Large Bank Examination Workshop February 2026

Appendix B - Model Classification

In order to classify models, the Bank utilizes a two-tiered approach based on 1) mission criticality and 2) inherent risk. A mission critical model is one that supports strategy-related matters (e.g., decisions, analyses, reporting) regarding lending. More specifically, this includes models that support the management of the Bank’s liquidity position, value loan collateral and the health of borrowers, are categorized as “SOX Critical”, or are used to assess overall Bank safety and soundness.

A model’s inherent risk is driven by the following factors and associated criteria:

Risk Factors

Risk Criteria

Complexity / Transparency

1. Model theory / Math complexity 2. Programming transparency 3. User complexity 4. Assumptions 5. External Factors 6. Ease of model replacement 1. Risk measurement 2. Purchase / sale decisions 3. Materiality of on-top adjustments

Model Use

A score ranging from 1 to 10 is assigned to each of the criteria identified. The table below outlines the different values and the rationale for assigning the values.

Risk Criterion

Score

Comments

Model theory / math complexity

1 = simple 10 = extremely complex

Subjective determination by the Model Risk Management Group (MRMG)

Programming transparency

1 = code fully accessible 10 = no transparency

1 = simple 10 = very complex

User complexity

Extent of data inputs Input methodology Adjustments to data User involvement in non input aspects (e.g., configurations, assumption updates, etc.) Subjective determination by MRMG Subjective determination by MRMG

1 = Few and simple 10 = Many and complex 1 = no changes 10 = extremely volatile

Assumptions

External Factors

12

Model Risk Management Policy

March 15, 20XX

Classification: Confidential

Page 38 of 39