Key takeaways

  • The 2010 interagency advisory on interest rate risk (FDIC FIL-2-2010, OCC Bulletin 2010-1) expects the board and senior management to approve and review IRR policies annually, to test meaningful stress scenarios including shocks of at least 300 to 400 basis points, and to arrange independent reviews of IRR models.
  • ASC 326 requires expected credit losses to be measured over the contractual term, using relevant historical information, current conditions and reasonable and supportable forecasts, with reversion to history beyond the forecast period. The agencies say no single method is required.
  • SR 11-7 defines a model broadly, calls for effective challenge by independent and competent people, and applies validation to vendor models as well as internal ones. OCC Bulletin 2025-26 says community banks may tailor validation frequency and need not validate annually.
  • Public data covers a lot: FFIEC call report bulk data, Treasury par yield curves and the New York Fed's SOFR data for market inputs. The bank's own loan and deposit records are better than any proxy for behavior.
  • QuantLib is a free, open-source library under a modified BSD license, and the Open Source Risk Engine (ORE) is built on it. They provide building blocks, not a validated bank model. Assumptions, documentation and independent validation remain the bank's work.
  • Bringing a model in-house does not remove model risk. It moves ownership of it. Plan for a parallel run against the current vendor, a model inventory, independent validation and a clear owner.

Why banks ask the question

Asset-liability management, or ALM, is the work of measuring and managing how changes in interest rates affect a bank's earnings and value. The two usual measures are net interest income, the earnings view over the next year or two, and economic value of equity, or EVE, the present value of assets minus liabilities. CECL, the current expected credit loss model, is the accounting standard that sets how banks estimate the allowance for credit losses. Both rely on cash-flow models of loans, securities and deposits.

For many institutions these models come from an outside vendor. The bank sends data, waits, and receives reports. That arrangement is legitimate and often sensible. It also has costs: limited visibility into assumptions, slow turnaround when the asset-liability committee wants a new scenario, and two sets of cash-flow logic if ALM and CECL come from different providers. Banks that rely on vendors can use the same regulatory frame this article describes to decide whether to keep, supplement or replace them. We are not arguing that every bank should build. We are describing what a build requires, so that the decision is informed.

Our team has described one illustrative version of the project in a case on the Experience page: a mid-size bank rebuilding its models on public methods and its own data, with a parallel run and an independent validation. All figures in that case are modeled examples. This article is the reasoning and the sources behind it.

Interest rate risk: what the 2010 advisory expects

In 2010 the federal banking agencies and the FFIEC issued an interagency advisory on interest rate risk management. The FDIC distributed it as FIL-2-2010, Financial Institution Management of Interest Rate Risk, and the OCC as Bulletin 2010-1. The FDIC's summary of its highlights is short and still useful. The board of directors and senior management are responsible for the establishment, approval, implementation, oversight and annual review of IRR management strategies, policies, procedures and limits. Analysis of an institution's exposure should include assessing the likely effects of meaningful stress scenarios, including interest rate shocks of at least 300 to 400 basis points. Capital and earnings should be sufficient to support the IRR profile. When measures approach or exceed limits, management should act, for example by hedging or changing the balance sheet.

The line that matters most for a build-or-buy decision is the last one: institutions are expected to conduct independent reviews of their IRR models and management processes, and if third-party models are used, management should obtain documentation of the results from reviews conducted by the vendor. In other words, the expectation of review exists either way. A bank with an in-house model must arrange the review itself. A bank with a vendor must obtain the vendor's. The FDIC letter refers to the earlier Joint Agency Policy Statement on Interest Rate Risk, FIL-52-96, as the base guidance it clarifies.

CECL and ASC 326, as the agencies describe it

The Financial Accounting Standards Board issued Accounting Standards Update 2016-13, Financial Instruments, Credit Losses (Topic 326), and it is codified in the Accounting Standards Codification as ASC 326. FASB's own website blocked our automated requests, so we cite the agencies' explanation instead. The Interagency Policy Statement on Allowances for Credit Losses, revised in April 2023 after ASU 2022-02 and published in the Federal Register on April 27, 2023, states that ASC 326 applies to all banks, savings associations, credit unions and financial institution holding companies that file regulatory reports conforming to GAAP, regardless of size.

The policy statement's key points on measurement are these. Expected credit losses are measured over the contractual term of the asset, considering expected prepayments. Management considers the effects of past events, current conditions and reasonable and supportable forecasts. For periods beyond the forecast horizon, the standard requires reverting to historical loss information or an appropriate proxy, and it does not prescribe a technique or period: reversion may be immediate, straight-line or another systematic and rational method. Qualitative adjustments may be needed for information not captured elsewhere, and historical losses alone are generally not a sufficient basis. The agencies list loss-rate methods such as weighted-average remaining maturity, vintage analysis and open-pool or snapshot analysis, and also probability of default and loss given default, roll-rate, discounted cash flow and aging schedule methods. They say a method should fit the assets and the institution's size and complexity.

Governance is explicit. The board or a committee oversees management's significant judgments and estimates, reviews and approves written loss estimation policies at least annually, and requires management to validate the process periodically. ACLs should be well documented with clear explanations of supporting analyses and rationale. Where models are used, management should evaluate them before use, adjust logic and assumptions as needed and document the evaluations and conclusions, and, in a passage that matters for shared engines, models used for multiple purposes within an institution should be specifically adjusted and validated for use in ACL loss estimation. A cash-flow engine that serves both ALM and CECL is allowed, but it needs to be validated for each purpose.

Model risk management under SR 11-7

On April 4, 2011, the Federal Reserve issued SR 11-7, Guidance on Model Risk Management, with the OCC issuing the same guidance as Bulletin 2011-12. The Federal Reserve's pages did not respond to our requests, so we read SR 11-7 and its attachment through the Internet Archive's copy. It defines a model as a quantitative method, system or approach that applies statistical, economic, financial or mathematical theories, techniques and assumptions to process input data into quantitative estimates. That definition covers ALM, deposit and CECL calculations, including spreadsheets that do the same job.

A guiding principle is effective challenge: critical analysis by objective, informed parties who can identify model limitations and produce appropriate changes. It depends on incentives, competence and influence. Validation, the set of processes that verify models perform as expected, has three core elements in the guidance: evaluation of conceptual soundness, ongoing monitoring including process verification and benchmarking, and outcomes analysis such as back-testing. Validation applies equally to models developed in-house and to those purchased from vendors or consultants, should involve a degree of independence from development and use, and any work done by developers should be critically reviewed by an independent party. The guidance also calls for a model inventory covering models in use, under development and recently retired.

There is a recent clarification. OCC Bulletin 2025-26, Model Risk Management: Clarification for Community Banks, says community banks have flexibility to tailor model risk management, including the frequency and nature of validation, to their risk exposures, activities and the complexity and extent of model use. It says the OCC's guidance does not require annual validation, and that the OCC will not give negative supervisory feedback solely for the frequency or scope of validation that a bank reasonably determined. It calls itself a first step in a broader review of model risk management guidance. Check the OCC and your own regulator for later changes, because this area is moving.

Public data you can start with

A surprising amount of what an ALM or CECL build needs is published. The FFIEC Central Data Repository distributes call report and related data for individual institutions through bulk downloads, which supports peer comparisons and priors for products where a bank has little history. The Treasury Department publishes daily par yield curve rates, based on the closing market bid prices of the most recently auctioned Treasury securities. The Federal Reserve Bank of New York publishes SOFR data, the benchmark that replaced LIBOR in many contracts. For mortgage prepayment and default behavior, the government-sponsored enterprises publish loan-level datasets, for example the Freddie Mac Single Family Loan-Level Dataset.

Public data supplies market inputs, priors and benchmarks. It does not replace the bank's own records. A bank knows every coupon, maturity, rate reset, balance and account history. A vendor modeling a bank from outside has to infer these. So the data architecture matters: nightly or monthly extracts from the core system, reconciliation to the general ledger and the call report, a place to keep versions of inputs and a lineage record so that any number in a committee package can be traced back. Volatility surfaces for pricing options normally require a licensed market data feed, which most banks already have through a terminal.

QuantLib and ORE: what they are and are not

QuantLib is a free, open-source library for quantitative finance, written in C++ and exported to other languages including Python, Java, C# and R. Its license is a modified BSD license suitable for free and proprietary software. It provides yield curve construction, day count and calendar conventions, instruments, and pricing engines for many products. The Open Source Risk Engine, ORE, is described by its maintainers as a free, open-source platform for risk analytics and XVA built on QuantLib, with interfaces for trade and market data and configuration through an API and XML, and launchers for Python, Jupyter and Excel. ORE is sponsored by Post Trade Solutions, formerly Acadia, and is also licensed under the modified BSD license. Both projects publish test suites and documentation.

These are building blocks. They make the mathematics of discounting, curve fitting and scenario valuation available without writing it from scratch, and they let the bank read the code. They do not decide how your deposits behave, which prepayment model fits your mortgage book, what reasonable and supportable forecasts are or how to document them. A bank that uses open-source code still owns the model under SR 11-7: it must document choices, test them and keep the version it validated. Pin the library versions, record them in the model inventory and re-validate when you upgrade.

What a sound build looks like

  • Start with governance. Name a model owner, agree a model inventory, decide how the asset-liability committee and the board will see assumptions, and write the validation plan before the code.
  • Build the data layer first. Instrument-level extracts, reconciliation to the general ledger and the call report, and versioned inputs make every later number defensible.
  • Fit deposit and prepayment assumptions on the bank's own history, use public data as priors for thin products and document the sensitivity of results to each key assumption. The 2010 advisory's stress range of at least 300 to 400 basis points is a minimum frame, not a ceiling.
  • For CECL, choose a method suited to each portfolio segment, document the reasonable and supportable forecast and the reversion approach, and keep qualitative adjustments explicit.
  • Run in parallel with the current vendor for at least two quarter-ends. Explain every material difference. A difference you cannot explain is a finding, in either direction.
  • Commission independent validation, covering conceptual soundness, ongoing monitoring and outcomes analysis. Keep the evidence, the findings and the closure.

When not to build

When not to build

In-house is not always better. A bank with a simple balance sheet and a small treasury team may be well served by a vendor, provided it understands the vendor's assumptions and obtains the vendor's validation documentation, as the advisory expects. A hybrid is common: a vendor for the production run and an in-house tool for ad hoc scenarios and challenge. Clayton Cybernetics builds secure software and data platforms for financial institutions, including model infrastructure that runs inside the bank's own environment. Accounting and regulatory opinions belong to your accountants, auditors and regulator.

Sources

This article is general information, not accounting, audit, legal or regulatory advice. Your accountants, auditors and regulator decide how ASC 326, interest rate risk guidance and model risk management apply to your institution. FASB's website and the Federal Reserve's own pages could not be reached by our tools on 2026-11-08, so ASC 326 is described through the April 2023 interagency policy statement on the Federal Register, and SR 11-7 was read from the Internet Archive's copies of the Federal Reserve letter and attachment. OCC Bulletin 2011-12, the OCC's twin of SR 11-7, could not be fetched and is cited by number only. The 2010 advisory is summarized from the FDIC letter's highlights. Guidance in this area is being reviewed by the agencies and may have changed. Open-source tools are building blocks and are not validated bank models. Last reviewed .

Keep reading

Need help with this?

Software built around your business in weeks, and you own the code.

Tailored Software