Model governance: meeting SBP model risk expectations

Three ways to see it

1. 1

   Model risk management, often abbreviated MRM, is the discipline of treating every model as a regulated artefact with a known provenance, known performance, and known governance. The vocabulary comes from the United States Federal Reserve's SR 11-7 Supervisory Letter, which became the global template for bank model governance. SBP's Risk Management Guidelines incorporate the same principles in a Pakistani regulatory context. The four pillars are model inventory, model validation, ongoing monitoring, and independent review. Every machine learning model in your bank, including third-party vendor models, must satisfy all four. There is no exemption for AI models, no exemption for vendor-supplied models, no exemption for models inherited from an acquisition.

2. 2

   Model inventory is the simplest pillar to build and the easiest to neglect. It is a single source of truth listing every model in production: model name, model owner, business purpose, training data window, performance metrics, regulatory exposure, last validated date, last reviewed date, retirement date if planned. At a Pakistani mid-tier bank the inventory typically lives in a shared spreadsheet for the first year and a proper governance platform thereafter. The rule is that the inventory must be queryable by the Chief Risk Officer in under fifteen minutes. If it cannot, the inventory does not exist for the purposes of an SBP review.

3. 3

   Validation is the formal proof that the model does what it claims, with the precision and recall the bank has committed to. A validation report has a standard shape: data lineage and quality assessment, training and holdout split, performance on holdout, performance broken down by segment (gender, age band, income band, region), stability tests over time, sensitivity tests for adversarial inputs, and explicit limitations. The team that validates must be different from the team that built. At a Pakistani bank with limited headcount, this often means the model risk function reports to a different MD than the modelling function. Where total separation is impossible, the next best thing is a written conflict-of-interest declaration on every validation report, signed by both parties.

The why-tree

Try this with Claude

AI-edge prompt: 'Draft a SBP-defensible model card template for an AML transaction monitoring model at a Pakistani bank, in the format expected by an independent validator. Include sections for data lineage, training methodology, performance metrics broken down by segment, drift monitoring plan, champion-challenger protocol, retirement criteria, and a regulator-facing summary in plain English. Include a Pakistani-context worked example using XGBoost on Raast data.' Use the output as a starting template, do not copy verbatim.