For model risk management
The new guidance scoped agentic AI out. Your validation file still needs a chapter on it.
In April the Fed, OCC and FDIC replaced SR 11-7 and the 2021 BSA/AML model statement, and put generative and agentic AI outside the new guidance. An agent in the alert queue now falls to your bank's own risk management. Assay is built to give that process evidence: what ran, under which version, how often people agreed with it, and what it is not allowed to do.
What your week looks like now
A business line wants an agent in the queue. There is no guidance to validate it against.
April 17, 2026
SR 26-2, issued with OCC Bulletin 2026-13, supersedes SR 11-7 and SR 21-8, the interagency statement that tied BSA/AML systems to model risk management.1
Footnote 3
Generative and agentic AI models are “novel and rapidly evolving” and outside the guidance. Controls for tools it does not cover fall back to the bank's own risk management and governance practices.1
The definition of a model
Deterministic rule-based processes without statistical, economic or financial theory behind them are excluded. So the rules layer of a triage tool is not a model either. Neither half of the tool is covered.1
April 7, 2026
FinCEN's proposed program rule would have examiners consider whether a bank is employing innovative tools such as AI. Still a proposal at last check.2
Jobs it does for you
The validation questions, and where the answers come from.
Borrow the structure SR 26-2 uses for models in scope: conceptual soundness, outcomes analysis, ongoing monitoring, change control, documentation. I wrote up the full control set in SR 26-2 left agentic AI out of scope.
Know exactly what produced a recommendation
Every run records the agent identity, the provider, the model and the policy version, with the full investigation trace and token counts. Past runs keep the policy version they ran under, so a later change never rewrites history.
Assess conceptual soundness
The method is split on purpose. Typology checks (structuring, funnel, wires, payroll, seasonality) and the policy rules are deterministic code you can read and test. The model only assesses those findings and writes cited claims. The model risk documentation export describes inputs, method, controls and known limitations.
Run outcomes analysis before anyone relies on it
Shadow mode comparison (autonomy level L0) runs the agent on alerts your analysts decide, keeps its output hidden, and reports agreement, missed escalations (agent would close, human escalated) and over-escalations by alert type.
Monitor it once it is live
QA sampling pulls 10% of agent-assisted closes for a second reviewer by default. The metrics screen tracks QA agreement, the override rate and each alert type's progress toward its autonomy bar. Every override carries a reason code in the decision log.
Control change
Policy settings can be changed only by workspace owners and admins. Each save creates a new policy version and writes the before and after values to the hash-chained audit log. The agent has no path to change its own policy.
Hand effective challenge a document
The model risk documentation export produces a print-ready pack in 9 sections, filled from live policy, run and QA statistics, ending in a sign-off block.
What is versioned
Five things you will be asked to pin down, and one gap.
| Item | Where it is recorded | When it changes |
|---|---|---|
| Model and provider | On every run | When an owner or admin picks a different model in policy settings |
| Policy | Version number on every run; before and after values in the audit log | On every saved change to thresholds, autonomy levels or QA rate |
| Agent identity | On every run and every agent entry in the audit log | One identity per workspace |
| Decisions | Decision record and audit log, with reason codes on overrides | Each human action |
| System prompt | A short hash of the prompt template (for example p-3f9a1c2e) on every run, in the audit log and in the documentation pack | Only with a code release, the same for every workspace on that release |
Default thresholds, read from the policy code
- confidence floor for a close; below it the alert goes to human review
- 0.85
- watchlist name similarity that forces L2, whatever the model says
- 0.88
- fewer transactions than this and the agent abstains
- 8
- of agent-assisted closes sampled for QA by default
- 10%
- confidence floor for auto-close, at autonomy level L3 only
- 0.95
- QA agreement and sample an owner attests to before L3
- 98% on 2,000
Every value is a setting your policy owners can change, and every change is versioned. The L3 gate is an attestation by an owner or admin today, backed by the QA progress shown on the metrics screen; it is not yet an automatic lock.
Shadow mode comparison
Outcomes analysis on your own dispositions.
At L0 the agent runs on every alert of a type and nobody sees its answer. The comparison screen sets its calls against your analysts' and breaks the result down by alert type.
- Agreement rate on alerts the agent decided
- Missed escalations: agent would have closed, analyst escalated
- Over-escalations: agent escalated, analyst closed
- Share sent to human review by policy
Model risk documentation export
The pack, section by section.
Generated from the workspace's live policy, run statistics and QA results, as a standalone document you can print, sign and file.
- Purpose and scope
- Regulatory context
- Inputs and data lineage
- Method
- Controls
- Performance and monitoring
- Limitations and known risks
- Change management
- Sign-off
What Assay will not do for you
Hard limits, in code, not in the prompt.
A sentence in a system prompt is not a control. These four actions have no code path at all, which makes them testable: there is nothing to switch on. Autonomy above recommend is set per alert type, from shadow to auto-close, and never covers these.
- Filing or deciding not to file a SAR
- Clearing a sanctions or watchlist match
- Contacting a customer about an alert
- Changing its own policy or thresholds
What your validators will not find, because it does not exist yet
- No independent model validation and no third-party penetration test.
- No SOC 2 report. See the security page for the plan.
- No production alerts processed. The demo runs on 44 synthetic alerts.
Put it through your own challenge process first.
Design partners get the control documentation and source access for their model risk review, and a shadow-mode pilot before any analyst sees a recommendation.