A large regional bank with $85 billion in total assets has deployed an AI-driven credit scoring model that was fully validated twelve months ago. The model has since processed over 2 million loan applications with no formal re-review. The Chief Risk Officer asks the model risk team what SR 26-2 (which superseded SR 11-7 in April 2026) expects regarding ongoing monitoring for this model. Which of the following best describes that expectation?

SR 26-2, issued in April 2026 by the Federal Reserve, OCC and FDIC, superseded SR 11-7 and is most relevant to banks with over $30 billion in total assets, so it reaches this $85 billion bank. It names ongoing model monitoring as a validation component: evaluating whether a model still performs as expected given changes in products, exposures, clients, data relevance or market conditions. When performance drifts outside established thresholds, the guidance points to overlays, adjustment, recalibration or redevelopment, and the frequency and scope of monitoring depend on the model's nature and materiality. A credit model that has scored two million applications has high exposure, so it deserves close monitoring: input population stability, discrimination measures such as KS or Gini, and predicted versus actual default rates. The one-time-validation view is wrong because the guidance treats validation and monitoring as lifecycle activities. The annual-review-with-volume-waiver rule is invented; SR 26-2 sets no fixed annual cycle, and high volume raises risk rather than excusing review. The OCC high-risk classification exemption is invented too; no such category exists, and relevance turns on bank size and model materiality. Exam caveat: SR 26-2 is non-binding, so the answer describes sound practice rather than a mandate, although supervisors can still act on unsafe practices. In practice, confirm the monitoring plan names its metrics, its thresholds and the action each breach triggers.