SR 26-2: The Governance Gap in AI-Powered KYC

On April 17, 2026, the Federal Reserve, the Office of the Comptroller of the Currency, and the FDIC jointly issued SR 26-2 — the first overhaul of model risk management guidance for U.S. financial institutions in fifteen years. The guidance replaces SR 11-7, a document written before machine learning was deployed in production banking systems, before foundation models existed, and before the term "generative AI" appeared outside academic papers.

The timing was unmistakable. Banks, credit unions, and fintechs in 2026 depend on AI for credit underwriting, fraud detection, BSA/AML screening, and customer onboarding. Regulators were fifteen years overdue to update the framework. SR 26-2 is technically sophisticated, operationally rigorous — and then, in one explicit clause, it draws a line around precisely the AI systems that are changing banking fastest.

Generative and agentic AI are excluded from scope.

That exclusion is the compliance gap that every institution running AI-powered KYC must now account for.

What SR 26-2 Actually Covers

SR 26-2 preserves and extends the discipline that SR 11-7 established. It applies to quantitative models used for consequential decisions: credit scoring, market risk, regulatory capital, fair lending analysis, and rules-based BSA/AML transaction monitoring. The requirements are substantive:

• Model validation by independent teams with documented methodologies
• Ongoing monitoring with defined performance thresholds and alert triggers
• Complete model inventory, including models used for regulatory reporting
• Conceptual soundness review, data quality governance, and change control
• Defined escalation paths when model performance degrades

These are the correct requirements for the systems they govern. A logistic regression model producing credit scores should be validated. A stress-testing engine for regulatory capital should face independent challenge. SR 26-2 codifies sound practice and tightens governance where SR 11-7 was ambiguous.

The gap is what it does not address.

The Explicit Carve-Out

SR 26-2 is unambiguous. The guidance states that generative and agentic AI "require separate governance frameworks" and are "placed outside the scope of this guidance." Institutions are directed to apply their existing risk management principles to govern these systems — meaning SR 11-7-era thinking applied to technology that did not exist when that thinking was developed.

The structural problem is that SR 11-7-era risk management was designed for systems that produce bounded, enumerable outputs from structured inputs. Generative and agentic AI operate differently:

• They generate outputs that cannot be fully enumerated in advance
• They reason across unstructured text, documents, and images
• Agentic systems take autonomous action sequences across multiple connected tools
• They change behavior based on context and prior conversation history
• They cannot be fully validated using traditional backtesting against historical labeled data

A June 2026 survey found that 72 percent of banks are unprepared for an AI failure. That statistic lands in a regulatory environment where the most consequential AI systems — the ones most likely to cause a visible failure — are the ones with no formal governance standard.

The KYC Stack That Lives in the Gap

Financial institutions have moved faster on generative and agentic AI in KYC than regulators anticipated. In a 2026 technology-forward institution, the verification workflow looks nothing like the statistical model inventory SR 26-2 was designed to govern:

KYC Function	System Type	SR 26-2 In Scope?
Credit scoring at onboarding	Statistical model	Yes
Document classification and OCR	Traditional ML	Depends
Adverse media screening	LLM-based summarization	No
PEP and sanctions analysis	Generative AI synthesis	No
Rules-based transaction monitoring	Structured model	Yes
Agentic ongoing monitoring	Agentic AI workflow	No
SAR narrative generation	Generative AI	No
Customer risk re-scoring	LLM with retrieval augmentation	No

The decisions most exposed to hallucination, inconsistency, and regulatory scrutiny — adverse media synthesis, PEP analysis, agentic re-scoring, SAR narrative generation — all fall outside SR 26-2 scope. They have no validated documentation standard, no required monitoring threshold, no mandated independent challenge process.

What Regulators Expect Despite the Carve-Out

The exclusion from SR 26-2 scope does not mean regulators are indifferent to how banks govern these systems. The guidance's own language signals what examiners will ask: "existing risk management principles — materiality, ongoing monitoring, effective challenge — should guide governance for any tools and systems outside this document's scope."

That sentence carries weight in examination contexts. Bank examiners are not bound by SR 26-2's formal scope when they observe that an institution's agentic KYC system generates SAR narratives without documented review criteria, or that an LLM-based adverse media tool produces inconsistent risk assessments with no monitoring in place.

There is also the EU dimension. Under the EU AI Act — whose high-risk AI provisions apply to biometric identification, credit scoring, and fraud detection regardless of the timeline changes introduced by the EU Digital Omnibus — institutions operating in Europe face legally binding requirements for technical documentation, human oversight, and post-market monitoring. An institution claiming governance maturity to EU regulators while running ungoverned agentic AI in its US book faces a credibility problem that spans jurisdictions.

The OCC Inventory Problem

Regulatory exposure is not only prospective. OCC examination findings from early 2026 found that most US banks have only partial AI inventory coverage, with self-learning models and agent-orchestration layers frequently missing from the inventories submitted to examiners.

This creates compounding risk. Under SR 26-2, a complete inventory for in-scope systems is mandatory. But because generative and agentic systems sit outside scope, institutions have had no formal obligation to inventory them. The practical result: many cannot answer the most basic governance question — which AI systems are making consequential KYC decisions?

The continuous monitoring approach that AMLA and EU regulators increasingly expect is not achievable if institutions cannot enumerate the AI systems doing the monitoring. Inventory is not a governance endpoint; it is the prerequisite for every other control.

What a Parallel Governance Framework Looks Like

The discipline SR 26-2 brings to quantitative models — validation, documentation, monitoring, independent challenge — represents a sound template that institutions should extend to their generative and agentic AI voluntarily, before formal guidance compels it. Several SR 26-2-compatible frameworks for GenAI in banking were published in the months following the April guidance, including an academic framework from a Federal Reserve-affiliated research group.

A minimum viable governance structure for generative and agentic AI in KYC should include:

AI inventory and risk classification. Every AI system contributing to a KYC or AML decision must be enumerated and classified by risk level. Agentic systems that orchestrate other tools require separate treatment from static models.

Behavioral documentation. Generative AI cannot be documented via coefficient tables. Documentation should capture intended use cases, known failure modes, prohibited output classes, and conditions requiring human review.

Output auditing. Every consequential output — adverse media assessment, risk score, SAR narrative — must be logged with enough context to reconstruct the AI's reasoning path. This is not optional for systems contributing to regulatory reporting.

Human-in-the-loop thresholds. Define conditions under which agentic decisions require human review before action. Agentic KYC workflows built with explicit escalation protocols address this requirement directly — and demonstrate to examiners that oversight is exercisable, not theoretical.

Performance monitoring adapted to generative outputs. Gini coefficients and KS statistics do not apply to generative AI outputs. Monitoring frameworks must assess consistency, factual accuracy on verifiable claims, and output variance across different input contexts.

Third-party AI governance. The principle that SR 26-2 extends to third-party models applies equally to GenAI. Institutions using vendor-provided LLMs or agentic systems in their KYC stack should obtain equivalent documentation from vendors and assess it with the same rigor applied to in-house systems.

The Agentic Problem Is Harder Than the Generative Problem

Generative AI introduces unpredictability at the output layer. Agentic AI — autonomous systems that execute action sequences across multiple connected tools — introduces unpredictability at the action layer.

An agentic KYC system might retrieve transaction history, query an adverse media database, assess a sanctions match, update a risk score, and trigger an alert — all without human intervention. Each step creates governance questions that no existing framework cleanly resolves. Which step is the "model"? What is the output being governed? How is failure defined when all individual steps complete correctly but the reasoning across steps is flawed?

The Know Your Agent (KYA) framework captures one dimension of this — validating that the agent acting in a financial context is authorized and traceable. But KYA addresses identity, not governance. SR 26-2's gap is the governance of what the agent does, not only who the agent is.

Joinble's approach to autonomous KYC agents embeds audit trails, escalation logic, and human oversight checkpoints into the agentic architecture itself — rather than treating governance as a layer applied after deployment, when the operational patterns are already fixed.

The Liability Did Not Move with the Carve-Out

SR 26-2's exclusion of generative and agentic AI from scope does not transfer liability to regulators or establish a safe harbor. Banks remain responsible for the outcomes of every AI-driven decision in their KYC and AML workflows, regardless of whether those systems appear in the formal model inventory.

If an agentic KYC system generates a false-negative on a sanctions match, the enforcement action does not reference SR 26-2. It references BSA obligations, OFAC requirements, and the institution's failure to maintain adequate controls — regardless of how those controls were classified internally.

The carve-out creates a documentation gap, not a liability gap. Institutions that treat exclusion from scope as permission to proceed without governance are building exactly the kind of control failure that BSA/AML enforcement actions are designed to address.

---

Frequently Asked Questions

What is SR 26-2 and when did it take effect?

SR 26-2 is joint model risk management guidance issued by the Federal Reserve, OCC, and FDIC on April 17, 2026. It replaces SR 11-7 — the prior guidance, issued in 2011 — and is the first comprehensive update to model governance requirements for U.S. financial institutions in fifteen years.

Why are generative AI and agentic AI excluded from SR 26-2?

The guidance states that generative and agentic AI require separate governance frameworks and places them outside its scope. Regulators acknowledged that the validation methodologies developed for quantitative statistical models — backtesting, performance benchmarking against labeled outcomes — are not directly applicable to systems whose outputs cannot be fully enumerated. Specific guidance for these systems has not yet been issued.

Does SR 26-2 exclusion mean generative AI in KYC is unregulated?

No. Institutions remain subject to BSA/AML obligations, OFAC sanctions requirements, fair lending laws, and supervisory expectations regardless of SR 26-2 scope. Bank examiners assess AI governance under existing supervisory authority. The exclusion creates a documentation gap, not a liability gap.

What should banks do now about governance for generative AI in KYC?

The most defensible path is to build an SR 26-2-style governance framework for generative and agentic AI — inventory, behavioral documentation, output auditing, and independent challenge — before formal guidance requires it. This positions institutions as early movers when specific requirements arrive and gives them a credible answer to examiner questions in the interim.

How does SR 26-2 interact with EU AI Act requirements?

EU AI Act high-risk AI requirements — covering biometric identification, credit scoring, and fraud detection — apply to institutions operating in Europe regardless of SR 26-2 scope. The EU Digital Omnibus extended some deadlines to December 2027, but transparency obligations under Article 50 are already enforceable. Institutions serving both US and EU markets need a framework that satisfies both sets of expectations simultaneously.

What is the practical first step for an institution with ungoverned AI in its KYC stack?

Build the inventory. Enumerate every AI system — including generative and agentic systems — that contributes to any KYC or AML decision. Classify each by risk level and assign an owner. This step reveals actual governance exposure and makes every subsequent remediation effort tractable. An institution that cannot produce its AI inventory in an examination context is starting from a materially weaker position than one with a documented, if imperfect, governance program.