The Global Risks Alliance (GRA)
Banks rely on models to grant credit, set provisions, price products, compute capital and detect fraud, and a growing share of those models use machine learning. Model risk is the potential for loss or poor decisions when a model is wrong or misused. This page sets out how model and AI risk arises, how validation and governance contain it, and which supervisory and legal frameworks now apply to automated credit decisions.
GRA · Established · service level R0
Model risk is the potential for loss or poor decisions when a model is wrong or misused. Banks rely on models to grant credit, set provisions, price products, compute capital and detect fraud, increasingly with machine learning, so drift, opacity, bias and herding are governed through model risk management and validation.
How satellite radar turns a flood into an exposure update. Synthetic scene; no real event or place.
Credit automation and validation. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Models learn from past data. When the economy, customer behaviour or products change, relationships shift and accuracy decays, often quietly until losses or complaints reveal it.
Complex machine learning models can be hard to explain to credit officers, customers and supervisors. Effective challenge, a pillar of model governance, is weaker when no one can say why a model decides as it does.
Training data reflect past lending patterns. Variables that proxy for protected characteristics can produce discriminatory outcomes, adding conduct, legal and reputational risk to credit risk.
Many banks use similar vendors, data and techniques. Common models can produce herding in credit supply or market responses, and errors compound when one model's output feeds another.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Model risk management | The governance, development standards, validation and inventory controls that limit model risk, as US guidance SR 11-7 sets out. |
| Population stability index | A measure of how much the distribution of a model's input or score has shifted since development. |
| High-risk AI system | Under the EU AI Act, a category that includes AI used to evaluate the creditworthiness of individuals. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Model inventory coverage | count of models by tier and validation status | quarterly | Model risk management records | REPORTED |
| Discriminatory power of credit scorecards | Gini coefficient or area under the curve | annual | Model validation | MODELLED |
| Population stability index | dimensionless | monthly | Model monitoring | OBSERVED |
| Calibration gap of default predictions | difference between predicted and observed default rates | annual | Back-testing | OBSERVED |
| Overdue validation findings | count by severity | quarterly | Model risk reports | REPORTED |
| Approval rate ratio across groups | ratio of approval rates | annual | Fair lending analysis | ESTIMATED |
| Overrides of automated decisions | share of decisions overridden | monthly | Credit decision logs | OBSERVED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| Federal Reserve and OCC supervisory guidance on model risk management (SR 11-7) | Expectations for model development, validation and governance | Public domain |
| PRA supervisory statement on model risk management principles for banks | UK principles for model identification, governance and validation | Free, Bank of England terms of use |
| ECB guide to internal models | Supervisory expectations for internal ratings-based and other internal models | Free, attribution |
| EBA follow-up report on machine learning for IRB models | Supervisory analysis of machine learning in credit risk models | Free, attribution |
| US Home Mortgage Disclosure Act data | Loan-level application and decision data used in fair lending analysis | Public domain |
| FSB and BIS reports on artificial intelligence in finance | Assessments of financial stability implications of artificial intelligence | Free, attribution |
Banking Nexus prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Bank board and model risk committee | What model risk appetite to set and which uses of AI are acceptable | Model inventory, tiering and validation findings |
| Independent model validation function | Whether a model is fit for purpose and what conditions or limits apply to its use | Back-testing, benchmarking, explainability and fairness tests |
| Prudential and conduct supervisors | Whether internal models can be approved for capital and whether automated decisions treat customers fairly | Validation reports, outcome data and governance evidence |
| Data protection and market surveillance authorities | Whether credit scoring systems meet legal duties on transparency, accuracy and human oversight | Technical documentation, impact assessments and testing records |
Whether models remain accurate and stable outside the conditions they were built on.
Whether credit decisions made with complex models can be explained to customers and supervisors.
Whether models produce unjustified differences across groups.
Whether shared models and data create correlated decisions.
Model risk arises from errors in design, data or use, and from using models beyond their intended scope. It can cause losses, mis-priced risk and unfair treatment.
Machine learning can capture complex patterns but may rely on spurious correlations, degrade as conditions change and resist explanation. Validation must test not only accuracy but stability, bias and behaviour in stress.
Data quality and representativeness shape outcomes. Models trained on historical decisions can reproduce past exclusion; alternative data can widen access or introduce new biases.
Herding is a systemic concern. If many lenders use similar models, vendors or data, they may tighten or loosen credit together, amplifying cycles.
Generative AI introduces new risks in customer service, coding and document analysis, including fabricated outputs and data leakage, which require controls and human oversight.
| Method or data | What it shows | Its limit |
|---|---|---|
| Independent validation | Model soundness and limits | Depends on validator independence and skill |
| Back-testing | Performance against outcomes | Past conditions may not recur |
| Fairness testing | Differences across groups | Choice of fairness metric matters |
| Monitoring for drift | Changes in performance | Detects problems after they emerge |
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.