OCC Model Risk Management
OCC Model Risk Management guidance (OCC Bulletin 2011-12 and Handbook)
The US banking supervisor's model risk regime: inventory, validation, and governance for models — now examined with AI and machine learning squarely in scope.
18 individual requirements seeded and assessable in AIXYRA.
US banking supervision has required disciplined model risk management for over a decade: a complete model inventory, independent validation, ongoing monitoring, and governance with clear ownership and effective challenge. The OCC's guidance and examination handbook define what examiners expect to see — and those expectations now explicitly reach AI and machine learning models.
AI strains classical MRM at the edges: models multiply faster, third-party and vendor models obscure internals, and agentic systems chain models with tools and data sources in ways a flat inventory can't express. Examiners still start with the same question — is the inventory complete? — but 'complete' now includes the AI estate.
Who it applies to
US national banks and federal savings associations supervised by the OCC — and, in practice, any US financial institution whose regulators apply equivalent model risk expectations.
Key requirement themes
Model inventory
A complete, current inventory of models — including AI/ML and vendor models — with owners and usage recorded.
Validation & effective challenge
Independent validation proportional to model risk, with documented findings and follow-up.
Ongoing monitoring
Performance tracked in production, with defined thresholds that trigger review when behavior drifts.
Governance & documentation
Board-level accountability, policies, and documentation that stands up to examination.
Orientation for evaluators — not legal advice. Consult counsel for obligations specific to your organization.
How AIXYRA helps
- The AI model catalog with version history, ownership, and lifecycle stages is a living model inventory
- Two-phase governance workflows give validation and effective challenge a recorded, repeatable structure
- Monitoring integrations watch production behavior and trigger governance re-review on drift
- Dependency graphs extend the inventory to what models actually touch — data sources, tools, agents — for examination-ready reporting
OCC Model Risk Management FAQ
Does OCC model risk guidance cover AI and machine learning?
Yes — supervisory expectations apply to models regardless of technique, and examiners increasingly probe AI/ML specifically: inventory completeness, validation of opaque models, vendor model oversight, and monitoring for drift.
How does AIXYRA extend classical MRM to AI?
It keeps the inventory-validation-monitoring backbone but adds what AI demands: agents and MCP servers as first-class entities, dependency chains between models and the data and tools they touch, drift-triggered re-review, and assessments against seeded OCC model risk articles.
Assess your AI systems against OCC Model Risk Management
OCC Model Risk Management ships built into AIXYRA — and the same assessment maps to every other enabled framework at once.