In April 2026 the U.S. bank regulators (the Federal Reserve, OCC, and FDIC) changed what counts as a "model" for the banks they supervise. Deterministic rule-based processes are now explicitly excluded. A doloop donkey is a deterministic check: a rule-based test with no statistical model underneath. This page gives the accurate version, with the primary sources. Your team can verify it.
This page is for the model-risk and compliance teams at supervised banks. If that is not you, the regime does not apply, and you can ignore it. The deterministic check still does the same job everywhere else; only this banking framing is specific.
SR 26-2, "Revised Guidance on Model Risk Management" (April 17, 2026), is interagency guidance from the three agencies. It supersedes SR 11-7 (2011), the document that launched modern model-risk management, and SR 21-8. It is most relevant to banking organizations with over $30 billion in assets.
It defines a model as "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates." It then excludes two things from that definition.
"simple arithmetic calculations, such as those found within spreadsheets," and "deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use."
A deterministic check with no statistical theory underneath is, by this definition, not a model, so it does not carry model-validation expectations.
Federal Reserve SR 26-2 → · OCC Bulletin 2026-13 → · SR 11-7 (superseded) →
For a bank's model inventory, the doloop layer sits in one place, and it claims only what it can.
The donkeys are rule-based and byte-identical, with no statistics underneath. By the revised definition they fall outside the meaning of a "model."
The LLM you bring is not in the safe zone. The agencies put generative and agentic AI expressly out of scope and flagged it for future rulemaking. doloop's deterministic verdict layer is the part the exclusion covers; the model it wraps is yours.
A determinism certificate (90 runs, zero variance for the extraction donkey), accuracy audits, and change-history exports, on request. Evidence your validators can hold.
Every verdict replays byte for byte: same input, same input_sha256, same findings, forever. Even the bill replays (loops times a published rate). Self-verifying, not trust-us.
SR 26-2 is non-binding, risk-based supervisory guidance. The guidance itself states that non-compliance "will not result in supervisory criticism." It narrows what a model is. It does not grant a safe harbor or a certification you "qualify" for. Nothing on this page is legal or regulatory advice.
Your model-risk function and your counsel decide how SR 26-2, or any framework, applies to your use of any tool. We make that call easy: deterministic behavior, reproducible verdicts, and the artifacts to prove both.
If your model-risk team needs the artifacts, we will send the determinism certificate, the accuracy audit, and change-history exports.
Routes you to a real page, asks when ambiguous, or refuses. No model on the answer path, so it never invents.