AI Risk Considerations Move into OCC Credit Examinations
The Regulatory Impact of OCC Bulletin 2026-29 and Revised Guidance for Banks
-
October 27, 2026
-
On June 25, 2026, the U.S. Office of the Comptroller of the Currency (“OCC”) issued Bulletin 2026-29,1 revising the “Lending and Loan Portfolio Risk Management” booklet of the Comptroller’s Handbook,2 consolidating the Loan Portfolio Management booklet (issued in 1998 and last revised in 2017) and a set of legacy thrift issuances into one modern credit examination manual. Institutions that have kept pace with post-2008 supervision will recognize most of the content.
Three insertions, however, are new and noteworthy. The “Lending and Loan Portfolio Risk Management” booklet now carries dedicated sections for model risk management, third-party risk management, and a subsection on automated credit approval processes.3 Each of these sections maps to procedures examiners will utilize.
These insertions expand testing for three programs. The assessment of risks to asset quality posed by models, third parties and automated decision-making tools will be embedded directly in credit risk examinations. While the handbook retains the frequently quoted focus on “material financial risks,”4 regulated institutions should anticipate scrutiny of their related, non-financial risk management controls.
One Credit Exam to Rule Them All
For years, model risk management and third-party risk management lived in their own guidance, their own exams, and often their own corners of the organizational chart. OCC Bulletin 2026-295 pulls them into scope for credit examinations. The Model Risk Management section notes that banks use models across “underwriting and credit administration ... loan pricing, financial analysis, stress testing, and portfolio monitoring.” It then instructs that models used to underwrite and decision credit “should be subject to sound model risk management.”6 The Third-Party Risk Management section, drawn from the 2023 interagency guidance, names the providers a credit examiner will scrutinize by function: providers of models, loan brokers and correspondents, and financial technology companies.7
Here is what should hold a board’s attention. The booklet governs artificial intelligence (“AI”)-driven lending without mentioning governance expectations, so this guidance does not reach some of the tools that banks are now deploying. Search the text, and the words “artificial intelligence” and “machine learning” do not appear. Automated underwriting is described in the language of “models” and “rule-based criteria,” and every path leads to the same destination, which is the revised model risk guidance in OCC Bulletin 2026-13.8
OCC Bulletin 2026-13, issued in April 2026 as the successor to the 2011 model risk guidance, states plainly that “generative AI and agentic AI models ... are not within the scope of this guidance.”9 It signals a forthcoming request for information on precisely those tools.
This is what the OCC said it would do, namely, to concentrate supervision on core, material financial risk. Credit is the oldest of those material financial risks and has a storied history of contribution to bank failures. Bank management teams should expect model risk, AI governance and third-party reviews to occur inside asset quality examinations, and supervision activity names may not be indicative of the scope of review. “Commercial Credit Underwriting,” “Credit Administration,” “Portfolio Stress Testing,” or “Concentration Risk Management” target examinations or focus reviews may hide supervision scope or focus on AI models used to support the functions cited in the title of the planned supervisory activities.
Reframing Guidance from Rules to Principles
The revised guidance is principles-based rather than rules-based, and it is written to be most relevant to banks above $30 billion in assets. A community bank running an AI underwriting engine is pointed to a framework that excludes its newest technology and may not classify a rule-based decision engine as a “model” at all. The age-old debate of what constitutes a model is irrelevant to regulators.
The revised guidance is meant to remove prescriptive and rigid control expectations and allow for risk-based oversight of models and tools. Consider the fundamentals of the guidance – integrity of input, accuracy of transformation, relevance of assumptions, and reliability of output for associated business decisions.
In the absence of clearly defined assessment criteria, examiners may ask about AI in credit and utilize rudimentary understandings of controls for data integrity and fair lending risks. The guidance the examiner relies on will not, in its own words, cover the AI in question. This creates a white space that institutions need to fill before examiner judgment does it for them.
When the Guidance Stops, Name the Standard
An examiner does not need an AI booklet to test AI governance. Its absence shifts the burden of defining the standard to the bank. A robust AI Governance Framework, built from the authoritative sources a U.S. bank can credibly cite, can map that standard to the credit use cases examiners will probe. Three of a bank’s risk domains carry a credit tag and a compliance floor, which means they cannot be rated down until the bank proves the relevant controls (model risk management, fair lending and bias, and consumer-protection defensibility) are designed and operating effectively.
Across those domains, the coverage pattern is consistent and instructive. Traditional predictive models are well covered by existing guidance. Generative and agentic tools are thinly covered where credit examinations will now focus. Closing the guidance gap does not require inventing a standard; it requires adopting one. The NIST AI Risk Management Framework, its Generative AI Profile, and the Cyber Risk Institute’s Financial Services AI Risk Management Framework10 give a bank a defensible, examiner-legible control set for the tools the prudential guidance leaves out.
To help comply with the revised guidance, these questions should be posed to senior stakeholders:
- Do we have a complete inventory of the models and AI tools used in underwriting, pricing, stress testing, and collections that include vendors that operate for us?
- For every AI-influenced credit decision, can we produce a specific, accurate adverse-action reason and the fair-lending testing behind it? The Consumer Financial Protection Bureau has been explicit that the notice requirements “apply equally to all credit decisions, regardless of the technology used to make them.”11
- When the guidance we cite excludes generative and agentic AI, which named standard governs those tools instead, and is that decision documented in policy or procedure?
Demonstrate Proactive Governance to Build Regulatory Goodwill
There may be no separate AI examination to prepare for. AI will be examined through the credit exam, the model-risk review, and the third-party review that the updated booklet describes. Examiners will look beyond policy documentation and risk appetites to the bank’s assurance functions over controls that ensure accuracy in decisioning, avoiding bias, and preventing consumer harm. Institutions that wait for dedicated AI regulatory guidance before building an AI governance framework will answer the credit examiner’s questions without support from approved policies, standards, and controls.
Rather than waiting for formal guidance, firms should take these practical steps to build strong governance and prepare for regulatory scrutiny:
- Map each credit AI use case to the booklet section and the examination procedure that will test it
- Adopt a named external standard for the generative and agentic AI tools the model-risk guidance excludes and record that decision as policy
- Make the model inventory, validation, and vendor-model oversight audit-ready under the full third-party lifecycle
- Prove adverse-action and fair-lending defensibility12
Executed prudently, this is the discipline that can allow a bank to defensibly deploy AI in credit, which is the difference between compounding innovation and efficiencies, and compounding risks or consumer harm that examiners will assess and cite.
Footnotes:
1: Office of the Comptroller of the Currency, OCC Bulletin 2026-29, (June 25, 2026).
2: Office of the Comptroller of the Currency, “Comptroller’s Handbook: Lending and Loan Portfolio Risk Management,” (June 2026).
3: Ibid. at 30 (Model Risk Management), and 27-28 (Automated Credit Approval Processes).
4: Ibid.
5: See supra note 1.
6: Id. at 30.
7: Id. at 31.
8: Office of the Comptroller of the Currency, OCC Bulletin 2026-13, Model Risk Management: Revised Guidance (Apr. 17, 2026), superseding OCC Bulletin 2011-12 / SR 11-7.
9: Office of the Comptroller of the Currency, OCC Bulletin 2026-13, Model Risk Management: Revised Guidance (Apr. 17, 2026), superseding OCC Bulletin 2011-12 / SR 11-7.
10: U.S. Department of Commerce, National Institute of Standards and Technology, “AI Risk Management Framework (AI 100-1)” (Jan. 2023), and “Artificial Intelligence Risk Framework: Generative Artificial Intelligence Profile (AI 600-1)” (July 2024); and Cyber Risk Institute, “Financial Services AI Risk Management Framework,” (n.d.).
11: U.S. Consumer Financial Protection Board, Consumer Financial Protection Circular 2022-03, “Adverse action notification requirements in connection with credit decisions based on complex algorithms”(May 26, 2022).
12: Ibid.
The views expressed herein are those of the author(s) and not necessarily the views of FTI Consulting, Inc., its management, its subsidiaries, its affiliates, or its other professionals.
Related Insights
Published
October 27, 2026
Key Contacts
Senior Managing Director
Managing Director
Managing Director