T2
FHFA
Medium Confidence
Guidance
Model Risk Management Guidance
Enhanced model risk management oversight and validation standards for FHFA-regulated GSEs and FHLBs
HIGH
Impact Level
Top: model risk (5)
Classification
- Regulatory Program
- Model Risk Management
- Doc Type
- Guidance
- Effective Date
- 2026-09-29 (est.)
- Days to Action
- 75
- Comment Deadline
- —
- Published
- —
Urgency Basis
FHFA model risk management guidance typically requires implementation within 60-90 days for regulated entities
Operational Context
Flags
Examination Focus
Board Reporting Required
Model Validation Trigger
Legal Review Required
Affected Functions
Risk Management
Model Validation
Compliance
It/data Management
Internal Audit
Credit Risk
Market Risk
Institution Applicability
Federal Home Loan Banks
Fannie Mae
Freddie Mac
Fhfa-Regulated Entities
Impact by Category
Compliance
4
Operational
4
Data Governance
3
Model Risk
5
Reporting & Disclosure
3
Capital & Liquidity
2
Consumer Protection
1
Third-Party Risk
3
Key Requirements
- Establish comprehensive model risk management framework
- Implement enhanced model validation and testing procedures
- Maintain current model inventory with risk classifications
- Document model assumptions and data quality standards
- Conduct regular independent model validation reviews
- Report model performance and validation results to board
Scoring Rationale
High model risk score (5) reflects core regulatory focus requiring enterprise-wide framework changes. Compliance and operational scores (4) indicate significant policy and process updates needed. Moderate scores for data governance, reporting, and third-party risk reflect supporting requirements. Lower consumer protection score as guidance primarily targets internal processes.
AI Analysis Disclosure — This record, including its scores, impact assessments, and Advisory
Assessment (impact, risk, and recommended actions), was generated by an AI model and may contain errors or
omissions. The Advisory Assessment is a starting point for analysis, not a substitute for professional judgment.
Effective dates, applicability determinations, impact assessments, and any recommended actions should be
independently verified against primary regulatory source documents and reviewed by qualified compliance or legal
personnel before taking compliance action. This output does not constitute legal or compliance advice.