SR 26-2 vs OCC Bulletin 2011-12: The OCC Bulletin Is Rescinded

What changed, and when

Many programs were built on two parallel documents: the Federal Reserve's SR 11-7 and the OCC's Bulletin 2011-12. It is reasonable to ask whether replacing one also retires the other, since each agency controls its own issuances. In this case the question is settled by the primary texts, because the agencies acted together.

SR 26-2 is the Federal Reserve's transmittal of the Revised Guidance on Model Risk Management, issued jointly by the Federal Reserve Board, the OCC and the FDIC. It supersedes and replaces SR 11-7 and SR 21-8, the 2021 interagency statement on model risk management for bank systems supporting BSA/AML compliance.

On April 17, 2026, the OCC issued Bulletin 2026-13, "Model Risk Management: Revised Guidance." It states that the OCC, Federal Reserve Board and FDIC are issuing updated interagency guidance to clarify model risk management principles, set out a risk-based approach, and rescind prior guidance and other issuances. It expressly lists OCC Bulletin 2011-12 among the rescinded items. The OCC's archived copy of 2011-12 now carries the banners "RESCINDED" and "Replaced - See OCC 2026-13."

A comparison framed as Federal Reserve guidance versus a separate, still-active OCC bulletin therefore no longer matches the current record. The more useful comparison is between the 2011 baseline and the revised guidance that replaced it at both agencies.

SR 26-2 and OCC Bulletin 2011-12 side by side

The table compares the documents on the dimensions where their status and coverage are clear from the issuances themselves. For program design, the revised guidance's own text is the reference for definitions, validation standards and documentation detail.

• Issuing authority: SR 26-2: Federal Reserve letter attaching interagency guidance issued with the OCC and FDIC. OCC Bulletin 2011-12: OCC issuance of the 2011 guidance. Its replacement, OCC Bulletin 2026-13, carries the same interagency guidance.
• Current status: SR 26-2: current, issued April 17, 2026. OCC Bulletin 2011-12: rescinded by OCC Bulletin 2026-13 and marked as replaced.
• Prior guidance replaced: SR 26-2: SR 11-7 and SR 21-8. OCC Bulletin 2026-13: OCC Bulletins 2011-12, 2021-19 and 1997-24, plus the Comptroller's Handbook Model Risk Management booklet.
• Overall approach: 2011 guidance: comprehensive model risk management guidance organized around development, implementation and use; validation; and governance, policies and controls. Revised guidance: risk-based, tailored, and commensurate with size, complexity and extent of model use.
• BSA/AML systems: SR 26-2 replaces the separate Federal Reserve statement, SR 21-8. The OCC separately rescinds its counterpart, OCC Bulletin 2021-19.
• Credit scoring models: OCC Bulletin 1997-24 and its appendix are rescinded by OCC Bulletin 2026-13, so programs that cite it need remapping.

What the risk-based framing means for existing programs

The 2011 guidance gave institutions a structure that many programs adopted wholesale: a model inventory, development and implementation standards, a validation framework, and governance with defined roles and internal audit oversight. The revised guidance replaces that baseline and states that practices should be risk-based, tailored, and commensurate with a banking organization's size, complexity and extent of model use.

Proportionality cuts in both directions. It can support differentiated validation depth and documentation for lower-risk models. It also puts the burden on the institution to explain why its program is scaled the way it is. A tiering scheme that was inherited rather than designed will be harder to defend under that framing.

The replacement also reaches beyond the two headline documents. Programs that relied on the separate BSA/AML statements, on the credit scoring bulletin, or on the Comptroller's Handbook booklet are citing material that has been superseded or rescinded. Those programs have more remapping to do than programs that cited only SR 11-7 and OCC 2011-12.

The practical consequence is that the revised guidance, not the 2011 documents, is now the reference an examiner will hold a program against. Institutions regulated by the Federal Reserve, OCC or FDIC should confirm which agency's communications apply to them, since all three issued the guidance.

Examiner questions for AI-enabled models, and what runtime evidence supports

Whatever the revised guidance requires in detail, examiners reviewing AI-enabled models will generally want to see the same underlying things: which models and AI uses exist, how their use is controlled, how they are monitored, and what evidence shows the controls operated. Programs should be ready to answer those questions with records rather than descriptions of intent. Expectations specific to AI and machine learning models should be planned against the revised guidance itself and any examination communications, not against assumptions carried over from the 2011 documents.

Runtime policy enforcement can support part of that evidence. Trussed enforces policy in the execution path of AI interactions and tool calls, with actions to allow, redact or block, and produces audit-ready evidence from that enforcement. Those records show what an AI system was permitted to do and what it did, which is relevant to controls on model use and to ongoing monitoring of how AI is used in practice.

The limits matter. Enforcement records do not replace model development documentation, conceptual soundness review or independent validation. They are one evidence stream within a model risk management program, scoped to individual interactions and tool calls. Insurance, a regulated financial sector, is where Trussed is deepest, and the evidence is mapped to frameworks such as NAIC, NYDFS and NIST.