When was SR 26-2 issued?

On April 17, 2026, jointly by the Federal Reserve, the OCC, and the FDIC.

Does SR 26-2 replace SR 11-7?

Yes. SR 26-2 supersedes SR 11-7, the 2011 model risk guidance, as well as SR 21-8, the 2021 statement on models supporting anti-money laundering compliance.

Does SR 26-2 apply to my bank?

It is expected to be most relevant to banking organizations with more than $30 billion in total assets. Smaller banks are generally expected to manage models through internal practices suited to their size, although the guidance may still apply to those with significant model risk.

Does SR 26-2 apply to FinTech companies?

Not directly, because it is addressed to banking organizations. FinTech companies that partner with banks may still find that their bank partners expect similar governance over models and critical spreadsheets.

Does SR 26-2 cover AI?

Partly. Traditional statistical models and non-generative machine learning are in scope. Generative and agentic AI are not, because the agencies consider them too new and fast-moving for this guidance.

Are spreadsheets exempt from SR 26-2?

Simple spreadsheet calculations are excluded from the definition of a model. A spreadsheet that applies statistical, economic, or financial theory, such as a credit scoring model built in Excel, can still be a model.

In financial services, end-user computing (EUC) risk is the risk created by tools that business users build and maintain themselves, most often spreadsheets, outside formal IT controls. It's different from the IT meaning of end-user computing, which refers to desktops and devices.

Do spreadsheets still need SOX controls?

Yes, if they support financial reporting at a publicly traded company. Those spreadsheets remain part of internal control over financial reporting under the Sarbanes-Oxley Act, whatever model risk guidance says about them.

SR 26-2 Explained: What It Means for Your Spreadsheets

Almost every bank and financial company has one: a spreadsheet that runs a critical process, that several teams depend on, and that only one or two people truly understand. For years, many institutions governed files like these as models. In April 2026, US regulators changed the rules.

The new model risk guidance, SR 26-2, says simple spreadsheet calculations are no longer models. That sounds like good news, and in some ways it is. But it leaves finance and risk leaders with a new question: if these spreadsheets aren't governed as models anymore, who governs them, and how?

This guide answers that question in plain language.

SR 26-2 in 60 seconds

What it is: the new US guidance on model risk management, issued on April 17, 2026, by the Federal Reserve, the OCC, and the FDIC. It replaces SR 11-7, the guidance banks had followed since 2011.
Who it's for: mainly banks with more than $30 billion in total assets.
The spreadsheet change: simple spreadsheet calculations are no longer considered models. Complex models built in Excel still are.
What hasn't changed: an error in a business-critical spreadsheet can still distort reports, decisions, and audits.
What to do now: for each critical spreadsheet, decide whether to control it better or replace it with a governed system.

SR 26-2 summary: what it is, who it applies to, and what changed for spreadsheets.

What is SR 26-2?

SR 26-2 is the revised US guidance on model risk management, issued April 17, 2026, by the Federal Reserve, the OCC, and the FDIC. It explains how banks should manage the risk of relying on models: the quantitative tools behind credit decisions, forecasts, and risk estimates.

The Federal Reserve published it as SR 26-2, the OCC as Bulletin 2026-13, and the FDIC as FIL-15-2026. It is guidance, not a regulation, but regulators can still act when weak model management leads to unsafe practices.

What changed from SR 11-7?

The short version: SR 26-2 is narrower, more risk-based, and clearer about what doesn't count as a model.

Comparison of SR 11-7 and SR 26-2 model risk guidance

	SR 11-7 (2011)	SR 26-2 (2026)
What counts as a model	Broad definition with no explicit exclusion for spreadsheet calculations	Complex quantitative methods only; simple spreadsheet arithmetic and fixed rule-based software are excluded
How much oversight	Expected to scale with risk, but less explicit about how	Oversight explicitly scaled to each model's materiality, based on how much it affects the business and what it's used for
Main audience	Banking organizations supervised by the agencies	Mainly banks with more than $30 billion in total assets
Artificial intelligence	Written before today's AI tools	Traditional machine learning in scope; generative and agentic AI out of scope for now
Anti-money laundering models	Covered separately by SR 21-8	Covered here; SR 21-8 is superseded

Are spreadsheets still covered by model risk rules?

Only some of them. SR 26-2 says the term model "excludes simple arithmetic calculations, such as those found within spreadsheets." What counts is what the spreadsheet calculates, not the fact that it's a spreadsheet.

If a workbook applies statistical, economic, or financial theory to produce estimates, it can still be a model, even though it lives in Excel. If it adds, multiplies, or applies fixed formulas to inputs, it isn't.

Probably still a model	Probably no longer a model
A credit scoring model built in Excel	A template that totals loan balances by region
A loss forecast using statistical methods	A reconciliation workbook comparing two reports
A pricing model based on financial theory	An allocation sheet applying fixed percentages

The second column is where most spreadsheets sit, and it's the column this article is about.

If spreadsheets are out of scope, why should a CFO still care?

Because the guidance changed the label, not the risk. A spreadsheet error that reaches a regulatory report, a financial statement, or a lending decision costs the same whether or not anyone calls the file a model.

Three obligations stay in place:

Your own governance still has to cover it. SR 26-2 says that for tools it doesn't cover, an institution's own risk management and governance practices should decide the right controls.
SOX still applies. At publicly traded companies, spreadsheets that feed the financial statements are part of internal control over financial reporting under the Sarbanes-Oxley Act.
Regulatory reports still have to be right. A spreadsheet behind a filing carries the same accuracy expectations as any other reporting system.

Spreadsheet failures are rarely dramatic. They build up quietly, and ProCredit Bank's experience is typical. When new regulations in 2019 required banks to report non-financial indicators across their loan portfolios, the group, which operates in more than ten countries across Europe and Latin America, built Excel templates to calculate the environmental impact of its green loans. At first, they worked. Then the portfolio grew. New staff couldn't follow the formulas, version conflicts led to lost data, manual input caused calculation errors, and every rule change made consistency harder to keep. None of those problems depended on whether anyone called the templates a model.

How do you know a spreadsheet has become business-critical?

Ask what happens if it's wrong. If an error would reach a customer, a regulator, an auditor, or a major decision before anyone caught it, the spreadsheet is business-critical, however simple it looks.

A quick five-question test:

Does it feed a regulatory, financial, or customer-facing report?
Does it drive lending, pricing, investment, or capital decisions?
Do several people or teams rely on it?
Would you be stuck if the one person who understands it left?
Do its rules change often, for example after new regulations?

One yes means the spreadsheet deserves basic controls. A yes to either of the first two questions, or three yes answers in total, means it's working as a production system and should be governed like one.

Should you fix the spreadsheet or replace it?

Keep and control a spreadsheet when it's stable, owned by one team, and rarely changes. Replace it when keeping it safe has become a job in itself: several teams depend on it, rules change often, volumes keep growing, and auditors need to see who changed what.

Keep it and add controls if...	Replace it with a governed system if...
One owner and a small group of users	Several teams depend on it
The rules rarely change	The rules change after every regulatory update
Volumes are stable	Volumes, entities, or file copies keep growing
A manual check catches errors	Auditors need a full record of who changed what
Maintaining controls takes little time	Maintaining controls has become a workload of its own

Most of your answers in the right-hand column? See how ProCredit replaced its Excel templates in the ProCredit case study, or explore our work for banks and financial companies on the Financial Sector page.

What good spreadsheet controls look like

Banks often call this discipline end-user computing (EUC) risk management, meaning governance of tools that business users build themselves. In practice, the essentials are simple:

One named owner and one master file, not copies circulating by email.
Locked formulas, with only the input cells editable.
Validation that rejects inputs outside expected ranges.
A written explanation of the logic that someone other than the author can follow.
A second person reviewing changes, and a backup that has actually been tested.

Five essential end-user computing controls for business-critical spreadsheets

Why spreadsheet replacements often fail

People keep spreadsheets because they can change the logic themselves, quickly. A new system that turns every rule change into an IT request will soon be bypassed by a new spreadsheet. A good replacement keeps that flexibility and adds the control the spreadsheet never had.

What does replacing a spreadsheet look like in practice?

A good replacement does what the spreadsheet did, with the control it lacked: one source of truth, a record of every change, access by role, and rules the business can still update itself. Two projects VOLO delivered show what that looks like.

ProCredit Bank: from Excel templates to a platform serving 100+ bank entities. After its green loan templates became hard to manage, ProCredit evaluated several off-the-shelf tools and found they lacked the flexibility and compliance features it needed. VOLO built EcoModule, a cloud-based platform for green loan assessments. Its calculation engine for CO2, energy, and water metrics is managed through an editable admin screen, so the bank can update rules after regulatory changes without waiting for developers. Access is role-based, inputs are validated at entry, configuration changes are audit-ready, and results flow into Power BI for reporting. EcoModule is live in Kosovo and Ukraine, with onboarding underway in more than ten countries. Read theProCredit case study.

Finance in Motion: one source of truth across five funds. The German impact asset manager, which advises on more than €5 billion in assets, ran five thematic funds with five different methodologies on spreadsheets, internal databases and workarounds. There was no single source of truth for impact data, and disclosures took time to prepare. Working with the firm's own developers, VOLO built Fimpact, a central platform with fund-specific logic, role-based permissions, built-in validation and version tracking for disclosures. Read theFinance in Motion case study.

Neither organization is a US bank subject to SR 26-2, but the problems they solved are the same ones US institutions now face with spreadsheets that sit outside model risk scope.

Build, buy or customize? What finance and operations leaders should ask

Start with off-the-shelf software if a product fits your process with little change. Consider a custom platform when your rules are specific to your business or your regulators, change often, or need to work across several entities with local differences. ProCredit reached that point only after evaluating off-the-shelf tools that lacked the flexibility and compliance features it needed.

	Off-the-shelf software	Custom platform
Best when	Your process is standard	Your rules are specific or change often
Time to start	Usually faster	Needs discovery and build time
Changing the rules	Depends on the vendor's roadmap	Designed around how you need to change them
Fit with your systems	Through the vendor's integrations	Built around your existing systems
Ownership	Licensed from the vendor	Typically owned by you, depending on the contract

Questions to ask a development partner

Whether you build or customize, these questions separate partners who understand regulated finance work from those who don't:

Will you map how our team actually works before proposing a solution?
How will our staff change calculation rules after launch, without waiting for developers?
How do you handle audit trails, access control, and data validation?
How will you prove the new system's results match the spreadsheet before we switch?
Will you train our people to run it, and support it after go-live?

What changes for your team

The biggest change is in roles. People who spent their time maintaining files become owners of rules and reviewers of results, working from one source of truth instead of reconciling copies. Adoption is easiest when the system is designed around existing workflows: EcoModule was built to fit ProCredit's current processes, reporting requirements, and compliance obligations, so staff could adopt it quickly without disrupting ongoing operations.

How do you move off a spreadsheet without breaking reporting?

Move in stages and prove the numbers match before switching. The goal is to change the tool without changing the answers, so people trust the new system from the first reporting cycle.

Pick the right spreadsheets. Use the five-question test above to decide which ones to replace, which to control better, and which to leave alone.
Map how the work really happens. Document the manual steps and workarounds, not only the formulas. On ProCredit's project, VOLO mapped workflows, regulatory requirements, and technical constraints with the bank's teams before building anything.
Turn formulas into documented rules. Write down every calculation, and use past inputs and results as test cases.
Build in short iterations. Deliver the core calculations first, then refine them with the people who use them.
Run old and new side by side. Produce results in both for at least one full reporting cycle and explain every difference.
Train the team, then retire the file. Make the old spreadsheet read-only so it can't quietly come back. VOLO also trained ProCredit's internal teams in business analysis and project management, so the bank could manage later rollouts itself.

Six steps for replacing a spreadsheet without disrupting reporting

For related reading, see our guides tofinancial process automation andautomated financial reporting.

The bottom line

SR 26-2 took most spreadsheets off the model risk list, but it didn't take them off your risk list. If you're reviewing your model inventory this year, use the same moment to ask a simpler question about every critical spreadsheet: control it, or replace it?

If some of your spreadsheets have outgrown their controls,talk to our engineers about which workflows to move first and how to do it without disrupting reporting. You can also see more of our work on the Financial Sector page.