Under SR 26-2's own definition, most of a borrowing base calculation is not a model. The revised interagency guidance defines a model as a complex quantitative method that applies statistical, economic or financial theories to produce quantitative estimates, and then excludes simple arithmetic and deterministic rule-based processes by name. A borrowing base re-test is the second thing: it applies a credit agreement's formula — eligible investor, advance rate, concentration limit, availability — to facts, and produces an amount rather than an estimate. The part of Fund Finance Borrowing Base Monitoring most likely to fall inside the guidance is narrower and more interesting: the forward-looking stress a NAV facility's loan-to-value test rests on.
This guide is written for model risk managers and internal audit deciding whether a fund finance monitoring tool belongs in the bank's model inventory. It quotes the current text of the guidance and its covering letter. It does not and cannot tell you the answer for your institution: scope decisions belong to the bank's own model risk policy, and the guidance is explicit that it sets no enforceable standard at all.
What changed on 17 April 2026
2
earlier letters superseded: SR 11-7 on model risk management, and SR 21-8 on model risk for systems supporting Bank Secrecy Act compliance
15yrs
of supervisory experience and industry feedback the agencies say the revision reflects
$30B
the total-asset level above which the Federal Reserve expects the letter to be most relevant
0
enforceable standards the guidance sets — non-compliance brings no supervisory criticism
What SR 26-2 changed, and when
On 17 April 2026 the Federal Reserve, the Office of the Comptroller of the Currency and the FDIC issued revised guidance on model risk management, distributed by the Federal Reserve as SR 26-2. It "supersedes and replaces SR letter 11-7, Guidance on Model Risk Management (issued April 4, 2011) and SR letter 21-8, Interagency Statement on Model Risk Management for Bank Systems Supporting Bank Secrecy Act/Anti-Money Laundering Compliance (issued April 9, 2021)" (SR 26-2). Anyone whose model risk policy cites SR 11-7 by number is now citing a letter that has been withdrawn.
The substance of the change is direction rather than content. The agencies say they have updated the guidance "to clarify model risk management principles and to emphasize a risk-based approach to model risk management that is tailored to a banking organization's model risk profile and the size and complexity of its operations". For a fund finance desk that means the question is no longer whether a tool is technically within a definition, but whether the bank's response to it is proportionate to what it could actually get wrong.
Two things in the covering letter and the guidance set the frame before any analysis starts. The letter "is expected to be most relevant to banking organizations with over $30 billion in total assets regulated by the Federal Reserve", and the guidance itself states that it "does not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with this guidance will not result in supervisory criticism against a banking organization". Nothing below should be read as a rule a bank must follow. It is a reading of what a sound programme would ask.
The guidance's own definition of "model"
The definition is unusually precise, and unusually generous in what it rules out. It is worth reading in full before applying it to anything.
For the purposes of this guidance, the term "model" refers to a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates. The term "model" in this guidance excludes simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use.
Revised Guidance on Model Risk Management, issued with SR 26-2, 17 April 2026
Three tests sit inside that paragraph, and a method has to pass all three to be in scope. It must be complex and quantitative. It must apply a statistical, economic or financial theory. And its output must be an estimate — something that could have been otherwise, produced by a method that chose among possibilities. The second sentence then names two things that are out whatever else they look like: simple arithmetic, including spreadsheet arithmetic, and deterministic rule-based processes and software where no such theory underpins the design.
The last clause is the one that does the work in fund finance. A rule engine is deterministic: given the same inputs and the same rules it returns the same answer, every time, with no distribution behind it. That is not a statement about how sophisticated the software is. It is a statement about where the answer comes from — a contract, not a theory.
Is a borrowing base calculation a model under SR 26-2?
On the definition above, a subscription-line borrowing base calculation is a deterministic rule-based process and falls outside the guidance. The credit agreement supplies the formula: which investors are Included and which Designated, the advance rate for each class, the concentration limits, what constitutes an exclusion event, how availability is derived from the base and loans outstanding. The re-test supplies the facts: who has paid a capital call and how many business days late, who has been downgraded, who has transferred an interest. Apply the one to the other and the answer is determined.
Take the sample facility this solution runs on. Certificate 21 reports a base of $336,702,000. Re-testing it as of the loan date finds three changes: an investor twelve business days late on $8,000,000 of a capital call, an exclusion event that removes $15,300,000 at the 90% advance rate; a downgrade from A- to BBB that moves $7,602,400 out by shifting an investor into the Designated group at 65% and under a 5% cap; and a half-commitment transferred to a buyer with no approved investor letter, $3,825,000. The re-tested base is $309,974,600 and availability $28,474,600. There is no estimate anywhere in that chain. Every figure is a clause applied to a document.
Why the arithmetic is not an estimate: each rule carries its section
Two caveats keep this from being a blanket answer. The first is that a bank's own policy may define "model" more broadly than the guidance does, and many do — a definition that captures any tool whose output feeds a credit decision will capture this one. The guidance sets a floor for scope, not a ceiling. The second is that a deterministic process can still be wrong, and being out of scope for model validation removes none of the ordinary obligations: change control, testing, access control, and evidence that the rules in the tool match the rules in the agreement.
Where agentic AI sits — and where it doesn't
A reader's next question is usually whether using language models to read the documents changes the analysis. Under the current text, it does not bring the tool into scope, because the agencies have placed this class of technology outside the guidance altogether for now. A footnote to the revised guidance states that generative and agentic AI models "are novel and rapidly evolving" and, as such, "are not within the scope of this guidance", while adding that a banking organization's risk management and governance practices should still guide what controls are appropriate for any such tool.
That is a narrower statement than it is often read to be. It does not say these tools are low risk, and it does not say a bank may deploy one without controls; it says the model risk framework in this document was not written for them. For a fund finance desk the practical consequence is that the controls have to come from somewhere else: from how the tool is built, what it is forbidden to do, and what evidence it leaves. The seven roles and the limits on each is where that case is made in detail.
It also means the honest claim about any such tool is a modest one. No agency has published a standard for agentic tools in fund finance, so nothing can be certified against one. What can be shown is narrower: that reading is separated from calculating, that every rule cites its section, that the reading step may never alter a figure the fund reported, and that no step may approve anything.
The one part of this solution that probably is a model: the NAV stress
Subscription lines are the easy case. NAV facilities are not, and a model risk function that waves the whole tool through on the arithmetic argument will have waved through the part that most deserves a look.
A NAV facility's test is loan-to-value against draw-stop, cash sweep and default levels, and the solution runs it with 10% and 20% valuation haircuts applied. Taken literally, multiplying a valuation by 0.9 is arithmetic, and a fixed haircut chosen by the bank and held constant is a policy parameter rather than an estimate. So the stress calculation itself is probably outside the definition too.
What is inside is what the calculation stands on. The mark is the fund manager's estimate of a private asset's value, produced by someone else's method, and the choice of haircut is a judgement about how far that estimate could be wrong. A bank that uses the stressed loan-to-value to decide whether a facility is close to a draw-stop is using a forward-looking estimate of value to make a credit decision, whatever the arithmetic in the last step looks like. That is why the solution's monitor is forbidden to adjust a manager's mark or to accept one without its valuation source: the integrity of this test lives entirely in its input.
Two tests in one tool, and why only one of them raises a scope question
A subscription line re-test: The credit agreement: eligibility, advance rates, concentration limits, exclusion events, each with a section number.
A NAV facility's stressed loan-to-value: The credit agreement sets the levels; the bank sets the haircuts and decides which scenarios to run.
A subscription line re-test: Facts with documents behind them: a receipt in the pledged account, a rating notice, a transfer agreement.
A NAV facility's stressed loan-to-value: A manager’s valuation of private assets — itself an estimate, produced outside the bank.
A subscription line re-test: An amount. Given the same facts and rules, always the same amount.
A NAV facility's stressed loan-to-value: A forward view: what the ratio would be if value fell by 10% or 20%.
A subscription line re-test: A deterministic rule-based process; the definition excludes these by name.
A NAV facility's stressed loan-to-value: The arithmetic is deterministic, but it rests on an estimate and a judgement about how far it could be wrong.
A subscription line re-test: Control it as software and as rule change management, not as a model.
A NAV facility's stressed loan-to-value: Decide scope deliberately, document the reasoning, and control the valuation input whatever the answer.
What a risk-based, tailored programme means for a facility of this size
The guidance's emphasis on proportionality is the part most useful to a fund finance desk, because fund finance books are small in facility count and large in exposure. Sixteen facilities is a book one person can describe from memory; $400,000,000 on a single subscription line is not an amount anyone treats casually. A programme tailored to that profile spends little on validating arithmetic and a great deal on two things: whether the rules in the tool are the rules in the agreement, and whether the facts the rules are applied to are complete.
The guidance also sets an expectation for anything that is in scope once it is running. "Ongoing model monitoring involves an evaluation of the extent to which a model is performing as expected given potential changes in products, exposures, activities, clients, data relevance, or market conditions," it says, and the frequency and scope of monitoring reports "will depend on the nature of the model, the availability of new data or modeling approaches, and model materiality". For a NAV stress, "changes in … clients" and "market conditions" is not an abstraction: it is a fund whose portfolio has rotated into a sector whose marks have become harder to support.
Validating without pretending the arithmetic is a model
If a re-test is out of scope, the review that should replace a validation is a reconciliation review, and it is a more demanding exercise than it sounds. It asks three questions. Do the rules the tool applies match the executed credit agreement and every amendment to it? When the tool and a person disagree, who wins, and is the disagreement recorded? And can any figure in a re-test be walked back to the document it came from?
The last one is the only one a tool can answer structurally. In this solution every amount that leaves the base links to the account statement, rating notice or transfer agreement behind it and to the investor's record; every rule quotes its clause with the passage highlighted; and each report read, each re-test, each signature and each change to the bank's own thresholds is written to the audit trail with who, what and when, with threshold changes versioned. A reviewer sampling ten re-tests can therefore test the chain rather than the arithmetic.
The thresholds a reviewer will want versioned
The settings screen is where an awkward truth sits. A tool whose early-warning thresholds can be widened quietly can make a book look calm, and no amount of correct arithmetic compensates for that. The haircut pair used in the stress — 10% and 20% here, with 5%/10% and 15%/30% also available — is a parameter that materially changes a NAV facility's reported headroom. Whether or not the stress is in scope as a model, those three settings deserve change control of the kind a model's assumptions would get.
What to ask before you rely on a monitoring tool
The checklist below is ours, written for a model risk or internal audit reviewer meeting a fund finance monitoring tool for the first time. None of it is a regulatory requirement, and a bank whose own policy defines model more broadly will need more.
What model risk should ask to see
- The scope decision, written down and reasoned
Not "the vendor says it is not a model" but the bank’s own analysis against its policy definition and against the guidance’s exclusion of deterministic rule-based processes.
- A rule-to-clause map for one real facility
Every rule the tool applies, with the section of the executed agreement it came from, and evidence that amendments supersede correctly.
- A re-test walked back to source documents
Pick one change — a missed capital call, a downgrade, a transfer — and follow it to the account statement, the rating notice, the transfer agreement.
- The list of what the tool may never do
Alter a reported figure, adjust a manager’s mark, add an investor to a schedule, approve, move money, contact an investor. Then test that each is actually prevented.
- Versioning on thresholds and haircuts
Who changed the stress haircuts or the headroom warning, when, and what the reported position was before and after.
- The disagreement record
Where the tool and the fund differ, and where the tool and the analyst differ. A tool nobody ever overrides is either perfect or unexamined.
- The escalation path for an unreadable term
A definition the tool cannot resolve should stop and go to a person, not be approximated. Ask how often that has happened.
What none of this supports is a claim that the solution "passes" SR 26-2. There is nothing to pass: the guidance is not an enforceable standard, it sets no certification, and it expressly places agentic tools outside its own scope for now. The useful question a reviewer can settle is narrower and more honest — whether this tool's output can be traced, challenged and reproduced. To see the re-test, the clause citations and the audit trail on one facility, start from Fund Finance Borrowing Base Monitoring, or read how to pilot it on your own certificates before relying on it at all.
Questions people ask
What changed when SR 26-2 replaced SR 11-7?
SR 26-2, issued on 17 April 2026, supersedes SR 11-7 (2011) and SR 21-8 (2021) and is interagency: Federal Reserve, OCC and FDIC. The agencies describe the revision as clarifying model risk management principles and emphasising a risk-based approach tailored to each organisation's model risk profile and the size and complexity of its operations. It also carries an explicit definition of "model" with named exclusions.
Is a spreadsheet calculation a model under SR 26-2?
Not by itself. The guidance's definition says in terms that "model" excludes "simple arithmetic calculations, such as those found within spreadsheets", along with deterministic rule-based processes and software with no statistical, economic or financial theory underpinning their design or use. A spreadsheet that runs a regression or produces a forward estimate is a different matter — what is excluded is arithmetic, not the file format.
Does SR 26-2 cover agentic AI?
No. The revised guidance states that generative AI and agentic AI models are novel and rapidly evolving and are not within the scope of this guidance, while noting that a banking organization's own risk management and governance practices should guide what controls are appropriate. That is an absence of a framework, not a clearance: the controls have to be established some other way.
What size bank does SR 26-2 apply to?
The Federal Reserve's covering letter says it is expected to be most relevant to banking organizations with over $30 billion in total assets that it regulates, and the guidance adds that it may also be relevant below that level where an organisation has significant exposure to model risk. It is guidance throughout: non-compliance will not result in supervisory criticism.
Is a NAV facility's loan-to-value stress test a model?
It is the part of a fund finance monitoring tool most likely to be in scope, and the answer depends on where a bank draws its line. The haircut arithmetic is deterministic, but it starts from a manager's valuation of private assets — an estimate produced outside the bank — and the haircut itself is a judgement about how far that estimate could be wrong. Whatever the scope decision, the valuation input needs controlling.
What does model risk need to see before relying on a monitoring tool?
A written scope decision reasoned against the bank's own definition; a map from every rule the tool applies to the clause in the executed agreement; one re-test walked back to its source documents; the list of actions the tool is structurally unable to take; version history on thresholds and stress haircuts; and the record of where the tool has been overridden. Those answer the two ways a deterministic re-test actually fails: wrong rules, or incomplete facts.