The challenge is structural. Regulators expect independent, technically credible validators and governance professionals. The pool of candidates who genuinely meet that bar is small, and most of them aren't browsing job boards. According to GARP's model risk research, few professionals possess excellent skills across all the areas MRM demands — and spreading scarce validation resources too thin is one of the field's most persistent operational problems.
This guide covers what SR 11-7 and SR 26-2 actually require from a talent perspective, the specific roles your institution needs, what to look for when screening candidates, and why standard recruiting approaches consistently fall short for these positions.
Key Takeaways
- SR 11-7 was formally replaced by SR 26-2 on April 17, 2026; core MRM disciplines and compliance expectations remain unchanged
- Compliance requires three distinct talent types: model developers, independent validators, and governance specialists
- Sourcing quantitative validators is the hardest part — and the highest-risk gap to leave open before an exam cycle
- Job postings won't reach most experienced MRM professionals; they're passive candidates who require direct outreach
- Fintechs face additional barriers: weaker brand recognition and no existing MRM infrastructure to hire into
What Is SR 11-7, and Is It Still in Effect?
SR 11-7 was issued on April 4, 2011, by the Federal Reserve and OCC as Supervisory Guidance on Model Risk Management. It required banks to manage model risk through structured development and testing, independent validation, and board-level governance — and became the foundational MRM standard across U.S. banking. Many fintechs adopted it voluntarily as a best-practice benchmark, even without formal regulatory obligation.
SR 11-7 Is Now Superseded
On April 17, 2026, the Federal Reserve, FDIC, and OCC jointly issued SR 26-2 and OCC Bulletin 2026-13, formally rescinding SR 11-7. The revised guidance modernizes the framework across four key areas:
- Narrower model definition — SR 26-2 excludes simple arithmetic calculations, deterministic rule-based processes, and software without statistical or economic underpinning
- Risk-proportionate validation cycles — instead of default annual revalidation, timing and frequency now vary based on model purpose, change frequency, and materiality
- Explicit size tiering — SR 26-2 is most relevant to banking organizations with over $30 billion in assets, with applicability to smaller institutions only where significant model risk exposure exists
- Generative and agentic AI carved out — these novel model types are explicitly outside SR 26-2's current scope
One notable shift: SR 26-2 states that non-compliance will not automatically result in supervisory criticism. This is a principles-based framework, not a checklist.
What This Means for Hiring
For institutions weighing what SR 26-2 means for their teams, the answer is straightforward: the organizational infrastructure doesn't change, only the flexibility in how you manage it.
The core disciplines — governance, independent validation, documentation, and controls — carry over unchanged. Institutions that maintained strong MRM functions are well-positioned under the new framework. Those that cut corners face the same scrutiny, just under principles-based rules rather than prescriptive ones. Demand for qualified model risk professionals remains as strong as it was under SR 11-7.
The Three Pillars of MRM Compliance and the Talent Each Requires
Both SR 11-7 and SR 26-2 organize MRM around three pillars. Each one maps to a distinct hiring need.
Pillar 1: Model Development, Implementation, and Use
This pillar covers model design, methodology documentation, data quality, and pre- and post-deployment testing. The professionals here — quantitative analysts, data scientists with financial domain expertise, and model owners embedded in business lines — set the quality baseline for everything downstream.
Core competencies for Pillar 1 hires:
- Quantitative model design and statistical methodology
- Data quality assessment and documentation practices
- Pre- and post-deployment testing protocols
- Business-line integration and model ownership accountability
The stronger this team, the less remediation validators face later.
Pillar 2: Model Validation
Validation must be performed by professionals who had no role in model development and have no stake in the outcome. SR 11-7 defined this as "effective challenge" — critical analysis by objective, informed parties who can identify model limitations and produce appropriate changes. SR 26-2 preserves this standard.
The core competencies validators need:
- Conceptual soundness review
- Outcomes analysis and back-testing
- Ongoing model monitoring
- Authority to require changes — not just document concerns
Organizational standing is non-negotiable. An institution that houses its validation team under the same management chain as model development has a structural independence problem regulators will find.
Pillar 3: Governance, Policies, and Controls
SR 11-7 places governance responsibility at the board of directors and senior management level. The talent this pillar demands is less quant-heavy than the first two — but no less specialized.
Key responsibilities include:
- Model inventory maintenance and audit-readiness
- Role and responsibility definition across business lines
- Policy documentation aligned to SR 11-7 and SR 26-2 requirements
- Board-level reporting and examiner-facing controls
These professionals translate regulatory expectations into operational structure. Their work is what examiners actually review.
Key Roles Banks and Fintechs Must Hire For
Institution size and complexity affect titles, but the functions are non-negotiable.
Model Risk Manager / Head of Model Risk
The program owner. Responsible for the overall MRM framework, policy development, model inventory, and escalation to senior management and the board. Larger institutions typically need a VP- or MD-level hire who has built or run an MRM function before and has direct examiner interface experience.
This person sets the tone for everything beneath them. A weak program lead creates compounding risk across the entire framework.
Model Validator / Quantitative Validator
The hardest role to fill on this list. Validators independently assess model design, assumptions, data inputs, and performance — without having been involved in building what they're reviewing.
Regulators don't specify a required degree, but the market has established clear expectations. Strong candidates typically bring:
- Advanced degrees in statistics, mathematics, econometrics, financial engineering, or economics
- The GARP FRM certification, covering quantitative analysis, credit risk, market risk, and valuation
- Practical fluency in Python and SAS, given the industry shift toward open-source validation tooling
What matters beyond credentials: the ability to challenge models convincingly, communicate findings to non-technical stakeholders, and produce documentation that holds up under audit.
Quantitative Analyst (Model Developer)
Quants build the models used in credit underwriting, stress testing, CECL, capital adequacy, and risk measurement. This role sits on the development side, not the independent validation side — but their documentation discipline directly affects validation workload. Fintechs building model-driven credit or fraud products should apply the same data quality and methodology documentation standards regulators expect from banks.
Model Risk Governance Analyst / MRM Program Specialist
The operational backbone of the MRM function. This role maintains model inventories, tracks validation cycles, manages documentation, and prepares materials for internal audit and regulatory exams. Often an analyst-to-senior-analyst hire, but the regulatory familiarity requirement is real — this person needs to understand what examiners look for, not just how to organize files.
Chief Risk Officer / Senior Risk Executive
For community banks and fintechs building MRM functions from scratch, this is often the first critical hire. A CRO who has designed compliant frameworks before can set governance tone, interface credibly with the board, and situate model risk within the broader enterprise risk management structure SR 11-7 calls for. Getting this hire wrong typically means rebuilding the entire framework later, often under direct regulatory pressure.
What to Look for When Hiring MRM Professionals
Technical Credentials and Quantitative Depth
Strong candidates typically hold a Master's or PhD in statistics, mathematics, financial engineering, economics, or a related field. Look for at least one of the following credential signals:
- FRM (GARP): The most MRM-specific designation — Part I and Part II cover quantitative analysis, credit risk measurement, market risk, and valuation
- CFA: Common in senior risk roles, but covers broader investment territory; treat it as supporting evidence of analytical rigor, not MRM-specific credentialing
- Advanced degree alone: Acceptable when paired with hands-on validation experience and strong programming skills
Programming proficiency matters practically. Python is now the dominant tool for model validation workflows, and SAS remains common at larger institutions. A candidate who can build and run their own back-tests — rather than relying entirely on developer-supplied outputs — is a meaningfully stronger validator.
Regulatory Fluency and Exam-Tested Experience
Look for candidates who can speak specifically to:
- How they structured validation documentation packages
- How they managed model inventories across validation cycles
- Whether they've responded to MRA (Matters Requiring Attention) findings
- How they've interfaced with Fed or OCC examiners directly
Theoretical regulatory knowledge and hands-on exam experience are not the same thing. Candidates who have been through a supervisory examination cycle understand what documentation gaps look like under examiner review — that knowledge doesn't come from reading guidance.
Independence and Effective Challenge Mindset
SR 11-7's effective challenge requirement is cultural, not just structural. Ask candidates directly:
- Have you ever identified model limitations that the development team disagreed with?
- How did you handle escalation when a business unit pushed back on your findings?
- Have you recommended that a model be taken out of use?
Validators who can't point to specific instances of genuine pushback are a risk. Governance professionals who've never pushed back on senior management present the same problem. When independence exists only on paper, it won't hold up under examiner scrutiny — and it won't catch the risks it was designed to catch.
Domain Knowledge Aligned to Your Model Inventory
Independence and technical depth only go so far if someone is validating the wrong model types. MRM professionals aren't interchangeable across model categories — a validator with deep CECL and credit risk experience needs a meaningful runway before they're fully productive reviewing BSA/AML or fair lending models.
Before posting a role, map it to your actual model inventory. According to RMA's 2024 MRM survey, the mean bank model inventory contains around 175 quantitative models — with the largest institutions skewing much higher. That breadth means domain specificity matters when building validation teams.
Why Hiring MRM Talent Is Harder Than It Looks
The supply-demand imbalance isn't a short-term hiring cycle problem — it's baked into how MRM expertise develops. GARP's research is explicit: few professionals have strong skills across all the areas MRM requires, and institutions that stretch limited validation staff across every model in their inventory create validation gaps that regulators notice.
Most experienced model validators and MRM program leads are not active job seekers. They're employed at large banks, Fed or OCC offices, or consulting firms — and they're unlikely to surface through job board postings. Standard recruiting approaches, post a job description and wait, consistently underperform for these roles.
Fintechs face additional barriers:
- Smaller brand footprint makes competing with large bank compensation harder
- No existing MRM infrastructure means the first hire has to build from scratch — a rarer and more expensive profile
- Candidates with bank-side MRM experience may be unfamiliar with or skeptical of fintech operating environments
These hiring challenges don't exist in isolation — regulatory pressure is actively expanding the pool of institutions that need MRM talent. Under OCC Bulletin 2023-17 on third-party risk management, banks that rely on fintech partners for model-driven underwriting or credit decisions bear responsibility for those models' governance. That means even fintechs not formally subject to SR 11-7 may find their bank partners requiring MRM-equivalent practices as a condition of the relationship — creating demand for qualified hires that the market is already struggling to fill.
How Wayoh Helps Banks and Fintechs Build MRM Teams
Wayoh specializes in compliance, risk, and regulatory hiring across banking and fintech — with 500+ professionals placed across regulated industries and a human-first recruiting model built on direct outreach and long-term market relationships. That approach surfaces the passive, highly credentialed candidates that job postings alone rarely reach.
For MRM-specific searches, that means:
- Vetted candidate pipelines for quantitative validators, model risk managers, and governance professionals
- Compensation benchmarking across major U.S. markets including New York, California, Florida, Texas, and Chicago
- Both permanent and interim placements — useful for institutions that need to close a validation gap quickly ahead of an exam cycle without committing to a permanent headcount addition
- Direct market outreach to professionals currently at large banks, consulting firms, and regulatory agencies who aren't actively looking but are open to the right opportunity
For community banks and fintechs building MRM functions from scratch, Wayoh also supports senior risk executive searches — including CRO-level placements that establish the governance structure an MRM program is built around.
If your institution is building or expanding its MRM function ahead of a regulatory review or a new SR 11-7 alignment effort, reach out to the Wayoh team at hiring@wayoh.com or visit wayoh.co to discuss your specific staffing needs.
Frequently Asked Questions
Is SR 11-7 rescinded?
Yes. SR 11-7 was formally rescinded on April 17, 2026, when the Federal Reserve, OCC, and FDIC jointly issued SR 26-2 and OCC Bulletin 2026-13. Governance, independent validation, and documentation requirements remain in force under the revised framework.
What is SR 11-7 model risk management?
SR 11-7 was supervisory guidance issued in 2011 by the Federal Reserve and OCC requiring banks to manage model risk through structured development, independent validation, and board-level governance. It became the foundational MRM standard across U.S. financial institutions — widely adopted well beyond its original regulatory scope.
What is the difference between SR 11-7 and SR 26-2?
SR 26-2 replaced SR 11-7 in April 2026 with a more principles-based, risk-proportionate framework. Key changes include:
- Narrower definition of "model"
- Validation cycles tied to materiality rather than default annual schedules
- Explicit size-based applicability thresholds
- Carve-outs for generative AI
Core requirements for independence, governance, and documentation remain.
What are the 7 stages of risk management?
Common risk management frameworks reference seven stages: identify risks, assess and prioritize, design controls, implement controls, monitor performance, report and escalate, and review and update. SR 11-7 and SR 26-2 both map onto this structure through their shared three-pillar approach — development, validation, and governance.
What roles do banks and fintechs typically hire for SR 11-7 / SR 26-2 compliance?
Core roles include Model Risk Manager, Quantitative Validator, Model Developer/Quant Analyst, MRM Governance Analyst, and senior risk executives. Independent validation staffing is the most critical and hardest to fill, given the technical depth and structural independence requirements regulators expect.
Can fintechs be required to follow SR 11-7 or SR 26-2 standards?
SR 26-2 formally applies to federally regulated banking organizations. However, fintechs partnering with regulated banks, seeking charters, or subject to state examination often face MRM-equivalent expectations through their bank partners' third-party risk management obligations — and investors increasingly expect structured MRM programs as a baseline governance standard.
