SR 11-7 is guidance, not law — and why that distinction wins an audit
The supervisory guidance tier, and why calling it law reads as someone who does not know the difference.
SR 11-7 is the Federal Reserve letter every US bank model-risk program cites. It is not a statute. Calling it one is the fastest way to tell an examiner you do not know which tier you are in.
SR 11-7 is the supervisory letter from the Board of Governors of the Federal Reserve System on model risk management, issued jointly with the OCC as OCC 2011-12. It defines effective model risk management: model development, validation, governance, the three lines of defense. Every US bank examiner knows it by number. It is not a statute passed by a legislature; it is supervisory guidance — the force behind it is the examiner, not the courtroom. That distinction is not pedantic. It is the distinction an examiner uses to decide whether you understand the regime you operate in.
This post is about the supervisory tier specifically — the middle tier between binding law and voluntary frameworks — and why a defensible posture names it as guidance, not as law. We are pre-revenue, building the POC; the manifest we are building (BR-842) is designed for the binding tier first, but SR 11-7 is the regime most US model-risk teams actually live under day to day.
What supervisory guidance actually does
Supervisory guidance is enforced by the examiner, not by statute. The consequence of non-compliance is supervisory criticism — matters requiring attention, matters requiring immediate attention, enforcement actions — not a statutory penalty. That sounds weaker than law, and in the courtroom it is. In the examination room it is not: an examiner who cites SR 11-7 against you has the force of the supervisor behind them, and the supervisor can restrict your activities faster than a court can. The tier is real; it is just a different kind of real than a statute.
Why calling it law loses the room
An examiner who reads "we comply with SR 11-7 as required by law" has already marked the submission down. SR 11-7 is not required by law; it is expected by the supervisor. The difference is that a statute compels you and a supervisor expects you, and an examiner knows which word belongs to which. A posture that lumps them reads as someone who has not read the document they are citing. A posture that separates them — "SR 11-7 is supervisory guidance; we meet its expectations as follows" — reads as someone who has.
A statute compels you; a supervisor expects you. An examiner knows which word belongs to which — and so should your documentation.
What SR 11-7 reaches for that the manifest answers
SR 11-7 reaches for model development documentation, validation, and governance — the ability to show what the model does, that it does what it is supposed to do, and that someone is accountable. The per-output manifest answers the development-and-governance half concretely: the model version (hash-pinned), the input NodeVersions, the agent trace (which of the 23 A2A agents participated, in what order), the output, and a replay anchor. Validation is the calibration loop — shadow runs against ground truth, scored with Brier and log-loss via deino-eval — and that loop is gated (Gate 1b) before any accuracy is claimed. The manifest is the development record; the calibration loop is the validation record; together they map onto the three lines without being stretched.
- SR 11-7 is supervisory guidance, enforced by the examiner — not a statute, not voluntary.
- The manifest answers the development-and-governance half: model hash, inputs, agent trace, output, replay anchor.
- Validation is the calibration loop (Brier, log-loss, Gate 1b) — a separate record, not a manifest field.
- Naming the tier as guidance, not law, is itself a signal an examiner reads as competence.
The line that does not move
The manifest attests provenance and reproducibility, not truth. SR 11-7 expects you to know what your model does; it does not expect you to certify that the model is correct. The examiner who asks "is your model accurate?" is answered with "we measure accuracy against a disclosed baseline, and here is the calibration loop that produced the number" — not with a yes. A yes is a promise; a loop is evidence. The manifest is the record that lets you point instead of narrate; the calibration loop is the record that lets you measure instead of assert. We are building the POC; the manifest fields exist, and the calibration loop is inert until it is filled.
Supervisory guidance is the tier most model-risk teams live under, and the tier most compliance writing mislabels. Name it correctly and the rest of your submission reads as if someone read it first.
— US model-risk review note