FinanceModel Governance
April 30, 2026 | 5 min read
What to do about SR 26-2
The organization, technology, and process framework SR 26-2 demands
The organization, technology, and process framework SR 26-2 demands
SR 26-2 replaces checklist compliance with principles-based defensibility. That demands three things from an institution, in order:
Every tactical choice sits inside one of these three. Skip any of them, and the rest does not compound.
The shift most institutions need to make is not structural. It is posture.SR 26-2 shifted the supervisory conversation from rule-following to judgment. That shift rewards institutions with MRM leadership that can defend a risk posture on its own terms rather than against a checklist. In practice, that means a CRO who owns the aggregate risk view, an MRM function whose independence is measured by rigor rather than reporting line, and a model risk management framework that brings GenAI under the same oversight without duplicating infrastructure.
A governance function that has spent 15 years producing evidence for regulators now has to produce evidence for itself in a form it can defend when the question is not 'what does the rule say' but 'what does your risk appetite actually tolerate.'
The platform has to be one thing, across classical models, rule-based systems, spreadsheets, and GenAI, with governance running through all of it as a first-class property rather than an add-on. Principles-based governance only scales on a platform that can enforce policies authored by risk teams, automatically capture evidence, and track dependencies across the full model lifecycle, including the systems SR 26-2 excluded. Spreadsheets and rule-based systems belong in the same inventory as ML models, because that is where errors happen. GenAI belongs in a parallel bridge track in the same platform, because the CRO's view has to be unified.
The failure mode for most institutions is a GRC tool that handles paperwork, a separate platform that runs the models, and a spreadsheet in between that nobody owns. SR 26-2 tolerates that architecture. A future regulation may not.
Governance has to be an attribute of the work, not an approval stage at the end. The workflow from model intake through validation, deployment, monitoring, and retirement has to carry that discipline through every step.Risk teams author policy. The platform enforces it. Validators sit close enough to developers to catch problems early. Documentation accumulates as a byproduct of the work rather than as a parallel exercise assembled at the end.
SR 26-2 calls this shifting governance into the development lifecycle rather than bolting it on at the end, and now gives that architecture explicit supervisory cover. For institutions still running a traditional handoff model, the process change is the hardest of the three because it touches how data scientists and validators actually do their jobs. It is also the one that compresses validation timelines the most once it is working.
The Domino Enterprise AI Platform is where the organizational roles, technology requirements, and process changes can all run, with each phase producing a defensible artifact by the end. SR 26-2 shifted the burden of proof to the institution. The Domino Enterprise AI Platform is how you carry it – enforcing the policies your risk teams write, capturing evidence as models run, and giving the CRO a unified view across classical models, rule-based systems, and GenAI.
Unified model inventory
Classical ML, rule engines, in-scope spreadsheets, and GenAI in a single inventory with a single audit record.
Policy engine
Risk teams author governance policies that the platform enforces at build time, not during a downstream review. Compliance becomes a property of how models are built.
Automated evidence collection
Exam-ready documentation accumulates as a byproduct of normal development work, not assembled after the fact from email chains and manual checklists.
Drift monitoring & lineage
Continuous monitoring tied to governance workflows generates findings automatically. Reproducibility and full model lineage are built in, not layered on.
GenAI bridge track
A parallel governance framework for generative and agentic systems, including prompt governance, hallucination monitoring, output filtering, and human-in-the-loop gating, run in the same platform as classical MRM.
SR 26-2 is a starting point, not an arrival. The regulation has moved, and it will move again. With state and international frameworks tightening, and architecture built to match exactly one regulation will be rebuilt for the next one.
The institutions that will lead the next cycle are those whose governance functions treat adaptability as offense rather than overhead – organization that can flex, technology that can extend, processes that can absorb change. That is what SR 26-2 is asking institutions to build and what Domino makes possible. The real advantage isn't surviving this regulation. It's knowing you won't have to rebuild for the next one.
The framework is here. The next step is putting it into practice. See why institutions like UBS, FINRA, and Moody's choose Domino to build governance that handles SR 26-2 today, and every regulation that follows. Sign up for a demo →
Part 1: What changes with SR 26-2
Part 2: How to navigate SR 26-2
Part 3: What to do about SR 26-2
Nicholas Goble, Ph.D. leads Solution Architecture for Financial Services & Insurance at Domino Data Lab, bringing more than ten years of experience across quantitative finance, derivatives modeling, and fintech innovation. At Venerable, Nicholas managed Quantitative Research and Development, where he established quant research capabilities from the ground up and guided teams in building sophisticated trading platforms and pricing engines. Before that, he was a Senior Quantitative Researcher at Chatham Financial, focusing on valuation methodologies and bringing machine learning models into live trading environments. Nicholas holds a Ph.D. in Physics from Case Western Reserve University.