Crossing the $10B Threshold: How Small Banks Must Rethink Model Risk Management

Pablo Salazar—Director of Model Risk Management at Stellar Bank—provides an in-depth, practical guide to how model risk management (MRM) evolves as banks scale in size, particularly when passing the regulatory $10 billion asset threshold.

Pablo begins by laying out the foundational MRM landscape for small institutions. These banks typically rely on four core models—interest rate risk, CECL, stress testing, and BSA/AML—and often outsource validations to consulting firms. Governance is minimal, with spreadsheet-based tracking and flat organizational structures.

However, as institutions cross the $10B mark, MRM must undergo a transformation. Models become more complex, especially as vendors introduce machine learning components. Regulatory expectations rise, particularly around stress testing with the application of SR 11-7 and more frequent scenario planning. Outsourcing remains common, especially for BSA, but banks must begin developing internal teams to handle growing inventories of models.

Pablo emphasizes that robotic process automation (RPA) and AI are increasingly treated as models themselves, requiring oversight and governance within MRM programs. He introduces a resourcing tool used at Stellar Bank to estimate workload by mapping all MRM activities, from policy creation to effective challenge. This tool supports team sizing decisions and highlights the cost differential between outsourcing and in-house validation—sometimes saving over $600,000 annually.

The takeaway? Growth necessitates not just more models but smarter infrastructure. Pablo advocates viewing MRM as a strategic risk management tool rather than a regulatory checkbox, offering actionable insights for banks preparing for scale.