Where SR 26-2 Creates Flexibility—and Where It Does Not

The opportunity is real, but it is narrower, more conditional, and more defensible-on-paper than a first read suggests.

The room is real, but it is bounded

SR 26-2 creates real room for firms to rethink parts of their model risk operating model. But the room is smaller and more conditional than the initial reaction to the guidance may suggest.

The most important areas of flexibility are threefold: a named path for immaterial models, the removal of SR 11-7’s guidance-level annual review cadence, and a narrower definition of what qualifies as a model. Each creates potential efficiency. None eliminates the need for control.

Immaterial models now have a named lighter path

SR 26-2 introduces the idea of an immaterial model and says that, for those models, model risk management can consist of identifying them and monitoring for the conditions under which they could become material. This is a genuine lighter-touch path that the guidance states outright, not something banks have to infer from its shorter length.

This matters because it gives firms an explicit basis to avoid applying heavy model risk machinery to models that do not warrant it. But it also raises the burden on classification. A model can only travel the lighter path if the firm can defend why it is immaterial and how it will know if that status changes.

The annual cadence has been loosened, not eliminated

SR 26-2 also drops SR 11-7’s “at least annually, more frequently if warranted” review cadence. In its place, validation timing and frequency vary by model purpose, methodology, frequency and scope of changes, and data limitations.

For a stable, well-performing model that has not changed, the guidance no longer imposes an annual full revalidation minimum. That opens the door to trigger-based revalidation: revalidate when there is a material change, a performance breach, or a regime shift, rather than simply because the calendar turned.

Two boundary conditions keep this honest. First, removing the guidance-level annual minimum does not mean stable models need no periodic revalidation. It means SR 26-2 no longer fixes the interval. A firm’s own model risk policy, regulatory capital rules, and other applicable requirements may still impose periodic validation independent of SR 26-2. Any savings are bounded by those requirements, not by SR 26-2 alone.

Second, SR 26-2 narrows the definition of “model” itself, explicitly excluding simple spreadsheet arithmetic and deterministic rule-based processes and software. That is a legitimate scope reduction, and firms should audit their inventories for it. But anything with statistical, economic, or financial theory underneath it stays in.

A tool can leave the model inventory without leaving the risk inventory

The narrower model definition should not be confused with the disappearance of risk. A spreadsheet that no longer meets the definition of a model is still a spreadsheet that can be wrong. If a tool is de-scoped from the model inventory, it needs a control home—for example, an end-user computing program or equivalent framework.

Otherwise, the institution has not reduced risk. It has moved risk off the model-risk ledger and into a place that may be harder to see.

The $30 billion point changes emphasis, not obligation

One scope point deserves precision. SR 26-2 says it is expected to be most relevant to banking organizations with more than $30 billion in total assets, and that smaller organizations are generally outside its focus.

This does not leave smaller banks ungoverned. SR 11-7 has been rescinded for all firms, and a sub-$30 billion organization is now expected to run model risk management appropriate to its size and risk profile. SR 26-2 itself notes that its principles may still be relevant to a smaller organization whose model use is prevalent, complex, or extends beyond traditional community banking.

The threshold changes supervisory emphasis, not the basic obligation to manage model risk. The wording itself signals as much: the guidance uses hedged terms such as “most relevant”, “typically”, and “generally”, rather than a clean cutoff. That is a fair indication that the $30 billion figure marks a shift in supervisory focus, not a bright line a smaller bank can stand behind.

Review does not equal validation

One change won more approval from practitioners than almost any other: dropping the fixed annual cadence. The reason lies in how the old rule drifted in the field. SR 11-7’s “annual review” language was originally meant to describe a lighter-touch check, a look at a model’s performance and a few related indicators. But over time, many examiners came to treat it as a call for full annual validation, a much heavier exercise. In practice, the two ideas often merged.

By tying frequency to a model’s purpose, methodology, and materiality, SR 26-2 gives firms room to separate them again and right-size the lighter work.

A more disciplined operating model

The practical operating model follows from that distinction. Rather than revalidating the whole inventory every year, a firm can lean on ongoing monitoring for stable models and rotate the heavier validation work across its higher-risk population on a multi-year cycle.

Industry reporting suggests some firms are doing roughly this—revalidating a portion of their higher-risk models each year rather than the whole set annually—though the right fraction and cycle length depend on the inventory, not on any figure in the guidance.

The effort that frees up should be redirected to genuinely complex models and hard-to-model areas where automated testing cannot substitute for expert review. The point is not to do less. It is to stop spending heavy-validation effort on models that have not changed and carry little risk.

The bottom line

SR 26-2 creates flexibility, but not a free pass. The best firms will use the guidance to reallocate effort, not to weaken discipline: lighter treatment for immaterial models, trigger-based revalidation for stable models where permissible, better inventory hygiene, and stronger focus on the models that genuinely move P&L, capital, or regulatory outcomes.

The operating opportunity is real. It is just conditional on evidence, policy alignment, and a defensible materiality framework.

Previous: Part 1 — SR 26-2 Did Not Lighten the Load. It Moved the Burden of Proof

Next: Part 3 — Under SR 26-2, Misclassification Is the New Model Risk