Artificial intelligence has moved from the innovation lab into production trading floors. Machine learning models now drive pricing adjustments, generate trading signals, forecast liquidity, and monitor risk in real time. Meanwhile, regulators still expect robust model risk management under frameworks like the US Federal Reserve’s SR 11-7.
SR 11-7 is the Federal Reserve’s supervisory guidance on Model Risk Management (MRM). It mandates that banks must validate models independently, monitor model performance, document models and their governance and separate model development and validation.
Here’s the problem: AI systems need speed and continuous iteration to work. Traditional control frameworks were built for models that barely change. The result? Friction, delays, and sometimes paralysis.
The real question isn’t whether we can govern AI. It’s how we do it without killing the velocity that makes these systems valuable in the first place.
Why Traditional Model Risk Management Breaks Down
SR 11-7 gave us a clear lifecycle: develop, document, validate independently, approve, monitor periodically. This works fine for credit scoring models that get reviewed annually. It falls apart when you’re dealing with models retrained daily as market regimes shift, feature sets that evolve with new data sources, ensemble systems where models interact in complex ways, and reinforcement learning agents adapting to market conditions.
In high-velocity environments, traditional controls create two problems. First, shadow deployment. Quants bypass formal processes because they’re too slow, building outside governed platforms. Second, control theater. Documentation exists but doesn’t reflect what the model does in production.
Neither reduces risk. Both amplify it.
The Shift: Governing Model Systems, Not Just Models
To make AI work in markets, we need to stop thinking about individual models and start governing model systems. That means the pipelines, data flows, retraining loops, and decision frameworks that interact to produce outcomes.
Build Controls Into the Platform, Not the Process
Most institutions layer controls on after models are built. When models evolve rapidly, this approach can’t keep up.
Instead, control generation should be automated within the AI platform itself. Lineage tracking from raw data through model output gets captured automatically. Feature definitions are versioned and tracked like code. Training datasets are hashed and stored for reproducibility. Model artifacts get logged with hyperparameters and environment configs.
Consider a volatility forecasting model. Under the old approach, a quant would build the model, then spend weeks creating separate documentation. By the time that documentation is reviewed and approved, market conditions have shifted and the model needs updating.
Under the embedded approach, the platform automatically captures everything. When the quant pulls Bloomberg data, that’s logged. When they engineer features, those definitions are versioned. When the model trains, the platform records which data it used and what the validation metrics showed. The controls are a byproduct of the workflow, not a separate artifact that decays.
Organizations like Capital One and JPMorgan have demonstrated that automated lineage and versioning can actually accelerate deployment while improving control quality.1,2
Move from Periodic Review to Continuous Risk Sensing
Traditional model risk management relies on quarterly or annual performance reviews. In fast markets, that cadence is useless.
AI risk monitoring needs to be continuous. You’re watching for performance drift, tracking data distribution shifts, monitoring feature stability, flagging infrastructure anomalies, and detecting behavioral drift in ensemble systems.
Consider a credit pricing model used in a trading book. Under traditional monitoring, you’d run quarterly backtests. If the model started deteriorating in February, you might not catch it until April. By then, you’ve potentially mispriced hundreds of trades.
With continuous monitoring, the platform tracks prediction accuracy daily. If credit applications suddenly come from unfamiliar geographies or credit scores cluster differently than usual, alerts fire immediately. The risk team investigates before losses accumulate.
The Bank for International Settlements highlighted this in their 2021 report, noting that “model monitoring frameworks must evolve to detect subtle changes in model behavior that traditional backtesting may miss.”3
Make Validation Modular and Risk-Based
One reason AI governance grinds to a halt? Validation is treated as binary. Full validation or nothing.
A smarter approach is modular, risk-based validation. Major architecture changes get deep validation. Incremental retraining within predefined bounds follows lighter review. High-impact models operate with tighter monitoring thresholds. Lower-risk models run within guardrails that trigger alerts if breached.
This mirrors how software engineering manages production systems. Not every code commit requires a complete architecture review. Validation still matters. It just needs to scale with model velocity.
The Agentic AI Challenge
As agentic AI systems start supporting research workflows and trade idea generation, we’re dealing with systems that execute tasks with some degree of autonomy.
Traditional model risk frameworks weren’t designed for goal misalignment, unintended action chains, over-reliance by users, or opacity in decision provenance.
Think about an agentic system that monitors market news and suggests trade ideas. You ask it to identify opportunities in emerging market debt. It scans news, analyzes pricing data, and proposes going long on a specific sovereign bond. But what if the agent noticed the bond was mispriced and decided to place the trade itself instead of just suggesting it? Or what if it optimized for volume of ideas rather than quality, flooding the desk with mediocre suggestions?
Controls for agentic systems need human-in-the-loop checkpoints for high-stakes decisions, action logging with explainable reasoning traces, guardrails that restrict access to sensitive systems, and clear escalation triggers when behavior deviates from expected patterns.
The goal isn’t to eliminate autonomy. It’s to ensure bounded autonomy.
What Regulators Actually Want
There’s a myth that regulators resist AI. In my experience, supervisory concerns are more practical. Can you explain how the system works? Can you detect when it stops working as intended? Can you intervene before things blow up?
When AI platforms provide transparent lineage, continuous monitoring, and documented guardrails, regulatory conversations get easier, not harder.
As the OCC noted in their Model Risk Management Handbook, “institutions should tailor validation activities to the complexity and materiality of the model.”4 That opens the door for risk-based, modular approaches.
The Competitive Edge
Firms that get AI risk management right don’t just achieve compliance. They unlock faster time-to-production for new models, greater confidence from traders using AI outputs, less firefighting when models behave unexpectedly, and stronger regulatory relationships.
Most importantly, they avoid the stop-start cycle where innovation surges ahead, then gets yanked back after a control failure. In high-velocity markets, sustainable speed is the real advantage.
Moving Forward
SR 11-7 remains foundational, but it was never designed for self-updating, interconnected AI systems operating in millisecond environments. The future of AI governance in capital markets lies in operationalized controls: embedded lineage, continuous monitoring, modular validation, and bounded autonomy for agentic systems.
When controls are engineered into platforms rather than bolted onto processes, risk management becomes an enabler instead of a brake. That’s the shift financial institutions need to make if AI is going to scale safely in markets where both opportunity and risk move at extraordinary velocity.
About Author:
Shuchi Agrawal is a senior AI and data executive specializing in the commercialization of artificial intelligence across capital markets, trading, and risk functions. She currently serves as Head of AI Commercialization at SMBC Group, where she leads enterprise AI strategy focused on front-office enablement, model acceleration, and scalable, regulation-aligned AI infrastructure.
With over 25 years of experience, Shuchi has held global leadership roles at institutions including Citi, where she drove large-scale data, model governance, and AI modernization initiatives supporting trading, liquidity, and risk management. She is known for bridging innovation with regulatory rigor, helping financial institutions deploy high-velocity AI systems with strong model risk controls and production-grade MLOps foundations.
Shuchi is a recognized thought leader in AI governance, model risk, and agentic AI in financial services, and is passionate about enabling responsible AI that delivers measurable business and P&L impact.
Footnotes
- Capital One. “Machine Learning at Capital One.” Capital One Tech. https://www.capitalone.com/tech/machine-learning/
- JPMorgan Chase. (2023). “AI and Model Risk Governance.” https://www.jpmorganchase.com/about/technology/news/ai-and-model-risk-governance
- Bank for International Settlements. (2021). “Artificial Intelligence in Financial Services.” FSI Insights No. 35. https://www.bis.org/fsi/publ/insights35.pdf
- Office of the Comptroller of the Currency. (2021). “Model Risk Management.” Comptroller’s Handbook. https://www.occ.gov/publications-and-resources/publications/comptrollers-handbook/files/model-risk-management/
References:
- Capital One – Machine Learning – General ML page: https://www.capitalone.com/tech/machine-learning/
- Capital One – ML platform best practices: https://www.capitalone.com/tech/machine-learning/best-practices-for-impactful-machine-learning-platforms/
- Capital One – Trust in AI: https://www.capitalone.com/tech/machine-learning/value-and-trust-in-ai/
- JPMorgan Chase – Machine Learning Governance – AI and Model Risk Governance (2023): https://www.jpmorganchase.com/about/technology/news/ai-and-model-risk-governance
- JPMorgan Chase – Data + AI Summit presentation: https://www.constellationr.com/blog-news/insights/jpmorgan-chase-digital-transformation-ai-and-data-strategy-sets-generative-ai
- Bank for International Settlements (BIS) – AI in Finance (2021) – BIS FSI Insights Report No. 35 (2021): https://www.bis.org/fsi/publ/insights35.pdf
- Office of the Comptroller of the Currency (OCC) – OCC Bulletin 2023-17: https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html
- OCC Model Risk Management Handbook (2021): https://www.occ.gov/publications-and-resources/publications/comptrollers-handbook/files/model-risk-management/index-model-risk-management.html
- Original SR 11-7 (OCC Bulletin 2011-12): https://www.occ.gov/news-issuances/bulletins/2011/bulletin-2011-12.html
Read more: Sustainable Business Practices for Long-Term Growth: A Strategic Framework for Competitive Advantage
