financial · Federal Reserve SR 11-7 · OCC 2011-12 · Basel III Pillar 2
Bank Model Risk Management (SR 11-7)
CMRO must document human review before remediation — receipt or 483-equivalent
—Freddie Mac AI governance (SR 11-7 baseline)
Regulatory exposure — commonly overlooked:
Banks validate models quarterly but cannot produce per-inference audit — examiners now ask both. · CMA: you are liable for your AI agent like an employee — applies to every agentic commerce vertical.
TAM / Exposure
Every OCC-supervised bank · SR 11-7 is law since 2011
Insurance lines
Bank E&O · D&O · Crime
Exhibit authority
UK CMA Agent Liability Pack — SR 11-7 Model Validation Evidence Pack