How have banking model-risk and third-party-risk expectations changed in 2026?

Three separate developments matter: revised model-risk guidance, proposed third-party guidance and an updated examination work programme. Do not classify them all as new binding regulations.

What changed in model risk management?

On 17 April 2026, the banking agencies issued revised model-risk guidance. The Federal Reserve’s SR 26-2 supersedes its earlier model-risk guidance and says the revised guidance is expected to be most relevant to banking organisations with more than $30 billion in total assets. (federalreserve.gov)

The joint text emphasises proportionality and expressly distinguishes guidance from enforceable standards. It excludes simple arithmetic and deterministic rule-based processes from its model definition, and excludes generative and agentic AI from this guidance’s scope while recognising the need for appropriate governance of tools outside that scope. Certain smaller institutions with significant model exposure may still find it relevant. (federalreserve.gov)

Recommended GRC changes:

• Separate the model inventory from a broader AI and analytical-tool inventory.
• Record classification decisions and the authority supporting them.
• Allow validation scope and frequency to reflect approved risk assessments.
• Preserve independent challenge, limitations, use restrictions and monitoring.
• Do not interpret exclusion from this guidance as approval to remove all governance.

Demo test: move a tool between classifications and show what changes, who approves it and which other obligations remain attached.

What is proposed for third-party risk management?

The agencies announced proposed replacement guidance on 11 September 2026, followed by Federal Register publication on 15 September. It seeks a proportionate approach to individual third-party relationships rather than treating all relationships as inherently high risk. Comments close on 16 November 2026. The agencies describe the guidance as non-binding and plan to replace existing guidance when the new version is finalised. (occ.gov)

Recommended action: retain the existing approved methodology while building a separately controlled impact assessment of the proposal.

For vendor risk management software, test whether the platform can support:

• Different risk treatment for different services from the same supplier.
• A documented rationale for proportionate due diligence.
• Residual-risk acceptance with accountable approval.
• Reassessment triggered by a material relationship change.
• A change of methodology without destroying earlier assessments.

Avoid signing a large reconfiguration statement of work that assumes the proposed text is final.

Does the OCC’s September cybersecurity update mandate a new framework?

No. The OCC’s 21 September 2026 update changed the Cybersecurity Supervision Work Program’s structure and references to align with the updated NIST CSF. The OCC says it added no procedures, changed no procedures and established no new regulatory expectations; banks are not expected to use the work programme as their own assessment tool. (occ.gov)

Separately, the FFIEC Cybersecurity Assessment Tool was sunset on 31 August 2025. The FDIC identified alternative government and industry resources rather than prescribing one universal replacement. (fdic.gov)

Migration recommendation: retain historical CAT assessments as dated records. Map the chosen successor framework prospectively, documenting incomplete mappings and changed assessment methods instead of presenting old and new scores as automatically comparable.