Sector
Banking
Where model risk management meets systems that act.
2026 interagency model risk guidance (OCC 2026-13)
Internal audit & effective challenge
Operational resilience
Internal audit & effective challenge
Operational resilience
The problem in one sentence
Model risk guidance was written for systems that score and predict. Your agents act. The April 2026 revision replaced that guidance and put agentic systems expressly outside its scope — which removes the specification, not the obligation.
Where it breaks
| Failure point | What actually happens |
|---|---|
| Inventory | Is an agent a model, an application, or forty models in a trench coat? Most MRM inventories cannot represent a system that chains tools, prompts and sub-models at runtime. |
| Validation | You validated the model. Did you validate the agent's authority? A well-scored model wrapped in an agent that can act outside its grant is a governance failure with excellent metrics. |
| Effective challenge | Challenge assumes the reviewer can reconstruct the decision. If the agent's context is gone, so is the evidence. |
| Monitoring | Model performance drifts slowly. Agent behavior changes the day a provider ships a new version — with no code change and often no revalidation trigger. |
The Banking regime references above are checked against their primary sources on an ongoing basis. Instruments move — several cited here changed inside the last year — so verify against the source before you rely on one. If you find something stale, tell me and I will correct it.
Next step
If any of this is live for you
The fastest route is a conversation. Bring the architecture you are worried about — the first useful thing usually surfaces inside twenty minutes.