Source: Cyber Risk Institute (CRI) — Financial Services AI Risk Management Framework (FS AI RMF), published February 12, 2026, in coordination with the Financial Services Sector Coordinating Council (FSSCC). 230 control objectives. 100+ contributing financial institutions globally.
Status: Primary-source verified via the CRI press release ("Financial Services Industry Unites to Launch Comprehensive AI Risk Management Framework," fetched 2026-05-28). The full framework text (230 control objectives, mapped risk statements, trustworthy-AI principle alignment) is published through CRI member-access channels; this mapping treats the public press release as the authoritative summary and marks every control-objective-level detail as ABSTRACT-ONLY where the full text is not in public hand.
Disclaimer. This mapping is provided for reference only and does not constitute legal or supervisory advice. Banks should procure or access the full FS AI RMF text through CRI / FSSCC channels for production use.
The FS AI RMF, launched February 12, 2026, is the most-mature operational AI-governance framework available to the US financial services industry as of this writing. Three structural facts make it the reference of choice for second-line MRM functions building their post-OCC-2026-13 posture:
- Sector-led, not vendor-led. CRI is the industry coordinating body; 100+ financial institutions contributed. The framework is consensus prudential industry practice, not a single-vendor narrative.
- 230 control objectives. The control surface is granular enough to function as a checklist for second-line model-validation walkthroughs.
- FSSCC coordination. The FSSCC is the sector's formal liaison with US Treasury and the financial regulators. The framework's posture is therefore the one most likely to be cited approvingly by examiners during the interval before the joint OCC / FRB / FDIC RFI on agentic-AI MRM completes.
For the framework's positioning relative to the April 17, 2026 OCC Bulletin 2026-13, see docs/interagency_mrm_2026_overlay.md.
The CRI press release names the following risk areas the framework addresses:
| FS AI RMF risk area | Public abstract | Verification status |
|---|---|---|
| Fairness | AI outcomes that produce disparate effects across protected classes; fair-lending overlay | ABSTRACT-ONLY (public press release) |
| Transparency | Explainability of model behaviour to consumers, regulators, and internal validators | ABSTRACT-ONLY |
| Data Privacy | Protection of consumer financial information used to train and operate AI models | ABSTRACT-ONLY |
| Security | Adversarial-robustness, prompt-injection, model-extraction, supply-chain integrity | ABSTRACT-ONLY |
| Operational Resilience | AI-workload availability, degradation modes, recovery posture | ABSTRACT-ONLY |
Six additional risk categories Treasury named in its prior 2024 financial-services-AI report (Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector, March 2024) recur in the same conceptual space and should be treated as in-scope for any second-line walkthrough:
| Treasury 2024 risk category | Bridges to FS AI RMF area |
|---|---|
| Data privacy / security / quality | Data Privacy + Security |
| Bias / explainability / hallucinations | Fairness + Transparency |
| Consumer protection / fair lending / financial inclusion | Fairness |
| Concentration | Operational Resilience + Security (third-party / supply chain) |
| Third-party risk | Security + Operational Resilience |
| Illicit finance | (orthogonal — flows to the institution's BSA/AML AI workload governance) |
The full 230 control objectives, the per-objective risk-statement linkage, and the trustworthy-AI-principle alignment are documented in the CRI / FSSCC publication and are not reproduced here.
Each row maps a v1.1 governance module to the FS AI RMF public risk areas that module addresses, plus the relevant ADR for the design rationale.
| Module | Canonical path | How it addresses Fairness | ADR |
|---|---|---|---|
adverse_action_gate |
finserv_agent_audit.governance.adverse_action_gate |
FCRA § 615 / Reg B § 1002.9 adverse-action notices; specific reasons must be recorded and disclosed | ADR-0009 |
equity_audit |
finserv_agent_audit.governance.equity_audit |
ECOA / Reg B § 1002.4 disparate-impact monitoring; per-cohort outcome tracking | ADR-0010 |
protected_class_proxy_detector |
finserv_agent_audit.governance.protected_class_proxy_detector (deferred per ADR-0019) |
ECOA proxy doctrine; flags features that proxy for protected-class status | ADR-0019 |
| Module | Canonical path | How it addresses Transparency | ADR |
|---|---|---|---|
audit_chain |
finserv_agent_audit.governance.audit_chain |
Per-decision rationale entry recorded in SHA-256 hash-chain; reconstructable post-hoc | ADR-0003 |
model_inventory |
finserv_agent_audit.governance.model_inventory |
Per-model lifecycle state, validation date, owning second-line MRM function | ADR-0007 derivative |
autonomy_ladder |
finserv_agent_audit.governance.autonomy_ladder |
A0→A4 progression makes the agent's scope of action explicit and inspectable | ADR-0004 |
shadow_mode |
finserv_agent_audit.governance.shadow_mode |
Promotion decisions documented; conceptual-soundness evidence packet generated | ADR-0006 |
| Module | Canonical path | How it addresses Data Privacy | ADR |
|---|---|---|---|
audit_chain |
finserv_agent_audit.governance.audit_chain |
Per-decision evidence supports GLBA Safeguards § 314 incident-response and access-audit obligations | ADR-0003 |
mi_proxy |
finserv_agent_audit.governance.mi_proxy |
Verifier-integrity control prevents silent data-handling-logic modification | ADR-0015 |
vendor_score_gate |
finserv_agent_audit.governance.vendor_score_gate |
Third-party / pre-trained model data-handling governance | ADR-0016 |
See docs/glba_safeguards_mapping.md for the GLBA-specific surface.
| Module | Canonical path | How it addresses Security | ADR |
|---|---|---|---|
mi_proxy |
finserv_agent_audit.governance.mi_proxy |
Model-implementation integrity; verifier root-of-trust attestation | ADR-0015 |
witness_anchor |
finserv_agent_audit.governance.witness_anchor |
External anchor to detect tamper attempts against the audit chain | ADR-0014 |
ledger_store_worm |
finserv_agent_audit.governance.ledger_store_worm |
WORM record-keeping prevents post-hoc audit-log modification | ADR-0013 derivative |
sovereign_veto |
finserv_agent_audit.governance.sovereign_veto |
Out-of-band kill switch independent of the agent's own decision surface | ADR-0002 |
vendor_score_gate |
finserv_agent_audit.governance.vendor_score_gate |
Supply-chain governance for third-party / pre-trained model components | ADR-0016 |
| (deferred) Adversarial-agent threat model | (design pattern, no module yet) | Threat-model document for prompt-injection, model-extraction, jailbreak | ADR-0018 |
| Module | Canonical path | How it addresses Operational Resilience | ADR |
|---|---|---|---|
defcon |
finserv_agent_audit.governance.defcon |
Autonomy-degradation state machine: NORMAL → CAUTION → ALERT → DANGER with hysteresis | ADR-0001 |
sovereign_veto |
finserv_agent_audit.governance.sovereign_veto |
Operator-initiated emergency degradation independent of model state | ADR-0002 |
autonomy_ladder |
finserv_agent_audit.governance.autonomy_ladder |
Graceful fallback from A4 → A3 → … → A0 when trust degrades | ADR-0004 |
shadow_mode |
finserv_agent_audit.governance.shadow_mode |
Pre-promotion validation prevents resilience-degrading deployments | ADR-0006 |
timestamp_source |
finserv_agent_audit.governance.timestamp_source |
Trusted-time backbone for resilience-event timeline reconstruction | ADR-0014 derivative |
For the 2024 risk-category vocabulary banks may still encounter in older policy documents:
| Treasury 2024 risk category | Primary v1.x modules | Mapping doc |
|---|---|---|
| Data privacy / security / quality | audit_chain, mi_proxy, vendor_score_gate, witness_anchor, ledger_store_worm |
docs/glba_safeguards_mapping.md |
| Bias / explainability / hallucinations | adverse_action_gate, equity_audit, audit_chain, model_inventory, autonomy_ladder, shadow_mode |
docs/ecoa_reg_b_mapping.md, docs/fcra_reg_v_mapping.md, docs/cfpb_circular_2022_03_mapping.md |
| Consumer protection / fair lending / financial inclusion | adverse_action_gate, equity_audit, best_interest_check |
docs/ecoa_reg_b_mapping.md, docs/fcra_reg_v_mapping.md, docs/sec_reg_bi_mapping.md |
| Concentration | vendor_score_gate, model_inventory |
(Concentration risk is institution-specific; the modules supply the inventory and vendor-score evidence that feeds concentration analysis.) |
| Third-party risk | vendor_score_gate, mi_proxy, model_inventory |
(Interagency TPRM final guidance, June 6, 2023; OCC Bulletin 2013-29 historical lineage.) |
| Illicit finance | sar_workflow_audit, audit_chain, witness_anchor |
docs/bsa_aml_mapping.md |
The framework's v1.x module set covers the operational-governance surface — the runtime patterns an agentic-AI workload needs to ship under prudential oversight. The FS AI RMF (and the broader Treasury / FSSCC corpus) covers additional surfaces that the framework either defers or addresses only through references to companion regimes.
| Gap | Why deferred | v2.0 disposition |
|---|---|---|
| Adversarial-agent threat-model module | Threat-model documentation exists as ADR-0018 but no runtime module yet | Candidate for v2.0 — runtime adversarial-input detection layer |
| Protected-class proxy detection | Deferred per ADR-0019 pending stable statistical baseline | Candidate for v2.0 — full implementation with cohort-baseline calibration |
| AI-specific concentration-risk monitor | Concentration analysis is institution-portfolio-level, not module-level | Candidate for v2.0 — inventory aggregation feeding concentration dashboard |
| Explainability surface (SHAP / counterfactual) | Substantive explainability requires per-model implementation; framework records the rationale, not the explainability artefact itself | Candidate for v2.0 — explainability evidence schema in audit_event |
| Consumer-facing AI-decision disclosure templates | Substantive law (FCRA § 615, ECOA § 1002.9) plus institution-specific brand voice; framework supplies the trigger and audit hook, not the consumer letter | Out of scope — institution-specific |
| Hallucination / confabulation runtime detector | Detection is workload-specific (retrieval-augmented, citation-required, etc.); framework records the event when flagged but does not detect | Candidate for v2.0 — confabulation-flag hook in audit_event |
| Gap | Reference |
|---|---|
| GLBA Safeguards § 314 program | docs/glba_safeguards_mapping.md |
| SOX § 404 ITGC | docs/sox_404_itgc_mapping.md |
| SEC 17a-4 record-keeping | docs/sec_17a_4_mapping.md + ledger_store_worm |
| EU AI Act high-risk obligations | docs/eu_ai_act_mapping.md |
| ISO/IEC 42001 AI management system | docs/iso_42001_mapping.md |
| NIST AI RMF 1.0 + Generative AI Profile | docs/nist_ai_rmf_mapping.md, docs/nist_ai_600_1_genai_profile_mapping.md |
| Interagency TPRM final guidance (2023) | docs/occ_2011_12_mapping.md § Gap Analysis (vendor section) |
| Gap | Why out of scope |
|---|---|
| Insurance regulation (NAIC Model Bulletin on AI) | State-by-state insurance posture; framework is bank-and-broker-dealer focused. Banks with insurance subsidiaries must layer NAIC overlay separately. |
| CFPB UDAAP enforcement specifics | Enforcement posture, not control surface. Framework supports evidence retention; the substantive UDAAP analysis is legal. |
| State-level AI statutes (Colorado SB 24-205 / SB 189, Texas TRAIGA, NYC Local Law 144, etc.) | State-by-state posture diverges; institution must reconcile by jurisdiction. |
A second-line model-risk-management function uses this mapping in three operational contexts:
- Pre-deployment review. Before any agentic-AI workload enters production, the second line walks each of the FS AI RMF public risk areas (Section 3) and confirms the relevant v1.x modules are wired, configured, and emitting evidence.
- Examiner walkthrough. During a prudential examination, the second line presents the FS AI RMF risk-area table (Section 3) as the bridge between the examiner's regulatory frame and the institution's technical controls.
- Internal-audit cycle. During the internal-audit cycle, the audit function uses Section 5 (gap analysis) to assess residual risk that the framework does not yet address; gaps marked "Candidate for v2.0" flag the institution's roadmap for compensating controls.
- Cyber Risk Institute. Financial Services Industry Unites to Launch Comprehensive AI Risk Management Framework. February 12, 2026. https://www.cyberriskinstitute.org/press/financial-services-industry-unites-to-launch-comprehensive-ai-risk-management-framework. (Primary-source verified via WebFetch 2026-05-28; date, 230 control objectives, 100+ contributing institutions, FSSCC coordination, and risk-area list confirmed.)
- Cyber Risk Institute. Financial Services AI Risk Management Framework (full document). [ABSTRACT-ONLY — full text published through CRI member-access channels; not fetched in this session.]
- U.S. Department of the Treasury. Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector. March 2024. [UNVERIFIED — primary source not fetched in this session; six-category vocabulary cited from public summaries on 2026-05-28.]
- Financial Services Sector Coordinating Council. FSSCC AI Working Group. [UNVERIFIED — primary source not fetched in this session.]
- Office of the Comptroller of the Currency. OCC Bulletin 2026-13: Model Risk Management — Revised Guidance. April 17, 2026. (Primary-source verified; see
docs/interagency_mrm_2026_overlay.md.) finserv-agent-auditv1.x —docs/interagency_mrm_2026_overlay.md,docs/nist_ai_600_1_genai_profile_mapping.md,ASSURANCE-GUIDE.md, per-regime mapping documents underdocs/.