August 16, 2026

Model Risk Management for AI in AML: A Starter Framework

Axle Team

Key takeaways

SR 26-2 (April 17, 2026) supersedes both SR 11-7 and SR 21-8. There is now one risk-based model risk management guidance, and it explicitly carves generative and agentic AI out of scope.
The revised "model" definition excludes deterministic rule-based software. Many legacy transaction monitoring rule sets may now sit outside the definition; ML-driven scoring does not.
The agencies expect the guidance to matter most for banks over $30 billion in assets, but validation expectations flow downstream through auditors, partner banks, and examiners regardless of size.
Out of scope does not mean ungoverned: the agencies still expect risk management and controls for generative and agentic AI, and an interagency request for information on AI is planned.
A workable starter framework: inventory, materiality tiering, pre-use validation, effective challenge, performance monitoring, and decision logs for AI agents.

On April 17, 2026, the Federal Reserve, OCC, and FDIC issued revised Supervisory Guidance on Model Risk Management — SR 26-2 — superseding both SR 11-7 and the 2021 interagency statement on BSA/AML model risk (SR 21-8). If you run AML models, your governance program just got a new reference document, fifteen years after the last one.

Model risk management for AI in AML means governing AI-driven monitoring, screening, and scoring systems under the interagency guidance now in SR 26-2: maintain a model inventory, tier each system by materiality, validate before first use, subject models to effective challenge by independent qualified reviewers, and monitor performance against defined ranges — with generative and agentic AI governed separately, outside the guidance's formal scope.

Here is what changed, and a starter framework that holds up in front of examiners.

What model risk management for AI in AML now requires

SR 26-2 keeps the familiar skeleton — development, validation, governance — but rebuilds it around a risk-based approach tied to materiality. Two changes matter most for AML teams.

First, the definition of "model" narrowed:

"For the purposes of this guidance, the term 'model' refers to a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates."
— Supervisory Guidance on Model Risk Management (SR 26-2), Apr. 17, 2026

The guidance goes on to exclude simple arithmetic and "deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use." Read literally: a static monitoring rule — alert on cash over $9,000 in a day — is not a model under SR 26-2. A behavior-scoring engine, a customer segmentation model, or an ML alert-prioritization layer is. Record the determination either way, with rationale.

Second, the agencies drew a bright line around newer AI:

"Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance. Nonetheless, a banking organization's risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document."
— SR 26-2, footnote 3

Out of scope does not mean ungoverned. Per OCC Bulletin 2026-13, the agencies plan a request for information that "considers, in particular, banks' use of AI, including generative AI and agentic AI." That gap will close. Build the governance file now, while you still get to choose its shape.

Where SR 21-8 went — and what survives

The 2021 interagency statement (SR 21-8) told banks that BSA/AML systems may or may not be models, and that model risk principles should not delay sanctions list updates or scenario changes. SR 26-2 absorbs and replaces it, but the practical points survive: the model determination is yours to make and document, and compliance-driven updates should not queue behind validation cycles.

Scope note: the guidance "is expected to be most relevant to banking organizations with over $30 billion in total assets." Smaller banks and fintechs are not off the hook — auditors, BaaS partner banks, and state examiners borrow this vocabulary within a cycle or two. Expect SR 26-2-shaped questions at any asset size.

What changed, topic by topic:

Model definition: before (SR 11-7 / SR 21-8), broad — quantitative approaches generally in scope. Now (SR 26-2), narrowed — excludes deterministic rules and simple arithmetic.
BSA/AML systems: before, addressed in a separate 2021 statement. Now, folded into one risk-based guidance.
Generative / agentic AI: before, not addressed. Now, explicitly out of scope; general risk management applies, and an RFI is planned.
Validation rigor: before, often applied uniformly across the inventory. Now, tiered by materiality (exposure and purpose).

A starter framework: six steps

The through-line in SR 26-2 is proportionality. The non-negotiable is effective challenge:

"Sound model risk management also involves 'effective challenge,' which refers to the critical analysis conducted by objective experts who evaluate model risk and effect appropriate changes throughout the model lifecycle, from model development to ongoing monitoring."
— SR 26-2, Section III

Inventory the AML stack. Every quantitative system, vendor tools included: monitoring scenarios, screening matchers, risk-rating engines, ML prioritization layers. Record purpose, inputs, owner, and whether each meets the SR 26-2 model definition — with a written rationale where it does not.
Tier by materiality. SR 26-2 makes materiality — exposure and purpose together — the dial that sets rigor. A screening matcher that auto-clears hits is high materiality; a dashboard nobody decisions off is not. Models "developed to help meet regulatory requirements" are called out as generally higher risk, which describes most of an AML stack.
Validate before first use. Conceptual soundness, developmental evidence, outcomes analysis. Note the new flexibility: where evaluating theoretical construction is impractical, the guidance accepts "interpretability measures or benchmarking to other models" — language written with machine learning in mind.
Stand up effective challenge. Reviewers need expertise, independence, and the organizational standing to force change. For a small team, a qualified external reviewer beats a captive internal one.
Monitor against defined performance ranges. Validation "can reveal performance deterioration over time and inform judgments about acceptable performance ranges." Set those ranges at deployment, not after the first exam finding. When performance deviates, the options are adjust, recalibrate, or redevelop — document which, and why.
Govern AI agents outside the model boundary. For generative and agentic AI, run a parallel track: a decision log per action, sampled quality review against written procedures, human gates on filings and account actions, and vendor documentation kept in the model file even when the tool is not formally a "model."

A practitioner's note on agentic AI

For agentic AI in AML operations, the useful unit of validation is the workflow, not the weights. You cannot hand an examiner a coefficient table for an LLM-based investigator. You can hand them a per-alert decision log, a monthly QA sample scored against your own procedures, and an escalation-rate trend. Teams that manage AI agents the way they manage junior analysts — full review at first, then sampled QA with error-rate thresholds — clear model governance committees far faster than teams forcing agents through a classic SR 11-7 validation template.

That is the design principle behind Axle's platform: every agent action carries an audit trail, so effective challenge has something concrete to grip. If you are earlier in the journey, the AI readiness playbook covers the governance artifacts worth building before the first agent goes live.

FAQ

Is SR 11-7 still in effect?

No. SR 26-2 superseded SR 11-7 and SR 21-8 on April 17, 2026. Existing validation work does not need re-papering overnight, but new validations and policy refreshes should cite SR 26-2 and its risk-based, materiality-tiered standard.

Are AML transaction monitoring systems "models" under SR 26-2?

It depends on the system. Deterministic rules with no statistical underpinning now fall outside the definition; ML detection, scoring, and segmentation fall inside. The determination is bank-specific — make it deliberately and write it down.

Does model risk management apply to generative AI in AML?

Not formally — SR 26-2 excludes generative and agentic AI from its scope. The agencies still expect governance and controls under general risk management, and an interagency RFI on AI is planned. Treat the exclusion as temporary breathing room, not an exemption.

Axle builds AML agents with the audit trails, decision logs, and QA hooks that make model governance workable. See how the pieces fit on the Axle platform, or put numbers on what agentic AI returns for your team with the ROI calculator.

Model Risk Management for AI in AML: A Starter Framework

More from the blog