Large Bank Examination Workshop February 2026

whether adjustments to model risk management practices (e.g., changes to the model validation schedule and/or the scope of validations) are warranted.

(3)

Model Validations

The principles for conducting validations are contained in the Model Validation Policy (approved by the Model Risk Management Committee) and more specific procedures and practices are outlined in the Model Validation Procedures. The principles of the model validation program apply to both internally and externally developed models. Model validation documentation will be maintained by Model Risk Management. Key principles of the model validation framework include: • Backtesting and/or benchmarking model output • Operational controls, document retention and business continuity • Frequency and scope of validations • Methodological and theoretical veracity The frequency and scope of validations is determined by the model classification. New models or models undergoing significant change are subject to validation prior to implementation and no new model or model undergoing significant change can be put into production without consent from the Model Risk Management Group. (Refer to the glossary for a description of what constitutes a “significant change”.) The opportunity to challenge a model’s efficacy, including its use or model -related findings, is an important element of model risk management. The Model Risk Management Committee and the Model Risk Management Group will be the primary model challengers. As it relates to findings resulting from model validations, model owners will be afforded an opportunity to agree or disagree with any finding and related recommendation(s). In the event of the latter, model owners will be expected to provide supporting rationale. Any “Medium” or “High” rated recommendation that a model owner deems unwarranted shall be escalated to the Model Risk Management Committee, unless the CRO is the model owner in which case the issue will be escalated to the Risk Committee. F. Model Challenge • Model validator skill and independence

G.

Record Retention

Documentation regarding models, their use, inputs, assumptions, output, validations, and management reporting will be retained pursuant to the Bank’s Records Management Policy. Established timeframes will consider and support audits, examinations, validations, business continuity, and other relevant business needs.

7

Model Risk Management Policy

March 15, 20XX

Classification: Confidential

Page 33 of 39