Skip to main content
OCC Flag

An official website of the United States government

OCC Bulletin 2025-26 | October 6, 2025

Model Risk Management: Clarification for Community Banks

To

Chief Executive Officers of All National Banks, Federal Savings Associations, and Federal Branches and Agencies; Department and Division Heads; All Examining Personnel; and Other Interested Parties

Summary

The OCC is underscoring flexibility for community banks1 to tailor their model risk management practices.

Note for Community Banks

This guidance is applicable to all community banks.

Highlights

  • Community banks have the flexibility to tailor their model risk management practices, including the appropriate frequency and nature of validation activities, commensurate with the bank’s risk exposures, its business activities, and the complexity and extent of its model use.
  • The OCC’s guidance on model risk management does not, and should not be interpreted to, require community banks to perform annual model validation.
  • The OCC will not provide negative supervisory feedback to a bank solely for the frequency or scope of the model validation that the bank reasonably determined to perform based on the bank’s risk exposures, its business activities, and the complexity and extent of its model use.
  • The OCC will reinforce these points in communications with its community bank examination teams to ensure consistent messaging throughout the agency.
  • This bulletin is a first step as part of the OCC’s broader review of model risk management guidance, practices, and examiner feedback at banks of all sizes.

Background

Community banks may use models for a broad range of activities, including underwriting credit; valuing exposures, instruments, and positions; measuring risk; managing and safeguarding client assets; and determining capital and reserve adequacy. However, use of models introduces the potential for adverse consequences from decisions based on models that are either incorrect or misused, referred to as “model risk.” Model risk should be managed like other

types of risk. Specifically, because the extent and nature of the risk vary across models and banks, model risk management should be commensurate with the bank’s risk exposures, its business activities, and the complexity and extent of its model use.

While intended as risk-based set of guiding principles, the model risk management guidance has been understood to establish prescriptive requirements on community banks. For example, while the model risk management guidance states that “it is generally good practice for banks to ensure that all models undergo the full validation process… at some fixed interval,” the fixed interval has sometimes been understood as annual rather than tailored based on risk. Furthermore, the guidance has been understood to require a full model validation every year instead of tailoring the frequency and scope of activities. As a result, even small, less complex banks have conducted full annual model validation or established in-house modeling teams to address potential disruptions with third-party supplied models without regard to whether it is reasonable in light of the banks’ risk profiles.

The OCC is issuing this bulletin to highlight that the practical application of the OCC’s model risk management guidance should be customized when applied by community bank management to be commensurate with the bank’s risk exposures, its business activities, and the complexity and extent of its model use. A community bank using relatively few models of only moderate complexity might conduct significantly fewer model risk management activities than a bank where use of models is more extensive or complex. Similarly, a community bank’s model validation frequency will generally be less than that of a larger bank with more extensive and complex model usage. Importantly, the OCC will not provide negative supervisory feedback to a bank solely for the frequency or scope of the model validation that the bank reasonably determined to perform based on the bank’s risk exposures, its business activities, and the complexity and extent of its model use.

This bulletin is relevant for all OCC issuances addressing model risk management, particularly the following:

To ensure that flexibility for model risk management is maintained going forward, the OCC will emphasize that message internally with its community bank examination teams.  

Further Information

Please contact your supervisory office or the Operational Risk Division, Office of the Chief National Bank Examiner, at (202) 649-6550.

 

James M. Gallagher
Senior Deputy Comptroller and Chief National Bank Examiner

1 “Banks” refers collectively to national banks, federal savings associations, covered savings associations, and federal branches and agencies of foreign banking organizations. OCC News Release 2025-89 (September 18, 2025) identifies “community banks” as institutions with up to $30 billion in assets. This bulletin focuses on model risk management practices for community banks to clarify the practical application of the relevant guidance for these banks with the intent of reducing unintended regulatory burden.