America’s new banking risk regulation overlooks AI and shifts the burden of defence

The old model risk rulebook told banks in America how to design, validate and monitor the quantitative systems they rely on. The new one asks them to defend what they chose. This isn’t relaxation, argues Vikram Singh , it’s burden transfer. And by failing to include AI within its scope America’s rules are lagging behind much of the world.

In April 2026 America’s banking regulators updated the guiding standard for how banks manage model risk. The Federal Reserve, Federal Deposit Insurance Corporation and Office of the Comptroller of the Currency jointly issued SR 26-2 , replacing the fifteen-year-old banking .^[1][2]

The update was not primarily driven by advances in AI. It was triggered by two developments: a decade and a half of accumulated supervisory experience showing that SR 11-7’s prescriptive approach was being applied too rigidly to institutions whose models did not warrant it. And a broader regulatory shift toward principles-based rather than rules-based supervision.

Across the risk departments in large and mid-sized institutions, the reception has been quiet relief . They are reading it wrong.^[3]

SR 26-2 applies most directly to institutions above $30 billion in assets. It replaces the prescriptive requirements of SQ 11-7 with a proportionality principle including expectations scale to the size, complexity and risk profile of each bank. For smaller institutions long frustrated with being held to the same standard as the largest banks, this is welcome. But flexibility is not leniency. Regulators are handing banks a blank sheet of paper and asking them to draw a defencible framework on it. Those who mistake the blank sheet for an easy week will discover at the next examination that the standard has not fallen. It has moved.

A look at the pervious update is instructive. When SR 11-7 was issued, in 2011, it was itself a response to the 2008 financial crisis, which had exposed how poorly many large banks understood the models driving their trading, pricing and risk management. Before 2011, model governance was largely informal, left to individual institutions to design, and widely inconsistent in rigor.

In my own experience, SR 11-7 was initially treated by many institutions as a procedural update rather than a substantive shift. Over the following two to three years, model risk management findings climbed steadily in supervisory reports as examiners recalibrated their expectations. The institutions caught by that recalibration were not the ones ignoring the guidance. They were the ones who assumed their existing informal practices were already good enough. The same dynamic is beginning to take shape under SR 26-2, and there is little reason to believe this cycle will end differently.^[4]

The most consequential thing about the guidance is what it does not cover. Generative artificial intelligence and agentic AI models are explicitly excluded from scope, on the grounds that they are novel and rapidly evolving. The agencies have signaled that separate guidance will follow. Until it does, banks deploying these systems operate without a specific playbook, but not without accountability.

How other jurisdictions chose differently

Other jurisdictions have taken different approaches to the same question. Singapore’s Monetary Authority moved earliest, publishing the Fairness, Ethics, Accountability, Transparency (FEAT) for AI in financial services in November 2018, and later extending its guidance through Project MindForge specifically for generative AI. In May 2023 Britain’s Prudential Regulation Authority published SS1/23 , which builds its five model risk management principles around the assumption that AI and machine learning techniques are within its scope. In September 2025 Canada’s Office of the Superintendent of Financial Institutions released Guideline E-23 , effective from 2027, which explicitly includes AI and machine learning models within a proportional framework organised across three pillars. Different jurisdictions and different starting points but a common conclusion. That adaptive AI needs a governance framework, not an exclusion. The America’s regulators chose otherwise, and the consequences of that choice will emerge in supervisory practice long before formal guidance catches up.^[5][6][7]

The warning signs are not hypothetical. In July 2025 the Massachusetts Attorney General reached a $2.5 million settlement with Earnest Operations LLC , a student loan lender, over allegations that its AI underwriting models disproportionately harmed Black and Hispanic applicants, generated inaccurate adverse action notices and lacked independent model validation. The Earnest case pre-dates SR 26-2, but it illustrates exactly the kind of failure the new regime is being asked to catch: an AI system producing consequential financial decisions without the governance architecture to defend them.^[8]

A survey of 230 banking professionals undertaken by Wolters Kluwer found that nearly three in four could not confirm their ability to shut down a malfunctioning AI model or report an AI failure to regulators. Supervisory letters issued since April have begun asking banks about kill-switch capability, data access boundaries and vendor oversight for the systems that sit outside SR 26-2’s scope^[9]

Consider a bank that rolls out a generative AI assistant for small business loan intake. It answers borrower questions, pre-qualifies applicants and suggests loan products. Six months later, the model begins subtly steering borrowers toward higher-margin products. The drift is behavioural, not statistical. A quarterly review does not catch it. The bank has no specific rule from SR 26-2 to fall back on. It also has no defence, because the guidance’s silence on generative AI is not silence from examiners.

The same pattern applies well beyond lending. An agentic AI system running anti-money laundering triage may autonomously investigate flagged transactions, pull related account history, cross-reference sanctions lists and draft suspicious activity reports. Two runs on nearly identical inputs may take different reasoning paths and reach the same conclusion through different logic. Outputs look clean, paper trails exist and yet the decision-making process itself becomes the audit problem.

Where the burden transfer bites

Regulators will not accept “the guidance did not tell us how” as an answer. They will ask what the bank chose to do, why and whether the decision can be defended on its merits held up.

Building a defense to that question requires abandoning the assumption that model governance is a periodic exercise. The framework I published earlier this year, since cited by the World Economic Forum’s AI4AI initiative , argues that AI governance must move from scheduled checkpoints to continuous monitoring . The reason is simple. The models themselves no longer sit still. In practice, this means observability built into deployment rather than bolted on afterwards, capturing decision paths rather than only outputs and drift detection tuned to the specific behaviour of adaptive systems. The oversight layer has to move at the speed of the system it oversees.^[10][11]

That shift comes down to three practical changes.

Every AI driven decision must be traceable back to its source data and decision logic. A model that cannot explain itself in plain English cannot be defended in plain English either. That is the examiner’s baseline, not an aspiration.

Validation must become continuous, not quarterly. Real-time drift detection is no longer a luxury reserved for the largest banks. It is the operational floor for anyone deploying models that adapt after deployment.

The business lines deploying these tools must understand the risks. Compliance cannot be the only department that speaks the language. When a loan officer or customer service lead cannot articulate why their AI tool is safe, the institution’s defence collapses exactly at the point regulators look first.

The engineering to support this is not trivial, but it is not exotic. The guiding principle is straightforward: oversight infrastructure has to move as fast as the systems it oversees. A dashboard that refreshes quarterly cannot govern a system that adapts hourly.

SR 26-2 isn’t the end of the conversation about AI regulation in banking. It is the start of a new chapter, one where banks will be expected to show, in practical terms, that they can defend the AI systems they use. The regulatory conversation itself is shifting from telling institutions what to build to asking them to prove what they built works.

Institutions that start building that capability now will be in a much stronger position when the next wave of guidance arrives, wherever that guidance comes from. Those that take SR 26-2 as a reason to do less may eventually find themselves explaining, model by model, why they didn’t. In an environment where technology moves faster than rulemaking, the burden of proof has already shifted. The institutions that recognise it first will define what defensible looks like for everyone else.

This article gives the views of the author, not the position of LSE Business Review or the London School of Economics. You are agreeing with our comment policy when you leave a comment.