An official website of the United States government
OCC Bulletin 2025-26 | October 6, 2025
Share This Page:
Chief Executive Officers of All National Banks, Federal Savings Associations, and Federal Branches and Agencies; Department and Division Heads; All Examining Personnel; and Other Interested Parties
The OCC is underscoring flexibility for community banks1 to tailor their model risk management practices.
This guidance is applicable to all community banks.
Community banks may use models for a broad range of activities, including underwriting credit; valuing exposures, instruments, and positions; measuring risk; managing and safeguarding client assets; and determining capital and reserve adequacy. However, use of models introduces the potential for adverse consequences from decisions based on models that are either incorrect or misused, referred to as “model risk.” Model risk should be managed like other
types of risk. Specifically, because the extent and nature of the risk vary across models and banks, model risk management should be commensurate with the bank’s risk exposures, its business activities, and the complexity and extent of its model use.
While intended as risk-based set of guiding principles, the model risk management guidance has been understood to establish prescriptive requirements on community banks. For example, while the model risk management guidance states that “it is generally good practice for banks to ensure that all models undergo the full validation process… at some fixed interval,” the fixed interval has sometimes been understood as annual rather than tailored based on risk. Furthermore, the guidance has been understood to require a full model validation every year instead of tailoring the frequency and scope of activities. As a result, even small, less complex banks have conducted full annual model validation or established in-house modeling teams to address potential disruptions with third-party supplied models without regard to whether it is reasonable in light of the banks’ risk profiles.
The OCC is issuing this bulletin to highlight that the practical application of the OCC’s model risk management guidance should be customized when applied by community bank management to be commensurate with the bank’s risk exposures, its business activities, and the complexity and extent of its model use. A community bank using relatively few models of only moderate complexity might conduct significantly fewer model risk management activities than a bank where use of models is more extensive or complex. Similarly, a community bank’s model validation frequency will generally be less than that of a larger bank with more extensive and complex model usage. Importantly, the OCC will not provide negative supervisory feedback to a bank solely for the frequency or scope of the model validation that the bank reasonably determined to perform based on the bank’s risk exposures, its business activities, and the complexity and extent of its model use.
This bulletin is relevant for all OCC issuances addressing model risk management, particularly the following:
To ensure that flexibility for model risk management is maintained going forward, the OCC will emphasize that message internally with its community bank examination teams.
Please contact your supervisory office or the Operational Risk Division, Office of the Chief National Bank Examiner, at (202) 649-6550.
James M. Gallagher Senior Deputy Comptroller and Chief National Bank Examiner
1 “Banks” refers collectively to national banks, federal savings associations, covered savings associations, and federal branches and agencies of foreign banking organizations. OCC News Release 2025-89 (September 18, 2025) identifies “community banks” as institutions with up to $30 billion in assets. This bulletin focuses on model risk management practices for community banks to clarify the practical application of the relevant guidance for these banks with the intent of reducing unintended regulatory burden.