SR 26-2 (Revised Model Risk Management)
Revised interagency guidance on model risk management, issued 17 April 2026, superseding SR 11-7 (2011) and SR 21-8 (2021). Most relevant to banking organisations with over $30 billion in total assets. Replaces fixed-cycle validation with materiality-based scaling, narrows the definition of 'model' to complex quantitative methods, and judges validation independence by the rigour of review rather than by organisational structure.
Why it matters for autonomous finance
The most consequential document on this list, for a reason almost nobody is stating plainly. Footnote 3 places generative and agentic AI models outside the scope of the guidance, describing them as novel and rapidly evolving, and directs that an organisation's own risk management and governance practices should determine appropriate controls for anything not covered. In April 2026 the US banking agencies formally declined to govern autonomous agents under model risk management and handed the question back to the institution.
What it does not cover
Reading the exclusion as permission is the error waiting to be made. SR 26-2 does not say agentic systems are unregulated — it says this framework does not reach them and yours must. An examiner who finds an agent committing capital under no articulated governance will not be reassured by footnote 3; the footnote is what makes the absence the institution's own choice.
No treatment of delegated authority, agent identity, kill criteria, or multi-agent systemic behaviour. The three MARQUE questions with no coverage anywhere are the three this document explicitly steps around. Every entry in this register carries this section. A standard read past its scope is worse than no standard, because it produces confidence without coverage.