AI Model Risk Management in
Financial Reconciliation
Is a matching engine a model, who signs it off, and what replaced SR 11-7? Model risk, validation and BPO leaders from TCS, Tech Mahindra and ReconIQ discuss how to take AI matching through model risk management.
Updated October 2026. The webinar discussed SR 11-7. On 17 April 2026, US regulators replaced it with SR 26-2 (OCC Bulletin 2026-13). Traditional machine-learning models remain in scope, while generative and agentic AI are excluded. UK banks follow PRA SS1/23, and reconciliation does not appear on the EU AI Act’s high-risk list.
ON-DEMAND WEBINAR
AI Model Risk Management in Financial Reconciliation
A 90-minute panel for model risk, compliance and reconciliation leaders. It covers who is accountable, how impact tiers work, why match rates drift, how long validation takes and where model risk management is heading.
.png)
Speakers
Tracey Lall, Marc McCarthy, Manish Upadhyay, Prashant Shegaonkar, Kavita Dwivedi and Pranjal Mendhekar.
Is a reconciliation matching engine a model?
Once AI starts labelling items as matched, unmatched or high-risk breaks, reconciliation stops being purely an operational control and starts producing model-driven outcomes. That was Kavita Dwivedi’s view, and the panel agreed the label now reaches rules engines too.
why the label matters
Rule sets can count as models.
Fraud engines with 1,500 to 2,000 rules are already treated as models. A matching rule set of 30 or 40 rules is also data-driven, can create false matches and drifts as the data changes.
Firms are divided.
Half of the attendees said their rules-based matching engine is classed as a model. Regulators call avoiding the label “definitional arbitrage”.
Controls apply either way.
Regulators told Tracey Lall that even where a rule set is not classed as a model, they expect drift monitoring, validation and back-testing.
Decline is gradual.
Marc McCarthy has seen match rates fall from 99% to around 80% over five to ten years, with teams blaming volume rather than rule decay.
Who is accountable: the bank, the BPO or the vendor?
The bank signs off.
Responsibility is shared, but in Kavita Dwivedi’s words, “the final accountability ... lies with the bank”.
Vendors and BPOs supply the evidence.
Development documentation, validation results, testing and a clear statement of assumptions and limitations.
Advisers rarely start from scratch.
Experienced advisers bring 60 to 70% of the work from previous engagements and tailor the rest.
Documentation goes missing.
A recurring problem is vendor models implemented years ago whose documentation nobody can find. Keeping it current avoids that.
How much risk does a matching error carry?
Model risk is the likelihood of a wrong decision multiplied by its impact, and impact depends on the reconciliation. Controls should be tiered to match.
High-impact reconciliations
Trade confirmation and client money reconciliations drive investigations, payments and funding decisions, so errors there are costly.
Lower-stakes reconciliations
Prashant Shegaonkar noted that a bank statement reconciliation carries less impact.
Errors at ingestion
Pranjal Mendhekar pointed out that an OCR misread carries through every later step, so data quality needs controlling before it reaches the model.
Confidence-based routing
Calibrated confidence values let teams send lower-confidence matches to people and approve the rest automatically.
Two weeks to six months
Pranjal Mendhekar has seen validation take two to eight weeks, and Kavita Dwivedi three to six months. Complexity and timing account for the difference, and the panel agreed on three ways to shorten it.
Involve model risk early
Bring the model risk team in at the design stage, not a month before go-live.
Agree standard tests
Standard test requirements for each use case let validation run alongside development rather than after it.
Treat rule changes like code
Prashant Shegaonkar recommends testing in a lower environment, checking the effect on rule order and logging who changed what.
What should you monitor after go-live?
Monitoring is continuous, and formal reviews follow a schedule set by the model’s risk tier: annually, half-yearly or quarterly.
%20(2)%202.png)
Drift
Track match rate and accuracy over time, so decay shows up before rising volume hides it.
Precision
The share of proposed matches that are correct. A high match rate can hide false matches.
Calibration
Confidence values should mean what they say, so routing thresholds keep holding.
Stated limitations
Kavita Dwivedi recommends revisiting a model’s documented limitations at least once a year.
What are the blind spots?
Hidden inventories and untested assumptions
Manish Upadhyay highlighted models living in spreadsheets, untested data-quality assumptions and unknown performance at scale.
Unknown downstream use
Pranjal Mendhekar warned that when nobody knows how a model’s output is used further down the line, its real impact is never assessed.
No industry standard yet
Marc McCarthy noted that there are no standards or certification for AI in reconciliation yet, so each firm sets its own bar. The panel called for industry certification so firms stop inventing their own approval processes.
Jump to the part you need
00:00 Introductions
09:49 Regulation and why model risk matters
13:02 Who's responsible: bank, BPO or vendor
18:21 Impact tiers and AI use cases
22:45 How impact varies by reconciliation
30:17 Is a rules engine a model?
35:37 Data drift and rule decay
41:00 Match rate vs accuracy
48:23 Validation timelines
56:54 Organising model risk
1:06:22 Blind spots
1:12:50 Standards and certification
1:19:14 Where model risk management is heading
AI Model Risk Management FAQs
1. Is machine-learning matching in scope of SR 26-2?
Yes. Traditional machine-learning models remain in scope, while generative and agentic AI are excluded. Treat machine-learning matching as a model and govern it accordingly.
2. Who is accountable for an AI matching model: the bank, the BPO or the vendor?
The bank. Vendors and BPOs supply development documentation, validation evidence, testing and a statement of assumptions and limitations, but the financial institution owns the final sign-off.
3. Are rules-based matching engines exempt from model risk management?
Not in practice. Even where they are not formally classed as models, regulators expect drift monitoring, validation and back-testing.
4. Is reconciliation high-risk under the EU AI Act?
It is not listed in Annex III. That could change if matching outputs fed a listed decision about individuals, such as credit, so confirm with your legal team.
5. What evidence will model risk ask for?
Development documentation, validation and back-testing against known correct matches, stated assumptions and limitations, KPIs, and a monitoring and retraining plan.
6. How long does model validation take?
Panellists reported anywhere from two weeks to six months. Involving model risk at the design stage and agreeing standard tests for each use case shortens it.
7. How does Matchimus support model risk management?
Each match comes with an explanation and a calibrated confidence value, and performance is tracked on precision, recall and calibration. Matchimus has passed a US Tier 1 bank's security and model risk management review.
Your next step
01
Security documentation, deployment options and the model risk review a US Tier 1 bank completed.