SR 11-7 still bites, and gradient boosting just made the wound worse

The concept at stake is model explainability as a compliance obligation, not a technical preference. Banks have been building explainability tooling for years, mostly as a way to satisfy internal model risk committees and, on occasion, satisfy an adverse action notice requirement under the Equal Credit Opportunity Act. What has changed is the intensity of examiner scrutiny, the complexity of the models now in production, and the uncomfortable gap between what SHAP values tell a reviewer and what the model is actually doing.

SR 11-7, the Federal Reserve and OCC guidance issued in 2011, predates transformertransformerA Transformer is a neural network architecture that uses self-attention to process sequences in parallel, powering most modern language and generative AI models.View full definition → architectures, gradient boosting frameworks, and the current generation of LLMLLMA Large Language Model is an AI system trained on vast text data to predict and generate language, enabling tasks like writing, summarizing, and answering questions.View full definition →-powered credit tools by a decade. But it has not been replaced. Examiners are applying it to models its authors never imagined.

How model risk flows into provisions, capital and consent orders

A bank's credit portfolio is priced on assumptions about default probability. Those assumptions live inside models. When a model misbehaves, the loss does not stay in the model risk management (MRM) team's inbox. It flows into provision charges, capital requirements under Basel III, and, if the model has been making discriminatory decisions, into consent orders with the CFPB or DOJ.

The OCC's 2023 model risk management handbook update made clear that "conceptual soundness" requires being able to explain not just what a model predicts but why it predicts it, and whether that reasoning is consistent with the bank's intended use. For a gradient boosting model doing mortgage underwriting, "consistent with intended use" is a very demanding standard when the model has learned from historical data that reflects decades of discriminatory lending patterns.

Regulators are also watching how banks deploy third-party models. JPMorgan Chase, Wells Fargo, and Bank of America all use vendor-supplied scoring models for segmentssegmentsDividing a market into distinct groups of customers who share similar needs, characteristics or behaviours, so each group can be served with a tailored approach.View full definition → of their credit decisions. Under SR 11-7, the bank owns the model risk regardless of who built it. If the vendor cannot produce a model fact sheet that satisfies an examiner, the bank answers for it.

Beyond credit,catching model risk before it triggers a supervisory action requires banks to apply the same explainability logic to AML transaction monitoring, fraud detection, and increasingly to the LLM-powered tools entering compliance workflows. An LLM that surfaces suspicious activity alerts but cannot articulate its reasoning chain is, under SR 11-7's logic, an unexplained model producing outputs the bank is relying on.

What does SR 11-7 require for model explainability?

SR 11-7 does not use the word "explainability." It requires conceptual soundness, ongoing monitoring, and documentation sufficient for a "knowledgeable party" to evaluate the model. In practice, MRM teams have interpreted this to mean three things:

First, the model must have a documented conceptual narrative: a plain-language account of why the chosen approach is appropriate for the intended use, what assumptions it rests on, and what it would take to invalidate those assumptions. For a logistic regression, this is straightforward. For an XGBoost model with 400 features, it requires discipline.

Second, individual predictions must be explainable at the decision level, particularly for adverse actions. The Fair Housing Act and ECOA require that applicants denied credit receive specific reasons. Post-hoc explanation tools like SHAP (SHapley Additive exPlanations) assign contribution scores to each feature for each prediction, giving the bank a basis for generating those reasons. But SHAP explanations approximate the model's behavior; they do not describe it exactly. When a CFPB examiner asks whether the reason codes produced are accurate, the honest answer is "approximately, within defined tolerance bounds," and the bank needs documentation to show those bounds have been validated.

Third, monitoring must detect when the explanation structure itself has shifted. If a model was approved with home value as its second-highest SHAP contributor and, six months later, a geographic cluster feature has displaced it, that is a material change that should trigger a model review. Many banks run this monitoring quarterly. Given how fast data distributions can shift, that cadence is increasingly inadequate.

A concrete example: in 2024, a mid-sized regional bank in the Southeast discovered during a fair-lending examination that its auto loan pricing model, built on LightGBM, was using postal code as a top-five feature. The model had been approved internally on the basis that postal code was a proxy for dealership network costs. The examiner read it differently: as a proxy for race in several metro markets. The bank's SHAP documentation showed the feature's contribution but had no analysis of its disparate impact. The result was a memorandum of understanding requiring model remediation and a second-look program for affected applicants. The cost ran past $40 million including remediation, monitoring infrastructure, and legal fees.

Where SHAP holds up and where it fails on LLMs

Post-hoc explainability tools work well when the model is relatively stable, the feature set is interpretable by domain experts, and the prediction task has a clear ground truth that can be validated over time. Traditional credit scoring, fraud rule optimization, and collateral valuation models sit in this zone.

They work poorly for foundation models and LLMs being used in credit or compliance workflows. When a bank deploys an LLM to summarize a commercial borrower's financial statements and produce a risk narrative, the explanation problem is qualitatively different. There is no feature importance vector. The "reasoning" is a function of attention patterns across billions of parameters. Asking SHAP to explain an LLM's output is roughly like asking a flight data recorder to explain the pilot's intention.

Building credit models that survive fair-lending scrutiny increasingly means choosing model architectures with governance in mind from the start, not retrofitting explainability after deployment. Constrained models, monotonic gradient boosting, or scorecard ensembles with explicit feature ceilings are less accurate than unconstrained deep models on holdout sets. They are also far more defensible when an OCC examiner sits down with your MRM documentation.

The honest tradeoff: a bank that optimizes purely for predictive lift will deploy models that perform better on paper and survive examinations worse. The margin difference between an 8% Gini improvement and a consent order is not close.

SR 11-7 will eventually be superseded by more specific AI guidance, and the OCC and Fed have signaled updates are in progress. Until that happens, the 2011 text remains the operational standard, and the banks treating explainability as a documentation exercise rather than a design constraint are building a liability, one model deployment at a time.

The full course on this sector:AI in Banking.