production. For AI systems that take actions, call tools or handle sensitive data at runtime, a bank may need a separate record of what happened in each interaction.

Trussed enforces policy in the execution path, applying allow, redact, block or escalate decisions to individual interactions and tool calls. Because enforcement happens at runtime, not reviewed after the fact, each decision produces audit-ready evidence of what an AI system was permitted to do and what it did. That evidence can complement monitoring and exception-tracking documentation in a model risk management program.

The scope is runtime behavior. It does not replace model validation or development documentation, and a bank should judge it against its own examiner scrutiny and model risk policy.

Common questions

Short answers on status and scope for risk teams reconciling older policies.

• {"question":"Is FIL-22-2017 still in effect?","answer":"No. The FDIC rescinded FIL-22-2017 in connection with the April 17, 2026 revised guidance, and it is now an inactive FIL. Policies should cite the revised guidance instead."}
• {"question":"Does the $1 billion threshold still limit scope?","answer":"The revised FIL states that it applies to all FDIC-supervised financial institutions, and the guidance scales practices to risk profile, size and complexity. Banks should document how they apply proportionality rather than rely on the former threshold."}