A global asset manager licenses a third-party AI platform from a fintech vendor to generate portfolio risk scores. The vendor refuses to disclose model architecture details, citing proprietary concerns. Using SR 26-2 (which superseded SR 11-7 in April 2026) and the June 2023 Interagency Guidance on Third-Party Relationships (which replaced OCC Bulletin 2013-29) as benchmarks, which approach best meets the asset manager's model risk responsibilities?

SR 26-2, the April 2026 Federal Reserve, OCC and FDIC guidance that superseded SR 11-7, says vendor and other third-party products create unique validation challenges because code, data or methodology may be proprietary, but the principles of model risk management remain applicable. It calls for validation of vendor products by internal or outside parties, an understanding of the vendor model's conceptual soundness, design, development data and performance, and ongoing monitoring and outcomes analysis to confirm the model stays accurate and fit for purpose. When internals are withheld, compensating evidence carries the load: back-testing scores against realized risk, benchmarking against challenger models, and sensitivity testing. The June 2023 interagency third-party guidance adds the contract side, including audit and information rights, performance reporting and notice of material changes. Relying entirely on the vendor's own validation fails because the developer is not an independent reviewer and proprietary status creates no exemption. Declaring third-party models out of scope contradicts SR 26-2, which keeps them in. A SOC 2 Type II report plus an OCC exemption filing fails because SOC 2 covers security controls rather than model soundness, and no model exemption filing exists. Exam caveat: both documents are written for banks and are guidance; an asset manager uses them as the recognized benchmark. In practice, treat a vendor that refuses every oversight mechanism as a risk escalation in its own right.