SR 10-1 is the Federal Reserve supervision letter of January 11, 2010 that transmits the Interagency Advisory on Interest Rate Risk Management, issued with the FDIC, the NCUA, the OCC, the former OTS and the FFIEC State Liaison Committee. The advisory sets out what supervisors expect of interest rate risk management at banks, thrifts and credit unions: board oversight, written policies, earnings and economic value measures, stress tests of at least ±300 and ±400 basis points, documented and regularly updated assumptions, limits, and independent review with back-testing. It is still in force. Its most instructive use came in April 2022, when Silicon Valley Bank presented a gap assessment against it that found fundamental weaknesses; the Federal Reserve's own review says supervisors did not act on it. Botminds' Interest Rate Risk (IRRBB) Management is built around the advisory's assumption and review expectations.
Quotations come from the advisory, its 2012 FAQ and the Federal Reserve's April 2023 review of Silicon Valley Bank, each linked where it is used. The product example is the solution's fictional sample credit union.
One advisory, one bank, one year
2010
year the interagency advisory was issued; the Federal Reserve's SR 10-1 page shows no superseding letter
±400bp
the largest parallel shocks the advisory names, beyond the ±200 bp it says may not be enough
Apr2022
when SVB presented its own gap assessment against SR 10-1 to supervisors
Mar2023
when SVB failed, before a planned downgrade of its sensitivity rating was issued
What is SR 10-1?
SR 10-1 is a supervision and regulation letter from the Federal Reserve Board that distributes the 2010 Interagency Advisory on Interest Rate Risk Management to Reserve Banks and the institutions they supervise. The letter itself is short and says what the advisory is not: "The advisory does not constitute new guidance. It reiterates basic principles of sound IRR management that each of the regulators has codified in its existing guidance, as well as in the interagency guidance on IRR management issued by the banking agencies in 1996" (Federal Reserve, SR 10-1).
The advisory was written for a particular moment. It opens: "In the current environment of historically low short-term interest rates, it is important for institutions to have robust processes for measuring and, where necessary, mitigating their exposure to potential increases in interest rates" (Interagency Advisory, January 2010). The same sentence describes 2021 as well as it describes 2010. The OCC distributed the same text as Bulletin 2010-1, and the agencies answered common questions about it in a January 2012 FAQ, which the Federal Reserve sent out as SR 12-2 (OCC Bulletin 2010-1; SR 12-2).
Is SR 10-1 still in effect?
Yes. When we checked on October 27, 2026, the Federal Reserve's SR 10-1 page carried no note that it had been superseded, and the OCC's Bulletin 2010-1 was still posted; the 2012 FAQ remains the agencies' clarification of it. That is a contrast with the model risk guidance: SR 11-7 was replaced on April 17, 2026 by SR 26-2 (SR 26-2). For interest rate risk, the 2010 advisory is still the common text all the banking agencies and the NCUA signed.
The Federal Reserve's own review of Silicon Valley Bank noted the advisory's limits. Among the reasons supervisors failed to assess the bank's interest rate risk thoroughly, it listed "exams staffed with limited resources, high-level scope, lack of IRR regulations, and the high-level nature of existing guidance (SR letter 10-1)" (Federal Reserve, SVB review, April 2023). A high-level advisory puts more weight on the institution's own policy and evidence, which is the point of running a gap assessment against it.
What does the interagency advisory on interest rate risk require?
The advisory expects seven things: board oversight and annual review of policies and limits; comprehensive written policies; measurement of both earnings and economic value; stress testing beyond ±200 bp; documented, monitored and regularly updated assumptions; limits that prompt action; and internal controls with independent model validation, including back-testing. Each section is short, and each is a test an institution can run on itself.
The 2010 advisory, section by section
| Advisory section | What it expects | In its own words |
|---|---|---|
| Corporate governance | Board oversight; annual review of strategies, policies and limits; an ALCO with broad representation | Boards "should understand and be regularly informed about the level and trend" of the exposure |
| Policies and procedures | Explicit tolerances for earnings and capital, short and long term | "IRR tolerances articulated in an institution's policies should be explicit" |
| Measurement | Earnings and economic value; earnings simulations over at least two years | "economic value methodologies should also be used to broaden the assessment of IRR exposure" |
| Stress testing | Shocks beyond ±200 bp, non-parallel, basis and prolonged scenarios | "up and down 300 and 400 basis points" |
| Assumptions | Prepayments, deposit price sensitivity and decay, key rate drivers; changes documented | "document, monitor, and regularly update key assumptions" |
| Risk mitigation and limits | Limits that get prompt attention and are neither lax nor routinely breached | "positions that exceed certain predetermined levels receive prompt management attention" |
| Internal controls and validation | Independent review of assumptions, their process and back-testing | "An important element of model validation is independent review of the logical and conceptual soundness" |
What did SVB's SR 10-1 gap assessment find?
It found that the bank fell short of the advisory in five areas, and said so to its supervisors. The Federal Reserve's review says that in April 2022 the bank "presented a gap assessment against SR letter 10-1, highlighting fundamental weaknesses, such as limited scenarios, limited behavioral models", and goes on to list late reporting, poor data quality with weak controls over it, and little formal governance or review of the results. Supervisors recorded no concern at the time and changed neither the bank's ratings nor their plan for 2022, a point the BCBS 239 implementation guide quotes in full.
Still, the lack of controls and oversight demonstrate fundamental weaknesses in risk management that should have been communicated to SVBFG through an MRIA.
Federal Reserve, Review of the Supervision and Regulation of Silicon Valley Bank, April 2023, on the interest rate risk findings of the 2020 and 2021 exams
The same month, the review says, the bank lengthened the duration it assumed for its deposits on weak support, which reduced the interest rate risk its model reported without changing the balance sheet; that change and the deposit study behind it are discussed in the core deposit study guide. Read together, the two events of April 2022 are the whole lesson: an institution can identify its own gaps against the advisory and, in the same quarter, use the weakest of them, assumption governance, to improve its reported numbers.
The table maps each weakness to the advisory section it falls under, and turns it into a question any institution can ask itself. The last two rows come from the review's wider findings rather than the gap list.
SVB's gap list against SR 10-1, turned into a self-assessment
| Weakness found | Advisory section | Ask of your own institution | Evidence that answers it |
|---|---|---|---|
| Limited scenarios | Stress testing | Do we run ±300 and ±400 bp, and non-parallel, basis and prolonged scenarios? | The scenario list in the policy and the last four quarters of results |
| Limited behavioral models | Assumptions | Is each key assumption supported by our own data and back-tested? | An assumption register: assumed against observed, with dates |
| Lack of timely reporting | Corporate governance | Does the board see level and trend at least quarterly, with the assumptions behind them? | Board and ALCO packages and minutes |
| Data quality issues and limited controls | Internal controls | Are model inputs reconciled to the general ledger every run? | Tie-outs with differences stated |
| Limited formal governance and review of results | Internal controls and validation | Is there independent review of assumptions and back-testing, reported to the board? | The independent review report and its follow-up |
| Only NII in the board's risk appetite | Measurement; policies | Do we limit both earnings and economic value? | The limit table, with EVE or NEV limits |
| Assumption changed in response to a limit breach | Assumptions | Are assumption changes reviewed and approved before use, with their effects identified? | Change memos, validator decisions and ALCO approvals |
From first breach to failure in six years, step by step
The review shows the gap assessment was neither the first warning nor the last. Breaches of the bank's long-term interest rate risk limits went back to 2017; internal audit had findings on data inputs, model governance and the NII position from December 2020; examiners noted deficiencies in the 2020, 2021 and 2022 examinations without issuing findings. A supervisory finding on the bank's interest rate risk simulations came only in November 2022.
SVB's interest rate risk history, 2017 to March 2023, against what the advisory asked
| When | What the review describes | What the 2010 advisory asked |
|---|---|---|
| 2017 onward | Long-term IRR limits breached on and off; the board's risk appetite set limits on NII only | Limits that receive prompt management attention; both earnings and economic value measured |
| 2020 and 2021 | Deficiencies noted in examinations without findings; internal audit findings on data inputs, model governance and the NII position from December 2020 | Independent review of assumptions and back-testing, with follow-up on corrective actions |
| January 2022 | A longer deposit duration assumption discussed, not aligned with the bank's own experience | Assumptions supported by historical and forward-looking analysis |
| March to July 2022 | Hedges protecting against rising rates removed | Hedging strategies the board understands, designed to limit downside exposure |
| April 2022 | Deposit duration assumption lengthened; gap assessment against SR 10-1 presented | Changes to assumptions and their effects documented and clearly identified |
| Fall 2022 | Management finds the IRR models unreliable; a matter requiring attention on IRR simulation follows in November | Validation as a fundamental part of internal controls |
| November 2022 to March 2023 | A downgrade of the sensitivity rating planned but not issued; the bank is closed on March 10, 2023 | Corrective action where risk management or exposure is weak |
The review's description of the April 2022 change is specific. Earlier that year the bank "discussed increasing the duration of its deposit assumptions. The proposed change was not aligned with SVBFG's actual experience." The change went ahead in April; through 2022 the bank also removed hedges, the duration of its securities grew, deposits moved from non-interest-bearing to interest-bearing accounts, and its economic value measure breached its limit again. In the fall, management itself identified that the interest rate risk models were unreliable, and supervisors issued a matter requiring attention.
The rules for such findings have since changed. The OCC and FDIC final rule on matters requiring attention, effective November 2, 2026, uses a foreseeable rise in rates during 2022 as its own example of a vulnerability that could have justified an MRA; what the rule changes is set out in the guide to the OCC and FDIC MRA rule. Either way, an institution that waits for a finding to fix an assumption gap is relying on the step that failed here.
What stress scenarios does SR 10-1 expect?
The advisory expects scenarios large enough to reveal the risk: it says parallel shocks of ±200 basis points "may not be sufficient to adequately assess an institution's IRR exposure", and asks institutions to assess "changes in rates of greater magnitude (e.g., up and down 300 and 400 basis points) across different tenors to reflect changing slopes and twists of the yield curve." It lists four scenario types: instantaneous shocks, prolonged shocks, basis risk and yield curve risk.
Size changes the number of scenarios, not the requirement. Non-complex institutions "may be able to justify running fewer or less intricate scenarios", but "interest rate shocks of sufficient magnitude should be run, regardless of the institution's size or complexity." The 2012 FAQ answered whether shocks larger than ±300 bp are expected with "Generally yes", and asked that analyses of basis, yield curve and options risk be run "at least annually, or when the risk profile of the institution has changed" (Interagency IRR FAQ, 2012). SVB's own gap list began with "limited scenarios", and the review found that only parallel rate changes were modelled.
What are the SR 10-1 expectations for assumptions?
The advisory asks institutions to document, monitor and regularly update their key assumptions, and names a minimum set: "At a minimum, institutions should ensure the reasonableness of asset prepayments, non-maturity deposit price sensitivity and decay rates, and key rate drivers for each interest rate shock scenario." It singles out deposits as "critical, particularly in market environments in which customer behaviors may not reflect long-term economic fundamentals", and asks for "historical and forward-looking analyses to develop supportable assumptions."
Two further sentences describe what SVB did not do. "When actual experience differs significantly from past assumptions and expectations, institutions should use a range of assumptions to appropriately reflect this uncertainty." And "when assumptions are adjusted from prior reporting periods, the changes and their effects on model outputs should be documented and clearly identified." A deposit assumption lengthened against the bank's own experience, as the review describes, fails both. The test of whether assumptions still match experience is back-testing, which the back-testing guide works through assumption by assumption.
Interest Rate Risk (IRRBB) Management: every assumption, every quarter, with escalations
How is SR 10-1 different from SR 26-2?
SR 10-1 is about one risk, interest rate risk, and reaches every bank, thrift and federally insured credit union; SR 26-2 is about one tool, models, across all uses, and is aimed mainly at banks above $30 billion. The advisory was issued by all the banking agencies and the NCUA; SR 26-2 by the Federal Reserve, the OCC and the FDIC, without the NCUA. SR 26-2 states that it sets no enforceable standards and places generative and agentic AI outside its scope; how its narrower definition of a model sorts bank tools is discussed in the customer risk rating model guide.
The two overlap at validation. The advisory asks the independent reviewer to cover how reasonable the assumptions are, how they were set, and how they and the results were back-tested; SR 26-2 describes validation as conceptual soundness, outcomes analysis including back-testing, and ongoing monitoring. For an ALM model they point the same way, and the interest-rate-specific expectations remain the advisory's. The full validation picture is in ALM model validation under SR 26-2.
Does SR 10-1 apply to credit unions?
Yes. The NCUA is one of the issuing regulators, and the advisory's own footnote defines the institutions it covers to "include banks, saving associations, industrial loan companies, federal savings banks, and federally insured natural person credit unions." For credit unions, NCUA's rule at 12 CFR 741.3(b)(5) and Appendix A to Part 741 carry the same expectations into regulation for those above $50 million in assets: a written policy, reasonable and supportable assumptions, documented changes when observed behaviour moves, and internal controls (12 CFR Part 741).
Run the gap assessment on your own institution
A gap assessment against SR 10-1 is a short exercise if the evidence exists, and a revealing one if it does not. The useful version does not ask whether a policy mentions each section; it asks for the evidence that each expectation was met last quarter. SVB's list shows where to look first.
An SR 10-1 self-assessment in nine questions
- Did the board review the policy, the limits and the key assumptions in the last twelve months?
Minutes that show the assumptions, not just the limit table.
- Do we limit both earnings and economic value?
With limits for each shock, and headroom reported.
- Do we run ±300 and ±400 bp, plus non-parallel and basis scenarios?
At least annually for the less common ones, more often if material.
- Is every key assumption back-tested against our own data?
Prepayments, deposit decay and beta, and key rate drivers at a minimum.
- Were assumption changes reviewed and approved before the model used them?
With their effect on every limit documented and identified.
- Did any assumption change follow a limit breach?
If so, is the evidence for it independent of the breach?
- Are model inputs reconciled to the general ledger every run?
Differences stated, not just passed.
- Did someone independent review assumptions and back-testing, and report to the board?
And are their findings closed?
- Could we hand an examiner the evidence for each answer the same day?
If the answer takes a week to assemble, the gap is in the process.
In Interest Rate Risk (IRRBB) Management, most of the answers are exports rather than projects: the assumption register with every back-test, the change memos with the validator's decisions and ALCO's approvals, the tie-outs, and a trail of every action by a person or an agent. The sample credit union's examiner package carries each of them.
One trail of every action, exported for the examiner
Questions people ask
Who issued the 2010 interest rate risk advisory?
The Federal Reserve Board, the FDIC, the NCUA, the OCC, the Office of Thrift Supervision and the FFIEC State Liaison Committee. The Federal Reserve distributed it as SR 10-1 on January 11, 2010 and the OCC as Bulletin 2010-1; the advisory itself is dated January 6, 2010.
What is the 2012 FAQ on the interest rate risk advisory?
It is the agencies' January 2012 answers to common questions about the advisory, issued as SR 12-2 by the Federal Reserve and FIL-2-2012 by the FDIC. It covers choosing vendor models, shocks beyond ±300 bp, no-growth simulations, why vendor certifications do not satisfy validation, back-testing practices and deposit decay assumptions.
Does SR 10-1 require EVE?
It expects institutions to consider both earnings and economic perspectives, and says economic value methods should be used alongside earnings simulations because those have limits. It names EVE (and NCUA's NEV) as the common economic value measures but does not prescribe a single model.
What happened to SVB's sensitivity rating?
According to the Federal Reserve's review, SVB's CAMELS sensitivity to market risk rating was Satisfactory-2 from 2018 until a November 1, 2022 vetting planned a downgrade to Less-than-Satisfactory-3. The downgrade was not issued because the bank failed before the letter was sent.
How often should an institution assess itself against SR 10-1?
The advisory does not set a cycle for self-assessment, but it asks for annual review of policies and limits by the board and regular independent review of the measurement process. An annual gap assessment alongside the policy review, with evidence for each section, fits both.