In April 2026 the regulators narrowed what counts as a "model." Deterministic rule-based processes are now explicitly excluded. doloop's donkeys are exactly that: rule-based checks with no statistical model underneath. Here is the accurate version, with the primary sources, so your team can verify it rather than take our word for it.
SR 26-2, "Revised Guidance on Model Risk Management" (April 17, 2026), is interagency guidance from the Federal Reserve, OCC, and FDIC. It supersedes SR 11-7 (2011), the document that launched modern model-risk management, and SR 21-8. It is most relevant to banking organizations with over $30 billion in assets.
It defines a model as "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates," and it explicitly excludes from that definition:
"simple arithmetic calculations, such as those found within spreadsheets," and "deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use."
That exclusion is the whole point. A deterministic check with no statistical theory underneath is, by this definition, not a model, so it does not carry model-validation expectations.
Federal Reserve SR 26-2 → · OCC Bulletin 2026-13 → · SR 11-7 (superseded) →
The deterministic checks are rule-based and byte-identical, with no statistical, economic, or financial theory underneath. By the revised definition they fall outside what counts as a "model."
The LLM you bring is not in the safe zone. The agencies put generative and agentic AI expressly out of scope and flagged it for future rulemaking. doloop's deterministic verdict layer is the part that sits outside the model definition; the model it wraps is yours.
A determinism certificate (90 runs, zero variance for the extraction donkey), accuracy audits, and change-history exports, on request. Evidence your validators can hold.
Every verdict replays byte for byte: same input, same input_sha256, same findings, forever. Even the bill replays (loops times a published rate). Self-verifying, not trust-us.
SR 26-2 is non-binding, risk-based supervisory guidance. The guidance itself states that non-compliance "will not result in supervisory criticism." It narrows the definition of a model; it does not grant a safe harbor or a certification you "qualify" for. Nothing on this page is legal or regulatory advice.
Your model-risk function and your counsel make the final determination about how SR 26-2, or any framework, applies to your use of any tool. What we can do is make that determination easy: deterministic behavior, reproducible verdicts, and the artifacts to prove both.
If your model-risk team needs the artifacts, we will send the determinism certificate, the accuracy audit, and change-history exports.