Defining Model Risk Tier: Not All Models Are Created Equal

How you classify a model determines how much governance it receives. Getting that wrong creates oversight gaps that persist until a regulator or an internal audit finds them.

Model risk tiering assigns a risk rating to each model in an institution's inventory based on its potential to cause harm if it fails or produces inaccurate outputs. Most financial institutions use three to five tiers, typically High, Medium, and Low, with some adding Critical or Minimal at the extremes. The assigned tier drives validation frequency, documentation depth, senior management visibility, and board reporting requirements.

Two factors dominate most tiering assessments: materiality and complexity.

Materiality measures the consequence of a model error on the business, its customers, or its regulatory standing. A credit scoring model decisioning $2 billion in annual loan approvals carries far greater materiality than a marketing response rate tool.

Complexity measures how difficult a model is to understand, validate, and challenge. A linear regression with a handful of variables is easier to interrogate than a gradient boosting ensemble trained on thousands of features. Opacity creates risk: the harder it is to explain an output, the harder it is to detect when something has gone wrong.

How regulators frame the requirement

Across jurisdictions, the principle is consistent: governance must be proportional to risk. Regulators differ in how prescriptive they are about the path to get there.

In the US, SR 11-7 established the foundation, and SR 26-2 (April 2026) updates it. Guidance requires a classified model inventory and expects that materiality and complexity visibly drive validation depth and cadence. It does not prescribe specific tiers but expects institutions to demonstrate and defend the connection between risk rating and governance intensity.

The PRA's SS1/23 takes a more structured approach. Firms must assign both a materiality rating and a complexity rating to every model, with frequency of use feeding into the complexity rating. A model running daily across thousands of transactions carries more inherent risk than one run quarterly for a limited internal purpose, even if both share the same underlying methodology.

The CBUAE's Model Management Standards require banks to submit their tiering methodology for regulatory review. Tiering is a supervisory deliverable, not just an internal governance document.

Canada's OSFI E-23, effective 1^st May 2027, introduces an explicit tiering requirement for the first time for its regulated entities and extends scope to AI/ML models, third-party vendor models, and decommissioned models that may still influence active decisions.

Two Approaches That Work in Practice

The two most widely used tiering methods are scorecards and decision trees.

A scorecard rates each model across fixed dimensions: financial impact, regulatory sensitivity, complexity, frequency of use, and data quality. Weights are applied to each dimension and aggregated into a composite score that determines the tier. The method produces consistent outputs and is auditable, but it can conflate low complexity with low risk, which is a calibration problem.

A decision tree routes each model through a branching sequence of questions. For example: does this model directly inform capital calculations? If yes, does it process over a defined financial threshold? If yes, it is High tier. Decision trees are faster to apply and tend to be more sensitive to the factors that carry the most governance consequence. They are also easier to manipulate if the branching questions are poorly designed.

The best frameworks combine both: a decision tree as the primary routing mechanism and a scorecard as a secondary check for borderline cases.

What Goes Into a Model Risk Score

Model risk scoring draws on a pre-defined set of parameters in the institution's model risk policy, using both quantitative and qualitative inputs to produce a score that maps to a tier.

The core parameters typically cover: usage (pricing, regulatory capital, risk measurement, customer analytics); impact (financial, business, and change-related consequences of failure); risk (financial and reputational damage potential); materiality (volume, context, and severity of use); complexity (data sources, assumptions, lines of code, input uncertainty); model interconnectedness (dependencies between primary and downstream feeder models); and regulatory risk (sensitivity to changes in law or regulation, usually associated with high-materiality classification).

The scoring process involves model owners, validators, and the MRM committee. It should distinguish between inherent risk, the risk embedded in a model's design before controls are applied, and residual risk, what remains after MRM policies and controls are factored in. Best practice anchors both to a target state risk score: a defined, measurable goal for aggregate model risk across the inventory that supports proactive tracking rather than reactive remediation.

Tier segmentation typically produces three to four categories, sometimes with notches within each tier for finer differentiation where the model population warrants it. The value of the exercise is not the number of tiers but the defensibility of the boundaries between them.

Case Study: Tiering on Paper vs. Tiering in Practice

A mid-sized regional bank operating across three jurisdictions undertook a full model inventory tiering exercise following SS1/23 implementation. With approximately 120 models in scope, the institution needed to move from informal, judgment-based classification to a structured, defensible framework. The project team, drawn from MRM, model validation, and risk governance, piloted both a scorecard and a decision tree on a subset of 20 models before selecting a methodology.

The scorecard rated each model across six dimensions: financial impact, regulatory sensitivity, complexity, frequency of use, data quality, and downstream dependencies. It produced consistent outputs but surfaced a calibration problem early: several models with material regulatory consequences scored Medium because their underlying methodology was straightforward. The scorecard was treating simplicity as a proxy for low risk.

The decision tree worked differently. Starting with regulatory impact, then financial exposure, then frequency and interconnectedness, it routed each model to one of three tiers: High, Medium, or Low. It separated the question of model complexity from the question of potential harm, a distinction the scorecard failed to make cleanly.

The team adopted the decision tree as the primary routing mechanism, with the scorecard retained as a check on borderline cases. Applied across the full inventory, the resulting distribution was 10% High, 40% Medium, and 50% Low. That distribution, concentrated at lower tiers with a defined high-risk cohort, reflects what well-calibrated frameworks typically produce. A distribution that is top-heavy or uniformly spread usually indicates the methodology is not discriminating on actual risk.

High-tier models received full validation cycles, enhanced documentation, and direct senior management visibility. Medium-tier models moved to structured but streamlined review cadences. Low-tier models were placed under automated monitoring with periodic attestation, releasing validation capacity for higher-risk work.

The exercise also identified two models not registered in the inventory that were functioning as inputs to a High-tier credit risk model. That interconnectedness risk would not have surfaced without a deliberate dependency mapping step built into the process.

The Road Ahead

AI / GenAI models are moving from pilots into production across financial institutions, and tiering frameworks designed for traditional statistical models are not keeping pace.

Conventional tiering criteria assume fixed inputs, documented assumptions, and stable outputs. Large language models and neural networks do not behave that way. Their outputs can shift as underlying data changes, and their behaviour is harder to characterise than the statistical models MRM frameworks were built around.

Regulators are responding, but not in an uniform or consistent manner. SR 26-2 takes the striking step of placing generative and agentic AI outside the scope of the guidance, treating them as too novel and fast-moving to govern under traditional MRM controls and directing institutions to their existing risk management practices instead; a request for information on AI is expected. SS1/23 explicitly references AI as a consideration but folds it as a sub-principle. OSFI E-23 brings AI models within tiering scope. The result is three different regulatory answers to the same question, and a live coverage gap in the US where generative and agentic systems fall between traditional MRM and a parallel framework that does not yet exist.

The exposure for institutions is twofold: misclassifying novel-but-conventional ML models by rating them too low because documentation is limited or methodology is unfamiliar rather than because actual risk is low; and leaving generative and agentic systems ungoverned because no framework formally claims them. Both failures share a root cause, allowing the maturity of the documentation to stand in for the level of the risk.

How Solytics Partners Can Help

Solytics Partners works with financial institutions across the US, UK, Canada, Europe, UAE, India, and Singapore to design and implement model risk tiering frameworks that are regulator-ready and operationally workable.

The MRM Vault platform supports centralized model inventory management with embedded tiering logic, whether scorecard-based, decision tree-based, or hybrid. It handles multi-jurisdiction frameworks, allowing institutions operating across multiple regulatory regimes to apply consistent methodology while accounting for local requirements. For the coverage gap that SR 26-2 leaves open, MRM Vault maintains a dedicated AI use-case inventory alongside the traditional model inventory, and Solytics' agentic governance capabilities extend oversight to generative and agentic systems that sit outside conventional MRM scope.

For institutions building a tiering process from the ground up, Solytics can design the criteria, build the scoring logic, and run an initial classification of the full model inventory. For more mature process, Solytics provides independent review and benchmarking against current regulatory expectations and peer practice.

References

Board of Governors of the Federal Reserve System, Office of the Comptroller of the Currency, and Federal Deposit Insurance Corporation (April 17, 2026). SR 26-2: Revised Guidance on Model Risk Management. The Fed - FRB: Supervisory Letter SR 26-2 on Revised Guidance on Model Risk Management -- April 17, 2026

Prudential Regulation Authority, Bank of England - SS1/23: Model Risk Management Principles for Banks (May 2023, effective May 2024) PS6/23 – Model risk management principles for banks | Bank of England

Office of the Superintendent of Financial Institutions (OSFI), Canada - Guideline E-23: Model Risk Management (Final version, September 2025, effective May 2027) Guidance library - Office of the Superintendent of Financial Institutions