Model Risk Management: Clarification for Community Banks

Summary

The OCC is underscoring flexibility for community banks¹ to tailor their model risk management practices.

Highlights

• Community banks have the flexibility to tailor their model risk management practices, including the appropriate frequency and nature of validation activities, commensurate with the bank's risk exposures, its business activities, and the complexity and extent of its model use.
• The OCC's guidance on model risk management does not, and should not be interpreted to, require community banks to perform annual model validation.
• The OCC will not provide negative supervisory feedback to a bank solely for the frequency or scope of the model validation that the bank reasonably determined to perform based on the bank's risk exposures, its business activities, and the complexity and extent of its model use.
• The OCC will reinforce these points in communications with its community bank examination teams to ensure consistent messaging throughout the agency.
• This bulletin is a first step as part of the OCC's broader review of model risk management guidance, practices, and examiner feedback at banks of all sizes.

Background

Community banks may use models for a broad range of activities, including underwriting credit; valuing exposures, instruments, and positions; measuring risk; managing and safeguarding client assets; and determining capital and reserve adequacy. However, use of models introduces the potential for adverse consequences from decisions based on models that are either incorrect or misused, referred to as "model risk." Model risk should be managed like other types of risk. Specifically, because the extent and nature of the risk vary across models and banks, model risk management should be commensurate with the bank's risk exposures, its business activities, and the complexity and extent of its model use.

While intended as risk-based set of guiding principles, the model risk management guidance has been understood to establish prescriptive requirements on community banks. For example, while the model risk management guidance states that "it is generally good practice for banks to ensure that all models undergo the full validation process…at some fixed interval," the fixed interval has sometimes been understood as annual rather than tailored based on risk. Furthermore, the guidance has been understood to require a full model validation every year instead of tailoring the frequency and scope of activities. As a result, even small, less complex banks have conducted full annual model validation or established in-house modeling teams to address potential disruptions with third-party supplied models without regard to whether it is reasonable in light of the banks' risk profiles.

The OCC is issuing this bulletin to highlight that the practical application of the OCC's model risk management guidance should be customized when applied by community bank management to be commensurate with the bank's risk exposures, its business activities, and the complexity and extent of its model use. A community bank using relatively few models of only moderate complexity might conduct significantly fewer model risk management activities than a bank where use of models is more extensive or complex. Similarly, a community bank's model validation frequency will generally be less than that of a larger bank with more extensive and complex model usage. Importantly, the OCC will not provide negative supervisory feedback to a bank solely for the frequency or scope of the model validation that the bank reasonably determined to perform based on the bank's risk exposures, its business activities, and the complexity and extent of its model use.

This bulletin is relevant for all OCC issuances addressing model risk management, particularly the following:

• OCC Bulletin 2010-1, "Interest Rate Risk: Interagency Advisory on Interest Rate Risk Management"
• OCC Bulletin 2011-12, "Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management"
• OCC Bulletin 2012-5, "FAQs on 2010 Interagency Advisory on Interest Rate Risk Management"
• OCC Bulletin 2021-19, "Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance"
• Comptroller's Handbook, "Interest Rate Risk"
• Comptroller's Handbook, "Model Risk Management"

To ensure that flexibility for model risk management is maintained going forward, the OCC will emphasize that message internally with its community bank examination teams.  

Further Information

Please contact your supervisory office or the Operational Risk Division, Office of the Chief National Bank Examiner, at (202) 649-6550.

James M. Gallagher
Senior Deputy Comptroller and Chief National Bank Examiner