Sustaining model risk management excellence amid deregulations
Financial institutions respond to a changing regulatory landscape
As financial institutions respond to a changing regulatory landscape following the first 100 days of the new administration’s tenure, particularly trends toward deregulation, the importance of maintaining a disciplined and forward-looking model risk management (MRM) framework remains unchanged. Although we do not anticipate immediate impacts to model risk management stemming from current deregulatory developments, it is critical to uphold compliance with regulatory guidance, such as SR 11-7, OCC 2011-12, and FHFA’s AB 2013-07 while preparing organizations for future evolution through operational excellence and robust risk management practices.
1. Core Regulatory Compliance
The foundation of sound model risk governance rests on rigorous adherence to regulations. This includes maintaining strong model validation practices, comprehensive documentation standards, and well-defined governance structures. These core elements ensure the ongoing effectiveness of the MRM framework, supporting consistency, transparency, and accountability across the model lifecycle. By reinforcing these fundamentals, institutions can withstand regulatory scrutiny while preserving internal risk controls and decision-making integrity.
Deregulation is unlikely to fundamentally alter the importance of model risk management regulatory guidance, but it may lead to less intense examinations, allowing banks to prioritize resources differently than in prior periods. Smaller or less complex banking organizations with limited model use may be afforded more flexibility and simplified model governance. The likelihood that the bulk of bank supervision could be consolidated inside the OCC may reduce duplicative work and more consistent feedback from regulators. It also implies potentially reduced exam frequencies regarding model risk.
While regulators may shift their focus from adherence to procedures to outcome-based supervision, they will prioritize the real-world performance and impact of models on decision-making rather than strictly following prescribed processes. Firms may have more flexibility to tailor model risk frameworks to their specific needs, provided core regulatory principles are met. This flexibility will continue to necessitate a proactive and robust approach to model risk management.
2. Operational Efficiency
To effectively navigate future challenges in a deregulated environment, institutions must focus on improving operational efficiency within their MRM functions. This involves streamlining internal model validation workflows, enhancing the clarity and completeness of documentation to reduce regulatory friction, and developing scalable model risk governance capabilities, including utilizing onshore, nearshore, or offshore execution. Investing in these efficiencies not only helps contain costs but also enables quicker adaptation to changing business and regulatory needs without compromising compliance or control.
With increased openness and flexibility to use Artificial Intelligence / Machine Learning (“AI/ML”) techniques, MRM functions can actively leverage these technologies to enhance operational efficiency. AI/ML can be used to automate repetitive and time-consuming tasks such as data quality checks, model performance monitoring, and validation report generation. Additionally, AI/ML techniques can analyze large datasets and identify anomalies in model output, enabling faster and more accurate performance assessments.
Using data lakes, warehouses, or cloud-based platforms to consolidate data from various sources can significantly enhance operational efficiency within MRM functions. For example, embedding automated data quality checks directly into the model validation workflows ensures consistency and early detection of data issues. Furthermore, a centralized cloud-based platform can streamline model risk management processes by integrating model-related information and standardizing workflows such as model validation planning, execution, and approval. The platform can enable real-time tracking of MRM Key Performance Indicators, issue management, and model validation progress. Additionally, it can support the automated generation of consolidated reports, improving transparency and oversight across the model risk lifecycle.
3. Risk-Based Prioritization
A risk-based approach to model oversight remains essential particularly as exploration and usage of AI/ML embedded in both models and non-models continues to increase. Institutions should continue to assess and validate models based on their risk tiering, ensuring that high-risk models and emerging model risks receive appropriate validation. Modifying key definitions to distinguish models, qualitative/non-model tools, and applications. Maintaining an up-to-date model inventory and accurate risk classifications is vital to this process. Partnering with other risk teams to address talent need for computer science and form joint review for AI powered assistants, tools and applications that leverage deep learning algorithms and large language models. Allocating resources strategically towards the most critical models ensures that oversight efforts are both impactful and efficient, aligning with regulatory expectations and sound risk principles.
Traditional model risk scoring and tiering methodologies typically evaluate various risk dimensions, such as business impact, model complexity, and regulatory importance. However, as the use of AI/ML models becomes more prevalent—potentially accelerated by deregulation—the model tiering framework should be updated to reflect the unique risk characteristics of AI/ML models, such as the use of unstructured data, complexity of the methodologies and evaluation criteria, frequency of retraining, and level of model transparency.
MRM should prioritize its activities and resource allocation based on model tiering, including model validation frequency, validation scope, governance review, and documentation requirements. MRM personnel, technology, and time should be budgeted proportionally to model risk tiers, with a contingency reserve. For example, validation efforts for lower-tier models can be partially or fully automated using AI tools or assigned to junior validators, and the technology and time requirements are generally less demanding for non-model reviews.
It is essential to periodically reassess model risk scoring or after significant events and conduct regular reviews to ensure that prioritization remains aligned with evolving risks and regulation.
4. Change Management Readiness
While maintaining compliance with model risk management regulatory guidance, institutions must also build flexibility into their MRM frameworks to accommodate future changes. This involves proactively monitoring regulatory developments that could influence MRM practices, maintaining a well-documented backlog of planned changes, and preserving clear documentation of the rationale behind current practices. Such readiness ensures that institutions are not only compliant today but also prepared to pivot effectively when regulatory, business, or technological shifts occur.
MRM functions must remain proactive in monitoring evolving regulations, including emerging regulations addressing AI/ML models and End User Computing (“EUC”) tools. It is essential to regularly evaluate how regulatory changes impact model risk policies, controls, and the governance framework, and to conduct periodic risk assessments to identify potential gaps. MRM policies and controls should be updated to reflect these changes.
Adopting a platform to automate the tracking of regulatory updates, assess impacts, and manage compliance tasks can significantly enhance the efficiency of change management. Utilizing AI-driven tools for intelligent automation and integration with existing systems will further streamline these processes, ensuring a robust and responsive MRM framework.
Deregulation—whether actual or theorized—does not diminish the importance of a robust model risk management framework; instead, it underscores the need for operational resilience within the MRM function. By adhering to regulatory guidance, optimizing efficiency, focusing on risk-based oversight, and preparing for change, institutions can sustain compliance while building the capacity to evolve. In doing so, they reinforce the role of MRM not just as a regulatory necessity but as a strategic enabler of trust, transparency, and long-term value.
Dive into our thinking:
Sustaining model risk management excellence amid deregulations
Download PDFMeet our team
