For fifteen years, SR 11-7 was the reference point for model risk management in US banking, and its influence reached well beyond the US. That changed in April 2026, when the Federal Reserve, OCC and FDIC issued SR 26-2, replacing SR 11-7 and the 2021 guidance on models used for BSA/AML compliance.

The UK now operates under a different, more recent framework of its own in the PRA's SS1/23. For firms with model risk teams in both markets, the two are close enough to share a common approach, but different enough to affect who you hire and how you structure the function.

What changed in the US

SR 26-2 keeps the core lifecycle of development, use, validation, monitoring and governance. Three changes stand out for hiring managers.

  • Tiering by materiality. Oversight now scales with each model's exposure and purpose. Lower materiality models may need only identification and monitoring. Higher materiality models need rigorous validation and effective challenge.
  • A narrower definition of a model. Simple spreadsheet calculations and deterministic, rules-based software without a statistical or financial underpinning fall outside the definition.
  • Generative and agentic AI are out of scope. The agencies describe these as novel and rapidly evolving. Firms are still expected to govern them under their own risk frameworks.

The guidance is aimed mainly at banking organisations with more than $30 billion in total assets.

How the UK compares

The PRA's SS1/23 took effect in May 2024. It applies to UK banks, building societies and PRA-designated investment firms with internal model approval for credit, market or counterparty credit risk capital. It sets five principles: model identification and classification, governance, development and use, independent validation, and model risk mitigants.

Two points of contrast are worth noting. SS1/23 brings AI and machine learning techniques within its principles where they are used in modelling, while SR 26-2 places generative and agentic AI outside its scope. And SS1/23 places strong emphasis on senior accountability, with a clear expectation that model risk is owned at board level.

What this means for your team

In the US, the immediate work is reclassification. Teams need to revisit their inventories, tier models against the new materiality criteria and evidence those decisions. That calls for experienced model risk managers who can make defensible judgements at speed, rather than adding validation headcount alone.

In the UK, demand continues to centre on independent validation and governance, particularly at firms preparing for Basel 3.1 recalibration in 2027. Candidates who can validate machine learning models and explain them clearly to non-technical committees are increasingly valuable.

"Since SR 26-2, most of my conversations with US clients have been about inventory and tiering," says Connor Nurse, who covers the US market for Broadgate. "Firms want someone senior who can make those calls and explain them to examiners. That profile is harder to find than another validation analyst."

"The hardest profile to secure in the UK is a validator who understands machine learning models properly and can explain them to a risk committee," says Declan Stark, who covers the UK market for Broadgate. "There are plenty of strong statisticians and plenty of good communicators, but far fewer people who are both."

What to look for when hiring

The strongest model risk professionals combine three things: technical depth in the model types they review, the confidence to provide effective challenge to senior model owners, and the ability to write documentation a supervisor will accept. For cross-border teams, add a fourth: fluency in both frameworks, so the function can apply one consistent standard while meeting each regulator's expectations.

Titles vary widely across markets, from model validation analyst to model risk officer to quantitative analyst. Briefs built on the work itself, rather than the title, will reach a much stronger candidate pool.

How Broadgate can help

Broadgate places risk and model risk professionals for regulated firms in the UK and, through our Boston office, in the US. For current UK pay benchmarks across model risk and validation roles, see our Risk UK Salary Guide.