Explain how SR 11-7 applies to LLM use in a bank

Flashcard·Hard·4.0 · 0·~30s·Asked atPromptlayer Sharechat

Attempt it

SR 11-7 treats the LLM as a model subject to model-risk governance: documented intended use, ongoing performance monitoring, independent validation, clearly documented limitations, and change-management controls for any version bump. Operationally this means a model-inventory entry, a validation report from an independent team (not the developers), a list of approved use cases the model is in-scope for, mandatory monitoring metrics with thresholds, and a sign-off process for every prompt or model upgrade. Guardrails specifically must have documented evidence of attack coverage and false-positive rates included in the validation file. SR 11-7 predates LLMs by a decade but the Fed has clarified it applies.

Your answer

**SR 11-7 is the Federal Reserve's model risk management guidance, originally issued in 2011.** It applies to any quantitative method that produces output used in business decisions. The Fed has clarified, most recently in 2024, that the definition is broad enough to cover LLMs deployed in customer-facing or decisioning roles at US banks. **The five core obligations.** 1. **Model inventory.** Every model in production has an entry in a centralised registry with owner, intended use, training data summary, and current version. 2. **Independent validation.** A team separate from the model developers reviews the model and signs off before production deployment. The validation produces a documented report. 3. **Documented intended use and limitations.** The model card lists what the model is approved for AND what it is NOT approved for. Out of scope use requires re-validation. 4. **Ongoing monitoring.** Production metrics are defined with thresholds and an escalation path. Drift outside thresholds triggers re-validation. 5. **Change management.** Any version bump, prompt change, or scope expansion goes through a formal change-management process with re-validation as appropriate. **Operationally for an LLM deployment:** - The LLM (base model + fine-tune + system prompt + RAG corpus version) is one model-inventory entry. Each component change is a version bump. - Independent validation includes adversarial testing of guardrails, red-team coverage, jailbreak rates, false-positive rates on safety classifiers. - The model card lists 'approved for: providing general account-policy information' and 'NOT approved for: providing investment advice, account-specific recommendations, regulated disclosures.' - Monitoring tracks refusal rates, citation rates, drift on quality metrics, and guardrail hit rates. - Every prompt template change is a change-management ticket with regression testing. LLMs do not get a free pass because they are new. The Fed's framework applies; the guardrails are a documented part of the validation file.

**SR 11-7 is the Federal Reserve's 2011 guidance on model-risk management, and applying it to an LLM deployment means treating the LLM as a governed model with all five obligations: inventory, independent validation, documented intended use, ongoing monitoring, and change management.** **The inventory entry.** Every model in production at a US bank has an entry in the model risk-management inventory. For an LLM, the unit of model is the full deployment configuration: base model name and version, fine-tuning data and process, system prompt content, guardrail stack configuration, RAG corpus version. Each of these is a component; a change to any component is a version bump and re-validation event. The inventory entry names an owner, an intended use, and a validation status. **Independent validation.** SR 11-7 requires that validation be performed by a team independent of the model developers, separation of duties. The validation produces a documented report covering: theoretical soundness (does the approach make sense for the intended use?), implementation correctness (does the model do what the design says?), performance testing (does it meet the documented quality targets?), and adversarial testing (does it resist the threats relevant to its deployment?). For an LLM specifically, the adversarial section includes jailbreak coverage, prompt-injection robustness, refusal calibration, and bias testing. The guardrail stack is part of the model under validation, guardrails are not an after-thought; they have their own attack-coverage and false-positive numbers in the validation file. **Documented intended use and limitations.** The model card is explicit about what the model is approved for and what it is not. For a customer-facing financial-guidance LLM, the in-scope list might be 'general account-policy questions, password-reset guidance, branch-location queries' and the out of scope list 'investment recommendations, account-specific advice, regulated

TL;DR

SR 11-7 treats the LLM as a governed model: inventory entry, independent validation, documented intended use, ongoing monitoring with thresholds, and change-management gates on every prompt or model bump.

Memory aid

Easy to grasp

Imagine a bank wants to use a new kind of calculator for handing out loans. Before that calculator can be used for real decisions, a bank regulator wants to see paperwork. Who built it. What it is supposed to be used for. What it is NOT supposed to be used for. Someone outside the team that built it has to double-check it works. Once it is in use, someone has to watch the numbers it produces and raise an alarm if they drift. Every time the calculator gets updated, the paperwork starts again. That is what SR 11-7 is for any model a US bank uses, and the Federal Reserve has clarified that an LLM is a model under that definition. Putting an LLM in front of customers without going through the model-risk governance process is a regulatory violation, not a technical decision.

Key concepts

Safety and guardrails LLMOps

Concept explanation~2 min read

Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.

SR 11-7 is the Federal Reserve's model risk management framework, issued in 2011 and extended through subsequent guidance to cover generative AI explicitly in 2024. The framework applies to any quantitative method whose output drives business decisions at a US bank, and the Fed has been clear that LLMs meet the definition.

The interview question is checking whether you can map the five SR 11-7 obligations onto an LLM deployment and articulate the operational implications. The senior version of the answer is that compliance overhead is engineering work, validation infrastructure, monitoring with thresholds, change-management tooling, and that work is non-optional. Teams that internalise this from project planning ship; teams that treat compliance as paperwork that happens later end up with a blocked launch.

The framework and its applicability to LLMs

SR 11-7 defines model risk as the risk of adverse outcomes from decisions based on incorrect or misused model output. The framework is broad by design, it covers traditional credit-scoring models, market-risk models, fraud-detection models, and any other quantitative method whose output drives a bank's decisions. The 2011 guidance was written before generative AI existed in its modern form, and the natural engineering instinct is to assume the framework does not apply to LLMs.

That instinct is wrong, and the Fed has been increasingly explicit about it. The 2023 joint-agency request for information on generative AI surfaced examiner concerns about LLM deployments outside model-risk frameworks. The 2024 SR 11-7 update clarified that the definition of 'model' is broad enough to include LLMs, that the framework applies to LLM deployments, and that supervised banks deploying LLMs without applying SR 11-7 governance are out of compliance. Enforcement actions and examiner findings against banks that deployed customer-facing LLMs without proper governance have been documented in 2024 and 2025.

The applicability has practical scope. Customer-facing LLMs (any deployment where the model's output reaches a customer) are in scope. Internal LLMs used for decisioning (loan eligibility, fraud triage, AML investigation) are in scope. Pure research or prototype work not yet in any production decision flow is typically out of scope but governed by separate (lighter) pre-production controls. Internal engineering productivity tools with no customer or decisioning use are in a grey area that varies by bank policy.

The senior framing is to treat SR 11-7 as the default and to argue exceptions case by case with the model risk team. Assuming a deployment is out of scope without documentation is the failure mode that produces examiner findings.

The five obligations, applied to an LLM

Where LLM deployments commonly fail the framework

Composing SR 11-7 with the rest of the regulatory stack

Situations where this technique stops working.

2–4 min · Everything important, quickly.

Real products, models, and research that use this idea.

The Federal Reserve's 2024 supervisory letter on generative AI explicitly applied SR 11-7 governance to LLM deployments in supervised banks.
JPMorgan Chase's internal LLM platform (LLM Suite) operates under SR 11-7 governance, with documented independent validation for each deployed configuration.

What an interviewer would ask next. Try answering before peeking at the approach.

QHow does SR 11-7 treat prompt-template changes, as configuration or as model changes?

As model changes. The prompt shapes the output; changes to the prompt change the model's behaviour and therefore its risk profile. Material prompt changes trigger re-validation; minor edits go through change management with regression testing. Banks that draw the line at 'prompts are config' get cited for circumventing the framework.

2 more follow-ups an interviewer would ask next. Sign in to reveal them.

Red flags & common mistakes

The phrases that signal junior thinking. Click to expand.

Most common mistake

Assuming SR 11-7 does not apply because it pre-dates LLMs. The Fed has clarified that the definition of 'model' is broad enough to include LLMs.

60 second bullets to scan on the way to the call.

The five SR 11-7 obligations and how each applies to an LLM deployment
Why the system prompt and guardrail stack are part of the model under validation

Primary sources. Browse if you want the original framing.