Bank stress testing software is usually a model under the revised interagency model risk guidance of April 17, 2026 (Federal Reserve SR 26-2, OCC Bulletin 2026-13, FDIC FIL-15-2026), but not all of it, and not all of the time. The guidance defines a model as "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates," and excludes "simple arithmetic calculations, such as those found within spreadsheets." A CRE stress engine that values property by capitalization rate and estimates default probabilities applies financial and statistical theory; one that multiplies balances by loss rates the bank chose does not. The AI agents that read rent rolls and draft reports are outside the guidance's scope entirely. A buyer of stress testing software, including Botminds' CRE Concentration & Stress Testing, needs an answer for each part before the first board report, not one answer for the product.
What the 2026 model risk guidance changed for stress testing tools
$30B
the asset size above which the guidance is "expected to be most relevant"
0
enforceable standards: non-compliance "will not result in supervisory criticism"
Out
of scope: generative and agentic AI models, pending a promised request for information
Is stress testing software a model under SR 26-2?
It is when it applies statistical, economic or financial theory to produce estimates, which most CRE stress engines do somewhere. The test is in the definition, not in the label on the software. A tool that turns a capitalization rate and a net operating income into a value is applying the income approach to valuation, a financial theory. A tool that estimates a probability of default from loan-to-value and property type is applying a statistical one. Each produces a quantitative estimate that feeds a capital decision.
The same tool can contain parts that are not models. The guidance excludes "deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use." Dividing stressed income by debt service is arithmetic. Applying a board-approved 22% office income shock is a rule. A bank that classifies the whole product as a model will spend validation effort on arithmetic; one that classifies none of it will miss the parts that carry judgement.
What SR 26-2 says, in five provisions
Five provisions of the revised guidance decide how a community bank should treat its stress testing software. Each is quoted from the OCC's bulletin.
The SR 26-2 provisions that matter for a stress testing tool
| Provision | What it says | What it means for a stress engine |
|---|---|---|
| Definition | A model is "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates." | Valuation and default estimates are in; the bank decides which components meet it. |
| Exclusions | The term excludes "simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes." | Coverage ratios, loss-rate multiplication and fixed shocks are out. |
| Scope | "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." | Agents that read documents or draft reports need governance from elsewhere. |
| Size | The guidance "is expected to be most relevant to banking organizations with over $30 billion in total assets." | Smaller banks may still apply it where model risk is significant. |
| Force | It "does not set forth enforceable standards or prescriptive requirements." | A bank sets its own policy; examiners judge the result, not compliance with a checklist. |
The bulletin also carries forward a 2025 clarification for small banks: the OCC's model risk guidance "does not, and should not be interpreted to, require community banks to perform annual model validation." That is not a licence to skip review. It means the depth and frequency of review should match how much the bank relies on the tool and how much could go wrong.
Is a spreadsheet a model?
Usually not, under the 2026 definition, if it does arithmetic on inputs the bank chose. The OCC's own example stress test in Bulletin 2012-33 multiplies balances by two-year loss rates, adds pre-provision income and subtracts the result from tier 1 capital. That is the "simple arithmetic" the guidance excludes. The judgement lives in the loss rates, which the bank chooses and the board should see.
A spreadsheet can cross the line, though. One that fits a regression of loss rates on unemployment, or computes default probabilities from loan characteristics, is applying statistical theory whatever program it runs in. The question is what the calculation does, not whether it lives in Excel. The Federal Reserve's own CRE stress model is a logistic regression: a model by any definition, and, as a later section shows, a useful benchmark for what an interpretable one looks like.
Taking a CRE stress engine apart: which parts are models
Classify by component, not by product. A loan-level CRE stress engine has six parts, and they fall on different sides of the definition.
Six components of a loan-level CRE stress engine, against the 2026 definition
| Component | What it does | Our reading under SR 26-2 |
|---|---|---|
| Loan classification | Assigns each loan a property type, market and call report line | Rule-based: outside the definition. Test it by sampling against credit files. |
| Document reading | Extracts NOI, occupancy, lease ends and value from rent rolls, statements and appraisals | Done by AI agents: outside the guidance's scope. Needs its own controls. |
| Scenario shocks | Applies board-approved changes to income, value, vacancy and rates | Rules set by the board: outside the definition. The assumptions need board review. |
| Valuation under stress | Re-values property from stressed income and capitalization rates | Applies financial theory: inside the definition. |
| Default and loss | Decides which loans fail and projects loss given default | Inside if it estimates probabilities statistically; outside if it applies fixed rules such as "fails below 1.0x". |
| Report drafting | Writes the board report and proposes actions | Generative AI: outside the guidance's scope. A person reviews and signs. |
Read down the right-hand column and the governance work is clearer. Two components are models and need the familiar treatment: documented methodology, testing of outcomes, sensitivity to assumptions. Two are rules the board owns. Two are AI agents that the guidance has deliberately left for later, with the agencies planning "a request for information that addresses model risk management generally and considers, in particular, banks' use of AI, including generative AI and agentic AI and AI-based models."
Banks are taking a measured approach to the adoption of generative AI (genAI) and agentic AI, with usage generally limited to specific use cases with guardrails and human-in-the-loop accountability to manage risk.
OCC, Semiannual Risk Perspective, Spring 2026
How to validate a stress test model when the guidance does not require it
Validate it the way an examiner will read it: can the result be re-performed, does it behave sensibly when assumptions move, and does it agree with a simpler method in total? The OCC's CRE examination procedures have examiners judge both the quality and the results of a bank's portfolio stress testing (OCC, Commercial Real Estate Lending), so quality is judged whether or not the bank calls the engine a model.
Five tests a community bank can run on a CRE stress engine
- Re-perform a sample of loans by hand
Take ten loans across property types; recompute stressed income, debt service at refinance, value and loss from the source documents.
- Reconcile to a top-down check
Run the OCC's appendix B loss-rate method on the same date; explain any large gap by property type.
- Move one assumption at a time
Office values −25%, −35%, −45%: losses should rise smoothly, and the loans that fail should make sense.
- Look for extreme results
Loss given default near zero or above the balance, coverage on loans with no income, values above the last appraisal under stress.
- Compare with what happened
Where loans defaulted or were modified, did the engine flag them in earlier runs? Few banks have enough cases; record the ones there are.
For the agent components, the controls are different because the risk is different: not a wrong theory, but a wrong reading. The useful control is traceability. Every extracted figure should open to the page it came from, stale documents should be marked rather than silently used, and the agent should be unable to estimate a figure it could not find. The bulletin's warning on scope cuts both ways: the agents are outside the guidance, so the bank's own policy has to say how they are checked.
Interpretable by design: what the Fed's own CRE model teaches
The Federal Reserve's supervisory CRE loss model is a useful reference for any bank judging a vendor engine, because the Fed explains its choices. It projects default with a logistic regression on loan type, property type, loan-to-value, loan size and loan age and proximity to maturity, and it chose those variables partly because the coefficients are "readily interpretable" (Federal Reserve, Credit Risk Models).
It also shows how to handle a known weakness openly. The Fed found its regression underpredicts default for one group of loans, income-producing loans approaching maturity with debt service coverage below 1.2, "a typical minimum underwriting threshold," and rather than complicate the model it raises their projected default probability "by a factor of four." That is a documented overlay: a judgement, stated, sized and explained. A community bank engine should be held to the same standard. Rules such as "a loan fails below 1.0x coverage" or "loss is stressed value less 10% selling costs" are judgements too; what makes them acceptable is that they are written down, visible next to the result and approved by someone with the authority to approve them.
The opposite of this is the engine whose loss figure cannot be decomposed. If a vendor cannot show, for one loan, how income, rate and value moved and how the loss followed, the bank cannot validate it, and an examiner grading "quality and results" has nothing to grade.
What to look for in bank stress testing software
Look for what the board and the examiner will ask of the output, and for honesty about what the software does not do. The comparison below is how we would frame a vendor review.
Questions for a stress testing vendor, and the answers to expect
Ask: Is it bottom-up by loan, top-down by pool, or both?
A good answer: Loan-level by default, with a pool-level check, and the method written down.
Ask: Whose scenarios are they, and who can change them?
A good answer: The board's, versioned and dated; the software cannot change them on its own.
Ask: Can a number on the board report be traced to a loan and a document?
A good answer: Yes, in a click, for every loss and every failing loan.
Ask: Which loans does a higher refinance rate reach?
A good answer: Only those that mature or reprice inside the horizon.
Ask: Which components are models under SR 26-2?
A good answer: A component list, like the table above, with documentation for the ones that are.
Ask: What does AI do, and what is it not allowed to do?
A good answer: Reads and drafts; never invents an input, changes a limit or sends a report unsigned.
Ask: What does it not cover?
A good answer: A plain list: for example, the allowance calculation, non-CRE portfolios, enterprise interest rate risk.
Where CRE Concentration & Stress Testing sits on that list
In the solution, six agents divide the work. A loan tape reader classifies loans; an operating statement reader reads rent rolls, statements and appraisals and is not allowed to invent or estimate an income figure; a market data watcher keeps capitalization rates, rents and vacancy from the bank's own feed, each with its source and date; a concentration calculator and a stress tester apply the board's limits and scenarios to every loan; a report drafter writes the board report and proposes actions, which a person accepts or removes. Limits and scenario assumptions change only with board approval, and the Chief Credit Officer signs every report.
CRE Concentration & Stress Testing: the board's assumptions sit next to every result
Measured against the component table, the valuation and loss steps are the parts a bank's policy is most likely to call a model; the loss model is a setting (in the sample bank, 10% selling costs and 5% workout costs on the stressed value), and failure is a rule (coverage below 1.0x or loan-to-value above 100%), which keeps it interpretable. The reading and drafting agents are the parts the guidance leaves out of scope, and the solution's answer is traceability: each line of a loan's walk opens to the rent roll, statement or appraisal it came from. What the solution does not do is compute the allowance for credit losses, stress non-CRE portfolios, or run the bank's interest rate and liquidity tests; those stay where they are.
A run a reviewer can follow step by step
The method the engine follows is the one traced on a single office loan in loan level stress testing; for a bank deciding whether it needs software at all, what replaces the OCC stress testing tool compares the options, the free one included.
Questions people ask
Does model risk management apply to stress tests at community banks?
It can. SR 26-2 is "expected to be most relevant" above $30 billion in assets, but may be relevant to smaller banks with significant model risk. The OCC has also said its guidance does not require community banks to perform annual model validation; review should match reliance.
Is AI covered by model risk guidance?
Not generative or agentic AI, for now. The April 2026 guidance says those models "are not within the scope of this guidance" and promises a request for information on AI. Other AI and machine learning models that meet the definition are covered like any model.
What replaced SR 11-7?
SR 26-2, issued April 17, 2026 with OCC Bulletin 2026-13 and FDIC FIL-15-2026. It rescinded SR 11-7 and OCC Bulletin 2011-12, narrowed the definition of a model, excluded spreadsheet arithmetic and rule-based software, and stated that it sets no enforceable standards.
Is a stress test result a model output if the scenarios are judgement?
The scenarios themselves are assumptions, not models: a board choosing a 35% office value decline is applying judgement. The model question applies to what turns those assumptions into losses. Keeping the two apart lets the board own the scenarios and the reviewer test the engine.
Should a bank buy stress testing software or build it?
Build if the book is simple and the OCC's appendix B loss-rate method answers the board's questions. Buy, or build loan-level, when concentrations, maturities inside the horizon or office and construction exposure make the board ask which loans break. Either way, the bank owns the assumptions and the classification decision.