Model Validation Report
(SR 11-7 / OCC 2011-12)
Model Name: Commercial & Consumer Automated AI Credit Underwriting System (CAICUS)
Model Owner: Commercial & Consumer Credit Risk Division
Validator / Reviewer: Model Risk Management (MRM) Independent Validation Team
Model Risk Tier: Tier 1 (High Risk / Regulatory Sensitive)
Validation Date: September 2026
1. Executive Summary & Validation Verdict
1.1 Scope of Review
The Independent Model Risk Management (MRM) group conducted a full initial validation of the Commercial & Consumer Automated AI Credit Underwriting System (CAICUS) v2.4. This evaluation assesses compliance with Federal Reserve SR 11-7 / OCC Bulletin 2011-12, Equal Credit Opportunity Act (ECOA / Regulation B), Fair Credit Reporting Act (FCRA), and NIST AI RMF standards.
1.2 Overall Validation Rating
-
Verdict: Approved with Conditions
-
Risk Level: Tier 1 (High)
-
Re-validation Frequency: Annual (Next Scheduled: Q3 2027)
1.3 Key Findings & Mandatory Remediation Items (MRA/MRIA)
-
MRIA 2026-01 (High): Explainability Baseline: SHAP value calculations for commercial real estate exposure lack automated integration with legacy core system Adverse Action code generators. Remediation Due: 60 Days.
-
MRA 2026-02 (Medium): Data Stability Tracking: Population Stability Index (PSI) alert thresholds are set manually rather than dynamically updating across changing interest rate regimes. Remediation Due: 90 Days.
2. Model Overview & Business Context
| Component | Description |
| Business Purpose | Automated underwriting, risk-based pricing, and credit line determination for small-to-mid enterprise (SME) and consumer loan applicants up to $250,000. |
| Model Architecture | Gradient Boosted Decision Trees (XGBoost) combined with dynamic SHAP (SHapley Additive exPlanations) explainability layers. |
| Key Inputs | Bureau credit scores, debt-to-income (DTI) ratios, liquidity history, 24-month transaction velocity, and verified business revenue. |
| Key Outputs | Approved/Denied recommendation, recommended credit ceiling, risk tier score (1–10), and top 4 adverse factors (if denied). |
3. Data Integrity, Lineage & Governance Audit
3.1 Data Lineage & Sanitization
-
Data Sources: Core banking transactional database, credit bureau API feeds, audited financial statements.
-
Prohibited Variables Verification: Confirmed total exclusion of protected class attributes (race, gender, age, marital status, national origin) and direct proxies in both training and operational feature stores.
-
Privacy Controls: Evaluated Open Policy Agent (OPA) integration at the API gateway layer to ensure customer PII is masked prior to model feature extraction.
3.2 Data Quality & Representativeness
-
Evaluated dataset completeness across primary operating territories (Midwest US regional foot-print).
-
Verified that historical loan performance data spans both expansionary and contractionary credit cycles (2018–2025 data range).
4. Conceptual Soundness & Algorithmic Design
4.1 Theoretical Justification
-
The selection of XGBoost over traditional logistic regression is justified by a 14% improvement in Gini coefficient performance on non-linear commercial relationship datasets.
-
Hyperparameter tuning frameworks were audited to ensure grid searches were constrained against overfitting on edge-case regional data.
4.2 Explainability (XAI) & Fair Lending Architecture
-
ECOA Reason Code Generation: The model utilizes global and local SHAP value rankings to extract the top four negative feature contributions for every adverse credit decision.
-
Audit Findings: Explainability pipelines operate accurately for consumer lending features, but require minor feature-mapping alignment for specialized commercial real estate metrics (refer to MRIA 2026-01).
5. Model Performance, Backtesting & Bias Diagnostics
5.1 Discriminative Power & Calibration
-
Receiver Operating Characteristic (ROC-AUC): 0.865 (Target >= 0.80)
-
Kolmogorov-Smirnov (KS) Statistic: 54.2% (Target >=45%)
-
Brier Score (Calibration): 0.042 (Demonstrates strong alignment between predicted default probability and observed defaults).
5.2 Disparate Impact & Fair Lending Testing
MRM conducted independent demographic fairness tests across protected classes using synthetic proxy matching and Bayesian Improved Surname Geocoding (BISG):
| Metric | Target / Benchmark | Observed Result | Status |
| Adverse Impact Ratio (AIR) | >= 0.80 (80% Rule) |
0.92 | Pass |
| Marginal Effect Variance | < 0.05 across cohorts | 0.02 | Pass |
| Standardized Difference in Means | < 0.25 | 0.08 | Pass |
6. Operational Controls, HITL & Monitoring
6.1 Human-in-the-Loop (HITL) Rules
-
Auto-Execution Limit: Restricted strictly to credit applications <= $250K where model confidence >= 92%
-
Mandatory Officer Routing: Applications between $250K and $2M, or applications triggering confidence scores < 92%, are automatically routed to senior credit underwriters alongside the SHAP diagnostic payload.
6.2 Monitoring & Fallback Safeguards
-
Drift Telemetry: Real-time monitoring of PSI (Population Stability Index) and CSI (Characteristic Stability Index) configured with alerts at PSI> 0.10 (warning) and PSI > 0.25 (mandatory model halt).
-
Audit Trail Verification: Confirmed all inputs, feature vectors, SHAP outputs, and execution decisions are logged to WORM (Write-Once-Read-Many) compliant cloud infrastructure for regulatory inspection.
7. Sign-off & Approval Matrix
| Role | Name / Title | Signature | Date |
| Lead Validator | VP, Model Risk Management | [Signed] | Sept 14, 2026 |
| Head of MRM | SVP, Enterprise Model Governance | [Signed] | Sept 16, 2026 |
| Chief Risk Officer | Executive VP, Chief Risk Officer | [Signed] | Sept 18, 2026 |