Define the use
Finding a pattern is one task. Linking it to a rule is another. A compliance decision needs its own review. State what the method does and what happens when facts are missing.
Agree how records are handled
Start the discussion without customer records on this site. Before data is shared, agree where it will be held and processed. Set who can access it, how long it will be kept and how it will be deleted.
Work within the firm’s own systems can be discussed. Confirm the setup and controls for each scope.
Make the reasoning clear
Keep the link from source records to the proposed view, the relevant rule and the next step. Test other possible causes. Keep open questions clear when the facts do not resolve them.
Test what the method misses
Check reported findings and records left out. Review changes in data, business, places, products or the method itself. No technology should be assumed free of bias or risk.
Set the review and approval roles
A reviewer needs the records, skills, time and authority to challenge a result. Keep disagreements and the response on record. Check both reported findings and records left out. State who develops, reviews and approves the work. Independence must match those roles.
A synthetic example explains the method. It does not prove real-world performance. Test each intended use with authorized records in an approved setting. A tool used to suggest a pattern needs different checks from one used to rank or suppress cases.
Match oversight to the use
SR 26-2, issued April 17, 2026, replaced SR 11-7. It is supervisory guidance, not an enforceable standard. It is most relevant to banks with over $30 billion in assets, though it may also be relevant to smaller banks with significant model risk.
The guidance excludes generative and agentic AI. Its model definition also excludes simple calculations and deterministic rules without the specified theories. Tools outside its scope still need controls suited to their risk and use. Read the scope in sections I and II and footnote 3.
The Complaints Program Maturity Assessment opens on its own site. Get in Touch leads to the contact page, where you can select “Send us a message.” The worked example uses sample records. There is no complaint upload.
Read the privacy notice